I'm currently troubleshooting a network issue where laptops on the company network are receiving IP addresses from a DHCP scope associated with the Telephony VLAN instead of the Admin VLAN.

No changes have been made in the data room, on the switches, or on the network configuration to my knowledge. However, new devices are consistently being assigned to the wrong VLAN.

Could someone explain what could cause this behavior? What should I check first to identify whether the issue is related to switch port configuration, DHCP relay settings, VLAN assignment policies, or another network component?

Any insights or troubleshooting suggestions would be appreciated.

As the title says really. What is typically "normal"?

What makes you perk up and look further?

I can see the usual automated recons and corrolating using webstorm centre and other sources.

But sometimes I see a burst of interest to our servers, which makes me think someone has found something interesting enough to cause more probing.

Interested to hear peoples stories.

Hi everyone,

​Does anyone know where I can rent "dirty" IP blocks at a lower rate?

​I have been searching on Google for a while, but almost all IP leasing providers exclusively advertise clean IP subnets. I also couldn't find much useful information about leasing dirty IP ranges on LowEndTalk or WebHostingTalk.

​Currently, the going market rate for a clean RIPE /24 subnet is roughly $100–$120/month. Because my budget is limited, I am hoping to lease a dirty /24 block for around $50+/month.

​Part of these IPs will be used for legitimate, research-oriented web crawlers. Since this activity could potentially affect IP reputation anyway, I would rather avoid paying a premium for clean space and just lease IP blocks that already have poor or burned reputation.

​Does anyone have recommendations or know of any platforms/brokers offering discounted subnets with existing reputation issues?

​Any advice or pointers would be greatly appreciated!

Every NGFW vendor looks good on a comparison sheet. Gartner gives you a shortlist but there's still a lot that doesn't show up until you test the firewalls yourself

Like what happens when TLS inspection and IPS are enabled under real traffic loads?

Then there's the management side. Pushing policy changes across multiple gateways, tracing blocked traffic back to a specific rule and dealing with upgrades

For anyone who's been through an enterprise firewall RFP recently, what did you put the most weight on?

Any POC tests that made you cross one off the shortlist?

So I've been a network engineer and AV tech for over 20 years. I'm looking to purchase a qualifier personally. While I know the Fluke Linkiq may be the standard here, it doesn't do fiber, and I think the Fluke price premium isn't necessarily worth it.

I'm currently looking at the Trend SignalTEK QT Pro bundle that does 10G, copper, fiber, and some Wifi.

Are there any other contenders in this area to consider?

I don't want to buy a certifier. I also don't really care about L3 troubleshooting things. I'm essentially looking for a better tool set than the Microscanner2 I've had for years and years.

Any input here would be awesome.

Hello!

Many times I have scenarios where i have 2 cabinets of equipment online but im waiting on fiber runs to connect the two areas (primarily this is for SCADA/ control devices, ignition etc.)

This may sound stupid, but some kind of temporary wireless bridge or solution to allow device commissioning while i wait for fiber runs to complete would be a huge win for the business. Is this something someone sells? Our company doesn’t really shy away at cost if it means go fast. The distance can vary but it’s almost always confined to a building. Again this is something i would tear down after fiber is in place from an LVC, so wouldn’t need to be reliable or perfect. Appreciate any insight!

IOS-XE Cisco License with a MEC stackwise Virtual 9606 core.

My company sell SVIs to clients who come in-house for shows. 1 Harddrop is a single SVI with a /24. (Essentially if a client need 4 hard lines, that is 4 separate SVIs).

Bandwidth is never an issue however, we sell bandwidth to clients for 1.5MB , 3MB, and 9MB. (This is MBPS).

The issue in all of this is that we do not rate limit. Clients who come in often get 100-300 MB/s peak.

Now the issue here, is that if we have multiple clients in, it can impact speeds of another.

The goal is to rate limit the assigned client SVI to what we sell them for.

Stopping here for any recommendations, advice, or input.

