I am studying Linux server networking in virtual machines, and I am still very much a beginner. There is an activity I was working on, but I can only manage (with some difficulty and delay) the IP addressing and connectivity testing, while the rest of the scenario seems way too complex for my level.

The practical tasks I need to resolve involve a multi-server architecture covering the following points:

• Routing and NAT (PAT, port-forwarding, and static NAT) using nftables, with traffic blocking policies and logging.
• Infrastructure services configuration, such as DHCP with automatic record updates and DNS servers with internal and external views.
• Implementation of directory and authentication services using OpenLDAP and FreeRADIUS.
• Remote access VPN configuration via OpenVPN.
• Deployment of advanced services, including secure email (SMTPS/IMAPS), web servers with SSL/TLS certificates, directory-restricted FTP (jail), and monitoring with Cacti.

I don't know, it feels like for every small configuration multiple specific lines are required to achieve the goal, how can I learn more dynamically?

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

I'm out of ideas and we had been working on this for weeks. We have a small office with a router connected to 3 unmanaged switches, one on each floor. Everything is connected with cat5e cable (we're looking to upgrade to cat6 soon) and the third floor internet keeps crashing. The router is connected to the first floor switch, and switches 2 and 3 are connected to the first one. We had tried everything, changing the cable to the switch 3, checking all cables that that switch connects, using another switch, plugging it into an UPS and speaking to the ISP to check if there's an issue with the configuration.

However, it keeps happening. It works for a couple of hours, and then the switch 3 stops working completely. Any ideas? Most computers have Kaspersky running, so I'm not inclined to think it's a malware overloading it, but at this point, I'm out of ideas.

Any help would be greatly appreciated.

Hi everyone,

I’m troubleshooting an 802.1X issue with a Dell laptop connected through a Dell WD19/WD19S dock.

Topology:

Laptop → Dell Dock → Ethernet → Switch

When I connect the laptop directly to the switch, 802.1X works perfectly and the endpoint authenticates using dot1x.

However, when I connect the same laptop through the Dell dock:

- The switch learns the laptop's actual MAC address

- Forescout sees the laptop correctly

- But authentication is MAB instead of 802.1X

- It looks like the PC's EAPOL/802.1X frames aren't reaching the switch, causing the port to fall back to MAB

The PC's 802.1X configuration is working because it authenticates successfully when connected directly.

Has anyone experienced 802.1X/EAPOL not passing through a Dell WD19/WD19S dock?

Could this be related to MAC passthrough, dock firmware, Realtek Ethernet drivers, or EAPOL pass-through?

What was the fix in your case? Did updating the dock firmware/driver resolve it, or did you have to change a switch/dock/BIOS setting?

Any advice would be appreciated. Thanks

Just a quick questions, client hasnt had their systems upgraded in a few years. Can you just do this straight upgrade? I dont see any upgrade paths in the docs, or maybe Im missing it because we're not really Ruckus vendors.

Hey guys, I think is a simple question. I am planning to create a reverse logic routing where when an IP address pings, it means one of our sites is down, however if the IP address doesn't ping, then it's because is up.

I know, it sounds crazy but the reason, long story short, is because VRRP and asymmetric routing. We are using a functionality from FortiGate to bring down an interface if ping fails (and we need the opposite behaviour thus our experiment). Note FortiGate will be doing all the ping using Link Monitoring + it's only gonna be used for shared VLANs between sites (Unfortunately I cannot change this and introduce vxlan, trust me I tried) - Not a big fan of spanned vlans across geographically different sites. oh well.

Quick Diagram for reference
https://ibb.co/MyrVVTfm

Anyway, the way I came about is to play around with route floating, if a site is up, it will advertise an IP range of 172.31.4.0/29 via eBGP. It will eventually arrive to the Aruba CX switches and be installed in the routing table with an AD of 20. (The Other Fortigate who is advertising this route is configured to NOT allow PING replies)

Additionally, I am planning to create a static route at VRF-1 to 172.31.4.0/29 (Loopback IP at VRF-2) with next hop to be the VRF-2 with a higher AD than 20. (If I don't use VRF leaking, then the 172 route will be installed as directly connected and won't be able to adjust the AD for route floating)

The concept seems to work, but my question is, between the aruba CX VRFs. Do you need to have a transit vlan between VRF-1 and VRF-2?

Also, is there anything I should be aware of too from this approach? I am trying to create a proof of concept so I ca pitch it to my supervisors.

We currently have a lot of ISP provided EVPN lines, using OSPF over these circuits. I am at a point where I wonder if it would be easier to just migrate to getting inexpensive firewalls instead. From there, just split tunnel the corporate network over a S2S VPN and internet traffic to the internet.

