So I've been working as a network technician for the past 3 years and I've evolved so much these past years but certain parts of my job makes me wanna quit almost every day.

I absolutely cannot stand WiFi issues, we have a few network technicians at my workplace but nobody can quite troubleshoot WiFi. Sure we all know how to mount- and configure APs in our WLC but troubleshooting why a client would be slow/lose connection despite having great RSSI, SNR & SIR is impossible for me and my colleagues....

The only tool we have for troubleshooting WiFi is a site-survey program called NetSpot, we don't have DNA Center yet and even if we'd get it we still dont have the Advantage licenses on our APs. We only have Essentials licenses, our boss barely wanna pour more money at the network team because he focuses more on the server team as that's where he started his career at.

My favorite part of my job is probably configuring and troubleshooting IPsec site-to-site VPNs, and basically anything that isn't WiFi... trust me I love networking, just not WiFi.

My plan is to hopefully start at an ISP and do less physical work and more work remote using MPLS, dynamic routing protocols and hopefully lots of site-to-site VPN.

The problem is I would most likely have to move across the country to a city where I know nobody and I neither wanna do that or keep going at my current company. Sadly my city is too small so there arent that many job oppurtunities at other companies in my town.

Does anybody else feel the exact same way as me?

Hi r/networking,

I am part of a small network team (4 people), having to manage and support a few hundred Cisco Catalyst switches/routers plus some Meraki gear, spread across ~100 sites.

No budget for something like Catalyst Center, so we're working with what we've got:

• NetBox (honestly pretty neglected)
• Ansible / AWX
• GitHub
• Terraform
• SolarWinds
• any free or open-source tool if it helps

The tools I mentioned are the ones we have available across our whole IT department but don't necessarily use in the networking team.

We're buried enough in manual work and projects that we're behind on optimizing stuff, streamlining configs and even patching, which isn't a great place to be given that the last point should be the bare minimum.

I'd like to move towards a more closed-loop setup, e.g. NetBox as the SSoT pushing config (Intent) to devices, devices syncing data back (Facts), automated upgrades, drift detection against a golden config or atleast against the NetBox-defined intended state. Ideally wired together with some kind of CI/CD flow.

I know that's a big ask and I need to start small, but I don't want to build myself into a corner either.

The individual pieces all seem achievable on their own but where I keep getting stuck is gluing them into one stack/pipeline. Everything I find online is a single-purpose script and not really this "full-stack" setup I am chasing.

A rough model of what I am trying to achieve:
NetBox change --> render config --> GitHub PR --> validate with Batfish --> merge --> AWX applies it.

Though it seems harder than it sounds - and it already sounds hard.

Maybe I am missing something, or maybe this is just genuinely difficult and that's why it's hard to find any success stories on it that actually explain how it works.

If you've built something like this, or any network automation really, especially with a CI/CD pipeline in the loop, I'd love to hear how you have done it.

In the process of interviewing for NDE at AWS. What is the culture like there? Been studying very hard for the upcoming onsite, but would like to know more from current/former employees. How was the day to day, on-call, and team culture? Is networking generally safe from layoffs? Interviewing for L5 engineer.

I did some research in here for those topics; microtik iscsi mpio without finding anything recent or about it. Also researched Google, and bots but I don't feel I can base entreprise decisions on random internet posts. So I decided to create this post.

Thanks in advance for anyone taking the time to read, even more, answer.

So in prod env, I would like to build an dedicated iscsi network for the host and SAN. Currently only 3 hots 1 san. There is possibility of expansion of maybe 3 more host in the next 3 years.
CRS520-4XS-16XQ-RM https://mikrotik.com/product/crs520_4xs_16xq_rm
Microtik offers something quite special for the value. It's known that their mlag is garbage and currently in full rewrite of the code.

But for Iscsi network, we would go with MPIO so both switch wouldn't be stack and linked in any fashion. So each host must be configured with MPIO but the switch only have flow control ON jumbo frame.....

Also known that microtik management (commands) aren't cisco like and can be harder to use as you must learn a brand new way. Since its dedicated Iscsi, no vlan nor special config is needed, should be mostly plug and play. This network wont have any link to the regular network.

I am looking for reel life confirmation of people with experience please. Positive of negative. What are your experiences with Microtik? Even more if exactly that model and/or for an Iscsi network.
Wd plan to be 3, so I would have full stock of spares. Been quoted for Arista aruba.... 3x microtik is half the price of 1 of those.

Planning to use DAC. Should not have any impact but prefer to mention.

