Saturday, July 24, 2021

Subnetting in the cloud

Hi all,

I'm a former network engineer. Now I work mostly with AWS cloud where networking is abstracted (at least in my role).

I've recently been wondering about the relevance of network subnetting in the cloud and thought I would run my questions by some network engineers (hopefully some with cloud experience).

In a traditional on-pemise networks, you create subnets for several reasons, such as to minimize the broadcast domain or to group similar servers together. This tends to provide other ancillary benefits. If you put all the web servers on the same subnet, you can confidently and effectively allow traffic to *all* web servers on ports 80 and 443 with just one rule to the web server subnet. In IPAM, you can find all web servers by referencing the subnet where you placed all of them. Taking it a bit further, you could use subnetting as a means of easing network engineering/administration (e.g. map server VLAN ID to IP subnet octet, use the same octet for file servers across offices, etc).

In AWS cloud, broadcast traffic is eliminated. So the benefit of subnetting on the ground of broadcast suppression is nil. Securing traffic to/from the server is accomplished with security groups, which are applied directly on virtual instances. This diminishes the benefit of grouping like servers together to simplify firewall rules. Network ACLs work more like router ACLs, but applied to the subnet as a whole and are stateless; therefore, they have a very narrow purpose. IP address management is handled automatically by the underlying cloud router, and tracking IP usage can be done through the web console or web APIs. Lastly, the ancillary benefits are also reduced because you don't manage VLANs in the cloud and and there are better ways of easing network administration.

My questions are:

  1. In the cloud, how relevant are the aforementioned benefits of subnetting?
  2. How important is it to put all the similar servers in the same subnet in the cloud?

Thank you!



Traffic monitoring not seeing data on access level

TOPOLOGY https://ibb.co/tCS70MF

It is not RSPAN, Its using regular SPAN

I have a traffic analyzer program installed on a VM using vswitch SPAN. We are seeing broadcast traffic but not east/west traffic from our networks.

SVI Gateway IPs are defined on the core. They all have .250 IPs. From the core, the links are trunked with the VLANs going down to the access layer. If you look at the topology, we cannot see 10.33.33.131 traffic even though the VLAN is spanned up to the Vswitch.

What is missing here? Do we need IPs for every switch and corresponding VLAN? Does just the Dell switch need IPs in the same VLAN for it to see the traffic?



Learning Materials | Switching Hardware | Low Level Fundamentals

Hello everyone!

I’m currently in search of materials to understand the low level fundamentals of switching.

This is a bit beyond ARP tables; Mac tables, multicast etc. I’m looking more to understand the TCAM; ASICs, Auto-MDIX, PoE Detection and Types among other things that I may not even be aware of. I do know the breadth of this subject is extraordinarily large and that a single resource likely doesn’t exist.

While I know this may not be quite the right sub, I do know that it’s likely the right audience. Insight is appreciated.

Reading material is fine however audio/video is desired.

Thank you,

-Chuckanon



How to solve this modulo equation for RSA algorithm?

d*7 mod 60 =1. What will be the answer of this question?



Cloud Services

How are the cloud services offered by Cloudfare different from the services offered by AWS and Azure?



Public IP addresses vs private (nmap)

So I’m a bit confused between the two. My understanding of the public ip being the unique identifier of a network across the internet, while the private ip is for all devices on a local network.

Now when scanning the private ip 192.168.1/0.0-255 you see all devices connected on the local network so (nmap 192.168.1/0.0-255). Now when scanning for a public ip address you are only given the open ports(if any) and non of the hosts are displayed.

So my question, isn’t there an option to scan for hosts on a network similar to scanning your local ip where all hosts are displayed?



Will a new modem fix this? Please help.

I have a 32x4 modem, i noticed that channels 25-27 build up alot of uncorrectables in the morning and the power goes up around +8 dBmV on all three of them and when this happens my modem stalls for a few seconds causing my router to lose internet connection and disconnects all my devices for a minute.

This happens 2 times a day, one in the morning, one in the evening. It's been happening for about a year now and the isp doesn't want to help because everything "looks fine," on their end.

My question is, Since these uncorrectables always occur on channels 24+, will a 8x4 channel modem solve the issue?

(My max internet speed is 150Mbps, so I'm not even sure why I bought the 32x4 modem in the first place.)



Office Network Changes and Information/Feedback Needed.

Hello Networking subreddit I'm looking for some help in trying to determine needs and was hoping some feedback from people well more trained then I could help steer me in the right direction. I'll list below what we currently have and what we use as a company. Heads up while at times we employee 100+ employees we are a landscaping company and with that we are very seasonal in needs. We have a small group of actual office staff that work year round and access the network (8 - 10 people) while the rest of in office personal is maybe another 10 people. Everyone else would more or less be accessing internet only via AP or Cellular service with Tablets and Smart Phones.

We have a flat network as simple as that which consists of:

Spectrum Modem

Netgear Orbi RBK50 (supplies WiFi in Office Building)

2x Unmanaged Netgear Switches (24 Port)

Unmanaged Poe Switch (18 Port)

1x NVR

4x IP Cameras

10x VoIP Phones

Ubiquiti Rocket AC (supplies Internet to 3 areas where cameras are and for Internet in Shop)

3x airMax NanoStation AC 5 (Connected to Rocket AC)

Old Linksys Router in Shop (suppling very bad WiFi to the shop getting internet from the NanoStation)

2x Network Printers (Xerox and DesignJet Printer)

PoS System that runs through a Router provided by them that plugs into our network (we don't do anything with this at all management wise)

--------------------------------------------------------------

53 drops in a new building put up about 3 years ago. Phones take up 10x jacks, PoS take up 2x, Printers 2x, 12x for hard line plugged in Computers, 2x TV's, 1x line gets used for Fax, 1x for Rocket, 1x NVR and rest are for connecting each of the network devices and after that not used. Everything else that connects to network is via AP. Generally when I log onto the Orbi about 75 - 78 devices are connected but possibly could be more if we had better AP in the yard allowing for employee devices to connect when they come in in the moring and before leaving in the evening (allows for better syncing of devices for Scheduling software would be my thought).

--------------------------------------------------------------

We use Google Workspace for Email, Storage on Drive and File Sharing. Some users still store some of their files locally on their computers. We have one PC that is serverish meaning it has Quickbooks Enterprise Company file located on it to be accessed by Office personal to use and it has our Scheduling software Database on it but doesn't do anything else outside of it (We are in talks of switching Software to a more cloud based solution like NetSuite instead of Quickbooks and NextService instead of our Scheduling software or something similar in the future). We have an external HD that backups get run to for the Database and Company file. We aren't moving large video files or doing Photo editing and sending those around. Mostly what gets shared are Google Sheets or Excel spreadsheets, Word Documents or PDF's of Quotes. Our PoS system is Cloud bases as well for access.

---------------------------------------------------------------

So what's my question(s)? Well I don't have nearly the same experience as I see from the other people on this subreddit. I like learning and using hardware and I want to improve what we currently have. Off the bat we don't have any sort of Firewall which is not great at all. I'd like to upgrade to Managed Switches, better AP, and better Router/Firewall. I just cannot tell if our needs really constitute all those changes. It's definitely in the realm of if it's not broke don't fix it and that's kind of what our company runs on when it comes to technology. I don't mean to say they are poorly run just that everything else is second fiddle to proper equipment for landscaping work and services. They don't give much thought to computers etc as long as it 'works'. I want to be able to explain and show them what they get out of making these kinds of changes and how that money will be put to great use in assisting the company. I have been looking at UniFi, Aruba Instant On, and have started looking at others so if there are any additional ideas any of you may have that would be greatly appreciated.

Any feedback is welcome and while I understand people will say I'm in over my head and I get that it comes with the process of me wanting to learn and gather information to make the most informed decision I can. None of this is changing in the near future and more or less is in time what changes can I get them to make and for why.



How do i combine/aggregate 2 uplinks into 1 and load balance in EX4200 Juniper Switch?

Hi,

So i have 2 uplinks provided by my hosting, both are 1gbps and connecte to 46 & 47 port.

I was wondering how i can combine them into 1 connection and split the traffic between both?

My servers are connected from 0 till 16 ports (All even are public and all odd are private network).



Layer 2 Tunnels Across A LAN

What's the "best" way to create a layer 2 tunnel across a campus type of network, consisting of various buildings connected with layer 3 routing.

I have an application that requires a few megs of bandwidth, but it must be VERY reliable. The application cannot know about the network that is traverses. I have three endpoints that must communicate with each other, but that could expand to 4 or 5 perhaps down the road. The layer 2 must be transparent to the application, but carried over the redundant layer 3 routed network. I cannot use dedicated fiber pairs, since this application must have redundant routes in case of a fiber cut. I do not need encryption as far as I know, but its possible that this could become a requirement if we expand it to some other remote sites.

How should I do this? What hardware would be good for this? A reasonable budget for this would be in the thousands of dollars.



Friday, July 23, 2021

Confused scared and overwhelmed with new position. Was a lead support engineer before new role is architect and I cannot figure out where to start. Please help me

I was lead network engineer in a small Healthcare company, now I have joined a big organization which has a global network presence as a Sr. architect. I was good at what I did got promoted quickly.I am too young though (28).led team of 2 other engineers and I trained them kept outages to minimum.

So I thought let me try to see what is out there and I applied for Sr. Engineer position in this big company .long story short recruiter called me told me that position bus filled but apply for architect so I did. Assumed I won't get it but wanted to see what type of questions they will ask.

Interview was easy for me to crack since I knew everything they asked but work seems to difficult. I interview for architect and got role of Sr. Architect.

I am not dumb but not smart as well. I am hardworking though. I can figure out stuff and find out errors and optimize stuff here and there. And worked closely with architects and infact many times told them they are not doing it right.

But here I Am overwhelmed and not sure where to start. It has been a week and I am going through documentation which makes sense but I cannot imagine me writing one or designing solution like that. Seriously worried if I will be able to handle it or not. People are very busy and there is no mentor.

