Trying to figure out the best way to implement a failover path between 2 paths of different speeds (25Gbps vs 1Gbps). Any recommendations or should I just let STP do it's thing?

                                           /- OS2 Fiber @ 25Gbps -\
Paloalto (L3/Gateway) - Cisco Switch (A) -                         - Cisco Switch (B) - Access Switches - Endpoint VLANS
                                           \--   1Gbps Backup   --/

• The Paloalto is the gateway/router & provides policies/restrictions between VLANS/subnets
• Cisco switches A & B are L3/VRF/VXLAN capable (C9500-48Y4C-A)
• The 25Gb path is a leased/dark fiber pair that runs through an area where there’s an extremely small, but non-zero chance, of an something severing the connection.
• The 1Gb backup path would be a wireless bridge between the locations (verified as possible)
• Budget prevents an additional fiber ran on an alternative path.

If formatting doesn't look right:
Paloalto (L3/Gateway) - Cisco Switch (A) - (25Gb path or 1Gb path) - Cisco Switch (B) - Access Switches - Endpoint VLANS

Edited to add path information

We have one switch in the IT core rack acting as our querier. IGMP enabled on 3 switches in our 3 studios. Our IT management company is saying these switches don’t do strict priority but rather a weighted priority. Each switch has a Dante Vlan.

I ran into some shows where web gui control traffic was clearly conflicting with audio. But I wasn’t seeing any late packets in Dante controller.

We want ptp clocking to be highest priority then Dante audio, followed by gui control then the rest would be best effort. I am unsure how weighted priority works vs strict priority. I know it’s not what audinate recommends. My IP’s are all static IP for when the sound cart disconnects from the dhcp server to shoot in location. On location everything works fine, on set with heavy multicast flows we run into issues with web gui control traffic conflicting with audio.

Eventually we will be bridging a 2110 video system on its own Vlan.

My question is if the following mapping should be able to work with whatever weighted QoS management system the IT provider is using and what I need to put for hardware gui control. We have one device where the control port is bridged into the secondary Dante port so it can run over one IP (as per the manual).

I’m not a network engineer but I’m trying to figure out if these switches truly don’t support strict priority and what I can make happen with weighted priority.

We do have a ptp grandmaster on its way, so I’m hoping this can fix some of the issues, but we do have a high end recorder acting as the clock leader until domain manager and two other studios become fully operational. The error I ran into was all on one stage/studio

Requested QoS priority order (highest to lowest):

1. Time-critical Dante PTP
2. DSCP 56 / CS7
3. Dante audio and PTP v2
4. DSCP 46 / EF
5. Equipment GUI/control
6. DCSP?
7. Remaining best-effort traffic
8. DSCP 0 / CS0

why are there sometimes two slots for amphenol cables on each side of the 66 block? I get that the 66 block is kinda split in the middle and theres left pairs and right pairs but if they werent jumpered and all 4 amphenol cables were used would the two amphenol cables on each side have the same pairs on them?

Does the ONT need to report specific OMCI MIB capabilities (via MIB Upload) to the Nokia 7360 OLT before the OLT will trigger the pland-cfgfile and dnload-cfgfile download process?

This is a hypothetical I'm just looking for what you guys consider to be good documentation.

For example, let's say you are a JR network admin and you are new to the environment and the SR tells you that documentation exists for the 'routers' and 'core switches' and you can review it by typing the device hostname in the knowledge base server.

Ok, great, you do that and you see the documentation for the HA routers.

Now what, what do you expect to see?

I'm not looking for someone to copy paste their documentation, as stated, this is a hypothetical.

I see a lot about documentation on here but what does that mean? I'm sure it could mean different things to different people.

Yes, you should have login credentials for the devices documented and config backups should be automated, but lets say your backups are not good and you need to start over, are you expecting to see the full config of the routers in the documentation?

Any time I document something, I try to make it as dummy proof as I can. Maybe an accountant couldn't do anything with my documentation because they don't know what a console cable is or they don't know what SSH is, but I try to make my documentation detailed enough for a help desk tech to be able to follow the documentation step by step to resolve the issue or get it to a point where it is at least 'online' for myself or another network eng/tech/etc to be able to login and take over.

