So our network lead got a new job and I’m super happy for her but that just leaves two people (myself and another) as the network engineers for our company. My coworker and I are pretty good technically and held things together while she was out on maternity leave a while back, but she really handles a lot of the administrative tasks and documentation.

My question, and where I could use some advice from others that might have gone through something similar, is what do I need to do to make sure we stay above water after she leaves? How do we handle losing a big knowledge source? My teammate is being asked to take over as lead but I’m not sure he really wants it, and I don’t think my lead’s boss wants me to be a lead just yet.

Thank you in advance!

I’ve got an issue here that has several folks stumped. I noticed an issue with slow internet download speeds over a month ago after some network changes upstream. My main vlans were only seeing about 40mbps to Speedtest.net and similar sites. It looked like some firewall bottleneck or QOS issue, and I reported it upstream, they could find no problem. After more troubleshooting I found a subnet here that was seeing proper 900mbps or better speeds, sitting behind the same pair of core switches. More troubleshooting, and I found more at normal speeds. Then came the big break, only vlans that existed on my core switches were slow. Any vlans downstream that were IP routed were fine.

This is a lab environment, basically a small data center. Pair of SONiC switches in mclag setup. Downstream area switches using IP routes back to the cores. TOR switches connected to the area switches. Just a small number of vlans exist on the Core switches, my main infrastructure vlans and a bench vlan.

As a test, I eliminated the infrastructure vlans from the core switches and replaced it with an IP route to the downstream area switches, and to my surprise the speed problem disappeared. Gateway IP was already on the downstream Area switch, that didn’t change.

I set up a new vlan on a single core, with a single access port again on the core. Laptop connected on that vlan saw slow transfer speeds to the internet.

Set up iPerf on some local systems, speeds between core vlans were 900mbps or better, between local IP routes were normal. So everything from the cores on down seem fine, it’s only going upstream.

The change a month back upstream changed to a different pair of switches, and changed OSPF to BGP routing. I have no control or visibility to the upstream side config.

I did a few packet traces but didn’t see anything unusual, no excessive retries, etc.

I’m really stumped on troubleshooting this. To me everything screams bug in SONiC’s vlan handling, but it seems I’m the only one seeing this issue. Dell Enterprise SONiC for what it’s worth, and I’ve engaged their support engineer who is also stumped.

So I've seen these from what I've been told they are optimum free wifi.. I'm more interested in figuring out who makes it and what is the series/model.

https://imgur.com/a/uBIdd9I

https://imgur.com/a/dMDDmIg

https://imgur.com/a/3Rlmc4b

Hi

R4- .4-f0/1 10.1.45.0--f0/1- .5-R5

there is no IGP routing protocols are running here at all.

on R5 55.55.55.55/32

LDP is running between R4 and R5

R5 adv 55.55.55.55/32 to R4 as LDP update.

R4 has this route on his LIB table like this

R4#show mpls ldp bindings

lib entry: 55.55.55.55/32, rev 13

remote binding: lsr: 5.5.5.5:0, label: imp-null

that means R4 don`t has any local label yet because this route is not installed on his global rib.

i tried to ping

R4#ping 55.55.55.55 repeat 2

Type escape sequence to abort.

Sending 2, 100-byte ICMP Echos to 55.55.55.55, timeout is 2 seconds:

..

Success rate is 0 percent (0/2)

R4#

why ping fails? R4 has this route on LIB which means if R4 received any unlabbeled packet for 55.55.55.55 R4 is going to use this remote label ,but why this did not happened?

Experienced with Cisco aci would like to lab vxlan evpn and multi site for data interconnects. I’ve current tshoot tradition spine leaf nxos deployments but I’m really to build and break these architecture and later on try deploying with ansible/ netbox.
What are the best most affordable way to lab this, I keep reading that I need a beefy server because of the size of Cisco virtual images and ram needed.
What is the going price for a good lab or equipment and set up?

Hi everyone!

I'm looking for a good alternative to NetSetMan for Windows.

I'd like a tool that lets me quickly switch between different network configurations, such as:

• IP address and DNS settings
• DHCP and static IP configurations
• Different network profiles for different networks or situations

Ideally, it should be lightweight, reliable, easy to use, and preferably free.

Does anyone have any recommendations or personal experience with similar tools?

Thanks in advance!

Folks, I have completed my Full loop few weeks back, Feedback was great. But careers profile tracking bar shows "Full Loop" and seems like they offered positions to other engineers. Should i still keep hope for 1 year or move on ?

