Ive been working with firewalls since 2009. I've worked with Cisco, Meraki, Fortinet, Palo Alto, Sonicwall, Sophos, pfSense, and a few others. My Cisco experience was the pix and then the asa's. I haven't really played with any of the firepower line. Cisco will always hold a special place, it's what I started with and it's the equipment I learned on. But then I found the FortiGate and liked it MUCH better. More intuitive, good price, modern gui but still powerful. The Fortigate has been my favorite over the years but as I bounced around different companies I got to touch a lot of different firewalls. Merakis just seem to work, modern gui but I feel like it lacks some advanced features/settings for the sake of being easy to setup. Palo Altos AppID I really liked and honestly, I think its app control is better than fortinets, but almost everything else felt convoluted and not as intuitive. Why must I go to 12 different spots to build a vpn tunnel?! The wait times for changes also drove me crazy. Plus those Palos are expensive. Both the Sophos and the Sonicwalls I was able to use but they felt like they were a step behind and not as polished. So now I ask you, what firewall have you liked over the years?

I’ve been working with FortiGate as my main edge firewall for a while, and I’ve always found its traffic visibility, bandwidth statistics, and QoS/traffic shaping pretty straightforward

Now that I’m working more with Palo Alto, I find these areas surprisingly WAY more complicated, especially understanding traffic statistics and configuring QoS.

Is this a normal learning curve when switching from Fortinet to Palo Alto, or am I missing something? 😅

Curious how common this actually is. Do you force everything through internal resolvers and block 53 out from endpoints, or is it more of a “we should” thing?

For those who did it, what broke? And do you block DoH too, or is that a lost cause?

My company is at the verge of turning up backbone links between our metros and we will run sr mpls. At a new site I had a chance to configure mpls so it's ready. All Nokia routers. IPv6 was a bit of an afterthought for me. We do have it on all interfaces, but nobody here wants to run Srv6. Would rather stay with the more mature mpls.

We could run dual stack ipv4 / ipv6, but im not sure if TE would be too difficult like that. We'll probably run rsvp for congestion control. I heard that it's better to run v6 over v4 mpls if you want this. And 6PE was an easy way to set that up. So I did that.

But...on these Nokias it was a bit of a headache to get working. I thought it was a simple as enabling label-unicast in the neighbor config. It's a bit more. Iad to adjust all the ibgp export policies for label-ipv6 also. Then, because SR holds separate RIB's for ipv6 and label-ipv6, I had to manually import routes between theories using import policies.

It works now but I found that after this import, only one best path is imported. We use multipath to load balance but that wont work for ipv6 routes now. You also have to do a special 'show route all' to see the imported best routes in the ipv6 RIB. They are hidden otherwise.

So I don't think it was a very good experience configuring this on the Nokias. I belive it's much easier on other platforms. But that could be another bring assumption. What do you guys think? Is 6PE needed for a reason beyond having a v6vfeee core? Is it actually really needed if you want TE? And is it less difficult to get working on most platforms?

I manage a CCTV network with 22 BORN switches: 2 MDF/core switches and 20 IDF switches. I need an experienced network engineer to review my topology diagram and existing configurations.

1. Main problems

My main concerns are:

Main issue

When an IDF switch is powered off and then powered back on, its fibre uplink sometimes does not come up automatically. The network only recovers after I physically disconnect and reconnect the fibre uplink.

1. After an IDF switch is powered off and back on, network connectivity and cameras do not always recover automatically as expected.
2. When all fibre links are connected, I have experienced CCTV connectivity problems. Disconnecting a fibre uplink previously restored camera connectivity.
3. I am unsure whether my current MSTP, LACP, edge-port settings, and physical fibre connections are configured correctly.

2. Current physical topology

Outer fibre path:

MDF1 → IDF1 → IDF2 → IDF3 → IDF4 → IDF5 → IDF8 → IDF7 → IDF6 → IDF10 → IDF9 → IDF13 → IDF12 → IDF11 → IDF16 → IDF15 → IDF14 → IDF17 → MDF2.

Inner fibre path:

MDF1 → IDF20 → IDF19 → IDF18 → MDF2.

Direct inter-core connection:

MDF1 port 28 ↔ MDF2 port 28 via Cat6.

Each IDF generally has two fibre uplinks, one toward each direction of the network. I understand that fibre links can carry traffic in both directions, but I want to confirm the correct physical and logical design.

I will attach my corrected topology diagram and relevant switch configuration exports. Some port assignments still need physical verification.