They are using things like vxlans/evpn and teraform.Their LB and Firewall infrastructure is also very big and future work they are planning is also seems difficult which I am supposed to design (as a part of team)

I assume many of you might been through similar challenges guide me through your struggles please.

Tl;Dr: was lead engineer now sr.architect. scared and overwhelmed of new role many new technologies and don't know where to start.



Arista switches not working with Ansible

Hey all.

I'm learning Ansible (finally) and while I have it working with IOS devices, I cannot for the life of me get it working with my Arista switches. I'm starting to think it's a device config that i'm missing but i'm not sure. Every article I come across has different options and such, so i'm not sure what to use. I went straight to the Ansible site and just made a simple "show version" command, and I can't get that to run.

My question is, do we have to do something specifically to get it to run on Arista boxes? I enabled the eAPI and verified that with the show management api http-commands command which shows that it's enabled. I have a user created (network-admin role), enabled SSH and I tested from my Centos box to the Arista switch that i'm able to ssh with that user with no issues.

If someone can point me in the right direction, i'd really appreciate it. I'm completely stuck here. Thanks.



Router to HA Firewalls

Hi there, I'm working on a lab as skill-building for my employer. I have a customer that wants to add a firewall to an existing network. From the bottom up the network goes EUDs > switch > router > firewall > Internet.

Generally there should be a switch between the router and firewall with a route to the virtual IP of the FW in the router - I believe. Is there a way to go from a router to two FWs in active/passive HA?



Fiber Optical Cable Help

https://imgur.com/a/jxAWyWV

First I have little fiber experience other than premade cables. I have this Fiber Internet Line coming into a work container that will house some networking equipment. One side of the fiber is already spliced and terminated into a 1U patch panel inside (Blue SC connection) another building about 500ft away from a previous contractor. The Fiber cable has 4 cores? 48 Fibers? and the cable has "commscope optical cable os2 sm 48F" printed on it.

  1. Does that mean this fiber cable is Single Mode Fiber?
  2. How do I go about connecting a switch to this end of the fiber cable? Do I do the same thing that was done in the other building? Is there a way to do this without using a Fusion Splicer? I can learn but just want to have options for how to complete this task.

Any help would be apricated



Kemp loadbalancer

Hey all!

I've just started tinkering with kemp load balancer.. So I am wondering, I've got a domain that points to my WAN, then it gets routed to the correct server with server1.domain.com. BUT the internet here is so slow.... Is there a way i can use "NAT Reflection" with kemp lb?

I am also running a pfsense router, with NAT reflection set to "Pure NAT". And it works great outside the load balancer.

Any advice will be appreciated!



Did I just get hacked (Android TV - MiBox) - If so, what's next?

Hello everyone, gonna try to make this brief.

I have a MiBox on Android 8.x. I like the older, simpler builds.

Last week or so, I kept getting a random RSA Key prompt. I searched for the MAC, couldn't find it in my network, but finally hit OK on it a few days ago, thinking who could be trying to hack me and why?

Anyhow, this morning, my TV, Box turned off unexpectedly. Came on in a few minutes, by itself and it looked like it had be factory reset on the set up screen!

Before I could figure out what was happening, I saw the RSA Key box pop up again, and this time, the checkbox was checked by itself and it felt like someone else was in control!

I quickly killed the power source of the box, disconnected the Ethernet cable.

Question is, did I actually get infiltrated? How serious is it, if I did? What actions should I take to be secure my network first and can I use this box again?

Please help!



Modem mode & Static Routes?

Hi All,

I'm pretty sure I'm just overthinking, but if I put a ISP Router (Like Virgin's Hub for example) in modem mode (I know that modem mode passes all traffic over to the router plugged into the Virgin Hub) and plug it into a firewall or router like the UDM Pro or Sonicwall or whatever you want to use. Why is it the case that the router being plugged into the Virgin Hub (which is now in modem mode) can still send traffic over to the Internet even though there's no static route like 0.0.0.0 0.0.0.0 Public IP and I know having a static route would still be problematic because of PAT but still don't understand how it's capable of forwarding the traffic without a static route to the WAN? Even with a directly connected route existing, it still wouldn't make sense because when a packet wants to go off of your network, the destination IP address of the packet will NOT be your public IP address.

Am I missing something obvious here?



Office Network Upgrade (Ideas Validation)

Just joined a new company and they want me to upgrade their network.

The current infrastructure consists of a 1Gbps symmetrical Fiber WAN link on another floor (that we don't have control of) going into a Linksys home router that we have. That is it. No firewall, nothing. Wifi speeds are 100Mbps or so. Office is 1k sqft or so.

I want to go enterprise grade because, although the company has 50ish employees currently, they plan to double to 100 by EoY. Most people work hybrid and 20 or so are in the office daily, the rest are remote. There isn't a defined budget for the project and I have been asked to present a few options to compare.

To be honest, because I feel like it is one of the more futureproof solutions, I was going to try to push a Meraki solution. I was thinking of an MS120-8FP + MX84 + 2 MR20 APs to cover the security and access needs that they don't know they need. I have no doubt that an MX64 would get the job done currently but with the planned growth I don't want a bottleneck in the future.

Is there anything I am missing here? I've worked with networks before but this'll be my first complete build. They currently pay NordVPN to manage their VPN but want to bring it in house as Nord is quite expensive.

Two other options I am exploring are Ubiquiti and Aruba. Ubiquiti due to the cost savings (but the added headaches when something goes wrong) and Aruba because it is a decent competitor to Cisco.



Data rates

So I work for an electronics company and we produce data loggers. One of the things I’m still trying to figure out is 802.11b has to be on for this device to work with wifi. Can 802.11 be enabled on a network but be disabled on an AP? Also I had a customer say that his 802.11B was enabled but was not receiving 802.11 data rates how is this possible?



EIGRP Flapping over DMVPN

Hello, chat, I am currently having issues with DMVPN flapping over my DMVPN WAN infrastructure. I have been looking at my configurations for some time now and have not been able to identify any configurations errors that could be causing this issue. I wanted to upload to chat to see if anyone would help me figure out what is possible inconsistent or wrong in my configuration. Thanks!

Spoke Log Error: *Jul 23 18:16:11.972: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 172.27.250.2 (Tunnel500) is down: retry limit exceeded

--More--

*Jul 23 18:16:16.313: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 172.27.250.2 (Tunnel500) is up: new adjacency

SPOKE CONFIGURATION:

interface Tunnel500

description DMVPN

bandwidth 10000000

ip address 172.27.250.6 255.255.255.240

no ip redirects

ip mtu 1400

ip nhrp authentication DMVPN123

ip nhrp map 172.27.250.1 65.57.79.218

ip nhrp map multicast 65.57.79.218

ip nhrp map 172.27.250.2 4.17.253.242

ip nhrp network-id 10

ip nhrp nhs 172.27.250.1

ip nhrp nhs 172.27.250.2

ip tcp adjust-mss 1360

delay 1000

tunnel source GigabitEthernet0/0

tunnel mode gre multipoint

tunnel key 1

router eigrp DMVPN

!

address-family ipv4 unicast autonomous-system 100

!

topology base

exit-af-topology

network 172.27.250.0 0.0.0.15

exit-address-family

HUB CONFIGURATION:

interface Tunnel500

description DMVPN

bandwidth 1000000

ip address 172.27.250.1 255.255.255.240

no ip redirects

ip mtu 1400

ip nhrp authentication DMVPN123

ip nhrp network-id 10

no ip split-horizon

ip tcp adjust-mss 1360

delay 1000

tunnel source GigabitEthernet0/1

tunnel mode gre multipoint

tunnel key 1

router eigrp DMVPN

!

address-family ipv4 unicast autonomous-system 100

!

topology base

exit-af-topology

network 172.27.250.0 0.0.0.15

exit-address-family



what is network id / subnetmask / ip address (192.168.0.0) / ip address (234.54.143.22) eg.

I'm new at networking and there's a lot that i can't understand, starting out with network id, i heard this word a lot but i can't understand it. what is network id? and for example when i type what is my ip address on google i get the same ip address on every machine in my network is that my network id?

and this really confuses me as i thought that every single computer in the world has its own unique ip address but it turns out that my laptop and my phone has the same ip address?

and what is that ip that comes like (192.168.0.0) what is it used for?

and wtf is subnet mask!!



What makes a “full tunnel” VPN act as a “full tunnel”?

In something like a PANGP VPN, if it’s set as a “full tunnel”. Is there a magic configuration file/setting on the client that the PANGP VPN software changes to make all traffic go through that VPN? Or is it just changing the routes on the client?

Is there a way to make a full tunnel, not a full tunnel on the client?



Starting a cloud computing and networking internship next summer, what basics should I start with to get a head start?

I’m not too experienced at all, just a very basic understanding. What resources should i use or fundamentals should i get a better understanding of over the next year before i start?



FMC removes configuration on deploy to FTD

Anyone hitting this issue right now? We did an upgrade to 6.6 a few weeks back and it was fine until recently. Now we're hitting a behavior where FMC is removing configuration on the managed FTD, even though the relevant policy / object / config still exists.

For example, if you have an access control policy referencing some object named "Mail-Server-10.135.200.100", FMC may randomly decide that the rule and object no longer exists, and send commands to remove the rule entry and object.

The workaround? You change the thing referencing the object or rule and change it back, then re-deploy and cross your fingers hoping it doesn't remove something else.

We're hitting this on 6.6.1 and 7.0.0. We were specifically instructed by TAC to upgrade to 7.0.0 to fix this bug.

Jokes on us because we're still hitting it. We literally cannot make changes because it might remove something.



Weird Remote User Issue

Hello All I'm a new jr admin for a smallish company and we are having a strange issue. We have a user that connects remotely from out of state for work through Watchguard VPN.

They were having an issue with their terminal (write errors on the hard drive) normally their terminal lives in our server closet and is ran headless and has been working fine till the drive issues.

I took the terminal down and put a new boot drive reinstalled windows office ect. I had them remote in while the terminal was on the bench for a few days and it was working fine.

Then I put it back in the server closet and they cant connect through the vpn. I've switched cables, ports on the switch, heck even the power adapter for the terminal no dice. I pull it out of the server room and put it back on the test bench and they can connect fine.

