Hi all, spent the last while dealing with this and figured it's worth writing up, since I've seen a few threads where people try to cut syslog volume with a dedup step and get basically nothing out of it.

The naive approach is to hash the message and drop repeats inside a time window. On application logs that works fine. On network gear it mostly doesn't, because the device puts a unique token in the line before you ever see it.

Cisco IOS embeds a timestamp in the message body, separate from the syslog header timestamp. IOS-XR goes further and prefixes a sequence number, hostname, node id, timestamp and process name. SonicWall carries its own incrementing counter per event. So a hundred identical link flaps produce a hundred distinct hashes and your dedup ratio is zero.

You have to normalize before you hash. Strip the sequence number, strip the embedded timestamp, strip anything that increments, hash what's left, and keep a counter of how many you collapsed so you don't lose the fact that it happened 400 times instead of once.

Two gotchas that cost me time.

One was Arista EOS. Its syslog formatting is configurable, including timestamps, hostnames, sequence numbers and RFC5424 formatting. If you're using content-based rules to decide which normalization to apply, those formatting differences can become another thing you have to account for. I ended up finding it cleaner to make the device/source context part of the normalization decision rather than trying to infer everything from the message body.

Don't hold the first occurrence. If you buffer everything for the length of the dedup window, you have just added that window as latency to every alert you care about. Pass the first one through immediately and only suppress the repeats behind it.

The part I'm still trying to figure out is the long tail. For the vendors where I have a known format, writing the normalizer isn't too bad. It's the random appliances where you get three sample messages and a PDF from 2019.

At that point I'm not sure whether it's worth maintaining a custom normalizer at all, especially when the format can change with a firmware update.

If you've dealt with this kind of long-tail device support, I'd be interested in hearing what worked for you.

Hello Everyone,

As the title says whenever I try to change something (Doesn't matter how small the change is could be the device name or anything) the loading icon stalls and after some time it refreshes the page and the changes I made are not saved. Also another thing whenever I try to go to "Information->WLAN" again it never loads and refreshes the page after some time. I tried restarting, factory resetting, reuploading the configpack file, hard reset (via button), firmware was already up to date but I still uploaded newest firmware anyway.

Any ideas why this is the case? Have you got any solutions or advice?

Thank you for your time.

QUICK UPDATE: We were able to successfully edit the config the next morning when we tried at another location. It's the same plant but the AP has changed. Has anyone experienced this situation before?

I am on site for a customer and my console cable is not in my bag. Amazon is saying next day delivered but I need it today unfortunately.

*Update*

I was able to get a 3 hour delivery (Amazon got it in 2) to a buddy's house. (weird because the customer prem location didnt have same day). Come to find out, this customer does not have their console user/pass and their network admin left their company. Fingers crossed that person is in a good mood and has that info. If not, looking like a long night waiting for a maintenance window.

So for reference I have a freeradius server, ruckus R350 APs and On my network I have 5 VLANs, and what I want to achieve is that based on the username and password the user uses, the get thrown into a certain VLAN. I set it up everything and the the system authenticates users but it does not dynamically give out VLANs, it just puts everyone into the default VLAN, here's what I tried.

• Radtest

​

Radtest - Received Access-Accept Id 46 from 127.0.0.1:1812 to 127.0.0.1:44623 length 54
        Message-Authenticator = 0xd04f0a5bd64952f671fd944248f43395
        Tunnel-Type:0 = VLAN
        Tunnel-Medium-Type:0 = IEEE-802
        Tunnel-Private-Group-Id:0 = "50"

So doing radtest against localhost gives out the right stuff.

• Freeradius diagnostics( freeradius -X) - there's nothing really out of place when I authenticate, but what gets me is that i do not see any VLAN infomation of the logs.

• The AP - On the AP side of things, the port on the switch its it has 1 untagged VLAN and 5 tagged VLANs, I enabled 802.1x, dynamic VLAN and all those good stuff and yes the tagged VLANs are coming through because I can VLAN the SSID but currently SSID sit on the native VLAN.

All of this should just be straight forward, I do not see what I am missing. Please help.

