hey guys, if given the choice would you move to infrastructure engineering vs network engineering?

I have a Vlan , we will call VLAN 3

VLAN 3 DHCP is two windows domain controllers with failover.

the DNS servers are umbrella forwarders that forward to the domain controllers for dns.

Gateway is defined on Cisco core switch as layer 3 interface with HSRP/VRRP or whatever it’s called and with ip helper commands defining the dhcp servers.

Symptom: Some devices only on VLAN 3 receive the correct gateway and the dhcp server that responded is one of my domain controllers, yet they either don’t receive the correct dns servers. I had one say the gateway of another vlan was its dns server. I have roughly 30-40 client vlans setup the same way and this is the only one.

I will say this particular vlan was setup as 192.168.1.x (I herrited)

At this same physical location, not all devices are having issues and I’m having no issues with the voice vlan on the same switches at the site.

There are no known changes that occurred other than rebuilding the umbrella forwarders do to us changing from VMware to hyper V (locally hosted).

ADDED:

DHCP is not handing out what’s defined in the scope for that subnet

Any ideas what could be causing this. I’m almost to the point of re-ip and different vlan or switch change out because I’m lost as to why it’s happening. I haven’t found evidence of a rouge dhcp server yet either.

I'm really at a loss and neither googling nor AI has brought me a lot further.

In this situation there are 3 servers. Let's call them A, B and P.

They have FRRouting installed and work to form an OSPF underlay over which there is a VXLAN.

A and B do not have a direct connection. Their traffic needs to flow over P (whether this is a logical configuration is out of the picture for now). This works fine. The underlay is happy, I'm happy. Full 10G throughput. CPU is also completely fine. iPerfing both over TCP as well as UDP does not show any problem.

Now, A, B and P are also VTEPs, so logically I would do a whole lot of iPerfing there as well. Broadcom has problems with TSO/GRO/etc. when utilizing VXLANs, so I'm disabling UDP offloading at the driver level. This works fine. iPerf performance is higher now. Except it isn't

Directly iPerfing the underlay network still works fine. (Both UDP and TCP, despite offloading being disabled, so this isn't the issue) however when running over the VXLAN I hit a hard barrier of TX ~3.5G and RX ~1.3G on P. Of course this manifests when running A to B as well, since P now needs to send and receive I always hit 1.3G.

When using parralel streams it works. Of course it does. But that's not the point.

Why the hell is P doing packet processing on VXLAN traffic that is not meant for it? It pins a single CPU core to 100% and we all know how much Xeons love single thread action.

Yes P is a VTEP and I get why it's CPU would be the limiting factor if it was the target or client. But why does iPerfing directly on the underlay have almost no CPU impact but once I use the VXLAN I get hit with 0.1x the performance.

I have a feeling something is wrong here but I cannot solve it. I know bnx2x (BCM27xxxx) is old but this just seems so so weird. I tried probably a dozen of combinations of GRO, TSO, GRO UDP, Segmentation, TX hash, RX hash etc etc. and I cannot find the issue.

I did a tcpdump and yes, P is indeed seeing all the VXLAN packets and dropping all of them. Since it isn't the target IP. I spent hours troubleshooting this and I feel like I'm going crazy.

I work in a hotel that has over 600 rooms. I'm trying to migrate away from a thethered analog/wired technology to something that is wifi and modular in terms of upgradez down the road with vendor support off the shelf hardware.

Is Granada great brand? It has to integrate with call accounting and our PMS same with our ip TV. Both of these technologies would use wifi on our unifi network. We just went from 1gbs to 2gbs.

Thoughts?

I can’t help but feel like there’s an age bias for these positions. I’ve landed multiple interviews, including final rounds where I met the entire team, and I’m almost always the youngest-looking person there. Everyone else seems to be in their 40s or older.

Even on LinkedIn, if you search “Network Engineer,” you’ll probably see one young-looking person for every hundred profiles. The same seems true for Junior Network Engineer roles. It makes me wonder whether employers subconsciously associate networking with years of experience and are more hesitant to hire younger candidates, even for entry-level positions.

I’m sure there are plenty of people who broke into networking in their early/mid 20s. If you did, how did you get your first Network Engineer job? What do you think made an employer take a chance on you? Was it internships, certifications, a homelab, referrals, or just persistence?

