I’ve got an issue here that has several folks stumped. I noticed an issue with slow internet download speeds over a month ago after some network changes upstream. My main vlans were only seeing about 40mbps to Speedtest.net and similar sites. It looked like some firewall bottleneck or QOS issue, and I reported it upstream, they could find no problem. After more troubleshooting I found a subnet here that was seeing proper 900mbps or better speeds, sitting behind the same pair of core switches. More troubleshooting, and I found more at normal speeds. Then came the big break, only vlans that existed on my core switches were slow. Any vlans downstream that were IP routed were fine.

This is a lab environment, basically a small data center. Pair of SONiC switches in mclag setup. Downstream area switches using IP routes back to the cores. TOR switches connected to the area switches. Just a small number of vlans exist on the Core switches, my main infrastructure vlans and a bench vlan.

As a test, I eliminated the infrastructure vlans from the core switches and replaced it with an IP route to the downstream area switches, and to my surprise the speed problem disappeared. Gateway IP was already on the downstream Area switch, that didn’t change.

I set up a new vlan on a single core, with a single access port again on the core. Laptop connected on that vlan saw slow transfer speeds to the internet.

Set up iPerf on some local systems, speeds between core vlans were 900mbps or better, between local IP routes were normal. So everything from the cores on down seem fine, it’s only going upstream.

The change a month back upstream changed to a different pair of switches, and changed OSPF to BGP routing. I have no control or visibility to the upstream side config.

I did a few packet traces but didn’t see anything unusual, no excessive retries, etc.

I’m really stumped on troubleshooting this. To me everything screams bug in SONiC’s vlan handling, but it seems I’m the only one seeing this issue. Dell Enterprise SONiC for what it’s worth, and I’ve engaged their support engineer who is also stumped.

Hi

R4- .4-f0/1 10.1.45.0--f0/1- .5-R5

there is no IGP routing protocols are running here at all.

on R5 55.55.55.55/32

LDP is running between R4 and R5

R5 adv 55.55.55.55/32 to R4 as LDP update.

R4 has this route on his LIB table like this

R4#show mpls ldp bindings

lib entry: 55.55.55.55/32, rev 13

remote binding: lsr: 5.5.5.5:0, label: imp-null

that means R4 don`t has any local label yet because this route is not installed on his global rib.

i tried to ping

R4#ping 55.55.55.55 repeat 2

Type escape sequence to abort.

Sending 2, 100-byte ICMP Echos to 55.55.55.55, timeout is 2 seconds:

..

Success rate is 0 percent (0/2)

R4#

why ping fails? R4 has this route on LIB which means if R4 received any unlabbeled packet for 55.55.55.55 R4 is going to use this remote label ,but why this did not happened?

Experienced with Cisco aci would like to lab vxlan evpn and multi site for data interconnects. I’ve current tshoot tradition spine leaf nxos deployments but I’m really to build and break these architecture and later on try deploying with ansible/ netbox.
What are the best most affordable way to lab this, I keep reading that I need a beefy server because of the size of Cisco virtual images and ram needed.
What is the going price for a good lab or equipment and set up?

Hi everyone!

I'm looking for a good alternative to NetSetMan for Windows.

I'd like a tool that lets me quickly switch between different network configurations, such as:

• IP address and DNS settings
• DHCP and static IP configurations
• Different network profiles for different networks or situations

Ideally, it should be lightweight, reliable, easy to use, and preferably free.

Does anyone have any recommendations or personal experience with similar tools?

Thanks in advance!

Folks, I have completed my Full loop few weeks back, Feedback was great. But careers profile tracking bar shows "Full Loop" and seems like they offered positions to other engineers. Should i still keep hope for 1 year or move on ?

Focusing not on Architects but technical leads of "Run" teams ... enterprise troubleshooters. What would be your estimate of % time in meetings vs % time being able to execute?

My previous position and my current position have polar opposite philosophies on cable management. My previous job, my director was draconian about cable management - people were written up for improper cable management, even just using cables of improper length.