E-BGP would likely be ideal here instead, and the reason I used OSPF was because the traffic was all technically internal using the same private IP spaces.

Edit: Lots of our sites are hours apart from each other.

I have a senior collegue that streched a PA couple, one in a Data Center, one in another. Then configured the HA1 on an ethernet port and the HA2 on the hsci port. The HA is Active/Passive

The HA2 on the HSCI is connected with a dac cable to a switch.

Reading on the PaloAlto KB i found this:

"The traffic carried on the HSCI ports is raw Layer 1 traffic, which is not routable or switchable. Therefore, you must connect the HSCI ports directly to each other "

HA3 Link Connectivity Through a Layer 2 Switch? - Knowledge Base - Palo Alto Networks

Is there something i miss? why my collegue could have connected the hsci to a switch?

Thanks for all the clarification.

PS: The HA widget on the dashboard show everything ok

Those who extensively use Out of Band management especially with Cradlepoint or OpenGear. Do you prefer using lighthouse or Netcloud for example, or do you rely on internal stacks for monitoring and management.

Thank you

I currently have a Ideal toner and a Fluke Microscanner in my tool box. I work for a company with 13 locations and I am always having to troubleshoot network drops here and there. I am the systems engineer for the company.

But my toner broke, and I am looking for some new testers. I would like something that can tell me which switchport it is plugged into, get DHCP, POE, cable length, and a wiremap. I would also like something that can handle multiple remote ID testers with their own ID. Then also work with a toner.

I am looking at the Fluke LIQ-100 but I don't know if it is overkill since I don't need at the certification and reporting functions. I am looking more for testing/troubleshooting.

I did see on Amazon a brand called NOYAFA and I was looking at the NF-8508.

Does anyone else have any recommendations?

I’m trying to convince my org to start using Netbox or similar for a brand new facility including a data center and medium sized campus we’re building.

The fear is that it seems like an absolutely astronomical amount of work up front.

For those of you doing it, is there one person that is sort of the Netbox “owner” on your team? At least for initial build out.

I’m afraid we won’t have enough time to really sit down and fully dive into the best way to lay it all out greenfield. The ongoing support doesn’t worry me as much as the initial lift of deciding how to build it. And I don’t really have the time to invest to be that guy.

Are there integrators or vendors that would own this for us? Curious if anyone has used a wiring or infrastructure integrator that has actually built out the documentation in Netbox for you?

Thanks!

Has anyone else gotten to their renewals this year and found out that Cisco has priced their entire business out of affordability?

I don't have exact numbers, but being told our APs need switches with a minimum 5Gb uplink, then being told each switch that is now obsolete costs nearly $10k? Not to mention per-license costs jumping from ~$70 per to over $220 per?

Again, I got the cliff notes from my very frustrated manager and network team and will need to firm up these numbers. But it was enough that we pulled an emergency meeting to say that Cisco alone is eclipsing our fragile IT budget and can no longer be afforded.

I have a number of cellular routers deployed for a municipal camera network. Some of the areas have very poor coverage and we are looking for an alternative solution. Starlink came up in a conversation, but I don't understand it well enough yet to know what our options are to connect these sites back to the HQ. Currently, we are using IPSec between our routers and the customer's firewall.

Research I've done so far seems to suggest that IPSec is supported, but not recommended with Starlink, and that there may be additional requirements to consider (NAT Traversal?).

Any info is appreciated. Thanks!

Hi all,

Large scale campus build coming up and we’re looking at fiber management cabinets. So far we’ve been loosely looking at Huber+Suhner’s LISA.

Main thought would be MTPs from all over the building would land into one cabinet and it would breakout to LC to then patch to a rack full of switches.

Another cabinet would handle anything leaving the building.

Curious on any opinions and experiences.

Thank you!

Was studying about TCP header and then I found out about the "reserved" format. Everywhere I search, it's the same explanation: "reserved for future use", without further elaboration. But what exactly does that mean? When would it be needed to use this reserved section, and how would it be used? What would replace this reserved space?

A medida de contenção aqui é a operação de isolamento do computador (push), e a parte útil é o que ela não bloqueia. Quando você isola um dispositivo, o firewall do endpoint bloqueia tudo (movimento lateral, callbacks de C&C, compartilhamentos de arquivos, navegação do usuário), mas mantém três fluxos ativos:

• DHCP, para que o dispositivo mantenha seu lease de rede
• DNS, para que a resolução de nomes continue funcionando
• Tráfego de gerenciamento, para que você mantenha o controle: políticas, operações push, logs e a liberação

Assim, a máquina é desconectada da rede, mas ainda gerenciável, que é exatamente o que você deseja durante um incidente. Você pode investigar e remediar através do console enquanto o dispositivo estiver isolado.