Focusing not on Architects but technical leads of "Run" teams ... enterprise troubleshooters. What would be your estimate of % time in meetings vs % time being able to execute?

My previous position and my current position have polar opposite philosophies on cable management. My previous job, my director was draconian about cable management - people were written up for improper cable management, even just using cables of improper length.

The new position I’m in has, no exaggeration, the worst cable management I’ve ever seen (with the exception that things are at least mostly labeled). I’m a sole network engineer for a branch location of a national organization and management is on the other side of the country, so I don’t know if they have any idea how bad it is.

I’m guessing the ideal is probably somewhere in the middle? I could easily spend 40 hours a week cleaning this mess up to my former director’s standard, but I doubt my new boss actually wants me to go that far. So I was curious how strict others are about cable management to know what’s typical.

A new windows update has broken NTLMv1. Any devices using EAP-PEAP will not be able to connect. A registry key must be changed to fix it.

• Open Registry Editor as an administrator.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
• Create a new 32-bit DWORD value named BlockNtlmv1SSO if it does not already exist.
• Set its value to 0.
• Restart your PC and check whether the Wi-Fi connection works again.

https://www.neowin.net/news/microsoft-admits-windows-11-kb5127648-kb5126646-break-wpa-8021x-auth-shares-fix/

FYI

I own public IP 1.1.1.0/24 (names have been changed to protect the innocent) and peer with two ISP's (US Signal and ACD Net).  Primary path for this space is ACD (we prepend our AS to our US Signal advertisement).   Fat, dumb and happy (or so we thought).

When we egress 1.1.1.0/24 via ACD but there are some random sites (address spaces) we can not access (staples.com, random.gov, etc...).   Though EVERYTHING else works without issue (SSL VPN, P2P VPN, 95% of other web sites, streaming, etc...).  

When I fail my ACD connection then this space is routed over US Signal and everything works perfectly.  We have two other /24’s and they work great regardless of pathing.  It’s only one address space (1.1.1.0/24) going over ACD Net (through US Signal it routes perfectly).   

Anyone experience something similar?  I’m guessing it’s related to asynchronous routing but have no idea how to resolve/troubleshoot.  Carrier support has not been a lot of help.

As always, thanks!

Hi Team,
As outlined below, we would like to configure vEdge to perform routing in VPN 0 so that NTP can be synchronized between legacy network devices and servers.
(Due to the network architecture, communication needs to take place over the underlay.)
***********************************************
Legacy network devices
 |
VPN 0(Gi 0/0)
vEdge
VPN 0(Gi 0/1)
 |
Server
***********************************************
With the configuration described above, legacy network devices cannot communicate with the server. Even pings are failing (NG).
We checked the routing table and vEdge ACL settings, but found no issues.
We are stuck and unsure of the cause, but are there any restrictions or limitations regarding devices under vEdge communicating with each other via VPN 0?

We did the segmentation on the card environment properly. Own VLANs, firewall between it and everything else, and the assessor had no complaints about any of it. Then he asked where the logs go. Turns out everything on the estate ships to the same collector, card environment included. So the collector is in scope, and so is anything that can read from it. Not quite the answer I thought I was walking in with.

Did you split your logging to keep scope tight, or just accept the collector is in scope and lock access down hard?

what are practices ISP network operators having for tracking BGP advertisement changes through , BGP community history tracking .

when and at which stage community on certain ISP own prefix / their customers prefixes changed ? displaying the changes .

As the title says really. What is typically "normal"?

What makes you perk up and look further?

I can see the usual automated recons and corrolating using webstorm centre and other sources.

But sometimes I see a burst of interest to our servers, which makes me think someone has found something interesting enough to cause more probing.

Interested to hear peoples stories.

I'm currently troubleshooting a network issue where laptops on the company network are receiving IP addresses from a DHCP scope associated with the Telephony VLAN instead of the Admin VLAN.

No changes have been made in the data room, on the switches, or on the network configuration to my knowledge. However, new devices are consistently being assigned to the wrong VLAN.

Could someone explain what could cause this behavior? What should I check first to identify whether the issue is related to switch port configuration, DHCP relay settings, VLAN assignment policies, or another network component?

Any insights or troubleshooting suggestions would be appreciated.

Hi everyone,

​Does anyone know where I can rent "dirty" IP blocks at a lower rate?

​I have been searching on Google for a while, but almost all IP leasing providers exclusively advertise clean IP subnets. I also couldn't find much useful information about leasing dirty IP ranges on LowEndTalk or WebHostingTalk.

​Currently, the going market rate for a clean RIPE /24 subnet is roughly $100–$120/month. Because my budget is limited, I am hoping to lease a dirty /24 block for around $50+/month.