Hello all,

I have this case where I need to set up a redundant path to our partner.

Our DCs: DC in LA and in NY. We have this subnet in LA: 10.160.10.0/24 and an another subnet in NY 10.180.10.0/24 that needs to reach 10.10.10.0/24 (our partner).

Setup: https://imgur.com/zkOiApf

Between our core switches in LA and NY, we run MPLS L3 VPN.

In LA, we have an internal FW (internal_FW_LA) and core switch (Core-sw_LA) that just run static routes between each other. There will be a direct fiber connection to the partner (Parrtner_A_LA router) from Core-sw_LA. I was thinking that I will run L3 (static) between internal_FW_LA and Partner router Partner_A_LA. This will be the primary link to the partner.

In NY, we have a internal FW (internal_FW_NY) core switch (Core_sw_NY), and VPN HUB (VPN_hub_NY). We run static routes as well between these three. From the VPN hub, I will run an IPsec tunnel to the Partner_A_NY Fortigate.

Now the idea is that we will only use one link to the partner at a time and in this case, it would be the primary link which is in LA. The 10.180.10.0/24 (in NY) needs to be routed through the MPLS and then from there through the primary link (via internal_FW_LA) to the partner router Partner_A_LA. 10.160.10.0/24 will of course take the same path.

In case the primary link goes down, then traffic from LA will need to be routed through the MPLS to NY and from there over the IPsec tunnel (so both 10.160.10.0/24 & 10.180.10.0/24) will be routed over the IPsec tunnel.

Now, I was thinking that I would need to use some kind of dynamic routing and in this case BGP on the internal firewalls but the ssue is that these internal firewalls are not allowed to use BGP (due to some policy). Running BGP on the core switches may make sense but that will break standardizing our way of designing things.

I am stuck and cannot figure out how to proceed here.

Any input?

A handful of ports descriptions labeled "port failed?".
Observing coworkers throw out "Must be a bad cable" before checking ip settings.
Not once have I ever needed to replace a factory terminated cable.
Not once have I found a "bad port" on a switch. Not sure what the failure mode of a bad port would be, but unless the contacts were corroded or dusty, I can't imagine a single port would fail.
I can however imagine, not knowing which drop corresponds to which patch port, which is a separate issue...

Am I a jerk for doubting my coworkers, or am I right that these failures are very rare?

I've got a situation where we have a cradlepoint L950 at a location that has good reception and its connected to a fibre media converter to single mode fibre that's ran through a factory. On the other side, we have a Fortigate firewall that is connected to a media converter RJ45 that gets connection from the single mode fibre.

The site is remote.

When doing a ping test from our loopback IP that we setup with our tunneling, I'm getting packet drops every 30 seconds and it coming back online after 10 seconds. The fibre cable was installed in the last month and the Cradlepoint reception is good. Previously when we were remotely connecting to the firewall, we had the firewall connected to the Cradlepoint directly (through PoE Inj on Port 2 of cradlepoint for IPPT) and experienced no issues at the same location the Cradlepoint is now. We've replaced wires and such and still having issues. We're getting our cable guy to check the fibre line again but anyone have any insight as to what is happening or the resolution to this?

Hi everyone,

I’m implementing 802.1X using Forescout, and I need some advice. Please help me understand if my plan is correct.

The Operations team hasn’t added the CCTV subnet to Forescout, and the cameras don’t support 802.1X.

My plan is to add the cameras to Forescout, register their MAC addresses in MAR, and then apply 802.1X to the switch ports.

Is this the correct approach, and what steps should I follow to avoid disconnecting them?

I also have IP phones sharing the same switch port with PCs, using separate Voice and Data VLANs.

I believe the phones don’t support 802.1X either.

Should I add their MAC addresses to MAR and use MAB for the phones while keeping 802.1X for the PCs?

