This is a hypothetical I'm just looking for what you guys consider to be good documentation.

For example, let's say you are a JR network admin and you are new to the environment and the SR tells you that documentation exists for the 'routers' and 'core switches' and you can review it by typing the device hostname in the knowledge base server.

Ok, great, you do that and you see the documentation for the HA routers.

Now what, what do you expect to see?

I'm not looking for someone to copy paste their documentation, as stated, this is a hypothetical.

I see a lot about documentation on here but what does that mean? I'm sure it could mean different things to different people.

Yes, you should have login credentials for the devices documented and config backups should be automated, but lets say your backups are not good and you need to start over, are you expecting to see the full config of the routers in the documentation?

Any time I document something, I try to make it as dummy proof as I can. Maybe an accountant couldn't do anything with my documentation because they don't know what a console cable is or they don't know what SSH is, but I try to make my documentation detailed enough for a help desk tech to be able to follow the documentation step by step to resolve the issue or get it to a point where it is at least 'online' for myself or another network eng/tech/etc to be able to login and take over.

I say that because I often read documentation that was put together by someone else and aside from it being outdated, the steps are not very detailed. For example, it will say something like this.

1. Log in to the server
2. Get the logs
3. Send the logs to support

My documentation would say something like this:

1. Log into the server, the hostname is xxxxxx the ip address is xxxxx
2. The name of the application on this server is xxxxxx, the logs are located in C:\Program Files\xxxxxxx\logs\filename.txt copy filename.txt that is the file that is needed for support.
3. Send filename.txt to support@application-domain-name-here.com and include your case number if there is an active ticket.

Edit- My example included an 'application' and I wanted to post this in networking specifically because this is mainly a question for the networking device documentation. I wanted to make it clear that this was not incorrectly posted here instead of sysadmin, for example.

Hi everyone,

We’re planning to implement 802.1X using Forescout with EAP-TLS on our access switches.

We use Infoblox for DHCP/IP management.
A few questions before rollout:

Does enabling 802.1X require endpoint restarts, and why?

Can it cause devices to lose their current IPs or obtain new ones, even with DHCP reservations in Infoblox?

If authentication fails, is reconnecting the Ethernet cable enough, or might a full restart be needed?

We have many employees, including remote workers, so I’d appreciate insights from anyone who has implemented this at scale.

College student here learning about the two different states of FTP. The CompTIA Network+ courseware states that, in Active FTP, the client sends the desired port for the data connection over to the the FTP server at port 21, and the server then establishes the data connection at the chosen port + 1. In Passive FTP, the client establishes both the control connection AND the data connection, using a random port given to the client by the FTP server.

After some research, I also found that Passive isn't actually totally random—it's selected from a range of ports determined on installation

...so then why does the Module 7.2 quiz say otherwise?

Here's the question:

Which of the following is a limitation of active FTP mode regarding firewalls?

The answers, and the one I chose:

A It requires HTTPS for data transfer. 
B It can cause configuration problems due to unpredictable port usage. Correct Answer
C It only works with TCP port 22. Incorrect answer
D It encrypts the data transfer by default.

It's worth noting that I only chose C because I didn't know what else to choose, since I was under the impression that B would be incorrect

This was the explanation:

Active mode FTP can lead to firewall configuration issues because the server initiates connections to random client ports, which can be blocked by firewalls not configured to allow such connections.

FTP does not require HTTPS; this is a separate protocol used for secure web browsing.

Active mode FTP uses TCP ports 20 and 21, not 22, which is for SSH.

FTP does not provide encryption by default; secure versions like FTPS or SFTP are needed for encryption.

Maybe I'm just reading the entire thing wrong or something, but I'm getting from multiple sources—including CompTIA themselves—that Passive FTP is the one with "random" data connections, not Active FTP. Can someone please clear this up? It's making my head hurt.

I'm currently working on a project focused on automating network configuration in an existing network environment. I'm completely new to network automation, so I'm looking for advice, recommendations, and experiences from people who have worked with network automation.