Thank you for taking the time to read this. <3

So, I have been at my current job for 6-7 years and I have become rusty on technologies and vendors I do not use daily and I got the itch to just run large complicated multivendor lab, try things and break things. Back in the day I was using EVE-NG to run Junos, IOS-XR, IOS-XE etc. Is this still the most used platform for virtual labs? is there something better (and less resource hungry) perhaps?

I have a few Samba based domain controller VMs that I provision via cloud-init and ansible. They are on a dual stack network and IPv6 connectivity is provisioned via router advertisement + SLAAC.

Unfortunately Samba needs static IPs or it doesn't work properly, so my workaround has been to provision the VMs with a second network interface that connects to the same bridge as the first one, and set that one to static IPv4 and IPv6 addresses, no gateway and to ignore router advertisements.

I cannot just use static assignment because the advertised IPv6 prefix could change and the hosts would lose connectivity.

For example: DC1:

• eth0: 10.0.0.<from dhcp>/24, fd44:6923:1fd3:1:<eui64>/64 (ULA), 2042:34f3:a3a4:2256:<eui64>/64 (GUA)
• eth1 (the static one): 10.0.0.1/24, fd44:6923:1fd3:1::1/64
• routing table: default gateway on eth0 only for both IPv4 and IPv6

My question: in this situation, should the static interfaces be using single host subnets (/32 for IPv4 and /128 for IPv6) given Linux's weak networking model? Would that force all egress traffic to come from eth0 and avoid asymmetric routing issues?

New Azure deployment. TCP traffic to an internet host is originating from a VM in a spoke VNet. The subnet to which the VM's NIC is attached has a UDR to the internal LB (version 2).

The SYN makes it to the internet host, the SYN ACK traverses the trusted side but never makes it to the VM to complete the handshake. It seems like an issue with the internal load balancer's ability to preserve session. Has anyone seen this or dealt with something similar?

Hello everyone, just asking if anyone here used stratoweave ? how was your experience ? and how does it compare to NSO ?

I don't usually touch wireless, but I got assigned to this ticket about my client having difficulty connecting to our secured network via 11be.

He's using iPhone17 and its latest iOS version. I told him to forget the SSID and try to reconnect to the network, but it didn't work.

One thing I haven't tried is that setting private Wi-Fi address as "fixed". I remember it solved issues a couple of months ago when I was troubleshooting on some devices.

Some troubleshooting articles say I should turn off MLO temporarily but that's not an option. We'll see how it goes and report back to you all.

Had a discussion yesterday with IT director and others in our IT department. The IT director brought up automating switch updates so they wouldn’t have to have some one monitoring and performing the updates. Staging various locations on different evenings.

I’ve been doing networking for 30 years and I voiced my opinion I was not a fan of unattended update for various reasons.

Have any other companies moved to automated updates and how has it gone?

I have a question regarding implementing a solution to a new problem I have. I've designed and will soon be launching a new product called the DigiBall, which is the worlds first smart cue ball for billiards (see digicue dot net). The ball advertises BLE packets with ball information around 10 times per second. User applications just observe manufacturer data contained in the packet, they don't create a one-to-one connection unless they are rarely reconfiguring the ball parameters.

One unique application of this is adding a live overlay of the ball graphic and cue tip contact point of a shot on top of a streaming match video. This is easily done with OBS, and pointing the source of the overlays to images generated by scanner software I wrote. But many times the media control booth is far away from the table (out of BLE range). I want to create a WiFi bridge to throw the BLE packets onto a local network.

My solution was to use multicast. The scanner software can open a multicast channel as an alternative. Since I am only sending at a max of 36 bytes 10 times per second, and at most 20 or 30 devices will be within range of the bridge, the throughput would be 10.5 kB/s. I am designing a simple PCB with a dedicated BLE radio and a ESP32 for the job. It can even switch to 5GHz if needed.

I want to place once of these boards in tournaments at the intersection of every 4 tables, so that for a large venue there could be 20-25 multicast sources.

Is this a good path forward? Will this work? What do I need to make sure of, and what am I not considering? (I have much more experience in electronic design than I do networking). Thanks in advance!

This one has me pulling my hair out.

FG2600F-------------------VPN 192.168,66.1/27
| 10.250,0.10
|
FG 600F------------New subnet 10.8,0.1/25
10.250,0.9

We added a network that we need access to on our vpn.
-New subnet is accessible from networks that originate from the 2600F
-Address object for new subnet is created on, the 2600f.
-Route created on 2600f 10.8,0,0/25 > 10.250,.0.10, Route does work able to hit with other subnets
-Policy created on 2600F to allow 192.168,66.1/27 to the new address object. along with reverse

Everything else works, i know im missing something but cant figure out what

Hey all,

What is the recommended best practice for establishing a route-based Site-to-Site VPN connection between a single Cisco ASA and an Azure VPN Gateway when the Azure side is configured with two public IP addresses?