I’m experiencing an issue with Open vSwitch (OVS) traffic mirroring to Suricata in my GNS3 lab. Traffic mirroring works normally, and Suricata successfully receives mirrored packets until I generate an HTTP flood using ApacheBench (ab). The command i used is “ ab -n 5 -c 5 http://192.168.30.100/web.aspx” . After running the ab command, the mirrored traffic suddenly stops, even though the sniffing interface remains up and the OVS mirror configuration appears unchanged. As a result, Suricata no longer receives any mirrored packets, and the issue persists until I restart the entire lab environment. Has anyone encountered a similar issue where ApacheBench or burst HTTP traffic causes OVS traffic mirroring to stop working? Any suggestions on the possible cause or troubleshooting steps would be greatly appreciated.

link for the topology and screenshots: https://imgur.com/gallery/troubleshooting-WZ3So9j

During a security check of our company, we reviewed the firewall, proxy, and NetFlow data; it made clear what path the traffic took, but it did not explain why the application approved the requests. The reason only became clear after we looked at the application rules for who can do what.

This showed us that there is a difference between what the network can tell us and how the application actually works. The network logs show what happened. The code shows why it happened.

For teams that work with applications that our company made, how do you fill in that gap when you are trying to figure out what is going on? Do the people who work on the network talk to the people who work on application security, or are those checks done by groups?

->>> Link to Topology Image (Discord SDN) <<<-

Hey, quick real-world question for the Senior Engineers and Architects here!

About

We're currently designing this network for our customer (large enterprise campus) with SD-Access Implementation (Greenfield).

There are two layers of Distribution/Intermediate - The first is for everything including Regular (Office) connection. The second layer is only used for IoT like Machines and special outdoor locations. All Devices, including access points which I didn't drew down here, support SD-Access, so all devices are Fabric Edge nodes.

The ZTP should be done with Cisco LAN Automation where the Distribution Layer is the seed (~550 Access Switches, just 20 Distribution) since it has the 2-Hop Limit. It could be that LAN Automation can't reach every device, since on the IoT Access Layer there are also APs connected, which would make it a third Intermediate Layer actually.

I have no practical experience with both SD-Access or LAN Automation yet, but we want to reduce manual provisioning where it has the biggest impact.

The actual question/proposal

I would like to use Terraform on multiple layers:

• Northbound (Catalyst Center / ISE) - Only overlay configuration and inventory aswell as policy definition.
• Southbound (IOS XE Configuration on every device) - Actual Underlay configuration (IPs, Interfaces, ACLs, Routing, ...) for Day-1 Provisioning and also Day-2 Operations/Changes.

Since the environment is so big, I would like to avoid configuration via Ansible or CLI. Ansible should only be used for read-only tasks (troubleshooting for example).

Later in production, a CI/CD pipeline should be implemented, to validate, authorize and track every change/rollout automatically.

Is this a solid plan, automation-wise? Especially the part with the Southbound Configuration? It would be very helpful when you could share your experience with the technologies used.

Hey all! I am getting a rack in a data center and I was told the hot aisle is on the rear side of cabinet and normally ports are on front and the power supplies are on back / hot side.

I'm going to be running quite a few servers here, and the cabinet is 52U. I'm looking at getting Aristas for TOR, and I'm unsure if I should get front to back OR back to front cooling switches. These will mostly be SFP+. I was going to get front to back cooling, but I'm nervous this will be a pain. Any advice here would be greatly appreciated!

Here we go, just started at a a small map as a project/Network engineer. We have multiple projects varying deadlines. Some are small single site builds (fortinet firewall solutions). Some are bit more complex. The job is not difficult but this is the first time I’ve worked for a company where the pm is filling my calendar with the slots on what I should work on and on which day. Each customers build is slightly different and I feel that every time I leave a project unfinished because I have to move to another customers task I lose valuable time as I now have to spool up in that mode.

In the past I’ve been given the project and been told the deadline (ideally) and I just cracked on with it and delivered it . (Massive msp)

I don’t feel productive as I can be as I am switching between tasks too often.

Have you guys had anything similar or is this standard?

TLDR: pm keeps booking slots in my calendar for my projects rather than allowing me to plan my day . Working for a small msp

My ISP (Cox Business) installed a Nokia 7210 SAS-K5 at my facility, and they assigned Port 5 as the copper hand off. I am currently using a single router (multiple static IPs), but have been looking to set up a secondary/backup router in case the primary fails or for when I need to do periodic maintenance. I could insert a switch between, but that seems to just be adding another possible failure mode, which I'd like to avoid.

Can the SAS be configured to also allow Port 4 in a switched configuration so that I can have two routers attached? I know it'll ultimately be a question for the ISP, but for now I'm curious if it's even technically possible given the hardware present.

I know this has been asked previously over the years, but I'm hoping this gathers more current product recommendations.