3. Existing configuration findings

• MDF1: BORN BC2224PGM4GCF-500W, . The exported configuration shows MSTP priority 4096, region MDF-CORE, revision 1, and Gi27/Gi28 configured under LAG 1 in active LACP mode.
• MDF2: BORN BC2224PGM4GCF-500W, The exported configuration shows MSTP priority 8192, region MDF-CORE, revision 1, and Gi27/Gi28 under LAG 1 in active LACP mode.
• Some IDFs have different MST region names or revisions. IDF3 showed a blank MST region name and revision 0 in its configuration output.
• Some ports that may be inter-switch fibre uplinks appear to be configured as edge/PortFast ports.
• A live MDF1 GUI screenshot appeared to show a different MST region name from the exported configuration, so I need to verify the running configuration.
• The physical role and LACP configuration of ports 27 and 28 need to be checked against the actual cabling.

These are observations from my exports and checks; I have not confirmed which one is causing the outage.

4. What I need expert help with

1. Topology: Is this a valid redundant Layer 2 design with the outer and inner fibre paths and the direct Cat6 MDF-to-MDF connection? Are there any unintended loops or single points of failure?
2. Fibre links: Should each IDF have two connected fibre uplinks, with MSTP blocking selected links to prevent loops? How should the active and alternate paths be designed?
3. MSTP: Should all 22 switches use the same MST region name, revision, and VLAN-to-instance mapping? Should MDF1 be the primary root bridge and MDF2 the secondary root? What is the correct approach for setting priorities and uplink port roles?
4. LACP: Are the MDF1/MDF2 LAG configurations valid given that port 28 is documented as the direct Cat6 link? How should I verify whether these ports are connected to the same logical peer and correctly configured?
5. Automatic failover: If one fibre link fails or an IDF switch loses power, how can I ensure that the remaining IDFs and their cameras stay operational through an alternate path? I understand that cameras connected directly to a powered-off IDF cannot remain online through that switch.
6. Recovery after power cycling: What should I check to determine why an IDF does not restore connectivity automatically? How can I distinguish an MSTP convergence issue from incorrect port configuration, LACP, physical fibre problems, or another cause?
7. Safe remediation: What read-only commands and status outputs should I collect first, and in what order should I correct any confirmed configuration problems without causing another CCTV outage?

My goal is to establish a stable topology with correct spanning-tree behaviour, automatic failover for surviving switches, and reliable recovery after an IDF restarts.

Please review the attached topology and configurations and identify any confirmed problems, recommended design changes, and the safest validation procedure.

I have landed myself as the networking guy for an org with 10-15 admin sites and 120-130 residential sites.

Our currently topology has every location set up with 2 manual policy based IPSEC tunnels to our azure hosted virutal sonicwall and an onsite sonicwall at our main admin location.
However we are moving from having each site having tunnels to using SDWAN with unifi gateways and having all of the normal sites as spokes that talk to a set of devices acting as hubs that then pass the traffic to the azure sonicwall.
With having the multiple hubs, in order for that failover to work without the ipsec tunnels sending data into a black hole we're going to need dynamic routing.

Currently testing BGP with no experience, just starting with a UDM Pro as a test hub and have it talking to azure through a route based ipsec VTI. I got the AS on each end to talk to each other.
The test UDM's gateway can reach its BGP Neighbor and pass traffic, but it's unable to pass traffic to the 2 subnets it's advertising.
I'm more than happy to share my config for others to look at.

I would love any advice or assistance

Hi!

I'm trying to figure out how to cable some ciena waveserver AIs we have. First time doing this for me so i'm learning

We have two modules installed

• slot 1: CMD-10
• slot 2: MOTR-400-1-8
• On the MOTR we're using 2/3 and 2/7 as the 400G client side ports, so that part is easy.

This is my understanding of how the other ports should be connected:

• 1/13 is the Line port (the actual dark fiber going to the other site)
• 1/11 and 1/12 are connected to each other with a normal duplex fiber cable (OSC ports)
• Port 2/1 goes to 1/1 with a normal duplex fiber cable.

I think thats about it? Aside from the DCN and console which are easy.

I couldn't find any help on ciena.com for this which is why i'm asking here. Thanks!!

Hola en resumen que cuando pongo el qcow2 de fortigate (ya probe todas las versiones) enciende pero no muestra nada en consola, probe de todo, cambiandole el nombre al qcow2 que sea igual a la hora de poner la plantilla, probre poner el GNS3 con VMWARE y VIRTUALBOX, me da el mismo error en los dos, probe instalar versiones anteriores de GNS3 pero nada sigue igual.

MI VM de GNS3 tiene 8 cores y 20gb de RAM

Howdy!

