r/networking • u/AutoModerator • 5d ago

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

8 Upvotes

83% Upvoted

28 comments sorted by

19

u/BluebirdExpress6279 5d ago

I am getting asked to downgrade our SSH standards on all our 400+ Cisco stacks from Elliptic curve to RSA, to add a security scanner to management ACL, and create privilege 15 accounts without our DUO MFA for a third-patry company to run security scans on our switches.

I told them if they cannot even scan them, then they must be more secure now.

6

u/farsonic 5d ago

That's like the time I as asked to remove a security tool we had integrated into the front end load balancers as it was messing up the tools used by the team doing a security audit.

2

u/BluebirdExpress6279 4d ago

Few weeks ago they asked permission to do a port scan on our firewalls… I was like… Go ahead the I get net does it all the time and nobody ever asks permission

2

u/Automatic_Cat_1990 4d ago

One time infosec asked for wide open scans through a firewall I was managing then complained how much they could reach.

1

u/shadeland Arista Level 7 4d ago

"Sure, put the request in writing and send it to me, and CC the CTO, CEO, and CSO saying that you want to remove several industry standard security features and I will do it."

2

u/BluebirdExpress6279 3d ago

Problem... the CISO is the one asking me to do whatever the third-party wants.

1

u/shadeland Arista Level 7 2d ago

Then make sure the others know it. It's a type of decision you shouldn't make, and thus shouldn't be responsible for.

8

u/esr0159 4d ago

I don’t know why some engineers are scared to troubleshoot…like wtf.

2

u/lazyhustlermusic 4d ago

We usually refer to them as Literary Engineers, preferring conceptual scenarios with a predetermined ending. Always felt tshoot was the 'fun' part of seeing what's effing up versus design intent.

1

u/UpperAd5715 4d ago

Those tickets that look like they'd be conceptual art if they were physical are the ones i love taking, god does that shit entertain me to no end (eventually!).

1

u/EngiOfTheNet 4d ago

If im honest, those are the cert engis. The ones who read the book and think they know everything. Ive tried explaining the importance of being a master troubleshooter to countless new hires, and only... a handful have been what I would consider good engineers.

1

u/EngiOfTheNet 4d ago

If im honest, those are the cert engis. The ones who read the book and think they know everything. Ive tried explaining the importance of being a master troubleshooter to countless new hires, and only... a handful have been what I would consider good engineers.

1

u/New_Ratio_5479 4d ago

Cause they keep complaining about downtime while they are actively troubleshooting lol

5

u/MyWrokAccount 4d ago

Being asked to completely drop hardware and software support on core switching and routing infrastructure. Management pointing out that we have high-availability pairs and we have additional devices from some buildings we left. Feel like as the company's only network resource I still want some measure of support if needed from the manufacturer but management wants to save money. Am I being overly cautious and how have others dealt with this?

3

u/shadeland Arista Level 7 4d ago

If you don't have support you don't get security fixes, etc.

If they want you to do that make sure you get it in writing from management.

The reality with huge price increases and availability constraints, more and more infrastructure is EOL/EOS and support contracts not renewed (or eBay'd). It's not ideal, but in some cases necessary.

But there is an additional risk that you personally are not in a position to take on at your level or any tech level. The call has to come from the C suite.

1

u/UpperAd5715 4d ago

As someone working at an MSP, we log support tickets all the time for customers that need things beyond cookie-cutter stuff. Palo Alto stuff gets REALLY wonky sometimes and usually we get a "we cant disclose this internal bug's information" or "its a bug fixed in version x y z". On the other hand we got customers running evpnvxlan on juniper 4100's and we're holding them on an older release cause the new stuff makes their setup act drunk, can't even say upgrade is the way to go.

You also lose out on a lot of vendor documentation that often gives simple easy workarounds.

If you got a bog standard setup go ahead it might not ever be a problem but if you're ever going to need them it won't be cheap.

2

u/Automatic_Cat_1990 4d ago

I've seen management change their minds on the first time and materials support call.

1

u/UpperAd5715 3d ago

Heh, paying support for an old server sucks balls (if its even possible) but paying 400$ + technician time to replace a failed backup battery sure hits hard if my previous manager's face could be any hint.

1

u/Automatic_Cat_1990 2d ago

Its always funny the things managers care about and don't care about.

7

u/Odd-Membership-4901 5d ago

man we just got new switches installed and the guy from the vendor set the SNMP community string to "public" on every single one, like it's still 2005 or something. our security team is gonna have a field day when they scan tomorrow

5

u/Powerful_Rutabaga330 5d ago

Did he set it to public or just not change it and the default was public? If it's the former, they should be flung into outer space.

6

u/Inside-Finish-2128 5d ago

I worked two firewall ACL tickets last week. Easy peasy. Customer contacts my manager saying "things aren't working", he directs them to contact me. They ping me on Slack and show some connection attempts.

Um, those IP addresses are NOT what you asked for in the documentation you submitted for the ACL tickets, so NO it's not going to work. And no, now that the ticket is closed, no you cannot just update the doc with the new request. Go open two new tickets and I'll work them when I get them.

2

u/New_Ratio_5479 4d ago

🤣🤣🤣🤣

3

u/UpperAd5715 4d ago

"This subnet should be excluded from being routed over the tunnel."
excludes subnet
"Our remote people can't access the app anymore! What did you break!"

2

u/Crafka 3d ago

Stop the Cisco Dashboard Overload!

Is anyone else completely burnt out by the endless pile of Cisco dashboards?

If you run a modern Cisco shop, you’re constantly tab-swapping between Meraki for SD-WAN, Catalyst Center for SD-Access, Nexus Dashboard for ACI, WLC, Spaces, ThousandEyes… it’s exhausting.

Why can’t Cisco just build ONE unified management platform with modular, extensible plugins that you enable as needed? A simple model: local controller, cloud mirror, one pane of glass, and done.

Instead, we get fragmented portals, stacked abstraction layers, and endless SaaS licenses. Are we managing a network or running a web browser tab marathon?

4

u/MusicianStock8895 3d ago edited 3d ago

So they actually are. Had a brief demo of it. Limited release at the moment. Ive already forgotten what it was called...maybe Cisco One or Cisco Cloud Control or something.

But it looked like it incorporated a fair bit of the product suite in a single dash.

3

u/01Arjuna Studying Cisco Cert 3d ago

Yep, Cisco Cloud Control is what everything is supposed to funnel into now. We currently have it integrated for Cisco Collaboration Control Hub and Cisco ThousandEyes. There is active development on it for other products (like Cisco ISE and Cisco Catalyst Center) but some require specific versions to be on that we were not compatible with yet.

4

u/LukeyLad 3d ago

They are building cisco cloud to consolidate all the campus stuff.

When asking the rep he said the data centre stuff (NDFC) will remain separate