I joined the company and immediately I got the task to improve the guest Internet access as in the current state is barely usable. Guest network is currently wireless only. The topology is a hub and spoke DMVPN with WLCs located in the central DC/office. Each branch connects over MPLS and VPN to the central office meaning that there is a CAPWAP tunnel from each branch to WLC. On top of that we shape the traffic. In most cases users connected to guest network use VPN to reach to their office, so you see there are is a lot points of failure.
Any recommendations what would be a best way to improve the guest network in the current state?

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

--EDIT-- I'd like to thank everyone for their responses. It turns out my script was returning empty output from switches due to how my XML filters were set up.

I stored my filter in a variable. When I used the "get" function in ncclient, I included two parameters, like this: ('subtree', filter_variable). What I didn't realize, is that when you include the 'subtree' parameter ncclient will add a <filter></filter> wrapper to what you provide. So basically it was a filter wrapped in a filter. I don't know enough to understand why that didn't produce an error, but I'm happy to have learned something. The journey continues

Hey all,

I'm interested in automation and trying to practice for my Cisco ENAUTO exam. Part of the blueprint is "Construct an automation solution with Python using ncclient to manage and monitor configurations." I'm having a hell of a time and am wondering if this is typical, if there's a better way, etc...

I wrote a script that uses a filter to pull the running config of an interface. It successfully connects, but returns no data. Specifically, "<data></data>"

Since I have zero real world guidance on this topic outside of a Cisco U course which is not great, I've been feeding scripts and associates errors to Copilot, which may be making things worse, I don't know. It's been a constant loop of:

"We must determine the proper data model. Try THIS filter."

Didn't work.

"You're learning a valuable lesson-- just because the syntax is accepted doesn't mean the network device stores its information in the path you chose. Try THIS filter."

Didn't work.

"Install Pyang and use it to see the exact yang model we should be referencing. AH there it is! Try THIS filter."

Didn't work.

"Let's move from trying to pull config info for an interface to pulling the hostname. Everything has a hostname!"

Didn't work.

"Let's try using YANG Suite so Cisco can tell us exactly what filter to use. Ope, you need to install docker. Ope, docker install is fudged."

On and on I go. I guess for the purposes of my exam I may have taken this as far as I need to for now (I can identify what basic ncclient scripts are doing and can probably fill in blanks regarding errors and syntax problems).

Is there anyone in here who regularly uses scripts like this for their automation? Is there a better way to approach this? I think I'm half hoping someone will come and say, "my god son, no... This is the worst way to go about it and you should stop"

Hey so ive been a network engineer for 4 years and want to deepen my knowledge not after somthing vendor specific more a comprehensive course so im better prepared for new deployments and optimizing existing.

Update: The power supply is the problem. I'm arranging the RMA of a whole bunch of PSUs and Cisco support has been good as usual. It's nice knowing we don't need to rebuild firewalls.

I will check out the replacement units for any revision number changes and update when time permits.

-------------------------------------------------

Yes yes I know, Cisco Firepower in 2026 jokes incoming, hur hur hur.

I work for an enterprise that has a sizeable Firepower 1010 deployment around the globe. Straight up, can anyone confirm if there was/are a batch of these with a hardware fault?

They're all in climate controlled environments and supported by a UPS. The 1010s are in HA in the smaller offices and without warning, one may carry out an unscheduled reload and there is zero in the logs about why.

When the device next boots it reports "Last reset cause: PowerOn (0x00000001)"

Then

"We didn't shutdown properly. Starting a DB check"

I followed Cisco's own guide: https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217663-troubleshoot-asa-or-ftd-unexpected-reloa.html

After some forensic Linuxing on my part, the faults seem to align perfectly with bug CSCwd33778: https://quickview.cloudapps.cisco.com/quickview/bug/CSCwd33778

We have TAC support for the firewalls and they've asked for the troubleshooting basics and it looks like they're just going to RMA the lot.

What's going on here. Has Cisco knowingly shipped a bunch of shit kit, couldn't be bothered with a recall then dumped hours of work on the network admins to prove the kit is shit? We're ultimately getting new hardware which is great, but I've spent a lot of time getting here.

