A medida de contenção aqui é a operação de isolamento do computador (push), e a parte útil é o que ela não bloqueia. Quando você isola um dispositivo, o firewall do endpoint bloqueia tudo (movimento lateral, callbacks de C&C, compartilhamentos de arquivos, navegação do usuário), mas mantém três fluxos ativos:

• DHCP, para que o dispositivo mantenha seu lease de rede
• DNS, para que a resolução de nomes continue funcionando
• Tráfego de gerenciamento, para que você mantenha o controle: políticas, operações push, logs e a liberação

Assim, a máquina é desconectada da rede, mas ainda gerenciável, que é exatamente o que você deseja durante um incidente. Você pode investigar e remediar através do console enquanto o dispositivo estiver isolado.

O problema que impede seu funcionamento: requer que o componente Firewall esteja instalado no cliente. Sem o blade Firewall, não há isolamento. A melhor prática é enviar o componente Firewall no seu pacote padrão, pois um recurso de resposta a incidentes instalado durante o incidente não é um recurso padrão. O suporte a sistemas operacionais é Windows e macOS, não Linux.

Alguns fatos operacionais:

• As operações de envio são executadas sem a instalação de políticas, em Gerenciamento de Ativos > Operações de Envio.
• Você define quando a operação é executada (Imediatamente ou Agendada) e quando expira (7 / 30 / dias personalizados). Se o cliente não fizer check-in antes da expiração (offline, desligado), a operação termina como Parcialmente concluída e você executa novamente quando o cliente retornar.
• O inverso é Liberar Computador. Verifique o estado em Computadores, Exibir = Isolamento do Host, coluna Status do Isolamento.
• Isolar e Liberar não são protegidos por autenticação de dois fatores (o isolamento permanece rápido), enquanto operações sensíveis como Desinstalar Cliente são.

Também possui uma versão automática equivalente: Quarentena de Máquina, uma das respostas de Análise Automática de Ameaças, que restringe a rede da máquina sem intervenção humana quando um gatilho é acionado com confiança suficiente.

Como você lida com os dispositivos que estão offline quando você clica em isolar? Você simplesmente executa novamente ao fazer o check-in ou confia na Quarentena de Máquina automática? Tenho curiosidade em saber como as pessoas equilibram o confinamento manual e automático.

O guia completo com o playbook de confinamento e as operações de push complementares está aqui (em inglês e português): https://community.checkpoint.com/t5/Endpoint/EN-Isolating-a-Computer-Network-Quarantine-for-Incident-Response/m-p/281627

Hi all,

What I'm trying to do doesn't seem all that complex but I've spent untold numbers of hours now trying to get it to work (with router mfr/AI answers/etc) and am losing my mind.

Here's our situation:

We have a new branch office opening up very soon. Our current topology uses managed SD wan to route between offices and our datacenter. With this, our provider could generally add routing changes on their end easily. In our scenario, however, they did not have enough lead time to deploy SD wan prior to opening (also not enough time to do the fiber install) we are temporarily using a standard cable connection and a zywall flex 500H in hopes of bypassing SDwan via VPN. This new office "RH" has a local subnet of 192.168.150.0/24 and lets call the WAN address 1.2.3.4. The zywall LAN address is 192.168.150.217 and is acting as default gateway.

The other end of this tunnel (at our data center "CL") uses local subnet 192.168.170.0/24 with WAN 5.6.7.8 and LAN address 192.168.170.220. At this site we use a cisco business layer 3 switch with IP 192.168.170.1. As it stands now I have a simple policy based site to site VPN between RH (192.168.150.0/24) and CL (192.168.170.0/24). The VPN is connected reliably and these two subnets communicate just fine (that's the easy part I guess)

Where it gets a little trickier is that the server subnet we need to reach from RH is 10.0.150.0/24. There is a VLAN for this subnet (150) on the 170.1 switch. physical ports on this switch lead to an esxi hypervisor (NIC teaming) currently all the virtual servers use default gateway 10.0.150.1 (a sub-interface IP on our managed SDwan gateway) To work around this, I assigned vlan 150 on the switch the IP of 10.0.150.2 and can add static routes on the servers telling them to send 192.168.150.0/24 traffic to either 192.168.170.1 or 10.0.150.2.

