Is there more of an automation/programmability use case in ServerEng vs NetEng?

Pretty much the title.

• Certifications/education: The current flagship certification (CCIE) consists entirely of learning a proprietary operating system with no education about writing your own modules or writing any code at all. On the other hand, certain MCSE tracks include the basics of powershell. The RHCE also includes some basic shell scripting. I'm choosing these certifications to try my best at making equivalents but please correct me if I'm wrong.

• Coding: Most NetEng I've worked with do not know any coding at all. Their automation is limited to column highlighting with N++ and find/replace. Sometimes extremely basic regex. Certainly no config management, automated provisoning, orchestration, etc. But maybe that's because this use case doesn't exist or isn't as strong in networking? I'd love to hear from some of you on this.

• Proximity to developers: SysEng is way closer to developers (people who only code and do little to no Ops). So they feel more pressure to automate QA build-outs (VMs, DBs, LB configs, etc.) because the business puts pressure on SysEng to not delay Dev as that directly impacts profits.

To frame the question another way, if someone knows they love automation/coding but also knows they don't want to do development and would rather do operations, would they have more opportunity to code/automate if they went the NetEng route or the SysEng route?

These are some of the comparisons I've tried to make but I'd love to hear from people who have had more exposure to this in their career. Is there more of a use case for automation/coding in ServerEng than NetEng?

Wireless planning for unfinished buildings

Hello community. I've been given a project to design and implement the data infrastructure for an in-construction, 4,000 seat "mega"church. The structure will be a three level amphitheater-like design with a few adjacent rooms for office/study. MDF and IDF locations are set.

We were not involved in the initial design of the building. The original plans call for AP location rimming the back wall of each level with a horizontal cone. Since the plans were drawn, the original electrician has been let go, and the new electrical contractor is itching for us to give them new drop locations. They somehow determined 50 APs total, but just guessed at this number from what I can see, as well as original drop points.

My question is this: the building is only ~60% complete. In a typical project, we'll use carts for a site survey in an existing space. Any advice or experience on how to best figure this out using only floor plans and a partially completed space we can't have unfettered access to?

ASA Authentication using RADIUS?

Hi folks, hoping this will be an easy one. I'm trying to configure my ASA to use RADIUS authentication with a Microsoft NPS server. I want to use this identity source for both VPN users and admins. What I don't want is to have admin/CLI users to be able to hit the VPN and vice versa. Currently, admins can authenticate using AnyConnect so there seems to be a policy conflict. Has anyone set up the ASA AAA in this scenario or similar? I can provide configs as needed. Thanks in advance.

Fortigate 200E issues when replacing a Cisco ISR 4331.... Help?

I attempted to replace our ISR 4331 last night, but ran into some issues, and was hoping someone out there can help me out. I'll buy you reddit gold! Think of the possibilities ;)

We currently have:

ISR / Cisco Core Switch / Cisco Workstation Switch

Essentially, I want to replace the ISR4331, with a FortiGate 200E. Here is the information I can give you - let me know if you need more:

Port Config on Cisco ISR:

interface GigabitEthernet0/0/0 description Interface to Internet ip address xxx.xxx.xxx.xxx 255.255.255.248 ip nat outside ip nbar protocol-discovery zone-member security OUTSIDE negotiation auto ! interface GigabitEthernet0/0/1 description Po1 to Core Switch no ip address ip nbar protocol-discovery negotiation auto channel-group 1 mode active ! interface GigabitEthernet0/1/0 switchport mode access 

---

Other config on Cisco ISR:

interface Vlan20 no ip address ip helper-address 192.168.2.20 ! ip access-list extended NAT_LIST deny ip any host 67.226.181.231 permit ip 192.168.2.0 0.0.0.255 any permit ip 192.168.3.0 0.0.0.255 any permit ip 192.168.5.0 0.0.0.255 any permit ip 192.168.8.0 0.0.0.127 any permit ip 192.168.9.0 0.0.0.255 any permit icmp any any echo permit icmp any any echo-reply ! interface Port-channel1 description Po0 to Core Switch Po4 no ip address no negotiation auto ! interface Port-channel1.20 description Production VLAN20 Subinterface encapsulation dot1Q 20 ip address 192.168.2.1 255.255.255.0 ip nat inside zone-member security INSIDE ! interface Port-channel1.30 description DMZ VLAN30 Subinterface encapsulation dot1Q 30 ip address 192.168.3.1 255.255.255.0 ip nat inside zone-member security INSIDE ! interface Port-channel1.50 description DTE VLAN 50 Subinterface encapsulation dot1Q 50 ip address 192.168.5.1 255.255.255.0 ip nat inside zone-member security INSIDE ! interface Port-channel1.80 description Management 80 Subinterface encapsulation dot1Q 80 ip address 192.168.8.1 255.255.255.128 ip nat inside zone-member security INSIDE ! interface Port-channel1.90 description Storage 90 Subinterface encapsulation dot1Q 90 ip address 192.168.9.1 255.255.255.0 ip nat inside zone-member security INSIDE --------------- 

