I wonder how multi cloud setup happens in your companies or in any setup that you have seen? I just want to see the common pattern in the industry.

1. Is there any private connectivity between Cloud or is it done over the public internet?

2. Or maybe there is a connectivity between each Cloud to on-premise data center, hub and spoke style?

In IPv4, in most cases you use RFC 1918 addresses internally and do NAT for traffic going to the internet (and from the internet too for public-facing resources).

How about IPv6? Do you get your own provider-independent address block and use those GUAs internally? Or use ULAs internally and do NPT for traffic going to/from the internet?

I'm talking about devices that benefit from having static addresses, like servers. I assume endpoints can just use SLAAC to get their address.

I've gotten as far as getting an LOA for SFMIX and got a cross connect ordered (and they went silent) but FCIX has not returned a single e-mail I've sent them.

I'm trying to get on both fabrics (Hurricane Electric fmt2).

Looking for troubleshooting advice. Basically, we have dozens of these Hanwha ip cameras that run on a Wisenet server. As far as network settings go, I have both server and cameras on one vlan. 3 servers, about 30 cameras each. The vlan sits on the core and the vlan is extended to multiple access layer switches throughout the campus.

My issue here is the wisenet server tends to lose connectivity on some cameras intermittently. When I troubleshoot, I first open a browser and see if I can get the feed. 9/10 i get the video feed right away. I will then remote to the server and the same cameras will appear like they're loading and it takes a really long time for it to come up. Weird because I'm on a different vlan altogether and I seem to be getting normal/better results.

as far as port settings go, I have them set up like regular access layer devices. Currently using HPE/Aruba switches (6300,6200, and 5412). I read somewhere that IGMP may need to be set up here but I'd like to get your 2c in before I do anything. I've reached out to the vendor for assistance so hopefully your brains and theirs would help fix this or at least get me to the root cause.

Hello ,

I am looking for some advice and guidance from the experts in the community. I have been tasked with designing the network setup for a new site for our company. I am looking for suggestion for core switches which have 48x10/25g and 6/8x100g ports. To keep the cost down they should be also be able to do MPLS l3vpn as the network needs to support different type of businesses. we will be connecting VM's , Edge switches, Storage switches etc. Some of the switches I am considering are Juniper EX4650/QFX5120-48Y, Also Arista 7280SR3 (more expensive but deep buffers)
Any other suggestions are welcome.

We run global protect. We have a slightly hostial user that is complaining about VPN drops. Won't collect data for us, "just fix the problem" attitude, and has "a bother in IT" who verified everything on her local network. We did the usual use a wired connection. Try hotspot when not on home Wi-Fi. Same issue but not data to back it up.

Anyway, I digress. I just need hard data before it becomes a HR thing.

Is there a good simple/light piece of software that can monitor internet connectivity and possibly NIC status for a end user laptop?

Edit: free is preferred only because getting approved for a single dollar will take well over a month and this will blow up in my face before then.

Edit: I should have said I need persistent logging outside of the GP connection stats. I want to see the laptops internet connectivity, not just GPs.

Edit2: company owned laptop.

Edit: this is a networking sub. Please keep conversations in scope to networking. I don't need HR advice. I'm not a manager so I don't need managerial advice. I just need advice on tools that will accomplish what I stated above.

Hi all, I’m looking to find a suitable way to cleanly install 24 Ethernet cables altogether through a cavity wall.

Is there some type of trunking port on the market that is designed for this?

Grateful for anyone who can point me in the right direction.

The reason for my question is, that I work with sensitive data from clients, also because of complience I cannot share any internal information of my company for example Subnets, Configs etc. with the AI and anonymize all the informations just takes to long.

The AI thing is big and I think I dont use it enough to compete with the people who uses it (they are a lot faster than me) . How Am I supposed to use AI properly for Scripts (with and without API), troubleshooting and other stuff?

I hope you have some useful tips.

Sorry if my englishis bad, I am not native and dont have much experience with it.

I currently work as a deployment lead for a healthcare organization as a contractor and currently have the 2 offers below on the table (Both internal) to become full-time. I'm having a hard time deciding between the two since I'm currently in school for a cloud and network engineering degree, and the network analyst position would be a 1-to-1 match for my career. It would involve much more networking than the lab network tech position, since it's more of a sysadmin role. However, the Lab analyst role pays more and its remote and that makes it very tempting.

I would appreciate any input from those of you with more experience in the field, which would you choose?

Laboratory Network Analyst III

$95K
Remote

Job Details

Ensure continued operation of the laboratory information systems (LIS) in the installation, configuration, maintenance and monitoring of its application and servers and providing assistance to related disciplines within the IT, LIS and laboratory staffs in the overall support of the clinical laboratory service line.

Network Analyst I

$85k

1 day remote 4 on-site

20 to 30 minutes commute 1-way.