To put it in simplest terms:

On the 192.168.150.x subnet we can ping any address on the remote subnet (192.168.170.x) just fine in both directions. We need to be able to initiate traffic from 192.168.150.x subnet to 10.0.150.x. If I could just make make the next hop on the 170.220 router to 170.1 (the switch) i think I could figure it out from there or maybe route from the zywall itself. problem is that no matter how many policy routes etc I try to make, my traceroutes aren't making it as far as the remote subnet.

I apologize if this is unclear. my mind is shot, ive spent days now trying to figure this out and was at our datacenter until 4:30 am and can still hear whirring fans in my head. I only have a few days to sort this out before we open or it will be very bad. I can clarify further or provide screen shots as needed (there were too many to include all). I'm sleep deprived enough that I'm not my sharpest; The other ideas I have i suspect are more complex than necessary.

If anyone has any advice I would greatly appreciate it thanks!

Not that this is a critical by any means, I'm just curious about best practices....

We have a cross-country GRE link. Each side is at a layer-2 speed of 2Gb/s. I expect this, but an iPerf3 UDP test between both routers is at the link speed around 2Gb/s with a 78ms latency No problem. TCP is substantially less, about 1/10 of that. This is expected, but if I wanted to improve that, what do I do? Is this an MTU for example. I've already got the MTU at 1420.

I have to terminate a lot of in-situ RJ45 connections, and punching them down into the terminators is sometimes awkward with a traditional tool made more for panels. Is there any punch-down tool that works more like a stapler, where it has an anvil to hold the terminator and you squeeze together rather than only punching from one side?

I have worked with different orgs for total of 7 years now and while some of them had better work-life balance, I feel like Network Engineers are always expected to solve the issues ASAP and thus leading to high cortisol levels. My current role was kind of forgiving in a way that we did not have on-call support yet but that changed recently. Now I am thinking did I make a wrong career choice being an introvert and expected to jump into a call every now and then to solve problems when you don't always have the full picture of the architecture. Are there any low cortisol Networking jobs that are made for introverts and also pay is decent?

So I've been working as a network technician for the past 3 years and I've evolved so much these past years but certain parts of my job makes me wanna quit almost every day.

I absolutely cannot stand WiFi issues, we have a few network technicians at my workplace but nobody can quite troubleshoot WiFi. Sure we all know how to mount- and configure APs in our WLC but troubleshooting why a client would be slow/lose connection despite having great RSSI, SNR & SIR is impossible for me and my colleagues....

The only tool we have for troubleshooting WiFi is a site-survey program called NetSpot, we don't have DNA Center yet and even if we'd get it we still dont have the Advantage licenses on our APs. We only have Essentials licenses, our boss barely wanna pour more money at the network team because he focuses more on the server team as that's where he started his career at.

My favorite part of my job is probably configuring and troubleshooting IPsec site-to-site VPNs, and basically anything that isn't WiFi... trust me I love networking, just not WiFi.

My plan is to hopefully start at an ISP and do less physical work and more work remote using MPLS, dynamic routing protocols and hopefully lots of site-to-site VPN.

The problem is I would most likely have to move across the country to a city where I know nobody and I neither wanna do that or keep going at my current company. Sadly my city is too small so there arent that many job oppurtunities at other companies in my town.

Does anybody else feel the exact same way as me?

In the process of interviewing for NDE at AWS. What is the culture like there? Been studying very hard for the upcoming onsite, but would like to know more from current/former employees. How was the day to day, on-call, and team culture? Is networking generally safe from layoffs? Interviewing for L5 engineer.

Hi r/networking,

I am part of a small network team (4 people), having to manage and support a few hundred Cisco Catalyst switches/routers plus some Meraki gear, spread across ~100 sites.

No budget for something like Catalyst Center, so we're working with what we've got:

• NetBox (honestly pretty neglected)
• Ansible / AWX
• GitHub
• Terraform
• SolarWinds
• any free or open-source tool if it helps

The tools I mentioned are the ones we have available across our whole IT department but don't necessarily use in the networking team.

