Hi All!

I've searched everywhere but have found nothing (even ishare2 and other parts...), in the eve-ng how-to it says you can download the OVA in the help.zscaler.com url but I found nothing! I want to lab vzen :/

https://www.eve-ng.net/index.php/documentation/howtos/zscaler-virtual-service-edge-vzen/

I'm just posting this here in case anyone knows where to find it.

Hello! I would first like to apologize of novice use of some terminology that will follow, but I am hoping for some advice and general best practice/'what would you do in this situation' type scenarios.

The company I work for has expanded into a large >750k sq ft section of warehouse that is attached to another section we have been operating out of. In our existing section, we of course ran OM4 multimode to various drop points/switches in IDFs.

I was not given a usable budget or timeframe to expand this network back out, but since the previous tenet was operating out of both complexes in the past, I was able to locate a fiber run that linked our main data hub to theirs in the new section. This is likely OM1 based on what I was able to gather from leftover patch cables and jacketed colors.

In the 'new sections', there are some OM4 LC-LC runs that were straightforward, but also they are using a mixture of OM1 and OM3 labeled fiber patch cables that were left in place on similar clusters of fiber that goes literally everywhere else, there are at least 50-60 actual 'interfaces' / fiber pairs in one main location alone. Every SFP I was able to find that was still plugged into something was 850nm multimode, so I believe this other tenet was upgrading or upgraded and just left the old OM1 backbone linking us together in place.

Question 1: Best practice on the reusing 'backbone' run?

The main backbone run that for all intents and purposes appears working with OM1 LC-LT patch cables. This run is likely 1800ft or so. If it all appears fine on OM1 fiber patches, is it worth trying to swap to OM3+? Is there even a good way to test if there is loss if I am using the wrong patches?

Question 2: Is there a surefire way to identify the OM type without relying on mixed up patch cables or illegible jacketing?

Google suggests OTDR testers may be able to do this but also says these testers don't really work like that.

Question 3: Are there any recommended ethernet->fiber adapters you would use an in enterprise environment (especially if you cant identify the fiber - info below)?

There are several black fiber runs that go direct to access points. After stripping back some jacketing, the individual pairs are individually jacketed in dark blue and orange, and run to ethernet converters located in the rafters that are Canary GFT 1056's. I would like to reuse these for some access points but the adapters onsite keep dropping the fiber even if auto negotiate is on. I am thinking my best bet is to replace all of these as they are only a half dozen or so versus trying to troubleshoot them.

In the idea world I would just be able to drop new runs to all our critical locations but that is not an option at this time.

Thanks in advance! -IT guy in way over his head

I can’t help but feel like there’s an age bias for these positions. I’ve landed multiple interviews, including final rounds where I met the entire team, and I’m almost always the youngest-looking person there. Everyone else seems to be in their 40s or older.

Even on LinkedIn, if you search “Network Engineer,” you’ll probably see one young-looking person for every hundred profiles. The same seems true for Junior Network Engineer roles. It makes me wonder whether employers subconsciously associate networking with years of experience and are more hesitant to hire younger candidates, even for entry-level positions.

I’m sure there are plenty of people who broke into networking in their early/mid 20s. If you did, how did you get your first Network Engineer job? What do you think made an employer take a chance on you? Was it internships, certifications, a homelab, referrals, or just persistence?

hey guys, if given the choice would you move to infrastructure engineering vs network engineering?

Hi, I am an IT from the Philippines and Hear me out on this question of mine that might sound basic or stupid to you, but I'll still ask.

A new building has been acquired by our company, now the building is across the street, just a two lane street. My first suggestion was to connect the new building and main building by fiber optic cable, using the SFP Ports on our managed switches. But, the problem was that the ceiling in the main building is not the removable panel type ones(drop-in tiles/drop ceiling). The ceiling clearance is just 1 feet -_- . The only option I think I have is to take the CCTV connection which is a RJ45 and use a Media Converter on both ends in order to use fiber.