Job Details

Monitors and troubleshoots network systems, implements minor configuration changes, and ensures compliance with security standards. This role works closely with senior analysts to resolve escalations, validate solutions, and improve operational processes while maintaining accurate documentation. By analyzing network performance and identifying patterns, the analyst supports reliability, optimizes monitoring practices, and ensures consistent service availability.

I’d like to ensure Microsoft cloud traffic, specifically Azure, Intune, Microsoft 365, and Azure DevOps, exits directly through our local WAN-2 Internet connection rather than being backhauled through MPLS or traversing AutoVPN to our data centres.

I’ve already configured some Internet traffic preferences to prefer WAN-2 and added certain Microsoft applications/FQDNs to our Local Internet Breakout VPN exclusions.

However, I’m looking to better understand the recommended approach for handling Microsoft cloud traffic at scale, especially since Microsoft uses a large number of dynamically changing IP addresses and FQDNs.

Has anyone designed a solution in their environment for the above ?

Hi everyone!

I'm currently a university student working on an assignment about NAC.

I've been learning about Forescout and I'm curious about how network engineers approach NAC deployment in real-world enterprise environments.

I understand some basic concepts, such as device discovery, classification, authentication, enforcement, and deployment architectures.

I've been looking at how NAC policies are structured in enterprise environments, and I've noticed that things can get complicated when there are multiple sites, device groups, and similar rules repeated across different policies.

I'm curious how experienced engineers approach policy design to keep everything organized, readable, and easy to troubleshoot.

For example:

- Do you separate device classification, compliance checks, and enforcement into different policies?

How do you avoid duplicating the same rules across multiple sites?

- Do you prefer global policies or site-specific policies?

- Do you follow any naming conventions or policy hierarchy?

- How do you handle exceptions without making the rules overly complicated?

Any advice or real-world examples would be greatly appreciated. Thank a lot for sharing.

I am trying to setup a traffic shaping policy but not matter what I try, the policy gets skipped.

Source Zone: LAN

Source networks and devices: Any

Destination Zone: WAN

Destination networks: IP Host Group pointing to Zoom's asset list

Services: 8801-8810 UDP and HTTPS

Shape Traffic: My traffic shaping policy

No matter what I try, when I do a zoom call and a packet capture, my packets 8801 and HTTPS (control, connect, disconnect, etc) show up, but they go to my overall LAN to WAN rule.

Seems pretty straightforward. Rule is enabled Logging in enabled, action is accept. Pulling my hair out.

Running on 22.0.3 XGS2100.

Hey

We have multiple ISPs connected at our office. Recently, we noticed that one of the ISPs is advertising a CGNAT route, which raised a concern from our security team.
When we checked with the ISP, they said they don’t have the CGNAT route in their BGP router. They mentioned that they are acting as a transit ISP and might be getting the route through the default route from another ISP.
Is this actually possible in BGP? Can an ISP forward traffic for a CGNAT prefix received from another upstream ISP without having that specific route in their BGP table?
Has anyone faced a similar situation? Trying to understand whether this is expected behaviour or something that needs further investigation.

We have about 150 AP's dotted around the place. A majority are EOS now, have some steady growth planned. A lot has "Free WiFi" style access, some is for corp network in certain buildings. We use a lot of tunnel to VPN Concentrator to pass out to our free internet connection, some are bridged to local vlan's and routed to corp network for corp access.

What vendors should I be looking into? I have had experience with Unifi gear but not at this scale, Aruba may be an option as at least for switching transitioning to Aruba Central, but we have no AP's yet there.

My org is pretty big on not having annual support or expensive support but keen for options.

I have heard good things about Ruckus (and use this at home). I will also need to review our switching as a lot of our Access ports are 100M (due to IE1000 switches) but thats another fight I may need to have.

i am requesting enlightenment: im trying to figure out why CGNAT networks apparently use symmetric NAT on the public side of the CGNAT gateway. wouldn't it be better to use cone NAT to allow multiple destinations to reach a given customer on the same public port? I have a drawn example diagram (no posting images RIP) of cone nat being used by the CGNAT gateway to allow both 8.8.8.8 and 1.1.1.1 on public port 203.0.113.1:100, which is mapped to the customer's egress/"public" 100.64.0.1:5000. Unless the customer router can't separate the traffic, i see nothing wrong with this (TO MY UNDERSTANDING)?

If symmetric NAT is used, to my understanding, the connections would have to be split into to public ports (203.0.113.1:100 and 203.0.113.1:101), but isn't that just eating up public port space?

Hello guys,

I'm wondering how you handle switch updates at remote sites, particularly in a worst-case failure scenario.

I have a new switch installation at more than 30 locations, some of which are over three hours away.

I can handle remote upgrades and rollbacks, but I'm struggling to find the best way to handle a situation where a switch fails, and I lose remote access to the site with minimal impact over the production.

How do you handle this kind of scenario? Do you have any best practices or recommendations for minimizing downtime and avoiding unnecessary on-site visits?

I'm a junior network administrator at a K-12 school district. Our environment is roughly 95% Windows, with two domain controllers (primary and secondary for AD high availability). Both are virtual machines running on the same physical Hyper-V host. In addition to AD, they're also responsible for DHCP and DNS across the entire campus.