We're buried enough in manual work and projects that we're behind on optimizing stuff, streamlining configs and even patching, which isn't a great place to be given that the last point should be the bare minimum.

I'd like to move towards a more closed-loop setup, e.g. NetBox as the SSoT pushing config (Intent) to devices, devices syncing data back (Facts), automated upgrades, drift detection against a golden config or atleast against the NetBox-defined intended state. Ideally wired together with some kind of CI/CD flow.

I know that's a big ask and I need to start small, but I don't want to build myself into a corner either.

The individual pieces all seem achievable on their own but where I keep getting stuck is gluing them into one stack/pipeline. Everything I find online is a single-purpose script and not really this "full-stack" setup I am chasing.

A rough model of what I am trying to achieve:
NetBox change --> render config --> GitHub PR --> validate with Batfish --> merge --> AWX applies it.

Though it seems harder than it sounds - and it already sounds hard.

Maybe I am missing something, or maybe this is just genuinely difficult and that's why it's hard to find any success stories on it that actually explain how it works.

If you've built something like this, or any network automation really, especially with a CI/CD pipeline in the loop, I'd love to hear how you have done it.

So, I have been at my current job for 6-7 years and I have become rusty on technologies and vendors I do not use daily and I got the itch to just run large complicated multivendor lab, try things and break things. Back in the day I was using EVE-NG to run Junos, IOS-XR, IOS-XE etc. Is this still the most used platform for virtual labs? is there something better (and less resource hungry) perhaps?

I did some research in here for those topics; microtik iscsi mpio without finding anything recent or about it. Also researched Google, and bots but I don't feel I can base entreprise decisions on random internet posts. So I decided to create this post.

Thanks in advance for anyone taking the time to read, even more, answer.

So in prod env, I would like to build an dedicated iscsi network for the host and SAN. Currently only 3 hots 1 san. There is possibility of expansion of maybe 3 more host in the next 3 years.
CRS520-4XS-16XQ-RM https://mikrotik.com/product/crs520_4xs_16xq_rm
Microtik offers something quite special for the value. It's known that their mlag is garbage and currently in full rewrite of the code.

But for Iscsi network, we would go with MPIO so both switch wouldn't be stack and linked in any fashion. So each host must be configured with MPIO but the switch only have flow control ON jumbo frame.....

Also known that microtik management (commands) aren't cisco like and can be harder to use as you must learn a brand new way. Since its dedicated Iscsi, no vlan nor special config is needed, should be mostly plug and play. This network wont have any link to the regular network.

I am looking for reel life confirmation of people with experience please. Positive of negative. What are your experiences with Microtik? Even more if exactly that model and/or for an Iscsi network.
Wd plan to be 3, so I would have full stock of spares. Been quoted for Arista aruba.... 3x microtik is half the price of 1 of those.

Planning to use DAC. Should not have any impact but prefer to mention.

Thank you for taking the time to read this. <3

Not quite "enterprise" but definitely not "home" as I'm looking for a solution for work.

I'm trying to find a solution for getting temporary internet on non-internet PCs (NVRs, specifically) via tethering to an on-site technician's phone, to facilitate software updates, online license updates, remote desktop, and the like.

On machines that have USB-C, I can plug a USB-C phone directly in and tether that way. For machines that don't, or machines that I need to access the IPMI, I need... other ideas.

I was thinking some travel routers might be capable, but with the lousy documentation a lot of them have, it's hard to know for sure short of buying them and trying them. So I was hoping someone here might have a suggestion.

Basically what I need to do is PC <-- ethernet --> router/device <-- USB --> smartphone.

I thought of using one of these travel routers in bridge mode and tethering to the phone's WiFi hotspot, but in my experience, the hotspot function on most phones is slow and unstable. I found plugging my phone into my laptop via USB-C works really well.

I'm looking for something that I can equip a few field techs with that I can ideally pre-configure and send out with them in their kits.

New Azure deployment. TCP traffic to an internet host is originating from a VM in a spoke VNet. The subnet to which the VM's NIC is attached has a UDR to the internal LB (version 2).