Cisco Workstation Switch Config for port TO Cisco Core Switch:

interface GigabitEthernet0/48 description Uplink trunk to server switches switchport access vlan 20 switchport trunk native vlan 20 switchport trunk allowed vlan 20 switchport mode access spanning-tree portfast channel-group 1 mode passive --------------- 

Port config on Cisco Core switch for the port FROM Cisco ISR (Future FortiGate200E):

interface GigabitEthernet1/0/10 description to Cisco4331 Gi0/0/1 (Po1) switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate channel-group 4 mode active --------------- 

Config on new Fortigate 200E (Replacing Cisco ISR)

Interfaces: port1 (Plugs into same port the Cisco ISR plugged into for the Cisco core switch) IP/Mask -> 192.168.2.1 255.255.255.0 (no way to assign the default VLAN ID as 20??) L___VLAN 30 Subnet 192.168.3.1 255.255.255.0 L___VLAN 50 Subnet 192.168.5.1 255.255.255.0 L___VLAN 80 Subnet 192.168.8.1 255.255.255.128 wan1 (Plugs into the same port the ISR plugged into for the internet) IP/Mask -> xxx.xxx.xxx.xxx 255.255.255.248 Static Routes: I don't believe static routes are required, as they are all on the same port (port1) on the Foritgate... but I have tried with them as well, with no luck. Policies: I've tried setting a policy where all traffic to and from 2.x, 3.x, 5.x, and 8.x are allowed-and I tried with and without NAT enabled. --------------- 

Now, what happens when I plug in the 200E and turn off the ISR, is that internet works great.... traffic from within the 2.x (VLAN20) seems to work flawlessly.

Servers, computers, printers, anything on the 2.x (VLAN20) subnet seem to work just fine; VLAN 30,50, and 80 however, do not.

I have a feeling it's because the core switch configuration may be causing the issue here, however I don't know for sure.

Is there something I can do to make the Cisco Core & Workstation switch play friendly with the 200E? Could trunk encapsulation be causing this?

Perhaps that there is no 'default VLAN' set on the 200E? (I don't know where to set this for some reason.... only know how to add them, however I want the default IP to be 192.168.2.1, and the 200E won't let me set a VLAN 20 with 2.x, because the 'default' subnet is currently using that subnet.

Thanks in advance for your help!

Hi I am trying to find where to set the snmp setting on a vocality router version 8_51.05. Can anyone give any guidance thanks

Best Practice for securing upcoming IoT in corporate network.

Whats is the best approach to secure upcoming IoT devices in a corporate network? How to I go about to secure the network for devices such as a temperature sensor probes that requests internet access to the Wi-Fi and also wired HVAC systems that are managed remotely? I create separate vlans and put access lists? Or should I use a DMZ?

Thanks

VPN options?

Currently using a Pulse Connect Secure PSA appliance which we've had no issues with.

We need to add some capacity which is around $4-5k so it seems sensible just to check if there is any viable alternative.

We don't do much with the PSA

• Role Mapping
• RDP and HTML5
• Web Bookmarks
• Host Checker

And our users are split between users who establish a Pulse network level connection and those who use RDP through the web portal.

Firewall is SRX and we're virtual so virtual appliance is an option.

ELI5 How to condense IPv6 addresses without 0's?

As you can see here, we have an IPv6 address. He says anything with 0s can be skipped, just include the colons... Well, after aaaa:, there are FOUR colons. But he only includes two of them. Shouldn't it be aaaa::::dd? I don't get it...

site-to-site mesh backhaul with spoking sub mesh, and link bonding to internet.

Baiscally I am just wondering on the validity of this being possible.

If I say, have four neighborhoods in corners of a small city, that have their own small mesh networks, is it possible to plug in a long range radio and have all of them pipe together?

The other part, is link bonding withing the mesh. Each person with a mesh AP plugs their internet connection into the mesh network via that AP, is it possible to link bond within the small mesh, then run it out of the back haul stated before,between all of the smaller meshes?

I know this is an extremely long shot. I just wanted to satisfy my pedantic mind by getting an answer either way.

How does a DNS resolver work?

I've been looking on the internet how DNS work but so far I have only found explanations that are very superficial about it.

What I understand so far is that there 13 root servers. First you make a request to your DNS server, if its in cache it will reply with the IP, if not then they send the request to a root server, they will reply to look at an authorative Top domain DNS server (Let's say .com) and then those servers will reply to look at the nameserver DNS, which will return an IP if it exists.

From my understanding this are 3 layers. You got your root servers, top domain servers and the nameserver. An average user who owns a website will be able to control the nameserver and the registrar which links your domain name to a nameserver of your choice.

My question is how does a DNS resolver work. Like Google have their own DNS (8.8.8.8 and 4.4.4.4) but how do they set it up so they can query root servers, then top domain name server and finally the name server. Can an average user have their own DNS resolver? Or you need to be some sort of business or ISP to do it?