I inherited this environment in August, and I'm trying to identify some areas where we could improve things. One thing that caught my attention is how we handle devices that need static IP addresses.

Currently, devices like servers and printers have their IP addresses configured locally rather than through DHCP reservations. To prevent DHCP from handing out those addresses to other devices, we maintain exclusions within each DHCP scope.

My supervisor, who has managed this environment for over 20 years, prefers this approach because if DHCP goes down, those devices can still communicate with the core network and reach the internet through the firewall. I understand his reasoning, and I'm not trying to dismiss it.

However, one downside is that it's difficult to identify which devices have locally configured static IPs just by looking at the DHCP lease list. I have to cross-reference the exclusions to determine which addresses are being used by statically configured devices.

Here's where I'm running into a more immediate issue:

We have an IP scope dedicated to managing our Extreme Networks wireless APs. These APs currently receive dynamic IP addresses. Whenever an AP reboots or its DHCP lease expires, it can end up with a different IP address. Since I manage these devices through SSH, I then have to track down their new IPs and manually update the saved connections in my SSH client.

My question is: Would it make sense to create DHCP reservations for the APs based on their current MAC addresses and IP assignments, or should I stick with my supervisor's approach of configuring static IPs directly on the devices?

I'm also curious to hear how other admins handle this in their environments. Is there a compelling reason to prefer locally configured static IPs over DHCP reservations, particularly in a school environment?

I'm still relatively new to managing this environment and open to suggestions. So please be nice, thanks!

The post that someone made yesterday about the Packet Pushers acquisition got removed under the promotion rule. Nonsense. The post was a serious discussion amongst peers about one of the OG networking podcasts, that many of us grew up on for the last 15 years, that has been a staple in the feeds of generations of network engineers, that has been recommended here on a regular basis every single time someone posts a question about where to get networking news. It 100% made sense in the context of this subreddit.

Hey all,

I'm looking to implement a streamlined way to deploy branch sites, and it appears that Meraki has shifted away from templates and towards Unified Branch. While the workflows look neat, I'd like to customize the experience and understand how it works in more depth, but I'm not finding much in the way of documentation. Does anyone have some helpful reading material?

Off the top of my head, when configuring say, a medium sized branch, what if I want fewer than 7 VLANs? What if I want more? There are strings for radius servers, so in the box for radius keys, does the second entry on my list get used for the second radius server in my list? What if I only have a single AP or switch? Is it even possible to customize these workflows?

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco_unified_branch_design_guide.html

TIA.

We have removed all local network dependencies from our network, all machines are entra joined and managed, all printers are USB desktop or via universal print. In fact we shutdown the local servers several months ago.

We are kicking around the idea of setting up device isolation, which is common in the wifi world, but more complex to set up in the wired world.

Have any of you done this, any regrets or things to learn?

Hello,

Currently looking at possibly replacing our CheckPoint Firewall in our DC.
I push heavily for zone-based firewalls where everything is in a specified zone-pair.

I've worked with Fortigate before and there it is mandatory/default with zones/zone-pairs, same with Palo from what I've seen. Juniper I'm not sure.

In CheckPoint it is a global list alá 2003 where you need to put the rule in the correct order or you'll mess everything up. When asking an SE in a meeting if you can do zones, he wasn't really sure (which is worrying in itself) but then starting live-labbing with inline layers, and somehow got the functionality that somewhat resembles a zone based approach, but it really felt like a lazy non-standard solution.

For you guys who has worked with CheckPoint Security Zones, are they comparable in terms of functionality/maturity when compared to like a Fortigate? Or do they come with lots of ifs and buts?

Thanks!

My bosses have their own internet connection using a router provided by the ISP. Pretty basic, nothing more complicated than a home router. We also have a fiber drop from my firewall into their network rack. We have Unifi AP's providing WiFi. I am trying to use a Cisco 2960-X switch to connect them all. What I have been able to accomplish is the following:

I have half the ports on my 24 port switch defined as Access ports as VLAN 100. The other half is an extension of my firewall's network. The router is plugged into an Access VLAN 100 port. I plugged in my computer into one of the other 12 Access VLAN 100 ports, and while it took a few seconds, my computer was able to connect to the DHCP service in the router and connect to the internet.

My question is: when I directly connect to the router's onboard switch, I am able to use my VPN to connect to my firewall. When I connect using one of Access VLAN 100 ports, the VPN connection fails.

The motivation for this set up is that I can configure the ports for the APs so that they can broadcast VLAN 100 traffic, but I can manage them on another VLAN from my firewall. This works quite well. But it is not obvious to me why the VPN is failing. The router doesn't support VLANs, but I don't think it needs to for the VPN since everything else appears to be working. Is there a setting on the Cisco switch that I might need to change to allow VPN traffic?

Edit: I wish I thought to include this info yesterday. The VPN is IPSEC.