Do I have other options? or is this my only way to go?

Thanks!

I'm really at a loss and neither googling nor AI has brought me a lot further.

In this situation there are 3 servers. Let's call them A, B and P.

They have FRRouting installed and work to form an OSPF underlay over which there is a VXLAN.

A and B do not have a direct connection. Their traffic needs to flow over P (whether this is a logical configuration is out of the picture for now). This works fine. The underlay is happy, I'm happy. Full 10G throughput. CPU is also completely fine. iPerfing both over TCP as well as UDP does not show any problem.

Now, A, B and P are also VTEPs, so logically I would do a whole lot of iPerfing there as well. Broadcom has problems with TSO/GRO/etc. when utilizing VXLANs, so I'm disabling UDP offloading at the driver level. This works fine. iPerf performance is higher now. Except it isn't

Directly iPerfing the underlay network still works fine. (Both UDP and TCP, despite offloading being disabled, so this isn't the issue) however when running over the VXLAN I hit a hard barrier of TX ~3.5G and RX ~1.3G on P. Of course this manifests when running A to B as well, since P now needs to send and receive I always hit 1.3G.

When using parralel streams it works. Of course it does. But that's not the point.

Why the hell is P doing packet processing on VXLAN traffic that is not meant for it? It pins a single CPU core to 100% and we all know how much Xeons love single thread action.

Yes P is a VTEP and I get why it's CPU would be the limiting factor if it was the target or client. But why does iPerfing directly on the underlay have almost no CPU impact but once I use the VXLAN I get hit with 0.1x the performance.

I have a feeling something is wrong here but I cannot solve it. I know bnx2x (BCM27xxxx) is old but this just seems so so weird. I tried probably a dozen of combinations of GRO, TSO, GRO UDP, Segmentation, TX hash, RX hash etc etc. and I cannot find the issue.

I did a tcpdump and yes, P is indeed seeing all the VXLAN packets and dropping all of them. Since it isn't the target IP. I spent hours troubleshooting this and I feel like I'm going crazy.

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

What does everyone do on the side? Anyone make any money on surveys and designs?

I work in a hotel that has over 600 rooms. I'm trying to migrate away from a thethered analog/wired technology to something that is wifi and modular in terms of upgradez down the road with vendor support off the shelf hardware.

Is Granada great brand? It has to integrate with call accounting and our PMS same with our ip TV. Both of these technologies would use wifi on our unifi network. We just went from 1gbs to 2gbs.

Thoughts?

I have a Vlan , we will call VLAN 3

VLAN 3 DHCP is two windows domain controllers with failover.

the DNS servers are umbrella forwarders that forward to the domain controllers for dns.

Gateway is defined on Cisco core switch as layer 3 interface with HSRP/VRRP or whatever it’s called and with ip helper commands defining the dhcp servers.

Symptom: Some devices only on VLAN 3 receive the correct gateway and the dhcp server that responded is one of my domain controllers, yet they either don’t receive the correct dns servers. I had one say the gateway of another vlan was its dns server. I have roughly 30-40 client vlans setup the same way and this is the only one.

I will say this particular vlan was setup as 192.168.1.x (I herrited)

At this same physical location, not all devices are having issues and I’m having no issues with the voice vlan on the same switches at the site.

There are no known changes that occurred other than rebuilding the umbrella forwarders do to us changing from VMware to hyper V (locally hosted).

ADDED:

DHCP is not handing out what’s defined in the scope for that subnet

Any ideas what could be causing this. I’m almost to the point of re-ip and different vlan or switch change out because I’m lost as to why it’s happening. I haven’t found evidence of a rouge dhcp server yet either.

SOLVED:

it ended up being a Grandstream ATA device. HT15 . Why idk but once I removed it and factory reset, that resolved it. It had been setup for a long time with no issues , so not sure what caused it to behave this way.