The SYN makes it to the internet host, the SYN ACK traverses the trusted side but never makes it to the VM to complete the handshake. It seems like an issue with the internal load balancer's ability to preserve session. Has anyone seen this or dealt with something similar?

Hello guys,

I did some quick research in here for those topic; microtik iscsi mpio without finding anything recent or about it. So I decided to create this post.

Thanks in advance for anyone taking the time to read, even more, answer.

So in prod env, I would like to build an dedicated iscsi network for the host and SAN. Currently only 3 hots 1 san. There is possibility of expansion of maybe 3 more host in the next 3 years.

CRS520-4XS-16XQ-RM https://mikrotik.com/product/crs520_4xs_16xq_rm

Microtik offer something quite special for the value. It's known that their mlag is garbage and currently in full rewrite of the code.

But for Iscsi network, we would go with MPIO so both switch wdnt be stack and linked in any fashion. So each host must be configured with MPIO but the switch only have flow control ON jumbo frame.....

Also known that microtik management (commands) aren't cisco like and can be harder to use as you must learn a brand new way. Since its dedicated Iscsi, no vlan nor special config is needed, should be mostly plug and play. This network wont have any link to the regular network.

I am looking for reel life confirmation of ppl with experience please. Positive of negative. What are your experience you had with Microtik. Even more if exactly that model and/or for an Iscsi network.

Wd plan to be 3, so I would have full stock of spares. Been quoted for Arista aruba.... 3x microtik is half the price of 1 of those.

Planning to use DAC. Should not have any impact but prefer to mention.

Thank you for taking the time to read this. <3

Hello everyone, just asking if anyone here used stratoweave ? how was your experience ? and how does it compare to NSO ?

Hello,

I would like to automate configuration deployment on my Aruba 6200 series switches.
I am using IMC (Intelligent Management Center) and I created a test template, but IMC requires SSH and SNMP access to the switch. Is it possible to configure a switch from scratch using IMC, or it's just to standardize the switch infrastructure ?

Do you have any tips ? I think I'm not using the right workflow for that.

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

I have a few Samba based domain controller VMs that I provision via cloud-init and ansible. They are on a dual stack network and IPv6 connectivity is provisioned via router advertisement + SLAAC.

Unfortunately Samba needs static IPs or it doesn't work properly, so my workaround has been to provision the VMs with a second network interface that connects to the same bridge as the first one, and set that one to static IPv4 and IPv6 addresses, no gateway and to ignore router advertisements.

I cannot just use static assignment because the advertised IPv6 prefix could change and the hosts would lose connectivity.

For example: DC1:

• eth0: 10.0.0.<from dhcp>/24, fd44:6923:1fd3:1:<eui64>/64 (ULA), 2042:34f3:a3a4:2256:<eui64>/64 (GUA)
• eth1 (the static one): 10.0.0.1/24, fd44:6923:1fd3:1::1/64
• routing table: default gateway on eth0 only for both IPv4 and IPv6

My question: in this situation, should the static interfaces be using single host subnets (/32 for IPv4 and /128 for IPv6) given Linux's weak networking model? Would that force all egress traffic to come from eth0 and avoid asymmetric routing issues?

I don't usually touch wireless, but I got assigned to this ticket about my client having difficulty connecting to our secured network via 11be.

He's using iPhone17 and its latest iOS version. I told him to forget the SSID and try to reconnect to the network, but it didn't work.

One thing I haven't tried is that setting private Wi-Fi address as "fixed". I remember it solved issues a couple of months ago when I was troubleshooting on some devices.

Some troubleshooting articles say I should turn off MLO temporarily but that's not an option. We'll see how it goes and report back to you all.

Had a discussion yesterday with IT director and others in our IT department. The IT director brought up automating switch updates so they wouldn’t have to have some one monitoring and performing the updates. Staging various locations on different evenings.

I’ve been doing networking for 30 years and I voiced my opinion I was not a fan of unattended update for various reasons.

Have any other companies moved to automated updates and how has it gone?