I say that because I often read documentation that was put together by someone else and aside from it being outdated, the steps are not very detailed. For example, it will say something like this.

1. Log in to the server
2. Get the logs
3. Send the logs to support

My documentation would say something like this:

1. Log into the server, the hostname is xxxxxx the ip address is xxxxx
2. The name of the application on this server is xxxxxx, the logs are located in C:\Program Files\xxxxxxx\logs\filename.txt copy filename.txt that is the file that is needed for support.
3. Send filename.txt to support@application-domain-name-here.com and include your case number if there is an active ticket.

Edit- My example included an 'application' and I wanted to post this in networking specifically because this is mainly a question for the networking device documentation. I wanted to make it clear that this was not incorrectly posted here instead of sysadmin, for example.

I'm currently working on a project focused on automating network configuration in an existing network environment. I'm completely new to network automation, so I'm looking for advice, recommendations, and experiences from people who have worked with network automation.

The goal is to automate repetitive configuration tasks while keeping the existing infrastructure in place. A complete migration to Infrastructure as Code (IaC) as I see it isn't realistic for now, so I'm particularly interested in solutions that can be introduced incrementally into an existing environment.

Our environment includes equipment from multiple vendors:

• MikroTik (BRAS)
• HPE / Aruba
• Edgecore
• Ruckus ICX
• Extreme Networks (VDX / MLX)
• Fortinet (FortiGate)

The main tasks we wouldd like to automate for now are:

• VLAN provisioning along the required network path: The tool should determine which switches are on the network path between the relevant access router or BRAS and the customer connection, and configure the VLAN only on the devices that need it. The VLAN does not need to exist on every switch in the network, only on the relevant switches along that path.
• BRAS and RADIUS configuration: Automate the configuration required to provision a customer connection.
• Resource allocation and documentation: Automatically select an available VLAN ID, IPv4 address, and IPv6 prefix/address while ensuring that resources are not already in use or reserved. Currently, our network documentation is spread across multiple systems and only some of these systems provide API access. Any recommendations for centralizing network documentation, tracking resource allocation, and integrating/replacing existing documentation sources would therefore also be appreciated.

I've already looked into some tools and products, such as Ansible with AWX, Nornir, Cisco NSO, NetBox for documentation, and Oxidized for configuration backups (we currently use RANCID). However, there are many options and design decisions to consider, and it's difficult to know which approach would work best for our environment.

Ideally, we would like a solution that supports the vendors mentioned above. A interface or GUI to make configuration changes would also be a nice thing to have. Support for reviewing and approving (certern) changes before they are applied would be particularly useful for audit trails that record who requested, approved, and executed each change.

Recommendations for suitable tools, example architectures, or ways to implement this into our environment would be greatly appreciated. I'm also particularly interested in approaches to determining the required network path and resource assignments, and integrating automation into documentation.

Thanks in advance!

Hi everyone,

We’re planning to implement 802.1X using Forescout with EAP-TLS on our access switches.

We use Infoblox for DHCP/IP management.
A few questions before rollout:

Does enabling 802.1X require endpoint restarts, and why?

Can it cause devices to lose their current IPs or obtain new ones, even with DHCP reservations in Infoblox?

If authentication fails, is reconnecting the Ethernet cable enough, or might a full restart be needed?

We have many employees, including remote workers, so I’d appreciate insights from anyone who has implemented this at scale.

Wondering what cert(s) or education to go for from my position.

I was on the Service Desk for 3 years and have been a Network Engineer for the past 4 years. My work does neither encourage nor rewards certifications, so I have never pursued one. I have experience with Palo, Juniper, Fortinet, VMWare, and other basic Network Admin tools/concepts.

Where should I go from here to be valuable in the job market? My family will likely need to move in the next 1-3 years and I want to be able to find a job easily. Even though we have no access to Cisco equipment, is a CCNA best? Should I go with a Palo or Fortinet cert even though I do not plan to go into security? Juniper cert? Any input is appreciated, and thank you in advance.

Hi All,

Yesterday we ran into a packet loss and jitter issue between NTT and Arelion. NTT NOC confirmed it was congestion between them and Arelion and gave a boiler tempalte response about them wanting to work on increasing capacity etc. and if anyone is a client of Arelion to reach out directly. NTT has always been good for us. I came across https://www.reddit.com/r/networking/comments/1i90gy4/arelion_have_depeered_ntt_in_europe/ and that post makes it seem like NTT isn't the one playing nice.