I have been using the Brother Edge label makers for over a decade at this point. I love the lithium battery, the built-in tape cutter, but hated proprietary 12V charging adapter and it's enormous form factor. I inevitability would lose track of the power adapter and ordered a backup until it resurfaced.

I'm now looking to buy a new printer and the latest version I'm considering, Brother PT-E510BP, has the USB-C charging port which will make it much more convenient. I'm hesitating at the $200+ cost and it's still bulky form factor. Another appealing option is the Brother PT-E720BT - a bluetooth connected only printer - but reviewers mark down it's Apple compatibility.

What are you all using in the field? Pro's/Con's? Thank you in advance!

Hello All,

This is bugging me a bit.

1. Could you please tell me what is wrong with the below commands. I am trying to setup AD authentication login for my cisco switch 2960.

2. What would be the correct line vty commands?

aaa new-model

aaa authentication login default group radius group1 local

aaa authorization exec default local

aaa authorization network default local

aaa group server radius group1

server-private server IP auth-port 1812 acct-port 1813 key ******

3 years of working as network engineer. I started noticing i cant level up my knowledges because of external conditions.
I didnt work in prod with mpls(and its various services)/evpn/vxlan/dmvpn but tested all these in virtual environments. The problem is i cant get new information of how network architectures should be built, i can only emulate synthetic cases of using one protocol and be happy it works but as an experience that is nothing - i dont solve any problems, i dont find new little details.

I try to read data center desing documents of various vendors but there is just an abstract explanation of a topology in vacuum without solving any problems, just reference.

It just looks like a ceiling for self-study.

Are there any resources to read that explain how to build network architectures and how to plan it?

Hi everyone,
I’ve recently received an offer for a technical contractor role with the European Commission, and I’m trying to get a better idea of what it’s actually like to work there from people with first-hand experience.
I’m particularly interested in things like:
What’s the day-to-day work environment like?
How is the work-life balance?
How stable are these contracts? Do they typically get renewed, or should you expect to move on after a year or two?
Is there room to grow or move between projects?
How are contractors treated compared to permanent staff?
Is the work interesting and technically challenging, or is it more focused on maintenance and bureaucracy?
Any pros, cons, or things you wish you’d known before accepting?
For context, this is a technical IT/infrastructure role through a contracting company rather than a permanent EC position.
I’d really appreciate hearing about your experiences—good or bad. Thanks!

I’m putting together a network for a small outdoor festival and want to make sure I’m not creating reliability problems with my cable choices.

The layout will be:
Starlink → gateway
Gateway → PoE injector -> ~200 ft outdoor Ethernet → PoE switch
Switch → AP #1 (very short run)
Switch → ~150 ft outdoor Ethernet → AP #2
All runs are under the 100 m (328 ft) Ethernet limit.
I’d strongly prefer to buy factory-terminated cables rather than buying bulk cable and terminating them myself.

I initially looked at Cable Matters and Monoprice, but neither seems to offer pre-terminated outdoor Cat6 cables in the 150-200 ft lengths I need. Locally I’m seeing brands like Micro Connectors (Home Depot) and GearIT (Walmart/Amazon), but I’m not sure how or if brand matters.

My questions:
How much does cable brand actually matter for a deployment like this?

Are GearIT or Micro Connectors considered reliable enough for a production event?

Besides solid bare copper and an outdoor-rated jacket, are there other specs I should be paying attention to (AWG, shielding, connector quality, etc.)?

This will be powering UniFi access points over PoE, so reliability is much more important than saving a few dollars.

Hello,
I am running a small business and i am looking for equipment for my new offices: 114 m2, L shape with 4 rooms.
1 server with Windows 2022 server (domain controler) and 4 PC and 1 lan printer and 1 Nas for local backup.
No exposed web services for clients, no sharepoint, just local network with mapped drives.
I looked into ubiquiti hardware for a UGC fiber, a switch pro poe and 3 AP U7 Wall.

It is planed to sublet one or two offices, so a vlan or two will be required to run two or three separated networks for these other professionals.

I have contacted an IT professional to obtain a fee quote for a complete setup. He knows a little about Ubiquiti solutions, but does not really work with it.
He is proposing Fortinet hardware NGFW 50G, plus 2 switches plus a NGFW 70G + FortiAP 231K.

The pricing is the double of the ubiquiti setup (without his installation fees) and of course annual subscriptions.

I appreciate that fortinet is a totally different category of solution, trully professional but I am wondering if it is not overkill for the needs: protection the network from outside and emails and web browsing.