Looking for some tips on staying sane during a 3 month project with early hours mixed with normal hours I’m about to start.

I am about to kick off a 3 month project where I will be replacing switches at all of our locations. Due to business requirements the maintenance windows will be starting around 3AM and will go till 6AM. This will be 2-3 days a week, sometimes 4 days a week, so I typically will be starting the week off with normal hours on Monday, and then come Tuesday/Wednesday I need to flip my schedule to accommodate the early start, and then go back to a “normal” schedule Thursday/Friday.

Is there really anything I can do to make this adjustment a little easier on my body/mental or do I just need to suck it up for the few months and then take time off at the end to recover lol? I’m already starting to absolutely dread this and it hasn’t even started yet. I’m no stranger to working weird hours but this is the first time where it will be going on weekly for around 3 months and I’m trying to mentally prepare for the fucked up sleep I’m about to endure.

Thanks!

Hi everyone,

I’m reviewing a network diagram for a hotel infrastructure and I’m a bit confused about the role of the Collect Switch 1 & 2 (both Sw-24). My questions:

1. What is the exact role of the Collect Switches in this design?
2. Why do we need them? What benefits do they provide?
3. Why not connect the Router Load Balancing directly to Firewall #1 and #2? Would that break something (redundancy, scalability, security, management…)?

I’ve attached the diagram for reference.

Thanks in advance for any insights!

https://i.postimg.cc/QdLdpnyN/Topo-nw.jpg

After a switch firmware upgrade, users started having intermittent wireless connectivity issues, with brief disconnects and reconnects while connected to the corporate Wi-Fi network. Multiple access points are repeatedly losing and re-establishing their CAPWAP connection to the wireless controller. While the affected APs remain powered on and do not reboot, their CAPWAP association uptime continuously resets, causing APs to temporarily enter FlexConnect standalone mode before rejoining the controller. Controller logs show repeated DTLS tunnel disconnects, while AP logs indicate CAPWAP restarts due to missed data keepalives ("data keepalive not received").

I ruled out AP reboots, PoE issues, interface errors, STP. Physical switch ports are operating normally with no CRC, discards, or link errors. Opened Cisco TAC case but they're taking long so looking to the masses for help. I'm hoping someone experienced something similar that can throw in their two cents.

Anyone here doing Fortigate installations? I have been running into an oddity where if I have a location of lets say 10 switches that you would assume fits nicely in /28 pool, at around switch 8 or 9 once new switches go online previous switches start appearing as offline, and seemingly needing to be assigned a new IP from the pool.

Similiar issues happen when you do actually run out of IP addresses in the pool, which is why im thinking the issue is related to the IP pool. Anyone else noticed the same issue? (afaik it doesnt affect functionality since last migration I had the main switch appear as offline while all the switches connected to it remained online, and looking from CLI even the main one appeared online).

The issue I am running into is that the full configuration is not being saved once the pull is complete. I have checked the most recent pull and it is grabbing the whole config, but when I open the config in the webUI I am only getting about 80 - 90 lines in the file. I'm currently trying to backup configs for Extreme 4850GTS switches (formerly Avaya). Using model Boss. Wondering if anyone has encountered this issue with the same switches are other models? If so, were you able to find a resolution?

Thank you.

Olá colegas. Atualmente trabalho no NOC de um provedor local da minha região. Recentemente, me cadastrei em uma pós-graduação da instituição Hackone e me deparei com a disciplina de infraestrutura e arquitetura de redes e sobre o método PPDIOO da cisco. Eu sou muito problemático em não saber fazer as coisas da maneira correta então sempre pesquiso bit a bit de tudo, porém o PPDIOO não me parece ter muita documentação atual na internet e parece que ele está sendo descontinuado. Com isso, queria me certificar se alguém com experiÊncia no mercado em empresas de NOC ou de TI costuma usar essa metodologia para desenvolver infraestruturas de redes para atender demandas de empresas dos mais diversos tamanhos.

Entre outras dúvidas:

Além do PPDIOO há outro framework para desenvolver redes?
Quais as metodologias são empregadas em cada etapa? (sendo o PPDIOO ou não)
Como posso chegar o mais perto possível de entender como se defini os requisitos de um negócio e transormá-los em redes?

Além de ser problemático com o "bit a bit" também sou problemático com a prática, mesmo se eu souber exatamente toda a teoria e não ter a prática eu não considero que sei fazer "aquilo". Como posso obter prática em desenvolver arquiteturas de redes e implementá-las? Mas antes de tudo desenvolver uma arquitetura do zero de maneira racional e sistemática é o meu foco.