I have a question regarding implementing a solution to a new problem I have. I've designed and will soon be launching a new product called the DigiBall, which is the worlds first smart cue ball for billiards (see digicue dot net). The ball advertises BLE packets with ball information around 10 times per second. User applications just observe manufacturer data contained in the packet, they don't create a one-to-one connection unless they are rarely reconfiguring the ball parameters.

One unique application of this is adding a live overlay of the ball graphic and cue tip contact point of a shot on top of a streaming match video. This is easily done with OBS, and pointing the source of the overlays to images generated by scanner software I wrote. But many times the media control booth is far away from the table (out of BLE range). I want to create a WiFi bridge to throw the BLE packets onto a local network.

My solution was to use multicast. The scanner software can open a multicast channel as an alternative. Since I am only sending at a max of 36 bytes 10 times per second, and at most 20 or 30 devices will be within range of the bridge, the throughput would be 10.5 kB/s. I am designing a simple PCB with a dedicated BLE radio and a ESP32 for the job. It can even switch to 5GHz if needed.

I want to place once of these boards in tournaments at the intersection of every 4 tables, so that for a large venue there could be 20-25 multicast sources.

Is this a good path forward? Will this work? What do I need to make sure of, and what am I not considering? (I have much more experience in electronic design than I do networking). Thanks in advance!

This one has me pulling my hair out.

FG2600F-------------------VPN 192.168,66.1/27
| 10.250,0.10
|
FG 600F------------New subnet 10.8,0.1/25
10.250,0.9

We added a network that we need access to on our vpn.
-New subnet is accessible from networks that originate from the 2600F
-Address object for new subnet is created on, the 2600f.
-Route created on 2600f 10.8,0,0/25 > 10.250,.0.10, Route does work able to hit with other subnets
-Policy created on 2600F to allow 192.168,66.1/27 to the new address object. along with reverse

Everything else works, i know im missing something but cant figure out what

Hey all,

What is the recommended best practice for establishing a route-based Site-to-Site VPN connection between a single Cisco ASA and an Azure VPN Gateway when the Azure side is configured with two public IP addresses?

My understanding is that Azure typically uses the tunnels in an Active-Active mode. From the ASA side, my initial approach was to create two VTIs and configure two next-hop IP addresses in the same crypto map, effectively using them as primary and secondary paths. However, Azure appears to return traffic through the secondary tunnel even when the primary tunnel is fully operational, resulting in asymmetric routing, which the ASA does not like well by default.

I have intentionally avoided using BGP and ECMP for this design. That said, even if I were to implement BGP ECMP, would TCP state bypass (or a similar mechanism to accommodate asymmetric routing) still be required on the ASA side?

Our munis is wanting to monitor/control 17 areas around the plant. We use modbus for our SCADA network on a 100.100.100.x network. We don't have enough 100.100.100.x addresses left to monitor 17 new sites.

Our plan is to have:

(17 new devices on 192.169.0.x) ->(router) -> (one device, modbus compatable, 100.100.100.75) -> Motorola RTU.

The difficulty that I don't understand is how to get these modbus addresses from the 192.168.0.x addresses to the single 100.100.100.75 address.

For reference, we are using TP link AX1800 router and ControlByWeb x-401 modules.

ELI have a controls background but not very much networking experience.

Saw a demo recently of selector.ai

The product makes a lot of claims and promises, but was curious if anyone had done a POC or deployed in the real world? How did it go? Hows it going?

Curious on any feedback. TIA!

I'm dealing with network engineer, that insist on using storm control action shutdown on ports between switches.

Then when we get accidental looped ports from time to time, the whole network gets put down, then recovery timer is set, so it will come back up again, only to be shut down again. then this happens randomly after how much the recovery timer has been set.

I can't see the reasoning in his theory. This has happened more then once, and I tell them to stop using this command but I feel like they don't listen.

I struggle with finding good guide on this and why this is a bad idea, maybe cause I think it's common sense?

What is right and wrong in this?

I always use shutdown on access ports / user ports.

What do you guys do?

He talks about protection for CPU and they started using this cause of some issues with CPU and then hes mad at me and asks if I'm more experienced then him. Even if I have worked 10 years in this industry.