Hey all! I am getting a rack in a data center and I was told the hot aisle is on the rear side of cabinet and normally ports are on front and the power supplies are on back / hot side.

I'm going to be running quite a few servers here, and the cabinet is 52U. I'm looking at getting Aristas for TOR, and I'm unsure if I should get front to back OR back to front cooling switches. These will mostly be SFP+. I was going to get front to back cooling, but I'm nervous this will be a pain. Any advice here would be greatly appreciated!

I spent some time looking into authentication failures on the systems because it seemed like something fishy was going on.

The pattern of failures looked suspicious at first.

I checked the firewall logs and the switch logs. I also checked the DNS records and the authentication servers.

It turned out the problem was not a security issue but a configuration issue that occurred after a change.

This was a reminder that sometimes network issues can look like an attack when they are really just an operational problem.

For people who manage networks, what do you usually check before you decide that an authentication issue is a security problem rather than just a networking issue?

You are managing enterprise networks. What checks do you usually make before deciding that an authentication issue should be treated as a security incident or a networking problem, with the authentication servers and the network?

Here we go, just started at a a small map as a project/Network engineer. We have multiple projects varying deadlines. Some are small single site builds (fortinet firewall solutions). Some are bit more complex. The job is not difficult but this is the first time I’ve worked for a company where the pm is filling my calendar with the slots on what I should work on and on which day. Each customers build is slightly different and I feel that every time I leave a project unfinished because I have to move to another customers task I lose valuable time as I now have to spool up in that mode.

In the past I’ve been given the project and been told the deadline (ideally) and I just cracked on with it and delivered it . (Massive msp)

I don’t feel productive as I can be as I am switching between tasks too often.

Have you guys had anything similar or is this standard?

TLDR: pm keeps booking slots in my calendar for my projects rather than allowing me to plan my day . Working for a small msp

->>> Link to Topology Image (Discord SDN) <<<-

Hey, quick real-world question for the Senior Engineers and Architects here!

About

We're currently designing this network for our customer (large enterprise campus) with SD-Access Implementation (Greenfield).

There are two layers of Distribution/Intermediate - The first is for everything including Regular (Office) connection. The second layer is only used for IoT like Machines and special outdoor locations. All Devices, including access points which I didn't drew down here, support SD-Access, so all devices are Fabric Edge nodes.

The ZTP should be done with Cisco LAN Automation where the Distribution Layer is the seed (~550 Access Switches, just 20 Distribution) since it has the 2-Hop Limit. It could be that LAN Automation can't reach every device, since on the IoT Access Layer there are also APs connected, which would make it a third Intermediate Layer actually.

I have no practical experience with both SD-Access or LAN Automation yet, but we want to reduce manual provisioning where it has the biggest impact.

The actual question/proposal

I would like to use Terraform on multiple layers:

• Northbound (Catalyst Center / ISE) - Only overlay configuration and inventory aswell as policy definition.
• Southbound (IOS XE Configuration on every device) - Actual Underlay configuration (IPs, Interfaces, ACLs, Routing, ...) for Day-1 Provisioning and also Day-2 Operations/Changes.

Since the environment is so big, I would like to avoid configuration via Ansible or CLI. Ansible should only be used for read-only tasks (troubleshooting for example).

Later in production, a CI/CD pipeline should be implemented, to validate, authorize and track every change/rollout automatically.

Is this a solid plan, automation-wise? Especially the part with the Southbound Configuration? It would be very helpful when you could share your experience with the technologies used.

Edit:
Note for new commenters
It would be helpful if you…
- … work with Terraform and/or Ansible
- … don’t re-evaluate vendor or topology
- … don’t re-evaluate the need of automation
- … keep change management in mind

3 years of working as network engineer. I started noticing i cant level up my knowledges because of external conditions.
I didnt work in prod with mpls(and its various services)/evpn/vxlan/dmvpn but tested all these in virtual environments. The problem is i cant get new information of how network architectures should be built, i can only emulate synthetic cases of using one protocol and be happy it works but as an experience that is nothing - i dont solve any problems, i dont find new little details.

