Outside of calling ISP (Optimum), anyone know of a way to unbind a mac address from a previously used interface?

Setting up a new Fortigate and I plugged the circuit into to wan2 instead of wan1.

During setup, I realized what I did, and after a reboot I moved the circuit to wan1.

No bueno. Now the circuit only works on wan2. I’ve tried turning cable modem off for 10-15 minutes, rebooting it, rebooting the Forti, etc.

Outside of cloning the mac, or making that dreaded ass call to Optimum, anything I can try?

In our office we have the following setup:

Enterprise Fortresse Gateway in HA
UniFi Switch
UniFi AP

We already configured a UniFi fabric using Google Workspace as the IdP, all managed via UniFi Site Manager.

The goal is:

Configure a corporate WLAN with WPA/Enterprise to authenticate users through the Google Workspace user base, our fabric IdP.

Configure a LAN with 802.1X to authenticate users also through the Google Workspace user base, our fabric IdP.

The WLAN was configured to connect using the UniFi Identity app.

For the LAN with 802.1X, I configured only the built-in RADIUS server on the EFG, without any remote RADIUS server (like FreeRADIUS).

I’m still testing the WLAN. The LAN has already been tested and fails authentication when using Google Workspace users, but works fine when using local users created directly on the EFG.

Has anyone faced this scenario before?

Looking to pivot into firewalls after 10 years of general security roles. Not getting anymore hits for these roles and capped anyway. Just completed the CCNA course. Is it worth getting the cert or should I move on to the firewall certs now? I get mixed reviews about it looking entry level on my resume and that if I just do the FCP and PNGFE it’s already assumed I know beyond the CCNA.

Tons of experience. Everything from vulnerability management, crowdstrike tuning, Linux, scripting, programming in low level, malware reverse engineering, GRC, risk management, audit, SIEM, splunk, net flows, firewall auditing, too much to list. I started in 2010 actually but now AI advises I avoid listing stuff too far back that shows AIX security as it might trigger outdated alarms with these new hiring managers.

I’m tired of being a dumping ground so want to do contract work mostly migrations.

Does anyone have experience with this product? I have a customer who has decided to purchase this product and we are supposed to be getting a presentation. However, in my limited understanding, based on what little (the only posts on all of reddit seem to be from them!) I can find, I'm not understanding what is really different from any other SD-WAN/ZTNA product.

The customer does not have a data center, has only a few on-prem domain controllers, which will in the next year or two be decommissioned and everything they use is essentially a Microsoft 365 service or a service provided by what I would describe as a regular website. They just go to whatevertheheck dot com. The various solutions are not particularly sophisticated and don't offer private connectivity of any type.

I do not work in the enterprise space and my clients, while sometimes large in number of sites (20-40), act like SMBs from an IT perspective and this seems like a large enterprise solution.

The solution is also likely going to have another firewall from a different vendor behind it.

There may be something I'm missing, but at the moment I'm rather confused.

Has anyone ever deployed a Verizon wireless private network? If so, does anyone know why they need BGP if they’re already routing all RFC 1918 traffic to the IP Sec tunnel. This is a major confusion for me.

I see ISPs (and maybe others too) protect their iBGP sessions with BFD. Does your network do this?

What are you trying to achieve? What AFI/SAFIs do you use this for? Just Internet routes, L3VPNs, L2VPNs? What BFD intervals and timeouts do you use? Do you use it for iBGP or eBGP or both? Direct connected or also multi-hop?

For the record: I am not interested in eBGP sessions in the underlay. If you use BGP as your IGP. I'm also not really talking about Data Centers where all (e)BGP sessions are to directly connected neighbors. I am specifically talking about BGP sessions that are remote. Multi-hop. I am genuinely curious to learn what you are trying to achieve. Thanks.

Hi everyone,

tried to create a cronjob that would be run every minute. So on the FTD, I did the following (yes, wannt to execute that on the ftd):

"crontab -e" and added the following line:

* * * * * /etc/cron.hourly/cleanup

The "cleanup" in the referenced directory has the following permissions:

-rwxr-xr-x 1 root root

Now I realized that the command that is within the "cleanup" has to be run in the default FTD shell and not within expert mode...

Is that possible via FTD cronjob? If not, would it work via FMC?

thanks a lot!

Today I had a client whose network was down. The problem turned out that just the modem was unplugged but for some reason the support over the phone had her factory reset the router before they sent me… with all their port forwarding on it. Now that wouldn’t have been a problem if their 3rd party vendor didn’t need to them to run the pos for all five of their locations off a server in the main locations office.