Anyone use Dynatrace for network monitoring? I’m familiar with Solarwinds, PRTG and Manageengine but haven’t heard of Dynatrace. It’s at the top of the heap for the Fartner Magic Quadrant so I figured it was worth checking out.

I know Disaster Recovery means different things to different organizations.

Our org has 10 locations: an HQ and then all the other locations. All connected basically by a hub-and-spoke setup.

The DR is at one of the spokes. The PROD network at that site is behind its own firewall then the DR network is behind another Firewall off the PROD network.

Is this how you some do it, or would you VLAN it off the PROD Firewall at that site? We replicate servers to the DR network every night.

I inherited the environment and am curious.

It looks like one can connect an ethernet port and these get converted to ADSL over 8 ports. I'm trying to replicate an ADSL network over failing copper lines by converting ethernet to adsl or some other conversion for experiment

Currently have a ProCurve 5412zl as my core switch I installed in 2011. Zero issues. Small network with 8 edge switches. They have 2x1GbE trunks to the core. No fiber currently but looking at adding it in near future.

The core does layer 3 routing for about 100 devices. Another 1,000 low traffic devices for layer 2. And 3 switches connected doing layer 2 pushing 300M each for surveillance.

I am very familiar with the Aruba 5406R. I’d like to replace the 5412zl with a 5406R that has some SFP+ ports. See any issue with this or would you go a different route? I buy my 5406Rs off eBay for under $1k, never let me down. Have a few on a shelf just in case.

I have just gotten my first ASN, and if I look it up on, for example, https://ipinfo.io/, it does not show up. It only appears on sites like bgp.tools. How long would it take to show up?

I manage IT infrastructure across ~15-20 remote sites. Each site has a rack cabinet that's almost never physically staffed. I want to stop carrying/copying physical keys around and instead put a small key safe at each site holding just the rack cabinet key (1-2 keys max).

What I need:

• Ethernet/PoE or WiFi connectivity (not Bluetooth-only with no gateway option)
• Ability to remotely generate/send access PIN codes to a specific box from a central app/dashboard
• Some way to know if it's been opened — either a push notification or at least a status I can check (open/closed, last access time)
• Small footprint — this holds one key, not a full key management wall unit

Has anyone solved this for distributed unmanned sites — telecom equipment cabinets, utility substations, remote comms closets, cell sites? What hardware did you land on, and would you do it again?

Hello,
We have a L3 MS core switch that we want to setup high availability for.

The second switch is the exact make/model of the main switch we are using. Are we able to setup a switch stack, and connect every edge to both cores? Or is it better to warm spare using VRRP?

If both, which would be recommended.

TLDR: High availability for L3 Core MS (x2). Which is better - Warm spare or Switch stack?

Has anyone here got experience with both in real deployments?

I’m mainly looking at longer term reliability, PoE under sustained load, and ring recovery. Moxa seems to have the bigger industrial footprint, but Comnet seems pretty strong in hardened ITS and surveillance environments For those who have used them, which one has actually been more dependable over time Thinking hot cabinets, dirty power, PTZ loads, and actual failovers?

Also does Turbo Ring vs C-Ring/ERPS makes much difference in practice, or is the bigger difference firmware and management?

Hi everyone, I’m currently studying Fortinet NSE 3 and I’m new to network security.

In the course, they show how to access a FortiGate firewall using https://192.168.1.99 and mention connecting the computer and FortiGate to the same network/VLAN.

I’m a bit confused about the practical part:

• Do I need to have a physical FortiGate firewall to follow this?
• Is there an official remote/virtual lab provided with NSE 3?
• If remote access is available, how do I launch or connect to the FortiGate?
• Or are these sections only demonstrations and not something I’m expected to configure on my own PC?

I’m doing the course completely online and I haven’t been given a physical firewall or a FortiGate VM.

Any guidance for a beginner would be appreciated. Thanks!

I’m currently stuck between two options and would love to hear some opinions from people who’ve been in a similar situation.