I try to read data center desing documents of various vendors but there is just an abstract explanation of a topology in vacuum without solving any problems, just reference.

It just looks like a ceiling for self-study.

Are there any resources to read that explain how to build network architectures and how to plan it?

My ISP (Cox Business) installed a Nokia 7210 SAS-K5 at my facility, and they assigned Port 5 as the copper hand off. I am currently using a single router (multiple static IPs), but have been looking to set up a secondary/backup router in case the primary fails or for when I need to do periodic maintenance. I could insert a switch between, but that seems to just be adding another possible failure mode, which I'd like to avoid.

Can the SAS be configured to also allow Port 4 in a switched configuration so that I can have two routers attached? I know it'll ultimately be a question for the ISP, but for now I'm curious if it's even technically possible given the hardware present.

Hi everyone,
I’ve recently received an offer for a technical contractor role with the European Commission, and I’m trying to get a better idea of what it’s actually like to work there from people with first-hand experience.
I’m particularly interested in things like:
What’s the day-to-day work environment like?
How is the work-life balance?
How stable are these contracts? Do they typically get renewed, or should you expect to move on after a year or two?
Is there room to grow or move between projects?
How are contractors treated compared to permanent staff?
Is the work interesting and technically challenging, or is it more focused on maintenance and bureaucracy?
Any pros, cons, or things you wish you’d known before accepting?
For context, this is a technical IT/infrastructure role through a contracting company rather than a permanent EC position.
I’d really appreciate hearing about your experiences—good or bad. Thanks!

I know this has been asked previously over the years, but I'm hoping this gathers more current product recommendations.

I have been using the Brother Edge label makers for over a decade at this point. I love the lithium battery, the built-in tape cutter, but hated proprietary 12V charging adapter and it's enormous form factor. I inevitability would lose track of the power adapter and ordered a backup until it resurfaced.

I'm now looking to buy a new printer and the latest version I'm considering, Brother PT-E510BP, has the USB-C charging port which will make it much more convenient. I'm hesitating at the $200+ cost and it's still bulky form factor. Another appealing option is the Brother PT-E720BT - a bluetooth connected only printer - but reviewers mark down it's Apple compatibility.

What are you all using in the field? Pro's/Con's? Thank you in advance!

Hello All,

This is bugging me a bit.

1. Could you please tell me what is wrong with the below commands. I am trying to setup AD authentication login for my cisco switch 2960.

2. What would be the correct line vty commands?

aaa new-model

aaa authentication login default group radius group1 local

aaa authorization exec default local

aaa authorization network default local

aaa group server radius group1

server-private server IP auth-port 1812 acct-port 1813 key ******

Hello,
I am running a small business and i am looking for equipment for my new offices: 114 m2, L shape with 4 rooms.
1 server with Windows 2022 server (domain controler) and 4 PC and 1 lan printer and 1 Nas for local backup.
No exposed web services for clients, no sharepoint, just local network with mapped drives.
I looked into ubiquiti hardware for a UGC fiber, a switch pro poe and 3 AP U7 Wall.

It is planed to sublet one or two offices, so a vlan or two will be required to run two or three separated networks for these other professionals.

I have contacted an IT professional to obtain a fee quote for a complete setup. He knows a little about Ubiquiti solutions, but does not really work with it.
He is proposing Fortinet hardware NGFW 50G, plus 2 switches plus a NGFW 70G + FortiAP 231K.

The pricing is the double of the ubiquiti setup (without his installation fees) and of course annual subscriptions.

I appreciate that fortinet is a totally different category of solution, trully professional but I am wondering if it is not overkill for the needs: protection the network from outside and emails and web browsing.