Its all on the same network same server same switch.

Terminal is an intel NUC7i7BNH, wan side firewall is the Watchguard Firebox M200, and the switch is Cisco SG350x-48p. If someone could point me in the right direction I would really appreciate it.



David Bombal - Giveaway, Free Udemy Course - CCNP

This link was shared by David Bombal on his YouTube channel for the free course: https://www.udemy.com/course/complete-ccnp-encor-350-401-masterclass/

CouponCode=ENCORFREE



Juniper MX VRRP inner tags

Looking to see if anybody has configured something similar to this on Juniper MX before. I have traffic coming into my downstream switches that is encapsulated in a S-tag (outer tag) Within that there are multiple C-tags (inner tags) I want to be able to run VRRP or at least configure an IP address for each inner VLAN on my MX. I can't seen to find if this is possible or not.

E.g. here is partial config

[edit interfaces] + ge-1/1/9 { + flexible-vlan-tagging; + encapsulation flexible-ethernet-services; + unit 301 { + encapsulation vlan-ccc; + vlan-tags outer 301 inner-list 997-998; + } + } 

So in summary, I want to run VRRP (or at least put an IP address on the router for vlan 997 and 998. Is this even possible?

Thanks



Free Cage Nuts

I found out that patchbox is giving their devmount cage nut away for free. you need therefore to visit their website -> go to products and choose devmount. The trick is that you need to wait some seconds till a pop up appears and there you can request a sample pack. Google it and you will find it (i think i‘m not allowed to post a link here)

Please delete if this doesn't fit in here.



PIM-SM IGMP Groups

Have a basic understanding but don’t have a lot of experience deploying multicast so hoping somebody can help clear up some confusion.

If IGMPv3 isn’t supported for whatever reason then PIM-SSM can’t be used and PIM-SM is the next best choice. Holy crap it is way more complex.

The part that isn’t clear to me is how to handle different sources using the same IGMP group addresses if having to use PIM-SM. These sources are in different subnets/vlans/svi but it seems to me PIM-SM is one giant multicast domain and you have to make sure no two sources are using the same igmp group or else a receiver will get traffic from both sources. I came to the conclusion due to receivers sending igmp joins to *.g in PIM-SM whereas in PIM-SSM the source is specified.

It seems to me there would be some type of way to create multiple PIM-SM instances to segment out multicast sources or somehow identify which source the receiver is looking for. This doesn’t seem to be possible with PIM-SM and the more I think about it wouldn’t make sense since there is no way to tell which source a receiver wants. Which starts to sound more like PIM-SSM.

Hopefully somebody can confirm or fill me in on something I’m missing.



Thursday, July 22, 2021

How do you simulate packet drop caused by UDP flooding in Mininet?

Just to be clear, I am not interested in adding a constant packet drop on a link (as described by this Stack Overflow question). I want to observe packet drop taking place naturally in the network due to congestion.

The intention of my project is to observe the packet drop and delay taking place in a network (preferably an SDN) by varying the qdisc buffer size on the router node. I have a basic topology of three nodes h1, h2 and h3 connected to a router r. I am conducting my experiment along the lines of this tutorial taking place inside a custom environment. Node h1 is flooding the r-eth3 interface with UDP packets and node h2 is sending pings to h3 which are being analysed. I am running tc commands on router r, on the r-eth3 interface in an attempt to vary delay and packet drop by modifying queue size and throttling the link to 18 Mbps. My code is shown below:

DELAY='110ms' # r--h3 link BBR=False import sys import shelve import os import re import numpy as np import matplotlib.pyplot as plt from mininet.term import makeTerm from mininet.net import Mininet from mininet.node import Node, OVSKernelSwitch, Controller, RemoteController from mininet.cli import CLI from mininet.link import TCLink from mininet.topo import Topo from mininet.log import setLogLevel, info import time class LinuxRouter( Node ): "A Node with IP forwarding enabled." def config( self, **params ): super( LinuxRouter, self).config( **params ) # Enable forwarding on the router info ('enabling forwarding on ', self) self.cmd( 'sysctl net.ipv4.ip_forward=1' ) def terminate( self ): self.cmd( 'sysctl net.ipv4.ip_forward=0' ) super( LinuxRouter, self ).terminate() class RTopo(Topo): def build(self, **_opts): defaultIP = '10.0.1.1/24' # IP address for r0-eth1 r = self.addNode( 'r', cls=LinuxRouter) # , ip=defaultIP ) h1 = self.addHost( 'h1', ip='10.0.1.10/24', defaultRoute='via 10.0.1.1' ) h2 = self.addHost( 'h2', ip='10.0.2.10/24', defaultRoute='via 10.0.2.1' ) h3 = self.addHost( 'h3', ip='10.0.3.10/24', defaultRoute='via 10.0.3.1' ) self.addLink( h1, r, intfName1 = 'h1-eth', intfName2 = 'r-eth1', bw=80, params2 = {'ip' : '10.0.1.1/24'}) self.addLink( h2, r, intfName1 = 'h2-eth', intfName2 = 'r-eth2', bw=80, params2 = {'ip' : '10.0.2.1/24'}) . self.addLink( h3, r, intfName1 = 'h3-eth', intfName2 = 'r-eth3', params2 = {'ip' : '10.0.3.1/24'}, delay=DELAY, queue=QUEUE) # apparently queue is IGNORED here. def main(): rtopo = RTopo() net = Mininet(topo = rtopo, link=TCLink, #switch = OVSKernelSwitch, # ~ controller = RemoteController, autoSetMacs = True # --mac ) net.start() r = net['r'] r.cmd('ip route list'); # r's IPv4 addresses are set here, not above. r.cmd('ifconfig r-eth1 10.0.1.1/24') r.cmd('ifconfig r-eth2 10.0.2.1/24') r.cmd('ifconfig r-eth3 10.0.3.1/24') r.cmd('sysctl net.ipv4.ip_forward=1') h1 = net['h1'] h2 = net['h2'] h3 = net['h3'] h3.cmdPrint("iperf -s -u -i 1 &") r.cmdPrint("tc qdisc del dev r-eth3 root") bsizes = [] bsizes.extend(["1000mb","10mb","5mb","1mb","200kb"]) bsizes.extend(["100kb","50kb","10kb","5kb","1kb","100b"]) pdrops = [] delays = [] init = 1 pdrop_re = re.compile(r'(\d+)% packet loss') delay_re = re.compile(r'rtt min/avg/max/mdev = (\d+).(\d+)/(\d+).(\d+)/(\d+).(\d+)/(\d+).(\d+) ms') bsizes.reverse() for bsize in bsizes: if init: init = 0 routercmd = "sudo tc qdisc add dev r-eth3 root tbf rate 18mbit limit {} burst 10kb".format(bsize) else: routercmd = "sudo tc qdisc replace dev r-eth3 root tbf rate 18mbit limit {} burst 10kb".format(bsize) r.cmdPrint(routercmd) h1.cmd("iperf -c 10.0.3.10 -u -b 20mb -t 30 -i 1 >>a1.txt &") h2.cmd("ping 10.0.3.10 -c 30 >> a2.txt") print("Sleeping 30 seconds") time.sleep(30) #Below is the code to analyse delay and packet dropdata f1 = open("a2.txt",'r') s = f1.read() f1.close() l1 = pdrop_re.findall(s) pdrop = l1[-1][0] pdrops.append(int(pdrop)) print("Packet Drop = {}%".format(pdrop)) l2 = delay_re.findall(s) delay = l2[-1][4] + '.' + l2[-1][5] delays.append(float(delay)) print("Delay = {} ms".format(delay)) bsizes = np.array(bsizes) delays = np.array(delays) pdrops = np.array(pdrops) plt.figure(0) plt.plot(bsizes,delays) plt.title("Delay") plt.savefig("delay.png") plt.show() plt.figure(1) plt.plot(bsizes,pdrops,'r') plt.title("Packet Drop %") plt.savefig("pdrop.png") plt.show() for h in [r, h1, h2, h3]: h.cmd('/usr/sbin/sshd') CLI( net ) net.stop() setLogLevel('info') main() 

However, when I run the program, only the delay increases with queue/buffer size as expected. The packet drop stays constant (apart from the initial 3% packet drop that occurs regardless of the queue size used). I am flummoxed by this, since theoretically, as buffer size decreases, the space to 'store' a packet on the queue decreases, therefore the chances of a packet getting dropped should increase, as per the tutorial. The graphs are shown below:

Graph depicting an increase in delay

Graph depicting a stagnant packet drop

I need an explanation to this contrary behaviour. I would also appreciate a way to observe packet drop in my example. Could it have something to do with Mininet/SDNs in general prioritising ICMP over UDP packets, leading to a lack of packet drop? Or could it have something to do with controllers(I am using the default OpenFlow controller)?



Cisco Smart Licensing after 17.3

So I’m still sort of new to the smart licensing procedures for Cisco. Before 17.3 we would just do a smart license reservation and that’s it. Now in 17.3 and after you don’t have to do a reservation anymore but you have to upload a usage file to the smart account and then download a ack file to put on the switch? Do you have to download a usage file every year(or whatever the default is) ?



ST fiber install tool?

Are there any tools for installing st connectors? I’ve got to add a few in a -30F freezer and it’s too cramped, dark, and cold to do it with my bare hands.

I’ve found some nice LC SC tools but no ST



Cloud managed firewall suggestions with easy installation and management

Looking for the best cloud managed firewalls that are easily installed. We have palo and Asa, but not sure if meraki is the way to go for internal segmentation. I’ve heard they do l7, but is it worth the ease of installation/management?



Cloud managed firewall suggestion

Anyone have advice on a super easy cloud managed firewall that is easily deployed? Looking at something that is hands off from a deployment perspective that serve internal segmentation purposes. Nothing fancy but easily managed and deployable.