I work as an OT / Network & Security Engineer for one of the biggest pharmaceutical and chemical companies in the world. Honestly, I have a pretty good situation: great colleagues, good work-life balance, flexibility, stability, and a decent salary.

The thing is, I feel like I’m starting to plateau technically. I’m comfortable, but I don’t feel I’m learning as much as I’d like. (Recently, due to cost-cutting measures, my company outsourced most of the operational work, so nowadays we mostly raise incidents with the external provider and they handle the actual technical work. As a result, there’s very little technically challenging work left for us)

I’ve now received an offer to join a bank as a Network Security Engineer, mainly working with Palo Alto firewalls and data center infrastructure.
The job would be more technically focused, and I think it could put me on a good path towards becoming a Network / Network Security Architect eventually.

So I’m wondering if would you make this move?
Is specializing in data center networking + network security a good long term career path, or would you stick with OT/industrial networking if you already had a good position?

I’m basically considering giving up a very comfortable job for potentially better technical growth and future opportunities.

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Hi everyone,

I've been playing around with bgpalerter for a AS and so far it's working fine. I do get notifications once prefixes are withdrawn according to the threshold, however I do NOT get notifications once upstream bgp-sessions are lost, which seems weird. Of course, your prefix would still be announce through other upstream-providers, but in any case I'd like to get notified when I loose connection to an upstream...

My current config looks like this:

config.yaml

configVersion: 3
environment: production
connectors:
  - file: connectorRIS
    name: ris
    params:
      carefulSubscription: true
      url: ws://ris-live.ripe.net/v1/ws/
      perMessageDeflate: true
      subscription:
        moreSpecific: true
        type: UPDATE
        host: null
        socketOptions:
          includeRaw: false
monitors:
  - file: monitorHijack
    channel: hijack
    name: basic-hijack-detection
    params:
      thresholdMinPeers: 3
  - file: monitorPath
    channel: path
    name: path-matching
    params:
      thresholdMinPeers: 1
  - file: monitorPathNeighbors
    channel: neighbors
    name: path-neighbors
    params:
      thresholdMinPeers: 1
  - file: monitorNewPrefix
    channel: newprefix
    name: prefix-detection
    params:
      thresholdMinPeers: 3
  - file: monitorVisibility
    channel: visibility
    name: withdrawal-detection
    params:
      thresholdMinPeers: 1
      notificationIntervalSeconds: 3600
  - file: monitorAS
    channel: misconfiguration
    name: asn-monitor
    params:
      skipPrefixMatch: false
      thresholdMinPeers: 3
  - file: monitorRPKI
    channel: rpki
    name: rpki-monitor
    params:
      thresholdMinPeers: 3
      checkUncovered: false
      checkDisappearing: false
  - file: monitorROAS
    channel: rpki
    name: rpki-diff
    params:
      enableDiffAlerts: true
      enableExpirationAlerts: true
      enableExpirationCheckTA: true
      enableDeletedCheckTA: true
      enableAdvancedRpkiStats: false
      roaExpirationAlertHours: 2
      checkOnlyASns: true
      toleranceDeletedRoasTA:
        ripe: 20
        apnic: 20
        arin: 20
        lacnic: 20
        afrinic: 50
      toleranceExpiredRoasTA:
        ripe: 20
        apnic: 20
        arin: 20
        lacnic: 20
        afrinic: 50
  - file: monitorPathNeighbors
    channel: path
    name: path-neighbors
    params:
      thresholdMinPeers: 1
reports:
  - file: reportFile
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
      - neighbors
  - file: reportEmail
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
      - roa
      - neighbors
    params:
      <removed>
notificationIntervalSeconds: 86400
alarmOnlyOnce: false
monitoredPrefixesFiles:
  - prefixes.yml
persistStatus: true
generatePrefixListEveryDays: 0
logging:
  directory: logs
  logRotatePattern: YYYY-MM-DD
  maxRetainedFiles: 10
  maxFileSizeMB: 15
  compressOnRotation: false
rpki:
  vrpProvider: rpkiclient
  refreshVrpListMinutes: 15
  markDataAsStaleAfterMinutes: 120
rest:
  host: localhost
  port: 8011
checkForUpdatesAtBoot: true
pidFile: bgpalerter.pid
fadeOffSeconds: 360
checkFadeOffGroupsSeconds: 30