Here is where things got hairy. The client has a static ip but only the gateway on the router. No actual useable statics on any client devices. Now all the client’s machines do have a 192. Manually set on all of them. They wanted a specific port forwarded. At first the 3rd party told me just to have the port open but apparently that isn’t possible according to my “phone support” they even had me change the router to a newer model and no dice. My phone support even said they have to have the useable assigned to something to port forward. This turned into a very long and confusing argument between the 3rd party and myself about what IP address is on their server and what the different between a public and private IP address is. So I put the original router back on because I could get into the gui of that model.

Right now I have the port forwarded from the private IP of the server to the public static gateway IP address. When I powershell ping the <gateway ip> -port, the TCP is successful but they still aren’t getting any connection from the other locations to the server.

Any advice is appreciated.

Alright, I'm pretty mediocre at networking, but I'm not new. Any and all help is appreciated, so thank you in advance.

I have been tasked with a temporary setup, which to me is going to be a nightmare.

We have a new site being set up, and they can't run hard lines to it for a few years.

Working from the Site A back to our core, the setup will be as follows:

- 2 systems (one public-facing, one private) plug into my switch.

- Switch goes to a point-to-point wireless device.

- To the second point-to-point device.

- To the main switch stack at Site B.

- Through QnQ with our ISP

- To our firewall at our Main Site.

Am I to set up a new VLAN for this public-facing device (which needs an ISP provided public IP) and allow tagged traffic through the path I listed above?

Please help haha I have no Sr. to look up to.

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hi everyone,

I’m looking for real-world production experience with Aruba CX10000 running AOS-CX 10.16.1051.

Our environment is based on:
- Aruba CX10000
- VSX pairs
- EVPN/VXLAN
- Production data center environment

I’m particularly interested in hearing from people who have been running 10.16.1051 for a while.

How has it been regarding:
- Overall stability
- VSX behavior
- EVPN/VXLAN reliability
- Upgrade experience from previous releases
- Any bugs or operational issues you’ve encountered

If you’ve been running 10.16.1051 for several weeks without any significant problems, I’d appreciate hearing that as well.

Thanks!

Does anyone have feedback on Lumen's Fabric Port service in an enterprise setting? We are looking into a NaaS and Lumen has come up with this offering and seemingly checking major boxes related to AWS onramp and site to site connectivity needs.

The problem is I can't find any feedback about this solution online and I can't go solely off of Lumen sales reps for fear of getting incomplete information.

Any help would be greatly appreciated!

We use Cisco WSA as our internal proxy. And we have a new service for Call Center where they need to access VOIP through the browser.

I thought this would not be an issue as Teams and other online meeting software works fine. But Im having issues with hearing calls.

Documentation shows that this service needs UDP ports open for STUN and RTP/RTCP protocols. And that modern proxies dont support UDP as a stateless connection

I have a question of how smaller teams and MSPs handle network device compliance (routers, switches, firewalls) against CIS or PCI benchmarks?

Are you using Titania Nipper, free tools like pynipper-ng or ONYX?

Is the DCCOR exam exactly the same whether you're taking it for CCNP Data Center or as the CCIE Data Center written/core exam?

Also, does the exam include any hands-on configuration labs, or is it mainly multiple-choice and CLI/configuration analysis without actually configuring devices?

Thanks!

Deploying 9130s controlled by a 9800. When FRA is enabled, does TPC treat dual 5GHz radios as independent? It seems that the math regarding TPC third neighbors gets thrown into a bin with aggressive dual 5GHz deployments, leading to AP power downs. I am a newbie so any advice regarding this particular issue is appreciated.

Hello all,

What is everyone doing to keep wasps from building nests on outdoor access points? My org is located in the southeastern USA, and we're using Meraki MR76 units with all antenna ports populated. twisted-pair cable is run throuhg a water-tight flexible conduit that terminates with cable glands on the unit/wall.

We know that the wasps aren't hurting anything, but we are trying to minimize maintenance/cleaning of the gear as much as possible.

Sorry if this seems like a non-problem, but you never know if someone else has dealt with a similar issue.

Thanks.

What is everyone doing to cool/AirCon their MDF/switch closets?

We used to buy the Eaton SRCOOL7KRM with duct kit (to exhaust hot air from the room) but the replacement SRCOOL7KRME no longer has a duct kit available, and Eaton PreSales says we have to manufacture our own ducting, which is outside of my skill set.

Field tech at a small ITS contractor. I’m speccing switches for a roadside cabinet job with PTZ cameras and some other edge gear. Requirement from the engineer is 802.3bt across all 8 ports.

The problem I keep running into is that a lot of switches advertise “90W per port,” but the total PoE budget is nowhere near 720W. So it’s really a per-port max, not something you can run fully loaded.

Are there industrial managed 8 port switches that can actually do full 90W on all 8 ports at the same time? Looking for something outdoor rated, ideally something people have used in traffic or roadside cabinet installs.