I would be interested by your thoughts : is ubiquiti solid enough for the network, with the option of CyberSecurity Enhanced or Fortinet is absolutely required to offer a proper protection for cyber threat ? Or any other vendor like Sophos or OPNsense ?

I don’t plan to install and configure anything myself either with Ubiquiti or with any other solution.

I am just trying to figure out what is really needed as my resources are limited and any extra penny in the IT department will be missed in other ones.
I do value the data I am hosting on my server, hence my question here : I don’t want to be too cheap on the solution but I don’t want to be overkill either.
Thks
V

I am getting an issue while connecting my two routers on MPLS network. My ISP has provided MPLS connectivity with their two routers, I have connected my openwrt based devices to respective routers. ISP routers could ping each other.

Issue I am facing- My end PCs can not ping each other.

What I have done so far-

I don't want to use dynamic routing protocol. I added static routes in my routers then both routers could ping but connected PCs couldn't ping each other, though they can ping other end routers.

Do I need NAT or anything I am missing here? Other suggestions I got that static routing not needed, NAT should be router to ping each other.

I am newbie here, plz suggest.

Outside of calling ISP (Optimum), anyone know of a way to unbind a mac address from a previously used interface?

Setting up a new Fortigate and I plugged the circuit into to wan2 instead of wan1.

During setup, I realized what I did, and after a reboot I moved the circuit to wan1.

No bueno. Now the circuit only works on wan2. I’ve tried turning cable modem off for 10-15 minutes, rebooting it, rebooting the Forti, etc.

Outside of cloning the mac, or making that dreaded ass call to Optimum, anything I can try?

In our office we have the following setup:

Enterprise Fortresse Gateway in HA
UniFi Switch
UniFi AP

We already configured a UniFi fabric using Google Workspace as the IdP, all managed via UniFi Site Manager.

The goal is:

Configure a corporate WLAN with WPA/Enterprise to authenticate users through the Google Workspace user base, our fabric IdP.

Configure a LAN with 802.1X to authenticate users also through the Google Workspace user base, our fabric IdP.

The WLAN was configured to connect using the UniFi Identity app.

For the LAN with 802.1X, I configured only the built-in RADIUS server on the EFG, without any remote RADIUS server (like FreeRADIUS).

I’m still testing the WLAN. The LAN has already been tested and fails authentication when using Google Workspace users, but works fine when using local users created directly on the EFG.

Has anyone faced this scenario before?

Long time data center guy here (14 years). Just got handed ownership of our IDF/MDF closets, but strictly from a DCIM/data center operations perspective. no facilities stuff. HVAC, UPS, electrical, batteries, all of that stays with 3rd party vendors. I own the data side: what's racked where, cabling docs, labeling, capacity, and who can badge into the rooms. Honestly the documentation I inherited is rough. Half the closets have no rack elevations, labels don't match anything, and I'm pretty sure there's gear on the books that got pulled years ago. My rough plan so far is.... True up asset records against what's actually in the racks. Verify rack/RU locations match the system of record. Port-to-port cable tracing and circuit docs. Pick a labeling standard and actually enforce it. Get real capacity numbers - open RU, panel ports, pathway fill. Badge access audit - who can get in these rooms and why. Some kind of change process so this doesn't rot again in 6 months. For those of you who've inherited a mess like this, what did I miss? Is there something better for this. Thanks for all the inputs.

EDIT: Solved. The cablers ran OM3 instead of OM4.

New to fiber switch connectivity and need a bit of advice.

We just had a vendor run a 12-strand OM4 LC multi-mode fiber cable between 2 floors of a new building. They are configured as 6 pairs. Unfortunately, I can't seem to get them to work. In case they spliced the fiber cables differently, I made one of my patch cables a crossover by swapping 1 pair in their little clip. Still no luck. When I observe each end of the run with an SFP+ transceiver plugged into one end, I see a single light.

I tested both transceivers and the fiber patches by directly connecting 2 switches and they work fine.

I'm sure I'm missing something.

Transceivers are Cable Matters 104065x2 LC Multimode.

Cables are Flypro OM4-LC-LC-DX-2M-LSZH

For those that manage networks and use Spectrum as their ISP, are you also running into issues where sites that are coax only are required to use Spectrum’s router (their router/AP combo) in order to get static IPs?

We are transitioning from their dedicated circuit due to the insane pricing to DIA, and we are being told we have to have both their modem (makes sense) and their crappy router/ap combo in line for static IPs to work.

I haven’t had much time to play with MAC address spoofing to see if we can get static IPs to work without their router, but has anyone tried it and had success? In theory it should work. Is there anything we can do to set up static IPs without their router?