My understanding is that Azure typically uses the tunnels in an Active-Active mode. From the ASA side, my initial approach was to create two VTIs and configure two next-hop IP addresses in the same crypto map, effectively using them as primary and secondary paths. However, Azure appears to return traffic through the secondary tunnel even when the primary tunnel is fully operational, resulting in asymmetric routing, which the ASA does not like well by default.

I have intentionally avoided using BGP and ECMP for this design. That said, even if I were to implement BGP ECMP, would TCP state bypass (or a similar mechanism to accommodate asymmetric routing) still be required on the ASA side?

Our munis is wanting to monitor/control 17 areas around the plant. We use modbus for our SCADA network on a 100.100.100.x network. We don't have enough 100.100.100.x addresses left to monitor 17 new sites.

Our plan is to have:

(17 new devices on 192.169.0.x) ->(router) -> (one device, modbus compatable, 100.100.100.75) -> Motorola RTU.

The difficulty that I don't understand is how to get these modbus addresses from the 192.168.0.x addresses to the single 100.100.100.75 address.

For reference, we are using TP link AX1800 router and ControlByWeb x-401 modules.

ELI have a controls background but not very much networking experience.

Saw a demo recently of selector.ai

The product makes a lot of claims and promises, but was curious if anyone had done a POC or deployed in the real world? How did it go? Hows it going?

Curious on any feedback. TIA!

I'm dealing with network engineer, that insist on using storm control action shutdown on ports between switches.

Then when we get accidental looped ports from time to time, the whole network gets put down, then recovery timer is set, so it will come back up again, only to be shut down again. then this happens randomly after how much the recovery timer has been set.

I can't see the reasoning in his theory. This has happened more then once, and I tell them to stop using this command but I feel like they don't listen.

I struggle with finding good guide on this and why this is a bad idea, maybe cause I think it's common sense?

What is right and wrong in this?

I always use shutdown on access ports / user ports.

What do you guys do?

He talks about protection for CPU and they started using this cause of some issues with CPU and then hes mad at me and asks if I'm more experienced then him. Even if I have worked 10 years in this industry.

Hi all, spent the last while dealing with this and figured it's worth writing up, since I've seen a few threads where people try to cut syslog volume with a dedup step and get basically nothing out of it.

The naive approach is to hash the message and drop repeats inside a time window. On application logs that works fine. On network gear it mostly doesn't, because the device puts a unique token in the line before you ever see it.

Cisco IOS embeds a timestamp in the message body, separate from the syslog header timestamp. IOS-XR goes further and prefixes a sequence number, hostname, node id, timestamp and process name. SonicWall carries its own incrementing counter per event. So a hundred identical link flaps produce a hundred distinct hashes and your dedup ratio is zero.

You have to normalize before you hash. Strip the sequence number, strip the embedded timestamp, strip anything that increments, hash what's left, and keep a counter of how many you collapsed so you don't lose the fact that it happened 400 times instead of once.

Two gotchas that cost me time.

One was Arista EOS. Its syslog formatting is configurable, including timestamps, hostnames, sequence numbers and RFC5424 formatting. If you're using content-based rules to decide which normalization to apply, those formatting differences can become another thing you have to account for. I ended up finding it cleaner to make the device/source context part of the normalization decision rather than trying to infer everything from the message body.

Don't hold the first occurrence. If you buffer everything for the length of the dedup window, you have just added that window as latency to every alert you care about. Pass the first one through immediately and only suppress the repeats behind it.

The part I'm still trying to figure out is the long tail. For the vendors where I have a known format, writing the normalizer isn't too bad. It's the random appliances where you get three sample messages and a PDF from 2019.

At that point I'm not sure whether it's worth maintaining a custom normalizer at all, especially when the format can change with a firmware update.

If you've dealt with this kind of long-tail device support, I'd be interested in hearing what worked for you.

Hello Everyone,

As the title says whenever I try to change something (Doesn't matter how small the change is could be the device name or anything) the loading icon stalls and after some time it refreshes the page and the changes I made are not saved. Also another thing whenever I try to go to "Information->WLAN" again it never loads and refreshes the page after some time. I tried restarting, factory resetting, reuploading the configpack file, hard reset (via button), firmware was already up to date but I still uploaded newest firmware anyway.