Help please..! Trying to stand up a radius server

Hey yall. Im hoping someone here has the answer for me. I work for a company that manages several hundered SOHO networks. My goal is to set up a cloud radius server (using Linode) to authenticate all our client site VPNS. Currently using the built in radius on each gateway which makes it quite the task to add and remove users on the 200+ routers. (All Ubiquiti Dream Machine Pros)

I've been messing around with FreeRadius for a bit but cant quite get it to work (tried Ubuntu and CentOS). I can create users and can get localhost authentications to work. I then try to add clients but have not been able to get anything to work remotely. I've yet to get FreeRadius to open up port 1812 which I would assume it would? (using nmap to test this). I have to be missing something simple....?

I have gotten this setup to work using JumpCloud however their platform does not work for us because it only allows IP addresses for clients and most of my clients do not have static addys. Using DDNS.



VLAN segmentation as security, do you trust it?

Fill in a few back details first, understand VLANs, I am aware in the past there have been risks of VLAN hopping but there are published mitigations, I understand there are possible L2 risks that at the least could be a denial of service such as ARP attacks.

Now to the question, I have some sites where they have 2 air gapped networks as the opposite end of the trust spectrum, one is a PCI DSS CDE, the other is a public WiFi that is open to anyone who cares (the password is on the wall in reception). I have to propose refresh for these sites, and a single physical switch network with VLANs is obviously easier to implement, but the air gap was put in for a reason!

I just want to push this out for some general feeling from others in the industry what way you would fall on this question.

Thanks.



C9200 QOS command "auto qos voip cisco-phone"

Does anyone know if this command is only for use with cisco IP Phones on the C9200? or will it work with Avaya phones (specifically J169) as well?



cisco aci for L2 bridging

I'd like to use a bunch of EPG/BD's as L2 transport/bridging only connecting endpoints and using a firewall as a default gateway. I see a bunch of videos saying I need to use contracts, but if the firewall is sitting on the same L2 segment as the host, then assuming we're not doing any sort of useg thenhow does that work?

Also, if possible I'd like to be able to see my endpoint mac and IP addressing in ACI as I don't have access to the firewalls and ARP tables. I know I need to have a valid IP address assigned to the bridge-domain and I need to enable unicast routing for this, but I've painfully discovered this ends up having a lot of undesirable effects the BD's are in the same VRF as the networks begin advertising themselves internally and EPG-EPG comms start to break down even though the gateway is the FW sitting direclty on the same L2 segment . Removing the IP address from the bridge-domain fixes the problem but then I lose all layer 3 visibility into the EPG. Is there any way to have my cake and eat it too in this situation?



Why is the pinout/cable order for punchdown blocks different than RJ45 connectors?

Random quick question: when I make a network cable I do the T568B wiring standard, but when I wire up punchdown blocks, the wiring colors are kept in pairs. I was told in school probably ~10 years ago that the order mattered because of different twist rates between pairs, helping reduce crosstalk and interference. If that's the case, why are they different?



Best way to get internet access to remote location?

I need to get wireless connectivity to a couple of remote locations around my workplace.

Previously we have been using verizion MiFi jetpacks, but usually the cell connection is very weak/slow

I was thinking that starlink could be a possibility but no sure how well that would work either.

Thought about setting up wireless bridge but that seems pretty overkill/spendy for what we need.



SD-WAN and SASE Products

We have Meraki currently for our SD-WAN and also have ZScaler. Meraki is a little limited when combining it with such a product. As our SD-WAN contracts are coming due we're looking at upgrading to something a little more enterprise capable.

I can list our issues but we've worked with Cisco and other to try to find solutions.

So my question: Which SD-WAN providers are recommended for SASE users? Not just Zscaler but others like Palo Alto, Cisco, Forcepoint...

Anyone have any feelings when it comes to Palo Alto versus VeloCloud, Silverpeak?

We looked at Palo alto and they also have Prisma which is their SASE offering.



Adtran 900e Series Failover only kicks in when disconnecting eth 0/1

Failover Will Not Kick In Unless Eth 0/1 is Disconnected.

I have the following config on an Adtran 908e 2nd Gen. The failover kicks in when the eth 0/1 is unplugged but if I remove the modem's coax on the primary. The Failover bounces. Any changes to the config below to prevent this. 

ip local policy route-map probe ping1

probe ping1 icmp-echo
destination 8.8.8.8
period 10
tolerance consecutive fail 6 pass 3
no shutdown
!
!
track ping1
snmp trap state-change
test list or
if probe ping1
no shutdown

!

interface eth 0/1
ip address x.x.x.x x.x.x.x (Primary WAN)
no shutdown
media-gateway ip primary
!
interface eth 0/2
ip address x.x.x.x x.x.x.x (Back up WAN
no awcp
no shutdown
media-gateway ip primary

route-map probeping1 permit 10
match ip address ping1
set ip next-hop x.x.x.x (Primary Gateway)
set interface null 0

ip route 0.0.0.0 0.0.0.0 x.x.x.x (Primary Gateway) track ping1
ip route 0.0.0.0 0.0.0.0 x.x.x.x (Back Up Gateway) 10

I tried with the following config too and same issue the failover kicks in only when disconnecting eth 0/1. 

ip access-list extended MATCHALL-FAILOVER
permit ip any any
exit
!
no ip policy-class WAN-FAILOVER rpf-check
ip policy-class WAN-FAILOVER
allow list MATCHALL-FAILOVER self
allow list MATCHALL-FAILOVER stateless
exit
!
interface eth 0/1
ip address x.x.x.x x.x.x.x (Primary IP and Mask)
no awcp
no shutdown
no lldp send-and-receive
media-gateway ip primary

!
! -- Fail over Interface
!
interface eth 0/2
ip address x.x.x.x x.x.x.x (Back up IP and Mask)

ip access-policy WAN-FAILOVER
media-gateway ip primary
no shutdown
exit
!
!
probe FAILOVER icmp-echo
destination 8.8.8.8
source-address x.x.x.x (Back up IP Gateway)
period 10
tolerance consecutive fail 5 pass 10
no shutdown
exit
!
track FAILOVER
snmp trap state-change
test if probe FAILOVER
no shutdown
exit
!
!
!
!
ip access-list extended pingprobe
permit icmp host x.x.x.x (Primary IP) host 8.8.8.8
exit
!
ip local policy route-map ICMP_FAILOVER
!
route-map ICMP_FAILOVER permit 10
match ip address pingprobe
set ip next-hop x.x.x.x (Primary IP Gateway)
set interface null 0
exit
!
ip route 0.0.0.0 0.0.0.0 1x.x.x.x (Back up IP Gateway) 250
ip route 0.0.0.0 0.0.0.0 x.x.x.x (Primary IP Gateway)

I posted this in the Adtran support page too.

https://supportcommunity.adtran.com/t5/Total-Access-900-900e-Series/Failover-Will-Not-Kick-In-Unless-Eth-0-1-is-Disconnected/td-p/36250#.YPnALxwZFHU.link



Have a weird need, and I was wondering if there's a tool for my situation as a vendor in a county Airport System

Hey Everyone.

I work for a parking solutions provider and we have a mid-sized install at a county airport where we only own the systems and access layer switches. All routing and firewalling is managed by the county.

The county is, interesting. They have about 5 HA firewall pairs set up between the airport(where our parking stuff lives) and the actual internet connection.

It's happened a few times now where all the payment devices go offline because of a failure at the county level in one of these HA firewalls. I've confirmed it as much with the county network engineer, but they're not super interested in working with us to monitor the network so that we can minimize the loss of payment traffic.

So, I was wondering if there was a open-source tool that allowed you to start a TCP scan of a particular host:port, but the TTL time was incremented by 1 for each successful hop, hopefully allowing me to take advantage of the TTL exceeded error message and figure out when and where this traffic is breaking down a lot faster.

Any ideas? Am I going down the wrong rabbit hole?



Monitoring Cellular Data Usage

I have about 20 cellular routers in the field, each router has a static IP address. The router accepts a SIM card and the carrier is Verizon Wireless. The issue I'm having is that all these devices are using shared/pooled data and they are always exceeding the monthly plan.

I am currently using LibreNMS to monitor the traffic usage over the WAN but my issues are:

  • It seems to only be 5 min intervals
  • The Verizon Wireless Data Usage does not match what the LibreNMS billing module displays. I'm not sure if this is related to the 5 min interval of SNMP.

I like LibreNMS and I still use it for other devices, but I don't want the solution to be within LibreNMS unless I am doing something very wrong in LibreNMS and it is a simple setting that I've missed.

I want to state that LibreNMS community is great and I have donated to them many times, but most of the time the community recommends editing a bunch of files in LibreNMS and I am not comfortable doing that. I'm looking for a solution that is cloud based or an SNMP type of program that has paid support so that if I do end up going with an SNMP based solution, I can call in if/when I'm having a problem.

I understand that traffic/services are HTTPS based and that additional equipment, certificates, etc may need to be put in place in order for this to work properly. Since there is a business reason for wanting to track data on company owned equipment, I would also consider options that require a middle box/certificates/etc to be installed between the cellular routers and the computer/devices that connect to the cellular routers. At this point I'm simply looking for options from those who have gone through this, before.

The other issue with LibreNMS is that the interface usage doesn't match up with what LibreNMS billing is stating. For example, the billing module shows that one cellular router used 18GB of data in the last billing period (I've properly defined the billing period dates). However, when I check the interface stats for that router, the device barley peaked above 1MB. You can see the 1MB spike and all other graph data indicates that the traffic was much lower than 1MB throughout the billing cycle. Again, this could be due to the 5 min SNMP interval.

I have a call in to my Account Manager to see if they can 'sell' me additional data usage services and I'm also going to ask about upgrading the shared monthly billing package. I'm going this before I go to the higher ups because I'd like to have answers and/or possible solutions when presenting them with the problem.

At the end of the day, it may be cheaper to simply bump up the monthly data usage plan and that may be all that is needed.

Thanks.



Sophos Web Exceptions

Hi How do the web exceptions work in Sophos XG? Do they need firewall rule ?

I assume adding anything in exceptions will bypass firewall rule and web filter policies ?

Ca anyone please explain ?