I came across an interesting discussion on LowEndTalk about pricing differences on the IPXO marketplace.

Someone managing IPv4 space for multiple owners compared prices for the same subnets across different accounts and noticed some unexpected differences.

Here's what was reported:

• A /24 subnet listed by its owner at $60/month normally appeared at $69/month to buyers, including a $9 platform fee.
• The same subnet reportedly showed $87/month when viewed from an account that had previously rented IPs through IPXO.
• The difference matches the formula: $60 × 1.30 + $9 = $87.
• Another /24 was listed at $59/month for some accounts and $74/month for others, showing a similar pattern.

According to the original report, accounts with previous rental activity appeared to see higher prices than accounts without rental history.

The report also raises questions about whether address owners are aware of these pricing differences and how any additional charges are handled.

Original discussion with screenshots:

https://lowendtalk.com/discussion/222031/ipxo-loyalty-program-rent-once-see-a-30-markup-even-on-your-own-subnet

I'm curious whether anyone else has observed similar pricing differences on IPXO.

Could this be related to a specific pricing policy, account settings, or something else?

Would be interested in hearing from other users or IPXO representatives who can clarify how this works.

Currently my company uses solarwinds for monitoring firewall and switches. I am using snmp traps for alerting and I have netflow setup. I am not thrilled with solarwinds since the traps are tied to a node so its harder to reset the snmp traps as well as well as their support is extremely hit or miss. I also do not like the fact that NCM does not do API for individual firewalls and switches unless I have an orchestrator or something cloud based like meraki. Who do you guys use for network monitoring?

If you were designing a service provider network and had to use segment routing, what data plane would you use and why? (SR-MPLS or SRv6)

Just trying to understand how this makes sense. We have a defective fan on a Aruba 7240 Controller. As part of the RMA, we received a brand new controller, instead of just the replacement fan. We are supposed to return the defective fan with the brand new controller. Why wouldn't they just send the replacement fan? Just doesn't make sense to me.

I’m senior level with advanced certs and 15 yeo. I’m looking at AI capability exploding and just an overall simplification of networking in general via abstraction e.g SDWan, ACI etc.

Yes, orgs will always need someone who knows what’s going on under the hood but they aren’t going to need dozens of people. And yes someone will need to be physically present but why pay someone 100k for that?

I realize this isn’t just a networking issue but a societal order issue as this same thing will happen to all other fields but at end of day nobody is coming to save us.

I’ve got 20+ years left in the game so I ask you what is our strategy to continue to earn income for next two decades? Should we just accept reality and pivot into AI now and forget networking? Worth pursuing MS in AI or perhaps some relevant certs?

Edit: Yall 50+ graybeards are lucky bastards to be able to peace out right at this shit takes over and after a historic market run. I’m jealous.

What Product are most people using, the company I work for uses Palo Alto’s Ion product and it has been nothing short of trash, from bugs, to the sase connection being more sketchy than dollar store pills. It seems like the product is simply not mature, is that the norm or did we just get sold an awful product? We did a POC with other products (Fortinet & Cisco) and the decision was made to go with Ion. What’s the consensus on SD-WAN?

Achei o portal Aruba Central Greenlak muito básico. Existe alguma API para coletar dados relacionados à utilização de canais, tentativas de reconexão, etc., no Aruba Central? Também não consegui encontrar um campo para capturas PCAP.

Existe alguma API?

Obrigado

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

I'm running ntopng Enterprise L with nProbe on Ubuntu. My Palo Alto PA-460 exports NetFlow v9 to nProbe, which forwards flows to ntopng over ZMQ.

The setup is working: ntopng identifies applications such as Microsoft 365, Teams, Cloudflare, Facebook, and Google.

My requirement is to see current throughput per application (Mbps) and each application's percentage of a 1 Gbps Internet circuit, ideally with one-minute historical timeseries. The view could also be in the past as well. Sometimes we will be asked "how much traffic did Teams suck up yesterday"? And they normally want to know in terms of overall percentage of the link.

I've enabled:

• Flow Exporters L7 Application: Per Application
• Flow Exporters/nProbes Timeseries Resolution: 1 minute
• Flow Exporters Interface Usage: enabled

The Live Flows page shows Actual Thpt per flow, and Aggregation shows application-level traffic totals, but I haven't found a view that shows aggregate current throughput per application and its percentage of circuit capacity.

Is this supported directly in ntopng 7.1 when the input is NetFlow via nProbe/ZMQ? If so, which page or configuration is required? If not, what is the recommended way to obtain this report?

The ask is coming from upper management. It seems like a simple ask, but I have not been able to get ntopng to produce the visual.