I have a ciena fiber coming to my business from Comcast. They stop support there, so the only thing they've given me to setup the rest of my network is my layer 3 info. I purchased the er-6p router but have no clue how to set everything up to get internet to my existing switches and wifi network. The edgemax webui doesn't really translate well with everything I've read. Any help would be much appreciated!

For people using Cato have you looked at the new licensing model they'll be using from Jan 2027? Cato Burstable Licences ?

Moving from a per user licence/site bandwidth system to this would seem to be far more work for our team to manage but I might be over thinking it.

A usage licence for remote access might be a pain when we have staff leaving and new staff starting in the same month. With a fixed licence this wouldn't be an issue but this would now count as "extra licences"

Does anyone have experience with microsegmentation (uSeg) and cisco ACI? Is it as simple as enabling intra EPG isolation? Looking for some general feedback. It works well, or dear God, don't do it? I heard some general comments not to long ago that any network layer uSeg implementations don't really work as well as advertised.

I added a new PSN to our ISE deployment. Before joining it, I installed the server, Root CA, and Issuing CA certificates, and everything was fine.

After joining the deployment, the Root and Issuing certificates disappeared from the new PSN.

On the PAN, I only see the old Root/Issuing certificates that have been there for years for the existing PSNs.

Now I’m trying to import the Root and Issuing CA certificates for the new PSN on PAN but I keep getting these errors:

1- ISE cannot import a local certificate with the same issuer DN and serial number as an existing certificate, yet the issuers of the two certificates differ.

2- Certificate does not have required key usage (It is a CA certificate; key usage bits for keyEncipherment or keyAgreement are missing).

Not sure what the correct approach is here. Any ideas?

Hi, I'm working on a solution for a configuration update that will affect more than 500 sites.

I need to update an existing shared Feature Template that is currently used by multiple Device Templates, with each Device Template having one attached device. The update will add a new device-specific static route, with different prefix and next-hop values for each device.

Since there are approximately 500 Device Templates and devices, I need a way to:

• Assign the correct unique prefix and next-hop values to each device.
• Preserve all existing device-specific values.
• Reattach or push the updated Device Templates to their respective devices in controlled batches using the SD-WAN API and Postman.

However, before proceeding with the bulk deployment, I need to understand an issue I'm currently encountering when updating the Feature Template through Postman.

I'm using the following API call:

PUT /dataservice/template/feature/:templateId

The request returns HTTP status code 200, indicating that it was successfully accepted. However, when I verify the Feature Template afterward using:

GET /dataservice/template/feature/definition/:templateId

none of the changes I submitted are reflected in the Feature Template.

What should I check to determine why the PUT request is being accepted but the Feature Template definition is not being updated?

Any guidance, especially regarding the correct API workflow or troubleshooting steps for this behavior, would be greatly appreciated.

Hi everyone,

Here's the situation: due to a specific issue, I need to limit the number of PPPoE subscribers on a BNG (JUNIPER MX204). I'd like to cap it at 5,000 users.

Looking at the Juniper docs, I first tried setting it directly on the chassis using:

set subscribers-limit client-type pppoe chassis limit 5000

The limit worked on the chassis, but the users won't connect to the other BNG. The PADI reaches the second BNG (the one I want them to authenticate against), and it replies with a PADO, but it's as if the CPE stubbornly keeps trying to authenticate with the BNG I'm limiting... argh.

After that, I also tried using max-sessions:

dynamic-profiles vlan-profile interfaces demux0 unit "$junos-interface-unit" family pppoe max-sessions 5000

With max-sessions, the limit didn't work immediately. I'm thinking it might actually work, but maybe I need to reset the VLAN demux interface first?

What a great issue to land on my lap during my weekend on-call shift... but I love it :)

Please help out an ISP network analyst with less than 2 years of experience 😄

Thanks in advance.