Azure IP Address Question

Hey all,

Not familiar with networking/ip addresses in general. I am trying to whitelist Azure to integrate with our software, but when reviewing the IP address, I am seeing the following:

2603:1030:10:402::178/125

Not sure how to interpret :: or anything past that. Is this a range? How would I ensure I am including correct addresses?



Problem with PXE Boot over LACP on Aruba Switches

Hello!

I ran into an issue regarding PXE Boot over trunked Interfaces (LACP). A server is connected to a Aruba 5406R zl2 running ArubaOS over 2 interfaces, which are configured into a lacp-trunk and runs fine so far during normal operation. But sometimes the server needs to be reinstalled over PXE. This doesn't work, because during the pxe-boot the server doesn't send LACP BPDUs and therefore the connection doesn't come up. On Juniper-EX Switches there was a solution with the option 'lacp force-up', which enabled one of the trunked interfaces as a single link.

I can't find a solution for this on the Aruba Switches. Any help would be appreciated!



Access-point with internal controller

Hi,

I've been out of the game for a while and are now looking for an access-point solution that have an controller built in to it. So when I add another AP it will be controlled from the first one.
If I don't recall wrong, Cisco had a solution like this some years ago, maybe they still have?
Cloud based controller is a no go as well as apps on the phone or the computer.

Any suggestions?



Provide dhcp in a layer2 vlan network

Hello,

i have some Cisco Nexus here where i needed to create a subnet for an offline, unrouted network. The network is for ip-cams.
So i created a vlan but i did not created a default-gateway since its not needed that the network is routing capable. Its all layer 2 and the ip-cams are beeing discovered by a broadcast from the management-server. But what in fact is neccesary is dhcp in that network.

So i created the dhcp scope (192.168.100.0/24) without a defaultgateway, but the client are not receiving an ip adress. On the nexus i configured

interface vlan221 ip dhcp relay address 192.168.250.1 

But that also did not work. So i am curious: Is it even possible to have a ip helper that is in a different subnet when the network infact does not have a default gateway?

All my other networks have a default gateway on the nexus and dhcp is working fine there. I could just create a default gateway with the no ip redirects but i now want to know if its even possible :)

Thanks!



MMF & SMF Transceiver

Hi everyone.

Is it possible/recommended to do LACP/Trunk from server to two switches using one MMF & one SMF transceiver with the same speed of 10GB?
Thanks for any tips beforehand.



802.1x logon monitoring

Has anyone set up a monitoring for a full wireless radius login?

We just had an incident that regular radius/tacacs was working ok, but the full wireless client authentication started to fail because of backend issues.

I was thinking should I make a Raspberry Pi client and script it to do periodic testing instead of relying the regular scream alerts from users...



Troubleshooting low bandwidth NAS Synology

Hi everyone, I got an issue and I hope you guys can help…

I’m doing Tape backup with Veeam and data transfert is very slow (40 MB/s) while constructor says Data transfert max is 140 MB/s

While backuping (?), it says that the bottleneck is 99% source.

I would like to test the bandwidth between my Veeam server and the NAS with iperf3 but it’s impossible to install it (even Docker isn’t available in the package manager).

Do you know where I should search?

More detail:

  • the Veeam server is a physical server and is connected to the same switch as the NAS

  • Veeam server and NAS are not on the same network but there is 0 ACL about those networks (all trafic pass), gateway is the same router

I’m not looking for a direct answer about how to to solve my problem but more about what to check and where to search..



[noob question] are these just unterminated ethernet cables? If so, what's the point?

photo

For context, this is located in the room adjacent to the server room where I work. On several places next to it there is "patch row [X, LOCATION]"(translated) written next to it.



Cisco Aironet 1532 as Wireless Bridge

I would like to connect a Cisco router(4G NIM) and Cisco Catalyst Switch via Cisco Aironet 1532 (appropriate Cisco antennas installed). What would be the maximum range of the outdoor access point? Is there another product I should be considering?



Wednesday, July 21, 2021

Correlation to CPU usage and TCP throughput

Hello everyone,

I am currently doing some undergraduate network research and I am halted in this particular problem. I cannot find a logical reason to pinpoint why the TCP throughput is lower when the CPU is under stress.

Basically, I've been studying containers and testing the throughput among various types of networks and how they differ from another at a low level when using containers since they are easier to handle.

Let's say there are two containers both on the same network, one as a client and one as a server. I began using the stress-ng package to stress out the allocated CPU to 100% on the server container to check if the TCP throughput is affected by the lack of CPU resources. It is.

Into normal circumstances let's say the network bus communication is about 34 Gbps in this particular network. When using the stress-ng on the server it gets about 25 Gbps but the latency does not get too much affected (no more than 15ms on average).

Any hints I can look in more depth to find the culprit into this particular situation?



UPS Help

Hello guys recently I moved to California and for some reason they can’t keep consistent power. Once a month we lose power for about 10-20 min. Many times I’m on my PC and I don’t get to save my work which is frustrating. What UPS with uninterrupted power should I get to run my pc for atleast 30 min. I have a 850 watt pc. I don’t fully understand all these electrical terms and I need some help thank you.



Vpn Negotiations Phase 1 and 2

For phase 1 tunnel negotiations symmetric algo is used and the key is securely generated using dh groups and in phase 2 tunnel negotiations esp protocol is used for securing data and esp uses aes algo (for eg) for encryption but how key is generated on both devices in phase 2 how other device decrypts the encrypted data?



Packet Capture - Long Term Options

Hi,

Wondering if anyone is running packet capture software that captures all the time? Have seen one or two products, they have some issues capturing sometimes in Azure or AWS though. Usually needs to be inline, where in the DC you can do a span or tap to a dedicated device. We want something that we can go back in time and see metadata or even the raw wireshark, depending on time frame and storage of course.

Anyone using anything good out there to do this?



Nexus 9k with sflow - Resource Utilization

We use a Nexus 9k as one of our edge routers - we don't do NAT or anything crazy, BGP with 3 peers and not taking full tables.

As many of you know its tough finding a cost effective router that can do 100gbps. The jump from a layer 3 switch to an actual router is quite big at these port speeds. I've seen some decent deals on Juniper's but I'm a Cisco guy and not sure I'm ready to make the jump.

So my question is, has anyone with a similar setup seen any major performance issues enabling sflow pushing 20gbps to 40gbps traffic at peak on a Nexus 9k? I'd like to implement this so that I can setup some automatic DDoS mitigation.



Why does does an interface on the internet switch still allow devices to access the internet when you shut down the associated VLAN?

This may be a dumb question but I'm a noob trying to wrap my head around it. We were testing a failover on an internet switch so I mistakenly shutdown the vlan interface on the switch instead of the physical interface with the vlan on it. Why did the internet still work after shutting down the VLAN? I realized this didn't work and after I shutdown the physical interface with the VLAN, the pinging stopped.



BYOIP / BGP sessions server in LA region?

Hi, I'm looking to bring my rented /32 v6 IP space onto a datacenter (routed, announced by their network since I don't have an ASN) located in Los Angeles. I was using Vultr for over a year, but they kicked me off for excessive bandwidth usage... So I need a provider with unmetered bandwidth, either 4 (4 core) servers with 1 GBPS unmetered ports, or a single server with 16 cores or higher and a 5 GBPS+ unmetered port (with my prefixes routed to them, I can try to do the BGP sessions myself if necessary). If you can do this for me, or know a provider who can, let me know. Please be aware that I will be using a lot of bandwidth 24/7, with a lot of open connections. Bare metal/dedicated servers are fine. $500/mo budget, preferably less. We can test it out for a day (I can pay a little in advance and you can keep it even if it doesn't work out) if you want to check if it'll put too much stress on your edge router.

So far I've contacted several providers on http://bgp.services/ trying to find someone who can do this, but the ones that have replied so far aren't in my preferred region and are pretty expensive.



"Pardon the Interruption" message when browsing website

Not sure if this is the correct spot to post this, but I am hoping I can get some insight on this message my client is getting. I am new and helping them with their internal IT support / networking. They are browsing on ticketmaster.com and on any browser, on any device hardwired or on wifi they are getting this message:

"Pardon the Interruption

As you were browsing something about your browser made us think you were a bot. There are a few reasons this might happen:

You're a power user moving through this website with super-human speed.

You've disabled JavaScript in your web browser

A third-party browser plugin, such as Ghostery or NoScript is preventing JavaScript from running."

https://imgur.com/NIzcI4Q

I ran different browsers in incognito. I cannot find anything online about this except for it could be fingerprinting the browser, but it is happening on every device and browser on the network.

Is this happening from the ISP or ticketmaster?

Any thoughts on how I can resolve this?

Thanks in advance.



Equinix - Recommendations on Doing An Inbound Shipment

Hi Folks-

Just wondering on the process people use when shipping equipment to an Equinix COLO?

Some vendors require a local on-site contact with a name, email and phone number. Its hard to get a name and number for someone so we usually open an inbound shipment ticket with all the shipping details and then provide the duty manager contact number.

But some vendors require a contact name and email address in order to ship the equipment.

Just wondering what other folks have done if they've encountered something like this?

Thank You!



Problem connected KG175-D to laptop for Solarwinds TFTP file download

I am trying to upgrade a KG-175D to the newest version. I have a laptop connected to it with TFTP configured on Solarwinds. I have the Taclane configured to receive the file. I also have the TFTP server configured and started on the laptop. When I started the download process on the Taclane itself, it just hangs and doesn't do anything. Does anyone have any troubleshooting steps to determine why the Taclane isn't receiving the file? The Taclane is 'Zeroized', but I don't know if that's a problem.



Packet loss on the reverse path!

A customer has a layer 2 VPLS service between 4 sites site A, B, C and D.

A to D and D to A is fine. No issues no packet loss.

A to B 30% packet loss sometimes more B to A no packet loss.

A to C 40% packet loss C to A no packet loss.

The ISP is stumped as to why this is happening. Has anyone got any ideas?