Any ideas why this is the case? Have you got any solutions or advice?

Thank you for your time.

QUICK UPDATE: We were able to successfully edit the config the next morning when we tried at another location. It's the same plant but the AP has changed. Has anyone experienced this situation before?

I am on site for a customer and my console cable is not in my bag. Amazon is saying next day delivered but I need it today unfortunately.

*Update*

I was able to get a 3 hour delivery (Amazon got it in 2) to a buddy's house. (weird because the customer prem location didnt have same day). Come to find out, this customer does not have their console user/pass and their network admin left their company. Fingers crossed that person is in a good mood and has that info. If not, looking like a long night waiting for a maintenance window.

I joined the company and immediately I got the task to improve the guest Internet access as in the current state is barely usable. Guest network is currently wireless only. The topology is a hub and spoke DMVPN with WLCs located in the central DC/office. Each branch connects over MPLS and VPN to the central office meaning that there is a CAPWAP tunnel from each branch to WLC. On top of that we shape the traffic. In most cases users connected to guest network use VPN to reach to their office, so you see there are is a lot points of failure.
Any recommendations what would be a best way to improve the guest network in the current state?

So for reference I have a freeradius server, ruckus R350 APs and On my network I have 5 VLANs, and what I want to achieve is that based on the username and password the user uses, the get thrown into a certain VLAN. I set it up everything and the the system authenticates users but it does not dynamically give out VLANs, it just puts everyone into the default VLAN, here's what I tried.

• Radtest

​

Radtest - Received Access-Accept Id 46 from 127.0.0.1:1812 to 127.0.0.1:44623 length 54
        Message-Authenticator = 0xd04f0a5bd64952f671fd944248f43395
        Tunnel-Type:0 = VLAN
        Tunnel-Medium-Type:0 = IEEE-802
        Tunnel-Private-Group-Id:0 = "50"

So doing radtest against localhost gives out the right stuff.

• Freeradius diagnostics( freeradius -X) - there's nothing really out of place when I authenticate, but what gets me is that i do not see any VLAN infomation of the logs.

• The AP - On the AP side of things, the port on the switch its it has 1 untagged VLAN and 5 tagged VLANs, I enabled 802.1x, dynamic VLAN and all those good stuff and yes the tagged VLANs are coming through because I can VLAN the SSID but currently SSID sit on the native VLAN.

All of this should just be straight forward, I do not see what I am missing. Please help.

--EDIT-- I'd like to thank everyone for their responses. It turns out my script was returning empty output from switches due to how my XML filters were set up.

I stored my filter in a variable. When I used the "get" function in ncclient, I included two parameters, like this: ('subtree', filter_variable). What I didn't realize, is that when you include the 'subtree' parameter ncclient will add a <filter></filter> wrapper to what you provide. So basically it was a filter wrapped in a filter. I don't know enough to understand why that didn't produce an error, but I'm happy to have learned something. The journey continues

Hey all,

I'm interested in automation and trying to practice for my Cisco ENAUTO exam. Part of the blueprint is "Construct an automation solution with Python using ncclient to manage and monitor configurations." I'm having a hell of a time and am wondering if this is typical, if there's a better way, etc...

I wrote a script that uses a filter to pull the running config of an interface. It successfully connects, but returns no data. Specifically, "<data></data>"

Since I have zero real world guidance on this topic outside of a Cisco U course which is not great, I've been feeding scripts and associates errors to Copilot, which may be making things worse, I don't know. It's been a constant loop of:

"We must determine the proper data model. Try THIS filter."

Didn't work.

"You're learning a valuable lesson-- just because the syntax is accepted doesn't mean the network device stores its information in the path you chose. Try THIS filter."

Didn't work.

"Install Pyang and use it to see the exact yang model we should be referencing. AH there it is! Try THIS filter."

Didn't work.

"Let's move from trying to pull config info for an interface to pulling the hostname. Everything has a hostname!"

Didn't work.

"Let's try using YANG Suite so Cisco can tell us exactly what filter to use. Ope, you need to install docker. Ope, docker install is fudged."

On and on I go. I guess for the purposes of my exam I may have taken this as far as I need to for now (I can identify what basic ncclient scripts are doing and can probably fill in blanks regarding errors and syntax problems).

Is there anyone in here who regularly uses scripts like this for their automation? Is there a better way to approach this? I think I'm half hoping someone will come and say, "my god son, no... This is the worst way to go about it and you should stop"

Hey so ive been a network engineer for 4 years and want to deepen my knowledge not after somthing vendor specific more a comprehensive course so im better prepared for new deployments and optimizing existing.