The goal is to automate repetitive configuration tasks while keeping the existing infrastructure in place. A complete migration to Infrastructure as Code (IaC) as I see it isn't realistic for now, so I'm particularly interested in solutions that can be introduced incrementally into an existing environment.

Our environment includes equipment from multiple vendors:

• MikroTik (BRAS)
• HPE / Aruba
• Edgecore
• Ruckus ICX
• Extreme Networks (VDX / MLX)
• Fortinet (FortiGate)

The main tasks we wouldd like to automate for now are:

• VLAN provisioning along the required network path: The tool should determine which switches are on the network path between the relevant access router or BRAS and the customer connection, and configure the VLAN only on the devices that need it. The VLAN does not need to exist on every switch in the network, only on the relevant switches along that path.
• BRAS and RADIUS configuration: Automate the configuration required to provision a customer connection.
• Resource allocation and documentation: Automatically select an available VLAN ID, IPv4 address, and IPv6 prefix/address while ensuring that resources are not already in use or reserved. Currently, our network documentation is spread across multiple systems and only some of these systems provide API access. Any recommendations for centralizing network documentation, tracking resource allocation, and integrating/replacing existing documentation sources would therefore also be appreciated.

I've already looked into some tools and products, such as Ansible with AWX, Nornir, Cisco NSO, NetBox for documentation, and Oxidized for configuration backups (we currently use RANCID). However, there are many options and design decisions to consider, and it's difficult to know which approach would work best for our environment.

Ideally, we would like a solution that supports the vendors mentioned above. A interface or GUI to make configuration changes would also be a nice thing to have. Support for reviewing and approving (certern) changes before they are applied would be particularly useful for audit trails that record who requested, approved, and executed each change.

Recommendations for suitable tools, example architectures, or ways to implement this into our environment would be greatly appreciated. I'm also particularly interested in approaches to determining the required network path and resource assignments, and integrating automation into documentation.

Thanks in advance!

Hi All,

Yesterday we ran into a packet loss and jitter issue between NTT and Arelion. NTT NOC confirmed it was congestion between them and Arelion and gave a boiler tempalte response about them wanting to work on increasing capacity etc. and if anyone is a client of Arelion to reach out directly. NTT has always been good for us. I came across https://www.reddit.com/r/networking/comments/1i90gy4/arelion_have_depeered_ntt_in_europe/ and that post makes it seem like NTT isn't the one playing nice.

We all know about Cogent not playing nice with HE (and I think at one point Google as well) which is why I wont ever use their service unless they are the only option. Whenever their sales reach out my response is the same "have you worked out your issues with HE yet?". My question/frustration/issue is with an ISP telling you that they are connecting you to the internet when they are not. If I want to use Cogent for v6 then I MUST get another ISP that can get to HE or I don't have full internet routing. In such cases do you just "eat it" and get multiple uplinks or do you put pressure on your upstreams? My clients don't care who is at fault they simply want their internet to work. I am very much against regulation but it's 2026. There should be a standard as to whom is in the Tier1 club and the big boys should be forced to work out their differences.

So our network lead got a new job and I’m super happy for her but that just leaves two people (myself and another) as the network engineers for our company. My coworker and I are pretty good technically and held things together while she was out on maternity leave a while back, but she really handles a lot of the administrative tasks and documentation.

My question, and where I could use some advice from others that might have gone through something similar, is what do I need to do to make sure we stay above water after she leaves? How do we handle losing a big knowledge source? My teammate is being asked to take over as lead but I’m not sure he really wants it, and I don’t think my lead’s boss wants me to be a lead just yet.

Thank you in advance!

Wondering what cert(s) or education to go for from my position.

I was on the Service Desk for 3 years and have been a Network Engineer for the past 4 years. My work does neither encourage nor rewards certifications, so I have never pursued one. I have experience with Palo, Juniper, Fortinet, VMWare, and other basic Network Admin tools/concepts.

Where should I go from here to be valuable in the job market? My family will likely need to move in the next 1-3 years and I want to be able to find a job easily. Even though we have no access to Cisco equipment, is a CCNA best? Should I go with a Palo or Fortinet cert even though I do not plan to go into security? Juniper cert? Any input is appreciated, and thank you in advance.