Looking for advice on a low cable POE solution

Hey there, I work as Lighting Console Programmer in the film industry. Long story short, I’m looking to run as few cables as possible to power my antenna array in order to make it more mobile. I’m trying to power 4 standard Poe devices from one Ethernet cable essentially. So I’m looking for a PD or PSE (don’t know the difference tbh) switch with 4 Poe ports to be attached and powering the devices in the array (two are art-net devices that receive data and power, the other two ports I’d like to convert to usb power for two cintenna transmitters), and one cable running back to a switch with me at my board. I’m willing to buy a Poe+ or Poe++ switch if necessary. Lower cost non-industrial gear is fine for my needs. Thanks in advance for anyone’s help!



Azure public IP routing Issue

Posted this in /r/AZURE , but posing here as well to hopefully find someone who might be able to help.

Our azure environment was originally set up for a handful of servers etc., that would route 10.0.0.0/8 over the route-based VPN gateway back to HQ and everything else would route out via a Palo alto VM in azure.

Now we want to set up a VDI environment in azure and need to route two public IP’s back to HQ so that our partners can see them coming from our usual public IP. I already asked and no they are not going to allow our azure NAT’d public IP in through their firewall.

I have tried using the route tables to push the traffic from the azure subnet to HQ, but I see the gateway subnet IP and nothing after that, and I never see the traffic on my HQ firewall. I see traffic for 10.0.0.0/8 IP’s but never the public IP’s and I don’t see anything getting dropped.

I have tried using forced tunneling and advertising custom routes but that still no luck. I tried setting up a VPN tunnel from the Azure palo to my HQ firewall but that caused other routing issues.

A packet capture on the VPN gateway and on one of the VDI VM’s doesn’t show anything helpful

If anyone has any advice on how to get this working it is greatly appreciated. Thanks in advance



CMV: Deep packet inspection breaks zero trust

Hi,

I just had a thought today, and it may be obvious/common knowledge, but I see DPI being touted as a security feature and it always rubbed me the wrong way. I think I finally found a framework to express how it rubs me the wrong way.

So for context, I mostly work in cloud, but I know datacenter too and this still applies to datacenter networking. Current best practices are to implement what's called "zero trust", which is basically just an extension/rewording of older best practices of "don't make a big central firewall". So for zero trust to exist, there cannot be a central point of trust. To build on this, it is best practice, at least in cloud, to encrypt all data in transit (in AWS, all endpoints they give you from ALBs to SQS queues are all HTTPS) even if the traffic is "internal". So, to implement DPI in this setup, you route all traffic across a centralized point that inspects the traffic and applies rules, but its encrypted so you can only get the header information.

This leaves 2 possibilities:

  • You only inspect the headers
  • You decrypt SSL on device with injected certificates

If you only inspect the headers, then what's the point of a central firewall? Especially in cloud where everything gets a firewall through security groups or equilavent, though any ol' device can do basic header filtering with minimal overhead.

If you decrypt SSL, then that creates a central point of trust since it has certificates accepted by all devices and its also a central point for data collection.

Is there something wrong with this logic? It seems that common practice is to implement it but I don't see the actual benefit of implementing it.



Cheap wireless P2P solutions?

I've used Ubiquiti NanoBeam 5ACs before with good results, but having hard time finding any under $300. Found one for $175 on Amazon. I was paying under $100 a few years ago! I get about 300Mbps file transfers between the sites at 2,500ft apart, so not bad for $200 all in.

Are there any other products that you guys recommend that I should look at for under $300? My two buildings are about 2,000ft apart with direct LOS. I'd pay a little more if I could get over 500Mbps+ file transfers.

Thanx! :D



The problem with container networking: A UDS approach.

I have been playing with Consul and Envoy UNIX Domain Socket support and I think containers have gotten networking wildly wrong. I finally managed to put it in writing and I'm interested in feedback.

https://medium.com/hashicorp-engineering/the-trouble-with-service-mesh-6b0336964323



How can i learn network building as a beginner sysadmin ?

Hello guys, i want learn how can i build networks with wifi aps for 35-45 client. I finished my school as a beginner sysadmin but we not really learnt how can we build network for a company. Somebody can help or send teach videos how can i do this in a correct way ? I really want be good as a sysadmin.

Thank you guys really.



Symptoms of UDP Stream Timeout Value too high?

TL;DR - What negative affects occur with a UDP timeout value too high? Simply more Resource usage on device or other unintended consequences?

We have a Sophos XG Firewall and have VOIP Issue over a S2S VPN with phones dropping, screen freezing, no dialtone and other odd issues.

We've increased UDP timeout to 300 previously as per KB's online which fixed calls dropping out, however the other issues still occur (albeit very rarely - sometimes once per day, several times a day or not at all).

Network is stable over VPN with no loss including pinging each handset, however I did find a thread that stated if the phone is not used, the connection on port 2727/2427 for MGCP drops and this posted has a near identical issue however trails off without a resolution. Looking into this is appears to fit our issue.



how to fragment udp packet into smaller packets ?

hello,

is there a way to fragment packet into samller packets say i have packet with packet length of 1280 i want to split this packet into smaller packets of 5 or 6 packets with maximum 320 length for example

is it possible to acheive this with linux firewall (nftables or iptables) or with any app in general in linux ?

thanks in advance



Advice if something is possible or not. (Routing related)

Hi all good folks of Reddit, hope everyone are good!

I am not a networking engineer by trade, much more on the Infrastructure and some security before networking. To please bear with me and excuse if I am asking something stupid.

First a little bit of background information on the situation.

We have a VPLS network with our ISP and with that a data centre in London and a glorified server room at a remote site. we use this server room as DR which for us means we have backup replication to it and able to switch over VMs to that site should the main site go down.

Both the datacentre and the remote site is on the VPLS network with our ISP.
The remote site has a router from our ISP and a couple of Dell S4148T-ON switches.
The data centre has a Fortigate firewall.

Our company wide ingress and egress to/from the internet is via the data centre in London.

The VPLS network is using OSPF which is something our ISP looks after.

#### The addition to the setup

My IT director decided to rent a few cabs at a different data centre because rack space was cheaper. This new data centre is located in Sheffield and is NOT part of the VPLS network.

There is a IPSEC VPN between the 2 data centres and there is a 1 Gbps point-2point between the remote site and the new Sheffield data centre. That 1 Gbps p2p connection was originally meant for just carrying backup replication and VM replication traffic between Sheffield and the remote site.

The new data centre in Sheffield also has a FortiGate firewall and a couple of Dell S4148T-ON switches.

The provider of the data centre are the ones providing that 1 Gbps link between the remote site and the new Sheffield data centre site.

Moving VM's between sites but keeping same network range

When we first set up we had our production server network on 192.168.80.0/24 in Sheffield data centre and when they failed over to the remote site during DR test or a real DR scenario we would change the IP address network to 192.168.90.0/24.

The change in IP address network was annoying me a bit because we have a couple of systems that has hardcoded an IP address, which means during a failover i would have to be present and manually go and update the system/application to use a new IP address.
As an example we could say that we have a web proxy that looks at 192.168.80.10 as a backend web server IP and during a failover that web server would have its IP changed to 10.90.90.10 which means the web proxy setup would break until i logged in and corrected it.

So I wondered if it would be a good idea to say why not expand the 192.168.80.0/24 network to cover both Sheffield data centre and the Remote Site using the 1 GBps link. That link was heavily underutilised and could carry any VLAN i wanted to.

The problem

So i was able to add that VLAN for 192.168.80.0/24 to the 1 Gbps connection and I could put VM's currently running in the remote site on that network and it would all be working.

The first problem was of course now that a DR version of a VM sat on 192.168.80.0/24 in the remote site still had the gateway IP of the firewall in the Sheffield data centre and I could not add a 2nd default gateway. So I would either have to change the default gateway when a VM failed over to the remote site or manually go and update the default gateway on all failed over VMs. Manually changing the gateway is no better than the situation i tried to prevent (manual labour during a failover).

The other thing i wanted to see if i could improve was in case the IPSEC VPN between the 2 data centres went down. how did other remote sites now get to the servers still running in Sheffield or in the remote DR site. The firewall in London would state that in order to get to 192.168.80.0/24 you got to go via the IPSEC VPN to the Sheffield datacentre.
So i thought perhaps if we can re-distribute the networks to say if the IPSEC VPN is down go to the router at the remote DR site and it can send the traffic up via the 1 GBps link.

This does work but it is a bit clunky that when i add a new network to the Sheffield DC site i have to re-distribute that network on the OSPF to say go via the IPsec VPN between the DC sites and otherwise go back to the remote DR site. and then get hold of our ISP and ask them to make their changes.

What I would like to hear from you all

Is it a bad idea to expand a subnet between main site and DR site just to avoid server re-ip addressing? ?? I am using DNS whereever i can, but sometimes that is not possible.

If the IPSEC VPN between the data centres are down, Is it worth it to pump traffic back to the remote DR site and then use the 1 GBps link? This bit does seem to be the mostly clunky "fix" i have come up with :)

The other thing i was thinking of is that if i give a VLAN an IP on the switch at the remote DR site. i believe the dell switch will route traffic without going to the actual router at the site. is that correct?

Thx for reading if you are still here :)



Firmware Network Inventory

Hello everybody,

I am writing here because I am looking for a solution that allows me to keep track of all my network devices (firewalls, switches, APs) of their firmware version in order to have a sort of inventory.

I tried to search on the net but I did not find anything like that, can someone recommend something, if it exists?

Thank you very much for your availability :-)



Tuesday, July 20, 2021

Will my router support 100mbps?

Hi, I want to know if my WiFi router can support a 100mbps internet connection. I'm currently on a 40mbps connection and want to upgrade. It is a 2.4 GHz 802.11n router which says it supports link speeds of 150mbps (checked on Windows 10) but I'm not sure if that's true. (Also the link speed on my Android device is only 72mbps, don't know why is that?)



Guest Wi-Fi: Meraki NAT mode or pfSense VLAN?

I'm creating a separate guest network for clients to access Wi-Fi but am unsure of what would be the best approach to set this up. Guest clients obviously don't need any printer access, and it seems safer to ensure they are unable to communicate with each other, too. It seems Meraki NAT mode handles this. Per the dashboard:

Clients receive IP addresses in an isolated 10.0.0.0/8 network. Clients cannot communicate with each other, but they may communicate with devices on the wired LAN if the SSID firewall settings permit.