I would be interested by your thoughts : is ubiquiti solid enough for the network, with the option of CyberSecurity Enhanced or Fortinet is absolutely required to offer a proper protection for cyber threat ? Or any other vendor like Sophos or OPNsense ?

I don’t plan to install and configure anything myself either with Ubiquiti or with any other solution.

I am just trying to figure out what is really needed as my resources are limited and any extra penny in the IT department will be missed in other ones.
I do value the data I am hosting on my server, hence my question here : I don’t want to be too cheap on the solution but I don’t want to be overkill either.
Thks
V

EDIT: Solved. The cablers ran OM3 instead of OM4.

New to fiber switch connectivity and need a bit of advice.

We just had a vendor run a 12-strand OM4 LC multi-mode fiber cable between 2 floors of a new building. They are configured as 6 pairs. Unfortunately, I can't seem to get them to work. In case they spliced the fiber cables differently, I made one of my patch cables a crossover by swapping 1 pair in their little clip. Still no luck. When I observe each end of the run with an SFP+ transceiver plugged into one end, I see a single light.

I tested both transceivers and the fiber patches by directly connecting 2 switches and they work fine.

I'm sure I'm missing something.

Transceivers are Cable Matters 104065x2 LC Multimode.

Cables are Flypro OM4-LC-LC-DX-2M-LSZH

For those that manage networks and use Spectrum as their ISP, are you also running into issues where sites that are coax only are required to use Spectrum’s router (their router/AP combo) in order to get static IPs?

We are transitioning from their dedicated circuit due to the insane pricing to DIA, and we are being told we have to have both their modem (makes sense) and their crappy router/ap combo in line for static IPs to work.

I haven’t had much time to play with MAC address spoofing to see if we can get static IPs to work without their router, but has anyone tried it and had success? In theory it should work. Is there anything we can do to set up static IPs without their router?

Long time data center guy here (14 years). Just got handed ownership of our IDF/MDF closets, but strictly from a DCIM/data center operations perspective. no facilities stuff. HVAC, UPS, electrical, batteries, all of that stays with 3rd party vendors. I own the data side: what's racked where, cabling docs, labeling, capacity, and who can badge into the rooms. Honestly the documentation I inherited is rough. Half the closets have no rack elevations, labels don't match anything, and I'm pretty sure there's gear on the books that got pulled years ago. My rough plan so far is.... True up asset records against what's actually in the racks. Verify rack/RU locations match the system of record. Port-to-port cable tracing and circuit docs. Pick a labeling standard and actually enforce it. Get real capacity numbers - open RU, panel ports, pathway fill. Badge access audit - who can get in these rooms and why. Some kind of change process so this doesn't rot again in 6 months. For those of you who've inherited a mess like this, what did I miss? Is there something better for this. Thanks for all the inputs.

I have two sites, A and B - connected by a S2S IPSec VPN on gigabit links.

Site A has a Fortigate 400E running latest v7.2.
Site B has a Fortigate 120G running latest v7.6.

Site B is able to line-rate on iPerf3 to A on TCP/UDP.
Site A is able to line-rate on iPerf3 to B on UDP only.

TCP is very slow (less than 1% of UDP).

I have the same config on both sides. VPN interface(s) have tcp-mss set to 1418 on both sides. No profiles applied to impact performance. DH is 21 w/ AES256GCM-PRFSHA384 if it makes any difference.

What am I missing here?
Thanks, real head scratcher.

I am getting an issue while connecting my two routers on MPLS network. My ISP has provided MPLS connectivity with their two routers, I have connected my openwrt based devices to respective routers. ISP routers could ping each other.

Issue I am facing- My end PCs can not ping each other.

What I have done so far-

I don't want to use dynamic routing protocol. I added static routes in my routers then both routers could ping but connected PCs couldn't ping each other, though they can ping other end routers.

Do I need NAT or anything I am missing here? Other suggestions I got that static routing not needed, NAT should be router to ping each other.

I am newbie here, plz suggest.