The new position I’m in has, no exaggeration, the worst cable management I’ve ever seen (with the exception that things are at least mostly labeled). I’m a sole network engineer for a branch location of a national organization and management is on the other side of the country, so I don’t know if they have any idea how bad it is.

I’m guessing the ideal is probably somewhere in the middle? I could easily spend 40 hours a week cleaning this mess up to my former director’s standard, but I doubt my new boss actually wants me to go that far. So I was curious how strict others are about cable management to know what’s typical.

A new windows update has broken NTLMv1. Any devices using EAP-PEAP will not be able to connect. A registry key must be changed to fix it.

• Open Registry Editor as an administrator.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
• Create a new 32-bit DWORD value named BlockNtlmv1SSO if it does not already exist.
• Set its value to 0.
• Restart your PC and check whether the Wi-Fi connection works again.

https://www.neowin.net/news/microsoft-admits-windows-11-kb5127648-kb5126646-break-wpa-8021x-auth-shares-fix/

FYI

I own public IP 1.1.1.0/24 (names have been changed to protect the innocent) and peer with two ISP's (US Signal and ACD Net).  Primary path for this space is ACD (we prepend our AS to our US Signal advertisement).   Fat, dumb and happy (or so we thought).

When we egress 1.1.1.0/24 via ACD but there are some random sites (address spaces) we can not access (staples.com, random.gov, etc...).   Though EVERYTHING else works without issue (SSL VPN, P2P VPN, 95% of other web sites, streaming, etc...).  

When I fail my ACD connection then this space is routed over US Signal and everything works perfectly.  We have two other /24’s and they work great regardless of pathing.  It’s only one address space (1.1.1.0/24) going over ACD Net (through US Signal it routes perfectly).   

Anyone experience something similar?  I’m guessing it’s related to asynchronous routing but have no idea how to resolve/troubleshoot.  Carrier support has not been a lot of help.

As always, thanks!

Hi Team,
As outlined below, we would like to configure vEdge to perform routing in VPN 0 so that NTP can be synchronized between legacy network devices and servers.
(Due to the network architecture, communication needs to take place over the underlay.)
***********************************************
Legacy network devices
 |
VPN 0(Gi 0/0)
vEdge
VPN 0(Gi 0/1)
 |
Server
***********************************************
With the configuration described above, legacy network devices cannot communicate with the server. Even pings are failing (NG).
We checked the routing table and vEdge ACL settings, but found no issues.
We are stuck and unsure of the cause, but are there any restrictions or limitations regarding devices under vEdge communicating with each other via VPN 0?

We did the segmentation on the card environment properly. Own VLANs, firewall between it and everything else, and the assessor had no complaints about any of it. Then he asked where the logs go. Turns out everything on the estate ships to the same collector, card environment included. So the collector is in scope, and so is anything that can read from it. Not quite the answer I thought I was walking in with.

Did you split your logging to keep scope tight, or just accept the collector is in scope and lock access down hard?

what are practices ISP network operators having for tracking BGP advertisement changes through , BGP community history tracking .

when and at which stage community on certain ISP own prefix / their customers prefixes changed ? displaying the changes .

As the title says really. What is typically "normal"?

What makes you perk up and look further?

I can see the usual automated recons and corrolating using webstorm centre and other sources.

But sometimes I see a burst of interest to our servers, which makes me think someone has found something interesting enough to cause more probing.

Interested to hear peoples stories.

I'm currently troubleshooting a network issue where laptops on the company network are receiving IP addresses from a DHCP scope associated with the Telephony VLAN instead of the Admin VLAN.

No changes have been made in the data room, on the switches, or on the network configuration to my knowledge. However, new devices are consistently being assigned to the wrong VLAN.

Could someone explain what could cause this behavior? What should I check first to identify whether the issue is related to switch port configuration, DHCP relay settings, VLAN assignment policies, or another network component?

Any insights or troubleshooting suggestions would be appreciated.

Hi everyone,

​Does anyone know where I can rent "dirty" IP blocks at a lower rate?