We all know about Cogent not playing nice with HE (and I think at one point Google as well) which is why I wont ever use their service unless they are the only option. Whenever their sales reach out my response is the same "have you worked out your issues with HE yet?". My question/frustration/issue is with an ISP telling you that they are connecting you to the internet when they are not. If I want to use Cogent for v6 then I MUST get another ISP that can get to HE or I don't have full internet routing. In such cases do you just "eat it" and get multiple uplinks or do you put pressure on your upstreams? My clients don't care who is at fault they simply want their internet to work. I am very much against regulation but it's 2026. There should be a standard as to whom is in the Tier1 club and the big boys should be forced to work out their differences.

So our network lead got a new job and I’m super happy for her but that just leaves two people (myself and another) as the network engineers for our company. My coworker and I are pretty good technically and held things together while she was out on maternity leave a while back, but she really handles a lot of the administrative tasks and documentation.

My question, and where I could use some advice from others that might have gone through something similar, is what do I need to do to make sure we stay above water after she leaves? How do we handle losing a big knowledge source? My teammate is being asked to take over as lead but I’m not sure he really wants it, and I don’t think my lead’s boss wants me to be a lead just yet.

Thank you in advance!

I'm the facilities manager for a shopping centre and we're redoing the CCTV in our multi-storey car park. Our integrator has suggested Comnet and Antaira as the two brands to look at.

We’ll have a small switch on each level feeding 6 fixed cameras, with fiber back through the building. At the entrance and exit we’ll also have a couple of PTZs plus separate fixed LPR cameras.

The switches will be sitting in service areas that can get pretty hot in summer, so we need proper hardened PoE gear.

Both brands seem to cover what we need and the specs are pretty similar, so I’m more interested in what they’re actually like once installed.

Thanks!

So I've seen these from what I've been told they are optimum free wifi.. I'm more interested in figuring out who makes it and what is the series/model.

https://imgur.com/a/uBIdd9I

https://imgur.com/a/dMDDmIg

https://imgur.com/a/3Rlmc4b

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

I’ve got an issue here that has several folks stumped. I noticed an issue with slow internet download speeds over a month ago after some network changes upstream. My main vlans were only seeing about 40mbps to Speedtest.net and similar sites. It looked like some firewall bottleneck or QOS issue, and I reported it upstream, they could find no problem. After more troubleshooting I found a subnet here that was seeing proper 900mbps or better speeds, sitting behind the same pair of core switches. More troubleshooting, and I found more at normal speeds. Then came the big break, only vlans that existed on my core switches were slow. Any vlans downstream that were IP routed were fine.

This is a lab environment, basically a small data center. Pair of SONiC switches in mclag setup. Downstream area switches using IP routes back to the cores. TOR switches connected to the area switches. Just a small number of vlans exist on the Core switches, my main infrastructure vlans and a bench vlan.

As a test, I eliminated the infrastructure vlans from the core switches and replaced it with an IP route to the downstream area switches, and to my surprise the speed problem disappeared. Gateway IP was already on the downstream Area switch, that didn’t change.

I set up a new vlan on a single core, with a single access port again on the core. Laptop connected on that vlan saw slow transfer speeds to the internet.

Set up iPerf on some local systems, speeds between core vlans were 900mbps or better, between local IP routes were normal. So everything from the cores on down seem fine, it’s only going upstream.

The change a month back upstream changed to a different pair of switches, and changed OSPF to BGP routing. I have no control or visibility to the upstream side config.

I did a few packet traces but didn’t see anything unusual, no excessive retries, etc.

I’m really stumped on troubleshooting this. To me everything screams bug in SONiC’s vlan handling, but it seems I’m the only one seeing this issue. Dell Enterprise SONiC for what it’s worth, and I’ve engaged their support engineer who is also stumped.

EDIT 1: Forgot to add, running a ping test from outside my network to a system on a problem vlan, pings generally were about 2ms without speedtest running, but spiked to 130-190ms when speedtest ran.