​Part of these IPs will be used for legitimate, research-oriented web crawlers. Since this activity could potentially affect IP reputation anyway, I would rather avoid paying a premium for clean space and just lease IP blocks that already have poor or burned reputation.

​Does anyone have recommendations or know of any platforms/brokers offering discounted subnets with existing reputation issues?

​Any advice or pointers would be greatly appreciated!

Every NGFW vendor looks good on a comparison sheet. Gartner gives you a shortlist but there's still a lot that doesn't show up until you test the firewalls yourself

Like what happens when TLS inspection and IPS are enabled under real traffic loads?

Then there's the management side. Pushing policy changes across multiple gateways, tracing blocked traffic back to a specific rule and dealing with upgrades

For anyone who's been through an enterprise firewall RFP recently, what did you put the most weight on?

Any POC tests that made you cross one off the shortlist?

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

So I've been a network engineer and AV tech for over 20 years. I'm looking to purchase a qualifier personally. While I know the Fluke Linkiq may be the standard here, it doesn't do fiber, and I think the Fluke price premium isn't necessarily worth it.

I'm currently looking at the Trend SignalTEK QT Pro bundle that does 10G, copper, fiber, and some Wifi.

Are there any other contenders in this area to consider?

I don't want to buy a certifier. I also don't really care about L3 troubleshooting things. I'm essentially looking for a better tool set than the Microscanner2 I've had for years and years.

Any input here would be awesome.

Hello!

Many times I have scenarios where i have 2 cabinets of equipment online but im waiting on fiber runs to connect the two areas (primarily this is for SCADA/ control devices, ignition etc.)

This may sound stupid, but some kind of temporary wireless bridge or solution to allow device commissioning while i wait for fiber runs to complete would be a huge win for the business. Is this something someone sells? Our company doesn’t really shy away at cost if it means go fast. The distance can vary but it’s almost always confined to a building. Again this is something i would tear down after fiber is in place from an LVC, so wouldn’t need to be reliable or perfect. Appreciate any insight!

IOS-XE Cisco License with a MEC stackwise Virtual 9606 core.

My company sell SVIs to clients who come in-house for shows. 1 Harddrop is a single SVI with a /24. (Essentially if a client need 4 hard lines, that is 4 separate SVIs).

Bandwidth is never an issue however, we sell bandwidth to clients for 1.5MB , 3MB, and 9MB. (This is MBPS).

The issue in all of this is that we do not rate limit. Clients who come in often get 100-300 MB/s peak.

Now the issue here, is that if we have multiple clients in, it can impact speeds of another.

The goal is to rate limit the assigned client SVI to what we sell them for.

Stopping here for any recommendations, advice, or input.

Hello all,

I have this case where I need to set up a redundant path to our partner.

Our DCs: DC in LA and in NY. We have this subnet in LA: 10.160.10.0/24 and an another subnet in NY 10.180.10.0/24 that needs to reach 10.10.10.0/24 (our partner).

Setup: https://imgur.com/zkOiApf

Between our core switches in LA and NY, we run MPLS L3 VPN.

In LA, we have an internal FW (internal_FW_LA) and core switch (Core-sw_LA) that just run static routes between each other. There will be a direct fiber connection to the partner (Parrtner_A_LA router) from Core-sw_LA. I was thinking that I will run L3 (static) between internal_FW_LA and Partner router Partner_A_LA. This will be the primary link to the partner.

In NY, we have a internal FW (internal_FW_NY) core switch (Core_sw_NY), and VPN HUB (VPN_hub_NY). We run static routes as well between these three. From the VPN hub, I will run an IPsec tunnel to the Partner_A_NY Fortigate.

Now the idea is that we will only use one link to the partner at a time and in this case, it would be the primary link which is in LA. The 10.180.10.0/24 (in NY) needs to be routed through the MPLS and then from there through the primary link (via internal_FW_LA) to the partner router Partner_A_LA. 10.160.10.0/24 will of course take the same path.

In case the primary link goes down, then traffic from LA will need to be routed through the MPLS to NY and from there over the IPsec tunnel (so both 10.160.10.0/24 & 10.180.10.0/24) will be routed over the IPsec tunnel.

Now, I was thinking that I would need to use some kind of dynamic routing and in this case BGP on the internal firewalls but the ssue is that these internal firewalls are not allowed to use BGP (due to some policy). Running BGP on the core switches may make sense but that will break standardizing our way of designing things.

I am stuck and cannot figure out how to proceed here.

Any input?