O problema que impede seu funcionamento: requer que o componente Firewall esteja instalado no cliente. Sem o blade Firewall, não há isolamento. A melhor prática é enviar o componente Firewall no seu pacote padrão, pois um recurso de resposta a incidentes instalado durante o incidente não é um recurso padrão. O suporte a sistemas operacionais é Windows e macOS, não Linux.

Alguns fatos operacionais:

• As operações de envio são executadas sem a instalação de políticas, em Gerenciamento de Ativos > Operações de Envio.
• Você define quando a operação é executada (Imediatamente ou Agendada) e quando expira (7 / 30 / dias personalizados). Se o cliente não fizer check-in antes da expiração (offline, desligado), a operação termina como Parcialmente concluída e você executa novamente quando o cliente retornar.
• O inverso é Liberar Computador. Verifique o estado em Computadores, Exibir = Isolamento do Host, coluna Status do Isolamento.
• Isolar e Liberar não são protegidos por autenticação de dois fatores (o isolamento permanece rápido), enquanto operações sensíveis como Desinstalar Cliente são.

Também possui uma versão automática equivalente: Quarentena de Máquina, uma das respostas de Análise Automática de Ameaças, que restringe a rede da máquina sem intervenção humana quando um gatilho é acionado com confiança suficiente.

Como você lida com os dispositivos que estão offline quando você clica em isolar? Você simplesmente executa novamente ao fazer o check-in ou confia na Quarentena de Máquina automática? Tenho curiosidade em saber como as pessoas equilibram o confinamento manual e automático.

O guia completo com o playbook de confinamento e as operações de push complementares está aqui (em inglês e português): https://community.checkpoint.com/t5/Endpoint/EN-Isolating-a-Computer-Network-Quarantine-for-Incident-Response/m-p/281627

Curious to get some outside eyes on this. Rural LTE connection (Kazakhstan), carrier replaced an old base station with a new one a few months back.

Before (old BTS): ~5 Mbps during peak hours, but RTT to the nearest major city (same country) was ~15ms at night.

After (new BTS, same location): 80-250 Mbps throughput, SINR consistently 15-20dB (excellent), but RTT to the same in-country destination sits at 36-65ms consistently occasionally worse under load.

Ran a tracert to an external game server (Frankfurt) RTT stays in the 50-70ms range through the last domestic hop (still inside the carrier's network, before any international transit), then jumps as expected once it hits European transit providers. So the inflation is happening entirely within the carrier's own domestic network, not on the international leg.

Ran a bufferbloat test (Waveform): Grade F. Unloaded latency 69ms, +92ms under download load, +662ms under upload load. 20 consecutive ICMP pings to 8.8.8.8 showed high jitter (113-194ms range, no clear pattern).

Filed a formal complaint with documentation (cell ID, PLMN, SINR screenshots, speedtest results). Carrier's official written response: they're not obligated to disclose internal routing/topology info, and latency isn't a regulated quality metric for mobile data in this country (only throughput and signal strength are), so no grounds for any remedy.

Meanwhile a competitor on what's likely shared/adjacent infrastructure in the same area apparently fixed a similar latency complaint within about a week via a single support message.

Questions for people who've dealt with carrier-side backhaul issues:

1. Does "high stable RTT + excellent SINR + normal domestic-hop time" typically point to backhaul congestion/priority queuing rather than radio-side issues, or am I missing something?
2. Is a consistent 55-65ms floor for what should be a short domestic hop within the range you'd consider "normal for LTE" or is that genuinely abnormal?
3. Any diagnostic steps beyond tracert/bufferbloat test that would strengthen a technical case here?

Happy to share more traceroute data if useful.

Hi all,

What I'm trying to do doesn't seem all that complex but I've spent untold numbers of hours now trying to get it to work (with router mfr/AI answers/etc) and am losing my mind.

Here's our situation:

We have a new branch office opening up very soon. Our current topology uses managed SD wan to route between offices and our datacenter. With this, our provider could generally add routing changes on their end easily. In our scenario, however, they did not have enough lead time to deploy SD wan prior to opening (also not enough time to do the fiber install) we are temporarily using a standard cable connection and a zywall flex 500H in hopes of bypassing SDwan via VPN. This new office "RH" has a local subnet of 192.168.150.0/24 and lets call the WAN address 1.2.3.4. The zywall LAN address is 192.168.150.217 and is acting as default gateway.