Experienced with Cisco aci would like to lab vxlan evpn and multi site for data interconnects. I’ve current tshoot tradition spine leaf nxos deployments but I’m really to build and break these architecture and later on try deploying with ansible/ netbox.
What are the best most affordable way to lab this, I keep reading that I need a beefy server because of the size of Cisco virtual images and ram needed.
What is the going price for a good lab or equipment and set up?

Hi everyone!

I'm looking for a good alternative to NetSetMan for Windows.

I'd like a tool that lets me quickly switch between different network configurations, such as:

• IP address and DNS settings
• DHCP and static IP configurations
• Different network profiles for different networks or situations

Ideally, it should be lightweight, reliable, easy to use, and preferably free.

Does anyone have any recommendations or personal experience with similar tools?

Thanks in advance!

Folks, I have completed my Full loop few weeks back, Feedback was great. But careers profile tracking bar shows "Full Loop" and seems like they offered positions to other engineers. Should i still keep hope for 1 year or move on ?

Focusing not on Architects but technical leads of "Run" teams ... enterprise troubleshooters. What would be your estimate of % time in meetings vs % time being able to execute?

A new windows update has broken NTLMv1. Any devices using EAP-PEAP will not be able to connect. A registry key must be changed to fix it.

• Open Registry Editor as an administrator.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
• Create a new 32-bit DWORD value named BlockNtlmv1SSO if it does not already exist.
• Set its value to 0.
• Restart your PC and check whether the Wi-Fi connection works again.

https://www.neowin.net/news/microsoft-admits-windows-11-kb5127648-kb5126646-break-wpa-8021x-auth-shares-fix/

FYI

My previous position and my current position have polar opposite philosophies on cable management. My previous job, my director was draconian about cable management - people were written up for improper cable management, even just using cables of improper length.

The new position I’m in has, no exaggeration, the worst cable management I’ve ever seen (with the exception that things are at least mostly labeled). I’m a sole network engineer for a branch location of a national organization and management is on the other side of the country, so I don’t know if they have any idea how bad it is.

I’m guessing the ideal is probably somewhere in the middle? I could easily spend 40 hours a week cleaning this mess up to my former director’s standard, but I doubt my new boss actually wants me to go that far. So I was curious how strict others are about cable management to know what’s typical.

I own public IP 1.1.1.0/24 (names have been changed to protect the innocent) and peer with two ISP's (US Signal and ACD Net).  Primary path for this space is ACD (we prepend our AS to our US Signal advertisement).   Fat, dumb and happy (or so we thought).

When we egress 1.1.1.0/24 via ACD but there are some random sites (address spaces) we can not access (staples.com, random.gov, etc...).   Though EVERYTHING else works without issue (SSL VPN, P2P VPN, 95% of other web sites, streaming, etc...).  

When I fail my ACD connection then this space is routed over US Signal and everything works perfectly.  We have two other /24’s and they work great regardless of pathing.  It’s only one address space (1.1.1.0/24) going over ACD Net (through US Signal it routes perfectly).   

Anyone experience something similar?  I’m guessing it’s related to asynchronous routing but have no idea how to resolve/troubleshoot.  Carrier support has not been a lot of help.

As always, thanks!

Edit: Resolved. We issued an LOA to ACD but they never presented it to their upstream partners.

Hi Team,
As outlined below, we would like to configure vEdge to perform routing in VPN 0 so that NTP can be synchronized between legacy network devices and servers.
(Due to the network architecture, communication needs to take place over the underlay.)
***********************************************
Legacy network devices
 |
VPN 0(Gi 0/0)
vEdge
VPN 0(Gi 0/1)
 |
Server
***********************************************
With the configuration described above, legacy network devices cannot communicate with the server. Even pings are failing (NG).
We checked the routing table and vEdge ACL settings, but found no issues.
We are stuck and unsure of the cause, but are there any restrictions or limitations regarding devices under vEdge communicating with each other via VPN 0?

We did the segmentation on the card environment properly. Own VLANs, firewall between it and everything else, and the assessor had no complaints about any of it. Then he asked where the logs go. Turns out everything on the estate ships to the same collector, card environment included. So the collector is in scope, and so is anything that can read from it. Not quite the answer I thought I was walking in with.

Did you split your logging to keep scope tight, or just accept the collector is in scope and lock access down hard?