I’d appreciate any advice on the correct approach.
Thanks

Ive been working with firewalls since 2009. I've worked with Cisco, Meraki, Fortinet, Palo Alto, Sonicwall, Sophos, pfSense, and a few others. My Cisco experience was the pix and then the asa's. I haven't really played with any of the firepower line. Cisco will always hold a special place, it's what I started with and it's the equipment I learned on. But then I found the FortiGate and liked it MUCH better. More intuitive, good price, modern gui but still powerful. The Fortigate has been my favorite over the years but as I bounced around different companies I got to touch a lot of different firewalls. Merakis just seem to work, modern gui but I feel like it lacks some advanced features/settings for the sake of being easy to setup. Palo Altos AppID I really liked and honestly, I think its app control is better than fortinets, but almost everything else felt convoluted and not as intuitive. Why must I go to 12 different spots to build a vpn tunnel?! The wait times for changes also drove me crazy. Plus those Palos are expensive. Both the Sophos and the Sonicwalls I was able to use but they felt like they were a step behind and not as polished. So now I ask you, what firewall have you liked over the years?

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

I’ve been working with FortiGate as my main edge firewall for a while, and I’ve always found its traffic visibility, bandwidth statistics, and QoS/traffic shaping pretty straightforward

Now that I’m working more with Palo Alto, I find these areas surprisingly WAY more complicated, especially understanding traffic statistics and configuring QoS.

Is this a normal learning curve when switching from Fortinet to Palo Alto, or am I missing something? 😅

Curious how common this actually is. Do you force everything through internal resolvers and block 53 out from endpoints, or is it more of a “we should” thing?

For those who did it, what broke? And do you block DoH too, or is that a lost cause?

My company is at the verge of turning up backbone links between our metros and we will run sr mpls. At a new site I had a chance to configure mpls so it's ready. All Nokia routers. IPv6 was a bit of an afterthought for me. We do have it on all interfaces, but nobody here wants to run Srv6. Would rather stay with the more mature mpls.

We could run dual stack ipv4 / ipv6, but im not sure if TE would be too difficult like that. We'll probably run rsvp for congestion control. I heard that it's better to run v6 over v4 mpls if you want this. And 6PE was an easy way to set that up. So I did that.

But...on these Nokias it was a bit of a headache to get working. I thought it was a simple as enabling label-unicast in the neighbor config. It's a bit more. Iad to adjust all the ibgp export policies for label-ipv6 also. Then, because SR holds separate RIB's for ipv6 and label-ipv6, I had to manually import routes between theories using import policies.

It works now but I found that after this import, only one best path is imported. We use multipath to load balance but that wont work for ipv6 routes now. You also have to do a special 'show route all' to see the imported best routes in the ipv6 RIB. They are hidden otherwise.

So I don't think it was a very good experience configuring this on the Nokias. I belive it's much easier on other platforms. But that could be another bring assumption. What do you guys think? Is 6PE needed for a reason beyond having a v6vfeee core? Is it actually really needed if you want TE? And is it less difficult to get working on most platforms?

I have landed myself as the networking guy for an org with 10-15 admin sites and 120-130 residential sites.

Our currently topology has every location set up with 2 manual policy based IPSEC tunnels to our azure hosted virutal sonicwall and an onsite sonicwall at our main admin location.
However we are moving from having each site having tunnels to using SDWAN with unifi gateways and having all of the normal sites as spokes that talk to a set of devices acting as hubs that then pass the traffic to the azure sonicwall.
With having the multiple hubs, in order for that failover to work without the ipsec tunnels sending data into a black hole we're going to need dynamic routing.

Currently testing BGP with no experience, just starting with a UDM Pro as a test hub and have it talking to azure through a route based ipsec VTI. I got the AS on each end to talk to each other.
The test UDM's gateway can reach its BGP Neighbor and pass traffic, but it's unable to pass traffic to the 2 subnets it's advertising.
I'm more than happy to share my config for others to look at.

I would love any advice or assistance

Hi!