However, I also appreciate the flexibility and power that pfSense gives me. Presently, we have separate VLANs for different networks. This is all configured on our pfSense firewall.

My question here is whether it makes more sense to configure NAT mode for the SSID within Meraki or whether I should create a separate VLAN in pfSense and configure the necessary rules here? I'm not entirely sure the magic behind Meraki's NAT mode, but it seems that even though all clients are connected on the same LAN using the 10.0.0.0/8 DHCP scope, the WAP will actually be able to reject traffic designated for clients on that same network. This is pretty cool, and would make sense here since we theoretically wouldn't want clients on guest network to communicate with one another. I'm not sure if something similar exists in pfSense.



Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.



Spoofing public IP addresses?

We’ve been asked to open port 22 to the internet for a server a company that uses our network so that their technicians can remote in and troubleshoot when needed. I’m wondering how secure it would be if we put in a rule on our firewall to only open port 22 from 1 source IP address (which would be the company who needs to remote in)? We’ll also use an alternative port for SSH, so it wouldn’t be the well known port of 22. Additionally, I plan to put this server in its own vlan with an ACL in place so that it has no visibility into the rest of our network. Is this a good solution? The only thing I could think of is if someone outside was able to somehow figure out we had this port open and then spoof their public IP to gain access to the server. How likely is that? Any other considerations I should have?



Switch/router supply delay

Hopefully this is a suitable place. Curious to know who has any HW on order and has had a significant change to product lead time.

We have an order with Arista that was initially due September. But today we’ve been told it’s been delayed to Feb ‘22! Never have I had anything remotely close to this kind of leadtime.

While we all know about this shortage, and Broadcom has indicated they won’t catch up until until November, I’m curious to know if anyone has had lead times slip like this as this was a bit unexpected.



Cisco IOS XE Privilege Levels vs Parser Views and RADIUS Integration

Hi all,

I am tasked with configuring a lot of access switches with limited access to the junior network folks. So far, I've been configuring switches using privilege levels, which has been very frustrating and not intuitive at all. That said, I have come across the parser view function and seems perfect for what I need. I can define a bunch of limited commands, without having to exclude every other command as is the case with privilege levels.

Anyways, I am going to lab this out tomorrow, but I will need this to work with RADIUS. We define access via radius. Has anyone implemented this in the past? I can not seem to find any documentation where I can specific the AV value pair to provide an admin with the appropriate view once authenticated via RADIUS.

Any help or direction would be appreciated!



Memory Utilization Question on a Cisco 6500

I'm confused as to what the actual memory utilization for this box is.

Solariwnds is showing: memory used 89%

if i check show process memory i see 94% 848618096/902315760*100 = 94%

show processes memory Processor Pool Total: 902315760 Used: 848618096 Free: 53697664 I/O Pool Total: 67108864 Used: 21605592 Free: 45503272 

If i check show memory stat history the graph shows 70%

------------------ History of Processor Mempool ------------------ 5555555555555555555555555555555555555555555555555555555555 100 90 80 70 60 50 40 30 20 10 ********************************************************** 0....5....1....1....2....2....3....3....4....4....5....5.... 0 5 0 5 0 5 0 5 0 5 Free memory per second (last 60 seconds) 5555555555555555555555555555555555555555555555555555555555 100 90 80 70 60 50 40 30 20 10 ########################################################## 0....5....1....1....2....2....3....3....4....4....5....5.... 0 5 0 5 0 5 0 5 0 5 Free memory per minute (last 60 minutes) * = maximum # = average 5555555555555555555555555555555555555555555555555555555555555555555555 100 90 80 70 60 50 40 30 20 10 ###################################################################### 0....5....1....1....2....2....3....3....4....4....5....5....6....6....7. 0 5 0 5 0 5 0 5 0 5 0 5 0 Free memory per hour (last 72 hours) * = maximum # = average ------------------ History of I/O Mempool ------------------ 6666666666666666666666666666666666666666666666666666666666 7777777777777777777777777777777777777777777777777777777777 100 90 80 70 ********************************************************** 60 ********************************************************** 50 ********************************************************** 40 ********************************************************** 30 ********************************************************** 20 ********************************************************** 10 ********************************************************** 0....5....1....1....2....2....3....3....4....4....5....5.... 0 5 0 5 0 5 0 5 0 5 Free memory per second (last 60 seconds) 6666666666666666666666666666666666666666666666666666666666 7777777777777777777777777777777777777777777777777777777777 100 90 80 70 ########################################################## 60 ########################################################## 50 ########################################################## 40 ########################################################## 30 ########################################################## 20 ########################################################## 10 ########################################################## 0....5....1....1....2....2....3....3....4....4....5....5.... 0 5 0 5 0 5 0 5 0 5 Free memory per minute (last 60 minutes) * = maximum # = average 6666666666666666666666666666666666666666666666666666666666666666666666 7777777777777777777777777777777777777777777777777777777777777777777777 100 90 80 70 ###################################################################### 60 ###################################################################### 50 ###################################################################### 40 ###################################################################### 30 ###################################################################### 20 ###################################################################### 10 ###################################################################### 0....5....1....1....2....2....3....3....4....4....5....5....6....6....7. 0 5 0 5 0 5 0 5 0 5 0 5 0 Free memory per hour (last 72 hours) * = maximum # = average 

which is correct?



Small Business upgrading to Spectrum

I've got a small business (like 10-15 computers) that is upgrading to Spectrum Business Internet (30-40mb) from ATT DSL. ATT had provided a wireless modem/router that was handling all their DHCP as well. I'm guessing I'll have to order them a cheap router and/or switch. What's a low-end business class router that I could use. Sorry, I rarely handle stuff like this, outside of work (K12) and I know I could order them a Palo Alto and Cisco switch, or just put in a Cisco switch with a layer3 license, but I don't think that would be cost-effective. I'm sure most people use more internet at home in a night than this company uses in a week. I guess a router with a built-in firewall would be nice.



Library - Diigo

About This Gig

Welcome to our Spotify music promotion gig!

We have a knowledgeable Spotify Music marketer team. The team has 5 years' experience. 

we've already completed few music promotions and received outstanding results. 

We suggest you see our profile to urge a thought about my professionalism.

Requirements

  • Song Link 
  • Public Song ( I don't promote private or country-restricted songs) 

WHY IT'S LOVED BY SO MANY? 

✓ 100% real technique and organic results 

✓ Get featured on our music portals 

✓ 100% safe and manually works through with proof 

✓ Only interested people will listen to your track - NO BOTS! 

Note: We don’t sell engagement as it is against Spotify policy. Contact us or Order Now

If you want followers, save or show, knock me before ordering.

Thank You



What is a good argument for why I am not able to install fiber?

So I am a network admin for a DoD location. We have a part of our building that is being renovated. During this renovation, they want to run new single mode fiber to some wall jacks.

My team and I do not have a lot of experience with terminating fiber. A few of us have some training from Light Brigade taking a fiber basics course, but work did not pay for us to get the certification, so none of us are certified. We also have a fiber Unicam kit that we are somewhat able to do, but even with that, sometimes it can take me multiple tries.

Our higher ups think running/terminating fiber is a simple task and think that since we troubleshoot and occasionally repair/re terminate our current multimode fiber, that we should be able to do all this in house without any issues and save the $60k we were quoted to have a professional come in and do it for us.

So I am just looking at what things you need to know to be a certified fiber installer. What skills are required besides the basic termination with a unicam kit. Or am I wrong in thinking its more complicated that what others think? I am trying to justify why we cannot do it and they need to bite the bullet and pay the bill for a professional to come in and do it.



Cisco ISE Guest portal redirect issue

I’m using a Catalyst 9300 with an embedded wireless controller (non-SD-Access) and software 17.3.3. Additionally, I have a single ISE server running v3.0.

With MAC filtering disabled on the guest WLAN the wireless clients are able to reach the ISE on tcp/8443 (so I’m guessing my firewall rules are ok), but when I try CWA on the ISE (MAC filtering enabled) the wireless clients cannot reach the guest portal.

The Authorisation Profile looks like this:

Access Type = ACCESS_ACCEPT cisco-av-pair = url-redirect-acl=ACL_WEBAUTH_REDIRECT cisco-av-pair = url-redirect=https://<ISE_PSN_IP>:port/portal/gateway?sessionId=SessionIdValue&portal=c7953325-4b27-487b-8172-9b1a1efe6972&action=cwa 

The redirect ACL looks like this:

ip access-list extended ACL_WEBAUTH_REDIRECT deny udp any eq bootpc any eq bootps deny udp any any eq domain deny tcp any host <ISE PSN> eq 8443 permit tcp any any eq www permit tcp any any eq 443 

If I try using MAB on the wired network (using the same Authorisation Profile, and consequently the same redirect ACL on the switch) it does work. The redirect ACL works, and I’m able to reach the guest portal. The wired and wireless subnets are different, but they're much the same in terms of topology and firewall policy.

Any help is greatly appreciated!



Wlan0 and Wlan1 keep switching

My pi’s wireless card is wlan1 and I have a Alfa awus036ach that’s supposed to be wlan0. I was already confused, cause I thought the pi was supposed to stay wlan0 and anything new would be wlan1. But when I first set it up my Alfa was wlan0 so I just went with it. But now when I boot up, the pi is wlan0 and Alfa is wlan1. I got scripts that need Alfa to be wlan0 and it’d be tedious to change them. It takes about 5 reboots before the pi is wlan1 and Alfa is wlan0. I assume this is a problem? I feel like I’m having to trick the system by rebooting so many times. Does anyone know how to make my pi stay with wlan1 and my Alfa stay with wlan0? I’m on Kali arm64bit if that helps.



Is it too soon to make a career move? Even for a life changing opportunity?

Hey guys. I wanted to get some professional advice regarding a position that I could potentially be offered very soon.

The job is as a Senior Network Engineer for a very large and well known healthcare company. Currently, I work for a much smaller but still decently sized private medical practice and I am the only network engineer (as well as with my assistant).