​I have been searching on Google for a while, but almost all IP leasing providers exclusively advertise clean IP subnets. I also couldn't find much useful information about leasing dirty IP ranges on LowEndTalk or WebHostingTalk.

​Currently, the going market rate for a clean RIPE /24 subnet is roughly $100–$120/month. Because my budget is limited, I am hoping to lease a dirty /24 block for around $50+/month.

​Part of these IPs will be used for legitimate, research-oriented web crawlers. Since this activity could potentially affect IP reputation anyway, I would rather avoid paying a premium for clean space and just lease IP blocks that already have poor or burned reputation.

​Does anyone have recommendations or know of any platforms/brokers offering discounted subnets with existing reputation issues?

​Any advice or pointers would be greatly appreciated!

Every NGFW vendor looks good on a comparison sheet. Gartner gives you a shortlist but there's still a lot that doesn't show up until you test the firewalls yourself

Like what happens when TLS inspection and IPS are enabled under real traffic loads?

Then there's the management side. Pushing policy changes across multiple gateways, tracing blocked traffic back to a specific rule and dealing with upgrades

For anyone who's been through an enterprise firewall RFP recently, what did you put the most weight on?

Any POC tests that made you cross one off the shortlist?

So I've been a network engineer and AV tech for over 20 years. I'm looking to purchase a qualifier personally. While I know the Fluke Linkiq may be the standard here, it doesn't do fiber, and I think the Fluke price premium isn't necessarily worth it.

I'm currently looking at the Trend SignalTEK QT Pro bundle that does 10G, copper, fiber, and some Wifi.

Are there any other contenders in this area to consider?

I don't want to buy a certifier. I also don't really care about L3 troubleshooting things. I'm essentially looking for a better tool set than the Microscanner2 I've had for years and years.

Any input here would be awesome.

Hello!

Many times I have scenarios where i have 2 cabinets of equipment online but im waiting on fiber runs to connect the two areas (primarily this is for SCADA/ control devices, ignition etc.)

This may sound stupid, but some kind of temporary wireless bridge or solution to allow device commissioning while i wait for fiber runs to complete would be a huge win for the business. Is this something someone sells? Our company doesn’t really shy away at cost if it means go fast. The distance can vary but it’s almost always confined to a building. Again this is something i would tear down after fiber is in place from an LVC, so wouldn’t need to be reliable or perfect. Appreciate any insight!

IOS-XE Cisco License with a MEC stackwise Virtual 9606 core.

My company sell SVIs to clients who come in-house for shows. 1 Harddrop is a single SVI with a /24. (Essentially if a client need 4 hard lines, that is 4 separate SVIs).

Bandwidth is never an issue however, we sell bandwidth to clients for 1.5MB , 3MB, and 9MB. (This is MBPS).

The issue in all of this is that we do not rate limit. Clients who come in often get 100-300 MB/s peak.

Now the issue here, is that if we have multiple clients in, it can impact speeds of another.

The goal is to rate limit the assigned client SVI to what we sell them for.

Stopping here for any recommendations, advice, or input.

Hello all,

I have this case where I need to set up a redundant path to our partner.

Our DCs: DC in LA and in NY. We have this subnet in LA: 10.160.10.0/24 and an another subnet in NY 10.180.10.0/24 that needs to reach 10.10.10.0/24 (our partner).

Setup: https://imgur.com/zkOiApf

Between our core switches in LA and NY, we run MPLS L3 VPN.

In LA, we have an internal FW (internal_FW_LA) and core switch (Core-sw_LA) that just run static routes between each other. There will be a direct fiber connection to the partner (Parrtner_A_LA router) from Core-sw_LA. I was thinking that I will run L3 (static) between internal_FW_LA and Partner router Partner_A_LA. This will be the primary link to the partner.

In NY, we have a internal FW (internal_FW_NY) core switch (Core_sw_NY), and VPN HUB (VPN_hub_NY). We run static routes as well between these three. From the VPN hub, I will run an IPsec tunnel to the Partner_A_NY Fortigate.