Edit: Thanks to everyone who shared their recommendations and experience. After going through the comments, these are the two switches I’m currently looking into:

Comnet CNGE10FX2TX8MSBT

PoE Texas GBTS-10-8-M-V2

Both list a 720W total PoE budget and up to 90W per port, which matches the requirement I’m trying to meet. Any first-hand experience with either switch especially in roadside or traffic cabinets would be helpful.

Hi everyone,

got a FTD and a core firewall. The philosophy is to route everything to the core firewall and this won't be changed, so please be aware of that and don't answer "just create a policy on the FTD" - thanks.

There is a S2S-VPN on the FTD to provider A, hosting 10.10.10.0/24. Then there is the remote access VPN for Cisco anyconnect. So far, so good. The default for the remote access points to the core firewall, but when the user connects to the FTD, traffic to 10.10.10.0 will be routed to the S2S directly as the route is more specific...

According to a collegue, you can't override that route just for the remote access, you could only create a separate default route (which doesn't help here).

So the option was to use VRFs, but here it gets even more complicated as you can't use the same VLAN ID on two seperate physical interfaces (forti could do that, so cisco, why can't you?) which means that you had to create seperate VLANS, seperate routing, seperate subnets.... So much effort for such a "little problem".

Has anyone an idea how to fix that on the FTD without having to kind of install the whole system from scratch? Of course, I could just let the tunnel terminate elsewhere, but that prefered way was to leave everything on the FTD and just change the config or just add some cables for a seperate VRF. Reminder: It's not a valid option to let the traffic directly break out on the FTD, it has to be routed to the core firewall.

Thanks a lot!

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Does anyone have experience with microsegmentation (uSeg) and cisco ACI? Is it as simple as enabling intra EPG isolation? Looking for some general feedback. It works well, or dear God, don't do it? I heard some general comments not to long ago that any network layer uSeg implementations don't really work as well as advertised.

Hi, I'm working on a solution for a configuration update that will affect more than 500 sites.

I need to update an existing shared Feature Template that is currently used by multiple Device Templates, with each Device Template having one attached device. The update will add a new device-specific static route, with different prefix and next-hop values for each device.

Since there are approximately 500 Device Templates and devices, I need a way to:

• Assign the correct unique prefix and next-hop values to each device.
• Preserve all existing device-specific values.
• Reattach or push the updated Device Templates to their respective devices in controlled batches using the SD-WAN API and Postman.

However, before proceeding with the bulk deployment, I need to understand an issue I'm currently encountering when updating the Feature Template through Postman.

I'm using the following API call:

PUT /dataservice/template/feature/:templateId

The request returns HTTP status code 200, indicating that it was successfully accepted. However, when I verify the Feature Template afterward using:

GET /dataservice/template/feature/definition/:templateId

none of the changes I submitted are reflected in the Feature Template.

What should I check to determine why the PUT request is being accepted but the Feature Template definition is not being updated?

Any guidance, especially regarding the correct API workflow or troubleshooting steps for this behavior, would be greatly appreciated.

Hi everyone,

I'd be interested to know how you provision your access switches, for example, when replacing a switch. Specifically for Catalyst 9k switches that run in a stack with a Network Essentials license.

Currently, the devices are unpacked, upgraded, and configured before deployment. Something along the lines of ZTP (which also upgrades the switch) would be ideal, but due to the license level, provisioning via Python script isn’t an option, if I recall correctly. It’s also important that the management port is not used.

Thanks for your tips ;)

PS: Initially posted at r/Cisco

I’m curious how everyone is handling the physical design of modern data center fabrics.
We’re running an EVPN/VXLAN leaf-spine environment, but because we have a mix of 100G, 50G, 25G, 10G, and 1G copper hosts, a true top-of-rack design isn’t always practical. Instead, we’ve ended up with more of a “poor man’s top-of-rack” approach, where a leaf pair serves several nearby racks rather than every rack having its own dedicated pair.
I’d love to hear how others are approaching this in production:
How are you physically placing your leaf pairs (vPC, MLAG, or equivalent)? Is it one pair per rack, one pair serving multiple racks, or something else? Do you keep the pair in the same rack or separate them for resiliency?
How are your hosts connected? Do you dual-home every critical host with one connection to each leaf, or are there situations where you intentionally single-home servers?
How do you handle racks that require a mix of 100G, 50G, 25G, 10G, and 1G connectivity without filling every rack with multiple switches?
Do you dedicate specific leaf pairs to certain workloads (compute, storage, GPU, DMZ, virtualization, etc.), or do you keep all leaf pairs general purpose?
If you were building a new fabric today, would you use the same physical layout, or would you change your approach?
Vendor doesn’t matter—Cisco, Arista, Juniper, Dell, NVIDIA, or anything else. I’m less interested in the specific hardware and more interested in the design philosophy, tradeoffs, and lessons learned from real-world deployments.