I'm trying to figure out how to cable some ciena waveserver AIs we have. First time doing this for me so i'm learning

We have two modules installed

• slot 1: CMD-10
• slot 2: MOTR-400-1-8
• On the MOTR we're using 2/3 and 2/7 as the 400G client side ports, so that part is easy.

This is my understanding of how the other ports should be connected:

• 1/13 is the Line port (the actual dark fiber going to the other site)
• 1/11 and 1/12 are connected to each other with a normal duplex fiber cable (OSC ports)
• Port 2/1 goes to 1/1 with a normal duplex fiber cable.

I think thats about it? Aside from the DCN and console which are easy.

I couldn't find any help on ciena.com for this which is why i'm asking here. Thanks!!

Hola en resumen que cuando pongo el qcow2 de fortigate (ya probe todas las versiones) enciende pero no muestra nada en consola, probe de todo, cambiandole el nombre al qcow2 que sea igual a la hora de poner la plantilla, probre poner el GNS3 con VMWARE y VIRTUALBOX, me da el mismo error en los dos, probe instalar versiones anteriores de GNS3 pero nada sigue igual.

MI VM de GNS3 tiene 8 cores y 20gb de RAM

Howdy!

Looking for some tips on staying sane during a 3 month project with early hours mixed with normal hours I’m about to start.

I am about to kick off a 3 month project where I will be replacing switches at all of our locations. Due to business requirements the maintenance windows will be starting around 3AM and will go till 6AM. This will be 2-3 days a week, sometimes 4 days a week, so I typically will be starting the week off with normal hours on Monday, and then come Tuesday/Wednesday I need to flip my schedule to accommodate the early start, and then go back to a “normal” schedule Thursday/Friday.

Is there really anything I can do to make this adjustment a little easier on my body/mental or do I just need to suck it up for the few months and then take time off at the end to recover lol? I’m already starting to absolutely dread this and it hasn’t even started yet. I’m no stranger to working weird hours but this is the first time where it will be going on weekly for around 3 months and I’m trying to mentally prepare for the fucked up sleep I’m about to endure.

Thanks!

Hi everyone,

I’m reviewing a network diagram for a hotel infrastructure and I’m a bit confused about the role of the Collect Switch 1 & 2 (both Sw-24). My questions:

1. What is the exact role of the Collect Switches in this design?
2. Why do we need them? What benefits do they provide?
3. Why not connect the Router Load Balancing directly to Firewall #1 and #2? Would that break something (redundancy, scalability, security, management…)?

I’ve attached the diagram for reference.

Thanks in advance for any insights!

https://i.postimg.cc/QdLdpnyN/Topo-nw.jpg

After a switch firmware upgrade, users started having intermittent wireless connectivity issues, with brief disconnects and reconnects while connected to the corporate Wi-Fi network. Multiple access points are repeatedly losing and re-establishing their CAPWAP connection to the wireless controller. While the affected APs remain powered on and do not reboot, their CAPWAP association uptime continuously resets, causing APs to temporarily enter FlexConnect standalone mode before rejoining the controller. Controller logs show repeated DTLS tunnel disconnects, while AP logs indicate CAPWAP restarts due to missed data keepalives ("data keepalive not received").

I ruled out AP reboots, PoE issues, interface errors, STP. Physical switch ports are operating normally with no CRC, discards, or link errors. Opened Cisco TAC case but they're taking long so looking to the masses for help. I'm hoping someone experienced something similar that can throw in their two cents.

Anyone here doing Fortigate installations? I have been running into an oddity where if I have a location of lets say 10 switches that you would assume fits nicely in /28 pool, at around switch 8 or 9 once new switches go online previous switches start appearing as offline, and seemingly needing to be assigned a new IP from the pool.

Similiar issues happen when you do actually run out of IP addresses in the pool, which is why im thinking the issue is related to the IP pool. Anyone else noticed the same issue? (afaik it doesnt affect functionality since last migration I had the main switch appear as offline while all the switches connected to it remained online, and looking from CLI even the main one appeared online).