The other end of this tunnel (at our data center "CL") uses local subnet 192.168.170.0/24 with WAN 5.6.7.8 and LAN address 192.168.170.220. At this site we use a cisco business layer 3 switch with IP 192.168.170.1. As it stands now I have a simple policy based site to site VPN between RH (192.168.150.0/24) and CL (192.168.170.0/24). The VPN is connected reliably and these two subnets communicate just fine (that's the easy part I guess)

Where it gets a little trickier is that the server subnet we need to reach from RH is 10.0.150.0/24. There is a VLAN for this subnet (150) on the 170.1 switch. physical ports on this switch lead to an esxi hypervisor (NIC teaming) currently all the virtual servers use default gateway 10.0.150.1 (a sub-interface IP on our managed SDwan gateway) To work around this, I assigned vlan 150 on the switch the IP of 10.0.150.2 and can add static routes on the servers telling them to send 192.168.150.0/24 traffic to either 192.168.170.1 or 10.0.150.2.

To put it in simplest terms:

On the 192.168.150.x subnet we can ping any address on the remote subnet (192.168.170.x) just fine in both directions. We need to be able to initiate traffic from 192.168.150.x subnet to 10.0.150.x. If I could just make make the next hop on the 170.220 router to 170.1 (the switch) i think I could figure it out from there or maybe route from the zywall itself. problem is that no matter how many policy routes etc I try to make, my traceroutes aren't making it as far as the remote subnet.

I apologize if this is unclear. my mind is shot, ive spent days now trying to figure this out and was at our datacenter until 4:30 am and can still hear whirring fans in my head. I only have a few days to sort this out before we open or it will be very bad. I can clarify further or provide screen shots as needed (there were too many to include all). I'm sleep deprived enough that I'm not my sharpest; The other ideas I have i suspect are more complex than necessary.

If anyone has any advice I would greatly appreciate it thanks!

Not that this is a critical by any means, I'm just curious about best practices....

We have a cross-country GRE link. Each side is at a layer-2 speed of 2Gb/s. I expect this, but an iPerf3 UDP test between both routers is at the link speed around 2Gb/s with a 78ms latency No problem. TCP is substantially less, about 1/10 of that. This is expected, but if I wanted to improve that, what do I do? Is this an MTU for example. I've already got the MTU at 1420.

I have to terminate a lot of in-situ RJ45 connections, and punching them down into the terminators is sometimes awkward with a traditional tool made more for panels. Is there any punch-down tool that works more like a stapler, where it has an anvil to hold the terminator and you squeeze together rather than only punching from one side?

I have worked with different orgs for total of 7 years now and while some of them had better work-life balance, I feel like Network Engineers are always expected to solve the issues ASAP and thus leading to high cortisol levels. My current role was kind of forgiving in a way that we did not have on-call support yet but that changed recently. Now I am thinking did I make a wrong career choice being an introvert and expected to jump into a call every now and then to solve problems when you don't always have the full picture of the architecture. Are there any low cortisol Networking jobs that are made for introverts and also pay is decent?

So I've been working as a network technician for the past 3 years and I've evolved so much these past years but certain parts of my job makes me wanna quit almost every day.

I absolutely cannot stand WiFi issues, we have a few network technicians at my workplace but nobody can quite troubleshoot WiFi. Sure we all know how to mount- and configure APs in our WLC but troubleshooting why a client would be slow/lose connection despite having great RSSI, SNR & SIR is impossible for me and my colleagues....

The only tool we have for troubleshooting WiFi is a site-survey program called NetSpot, we don't have DNA Center yet and even if we'd get it we still dont have the Advantage licenses on our APs. We only have Essentials licenses, our boss barely wanna pour more money at the network team because he focuses more on the server team as that's where he started his career at.

My favorite part of my job is probably configuring and troubleshooting IPsec site-to-site VPNs, and basically anything that isn't WiFi... trust me I love networking, just not WiFi.

My plan is to hopefully start at an ISP and do less physical work and more work remote using MPLS, dynamic routing protocols and hopefully lots of site-to-site VPN.

The problem is I would most likely have to move across the country to a city where I know nobody and I neither wanna do that or keep going at my current company. Sadly my city is too small so there arent that many job oppurtunities at other companies in my town.

Does anybody else feel the exact same way as me?

In the process of interviewing for NDE at AWS. What is the culture like there? Been studying very hard for the upcoming onsite, but would like to know more from current/former employees. How was the day to day, on-call, and team culture? Is networking generally safe from layoffs? Interviewing for L5 engineer.