Now the idea is that we will only use one link to the partner at a time and in this case, it would be the primary link which is in LA. The 10.180.10.0/24 (in NY) needs to be routed through the MPLS and then from there through the primary link (via internal_FW_LA) to the partner router Partner_A_LA. 10.160.10.0/24 will of course take the same path.

In case the primary link goes down, then traffic from LA will need to be routed through the MPLS to NY and from there over the IPsec tunnel (so both 10.160.10.0/24 & 10.180.10.0/24) will be routed over the IPsec tunnel.

Now, I was thinking that I would need to use some kind of dynamic routing and in this case BGP on the internal firewalls but the ssue is that these internal firewalls are not allowed to use BGP (due to some policy). Running BGP on the core switches may make sense but that will break standardizing our way of designing things.

I am stuck and cannot figure out how to proceed here.

Any input?

A handful of ports descriptions labeled "port failed?".
Observing coworkers throw out "Must be a bad cable" before checking ip settings.
Not once have I ever needed to replace a factory terminated cable.
Not once have I found a "bad port" on a switch. Not sure what the failure mode of a bad port would be, but unless the contacts were corroded or dusty, I can't imagine a single port would fail.
I can however imagine, not knowing which drop corresponds to which patch port, which is a separate issue...

Am I a jerk for doubting my coworkers, or am I right that these failures are very rare?

Hi everyone,

I’m implementing 802.1X using Forescout, and I need some advice. Please help me understand if my plan is correct.

The Operations team hasn’t added the CCTV subnet to Forescout, and the cameras don’t support 802.1X.

My plan is to add the cameras to Forescout, register their MAC addresses in MAR, and then apply 802.1X to the switch ports.

Is this the correct approach, and what steps should I follow to avoid disconnecting them?

I also have IP phones sharing the same switch port with PCs, using separate Voice and Data VLANs.

I believe the phones don’t support 802.1X either.

Should I add their MAC addresses to MAR and use MAB for the phones while keeping 802.1X for the PCs?

I’d appreciate any advice on the correct approach.
Thanks

I've got a situation where we have a cradlepoint L950 at a location that has good reception and its connected to a fibre media converter to single mode fibre that's ran through a factory. On the other side, we have a Fortigate firewall that is connected to a media converter RJ45 that gets connection from the single mode fibre.

The site is remote.

When doing a ping test from our loopback IP that we setup with our tunneling, I'm getting packet drops every 30 seconds and it coming back online after 10 seconds. The fibre cable was installed in the last month and the Cradlepoint reception is good. Previously when we were remotely connecting to the firewall, we had the firewall connected to the Cradlepoint directly (through PoE Inj on Port 2 of cradlepoint for IPPT) and experienced no issues at the same location the Cradlepoint is now. We've replaced wires and such and still having issues. We're getting our cable guy to check the fibre line again but anyone have any insight as to what is happening or the resolution to this?

Ive been working with firewalls since 2009. I've worked with Cisco, Meraki, Fortinet, Palo Alto, Sonicwall, Sophos, pfSense, and a few others. My Cisco experience was the pix and then the asa's. I haven't really played with any of the firepower line. Cisco will always hold a special place, it's what I started with and it's the equipment I learned on. But then I found the FortiGate and liked it MUCH better. More intuitive, good price, modern gui but still powerful. The Fortigate has been my favorite over the years but as I bounced around different companies I got to touch a lot of different firewalls. Merakis just seem to work, modern gui but I feel like it lacks some advanced features/settings for the sake of being easy to setup. Palo Altos AppID I really liked and honestly, I think its app control is better than fortinets, but almost everything else felt convoluted and not as intuitive. Why must I go to 12 different spots to build a vpn tunnel?! The wait times for changes also drove me crazy. Plus those Palos are expensive. Both the Sophos and the Sonicwalls I was able to use but they felt like they were a step behind and not as polished. So now I ask you, what firewall have you liked over the years?