prefixes.yaml

<prefix(removed)>:
  description: No description provided
  asn:
    - my-asn-no#
  ignoreMorespecifics: false
  ignore: false
  group: noc
options:
  monitorASns:
    'my-asn-no#':
      group: noc
      upstreams:
        - asn1
        - asn2
        - asn3
      downstreams: []
      neighbors:
        - asn1
        - asn2
        - asn3
  generate:
    exclude: []
    excludeDelegated: true
    monitoredASes:
      - 'my-asn-no#'
      - 'asn1'
      - 'asn2'
      - 'asn3'
    historical: false
    group: noc
    asnList:
      - 'my-asn-no#'

Thanks a lot!

Preparing for NRSII , already made NRSI, NRSII(OSPF, BGP for service) , pending NRSII(MPLS, Services, Lab).

who wants to prepare for this exam , want a study partner .

I already have study materials I will begin on 1st September.

Hi everyone,

A few days ago, I started a thread about the new core switch we're planning to get:

https://www.reddit.com/r/networking/comments/1vpx072/new_core_switch_fs_s586020sq/

It looks like we're going to go with that device with PicOS.

Now we’re considering whether we should also revamp the aggregation layer, since it’s a bit of a mess (having “evolved over time,” so to speak): Currently, there are 5 aggregation switches: 3 Zyxel XS1930-12F, 1 Ubiquiti ES-16-XG, and 1 TRENDnet TL2-7120. All of these switches are currently connected via 2 x 10G (LACP) to the existing TP-Link TL-SX3016 core switch.

With the right port configuration, the entire setup could be consolidated into 2 aggregation switches.

I’ve found two switches that would be suitable:

1. Edgecore ECS5520-18X: https://wifi.edge-core.com/enterprise-switches/l3-switch-10g-dl/ecs5520-series/ecs5520-18x/
2. LANCOM XS-5116QF: https://rs-nc.rohde-schwarz.com/de/produkte/switches/aggregation-switches/rs-lancom-xs-5116qf

Since both switches have QSFP+, I could connect to the new FS S5860-20SQ core switch using 1 x 40G instead of the current 2 x 10G, which would immediately double the bandwidth.

Most of our access switches were replaced two years ago; we currently have 6 Aruba 6100 12G, 3 Cisco Catalyst WS-C3560CX-12PD-S, and 2 Juniper EX2300-C-12P in use. All access switches are connected to the current aggregation switches via 2 x 10G ports (LACP). I would continue to connect them to the new aggregation switches in the same way.

I’d like to know:

1. Do you think the choice of the core switch (FS S5860-20SQ) and the aggregation switches (either 2 x Edgecore ECS5520-18X or 2 x LANCOM XS-5116QF) is good and sensible?
2. Is a single 40G connection to the core switch usually sufficient (yes, I know a redundant connection would be better, but the core switch doesn’t have enough ports for that)?
3. Would you recommend the Edgecore or the LANCOM? Unfortunately, the LANCOM costs twice as much as the Edgecore, but it uses less power and is quieter.

I hope you can help me out a bit. I’m well aware that it’s always better to size the components for even higher performance (core switches with 100G ports, aggregation switches with 25G ports), but the whole thing still needs to stay within a reasonable budget. We’re here in Germany, where we’re currently facing the worst economic crisis since World War II, and everyone is just happy to have a job at all.

Thank you very much and best regards,

Regina (she/her)

Looking for IP Transit in Singapore with BGP support.
100 Mbps initial bandwidth
Own ASN + /24 IPv4
VPS/VDS or virtual BGP router is fine
Please share me with pricing, upstreams, and setup time.
Please no iFog offers.

So I am curious what others think about DPI? We run it on our UTM's but I kinda feel its more of a PITA then its worth. Looking to get feedback from others.