I love my current job if I’m being honest. Pay is good, 75k, and I get 5 weeks PTO and honestly the job is very easy… sometimes too easy at times but yea it’s great and lots of freedom. I wasn’t looking for a new position at all.

Well, here is the big thing about this new position… the pay is between 145k and 175k on a one year contract to hire. I always told myself I would never take a contract again, but at this salary point it’s a lot different.

If I left my current position I would definitely be screwing them over. Ive only been there a year and before that I was at a different company for only a year as well. I have a lot of projects I’m involved in right now and also just took took a two week vacation.

What would you guys do? I know it’s not always about the money but this seems life changing. I may never get a chance to make this much again in my life and a big part of me really wants to make the move…



When do you think network engineering as a career really caught traction?

Cisco certification first became available in 1998. I'm asking purely out of curiosity, there are many that have been working as network engineers for 20+ years, some 10 years, some 2. Then there are guys like Keith Barker who evidentially have been working in IT/networking well before the Cisco certs from back in the 80s. I understand too that many us (me included) kinda stumbled into our networking career from some other IT-related position, some waited until after 40 yrs of age to change careers into tech, but in your opinion, when did the surge really happen where we see that uptick in techs specifically seeking to become network professionals?



Difference between 'port' and 'interface' ?

When we say a port on some device, be it switch or router, it means the physical place where we plug in a cable.
And when we use the term 'interface' related to some device, does it mean the logical part or the software representation where we configure it ?

I see the terms are used interchangeably, did I get it right? Also can someone explain it more?



Partnumber for the smaller H3C mounting bracket for JE068A and many more

Hello, does anyone know the partnumber that fits this swtich JE068A? And also many more models?

Thank you very much.



Monday, July 19, 2021

Is it Alright to Team NICS From Different Manufacturers?

I’m curious because I’d like more bandwidth for my server and PC, but I don’t want to spend twice as much getting on 2.5Gb networking gear. I was hoping to just get gigabit cards and pair them with the onboard gigabit NICs in my server and my PC.



Could you please recommend HBA adapters with hardware RAID 5/6 that are 100% compatible with JBOD SuperChassis 826BE1C-R741JBOD. The current HBA-adapter LSI SAS 9300-8e doesn't have hardware RAID capabilities.

We have Supermicro SuperChassis 826BE1C-R741JBOD, with 12 * 12TB SAS hard disks installed.

We would like to connect it to HP DL380 Gen10 server.

We bought an HBA adapter (LSI SAS 9300-8e), but it turned out that this adapter didn't have any hardware RAID capabilities. Sadly for this particular adapter, there is no IR firmware, only IT.

We tried creating software RAID using windows server 2016 (Storage Spaces), but the performance wasn't great for our applications - oracle database, especially because of the low IPOS, and slow read/write speed for small blocks. Although it is acceptable for file storage (linear read/write speed is quite high).

What HBA adapters with hardware raid capabilities could you recommend? I mean that is 100% compatible with our Supermicro SuperChassis 826BE1C-R741JBOD.

Our applications: a fileserver for long-term file storage, and an oracle database (backup server with low-medium load) - but in this case, the JBOD (and HBA adapter) must have reasonable read/write speed for small blocks.

Required space for a database - 10 TB. Anything else for files storage.

OS: Windows server 2016.

Maybe you could recommend a structure on how to organize storage.

Currently, we have all disks in one storage spaces volume (mirror).

And an additional question:

There is MegaRaid Storage Manager. But what is it? Is it a hardware RAID solution? Or a software raid, or something in between?

Is it better than windows software raid? Will MegaRaid Storage Manage work on my LSI SAS 9300-8e HBA adapter.



BGP Routes

Hey guys! Some time ago I came across a website that allowed you to enter an IP address and it would return the different ASNs used to get directly to the final AS. My problem is that I can't remember the website!

I am aware of sites like https://bgp.he.net where it lists (or maps) all peers, this is not what I am looking for.

Please excuse the very basic example. Let's say AS1 peers with AS2, AS4, AS5, AS8, AS9, AS22, and AS24; and had the blocks 1.1.1.1/24, 2.2.2.2/24 and 3.3.3.3/24. 1.1.1.1/24 is announced with AS2, AS4, AS8, and AS22. 2.2.2.2/24 is announced with AS4, AS5, AS9, and AS24. 3.3.3.3/24 is announced with AS4 and AS5.

If I was on this website I am searching for and entered the IP 3.3.3.37, it would return AS4 and AS5.

Does anyone have any idea what I am referring to? I've been Googling trying to find the site but the majority of what I find is documentation for different routers with the occasional looking glass.

TIA!



Which SSH Clients are worth using?

I am looking into different terminal clients to see if we should renew our SecureCRT or not. I have been looking into Terminus and SolarPutty(hate the adds though)so far and am curious which ones people have had good experiences with or ones people wouldn't recommend and why. Thanks in advance for the help!



Linksys MX8500 and MX5300

On the 2.4Ghz side of both units. I know how to adjust with the main unit. How do I get into the second unit to manually adjust on the 2.4GHz side?

My setup

Modem>Parent MX8500>Switch>Child MX5300



Flashing a open source firmware on a cellular modem

Backstory:

So little backstory, the company I work for require 100s of monitoring stations all over and they all run on cellular modems, I thought I would cheap out and buy cheap Chinese modems. And whilst they work, after looking into them more in depth, I don't trust them with any of the data, or any of the IPs of the corporate servers they're going to be calling into. And the reason why I'm trying to figure this out is cause I've got 100s sitting in a box at work pretty much e-waste, so I'm going to go to pretty far extents to try to get these things reliable and secure.

Question:

Would I be able to flash/load the firmware of an open source project on to it, to re-gain security back on the modems, I've looking inside and it's an ARM Processor with a cellular card installed (Quectel EC25-A)

Here is also a few phones if your curious about the config: https://imgur.com/a/ssuq1kt

The model is the USR-G781 (I'm not posting links cause I'm even sketched out about their website)

Thanks everyone



BGP beginner to Advanced

Hey all - any of you can recommend a beginner to advanced BGP training/study materials? I know all of it can’t be covered as real life scenarios can bring different paths in the environment but to learn the concept deeply on the bgp protocol would be great with possible videos/lab or something similar.



TCP issue

Dealing with an issue where TCP not completing and times out.

The sender says timeout. The recievers PCAP shows the senders the TCP SYN, but the reciever replies immediately with a TCP RST/ACK.

Cause of that the TCP session fails to form and nothing is sent.

Does anyone know of or have an official document (preferably RFC) which covers the potential flags and causes of those flags when an RST and RST ACK is sent? That would help with diagnosis greatly. And my Google Fu is failing me on this one.

Thanks



Do you know of any autofill software that fills out typical job application information?

I am in the process of looking for work, and I'm spending a lot of time filling out the same information repeatedly (previous employers, dates hired, reasons I left, and so on).

Is there any software that could help make this process easier?



Our company's new phone service provider doesn't verify TLS certificates -- what does this mean?

Recently switched phone service providers to some dinky low-end company from New York cuz its cheaper. When configuring SIP user accounts in our softphones, they tell us to disable 'Verify TLS Certificate'. Also, they want us using TCP instead of UDP, which seemed odd to me. Shouldn't VOIP avoid TCP?

Mainly, I'm concerned about the security of our calls now, which contains customer payment info.

Is this normal practice for softphone configuration? Should I be concerned about call information being monitored by third parties?



N9K-C93180YC-EX alternative (24/48 - 25gb ports, 6+ 100Gb ports)

So since my last post we deployed pair of N9K-C93180YC-EX and they are working like a charm.

And now we need to deploy similar setup at two other DCs but price for these nexuses on used marked jumped 100%. Any other good alternatives ? I was looking at two SN2100 but they lack 25gb ports and can only accept 4.5w transceivers on 4 ports (which limits us a lot)

Arista and juniper models which I found cost even more..



Software for Organizing Network Devices/Addresses

What kind of software do you use or recommend for managing network IP addresses and devices in a company? I'm currently using excel but would like a sleeker program to use.

Thank you.



NSX for network overlay without a 2nd network overlay

Hi I'm looking into a network refresh for a Data Center, the predominant architecture is to use VMware for a software defined DC I'm trying to understand if using something ACI is necessary to work with NSX if NSX would cover most of the use cases.

It's around 4 spine and maybe 10-15 leaf switches. Please could someone help me navigate this? Ive read far too many blueprints that don't really give a solid answer with everyone trying to sell their products...



Ruckus ICX errors fdry2bcm_linkscan_callback

Ram into 7 switches in a QinQ that froze up and had to be rebooted. This is the only error (log) i could get from any of the consoles. Anyone seen this before?

17 Comm rooms with 11 of these rooms having switches behind running in QinQ. Main network was fine (lags went into blocking state) but all accessible. 7 of the switches on QinQ connections were froze.

fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message
fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message
fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message
fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message
fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message
fdry2bcm_linkscan_callback port 0/17 1 1 1 100 1: failed to send message

Thoughts?



Cumulus dropping non-Nvidia hardware?

I stumbled on this nugget looking at the release notes for Cumulus Linux 4.4:

Unsupported Platforms

Cumulus Linux 4.4 supports NVIDIA Spectrum-based ASIC platforms only. This release removes support for Broadcom-based networking ASICs. Broadcom-based ASICs will continue to be supported throughout the life of the Cumulus Linux 3.7 and 4.3 releases.

Has anyone heard anything about Nvidia making Cumulus an internal NOS only? I can only find news about the acquisition a year ago.

I'm in the market for another switch but this would change that calculus.



How to see how much of our purchased bandwidth we use at my work?

What would be the best way to see CORE uplink bandwidth utilization?

Long story short we have a 500mbps up/down dedicated fiber and I'm being asked by management if that is overkill or not. I'm hoping to find a way to see real time usage on that interface so I can get a better idea of whether 500mbps is to much bandwidth for us or just enough.

We use palo alto firewalls, and I also have solar winds at my disposal if that helps