I'm the facilities manager for a shopping centre and we're redoing the CCTV in our multi-storey car park. Our integrator has suggested Comnet and Antaira as the two brands to look at.

We’ll have a small switch on each level feeding 6 fixed cameras, with fiber back through the building. At the entrance and exit we’ll also have a couple of PTZs plus separate fixed LPR cameras.

The switches will be sitting in service areas that can get pretty hot in summer, so we need proper hardened PoE gear.

Both brands seem to cover what we need and the specs are pretty similar, so I’m more interested in what they’re actually like once installed.

Thanks!

So I've seen these from what I've been told they are optimum free wifi.. I'm more interested in figuring out who makes it and what is the series/model.

https://imgur.com/a/uBIdd9I

https://imgur.com/a/dMDDmIg

https://imgur.com/a/3Rlmc4b

I’ve got an issue here that has several folks stumped. I noticed an issue with slow internet download speeds over a month ago after some network changes upstream. My main vlans were only seeing about 40mbps to Speedtest.net and similar sites. It looked like some firewall bottleneck or QOS issue, and I reported it upstream, they could find no problem. After more troubleshooting I found a subnet here that was seeing proper 900mbps or better speeds, sitting behind the same pair of core switches. More troubleshooting, and I found more at normal speeds. Then came the big break, only vlans that existed on my core switches were slow. Any vlans downstream that were IP routed were fine.

This is a lab environment, basically a small data center. Pair of SONiC switches in mclag setup. Downstream area switches using IP routes back to the cores. TOR switches connected to the area switches. Just a small number of vlans exist on the Core switches, my main infrastructure vlans and a bench vlan.

As a test, I eliminated the infrastructure vlans from the core switches and replaced it with an IP route to the downstream area switches, and to my surprise the speed problem disappeared. Gateway IP was already on the downstream Area switch, that didn’t change.

I set up a new vlan on a single core, with a single access port again on the core. Laptop connected on that vlan saw slow transfer speeds to the internet.

Set up iPerf on some local systems, speeds between core vlans were 900mbps or better, between local IP routes were normal. So everything from the cores on down seem fine, it’s only going upstream.

The change a month back upstream changed to a different pair of switches, and changed OSPF to BGP routing. I have no control or visibility to the upstream side config.

I did a few packet traces but didn’t see anything unusual, no excessive retries, etc.

I’m really stumped on troubleshooting this. To me everything screams bug in SONiC’s vlan handling, but it seems I’m the only one seeing this issue. Dell Enterprise SONiC for what it’s worth, and I’ve engaged their support engineer who is also stumped.

EDIT 1: Forgot to add, running a ping test from outside my network to a system on a problem vlan, pings generally were about 2ms without speedtest running, but spiked to 130-190ms when speedtest ran.

Experienced with Cisco aci would like to lab vxlan evpn and multi site for data interconnects. I’ve current tshoot tradition spine leaf nxos deployments but I’m really to build and break these architecture and later on try deploying with ansible/ netbox.
What are the best most affordable way to lab this, I keep reading that I need a beefy server because of the size of Cisco virtual images and ram needed.
What is the going price for a good lab or equipment and set up?

Hi everyone!

I'm looking for a good alternative to NetSetMan for Windows.

I'd like a tool that lets me quickly switch between different network configurations, such as:

• IP address and DNS settings
• DHCP and static IP configurations
• Different network profiles for different networks or situations

Ideally, it should be lightweight, reliable, easy to use, and preferably free.

Does anyone have any recommendations or personal experience with similar tools?

Thanks in advance!

Folks, I have completed my Full loop few weeks back, Feedback was great. But careers profile tracking bar shows "Full Loop" and seems like they offered positions to other engineers. Should i still keep hope for 1 year or move on ?

Focusing not on Architects but technical leads of "Run" teams ... enterprise troubleshooters. What would be your estimate of % time in meetings vs % time being able to execute?

My previous position and my current position have polar opposite philosophies on cable management. My previous job, my director was draconian about cable management - people were written up for improper cable management, even just using cables of improper length.

The new position I’m in has, no exaggeration, the worst cable management I’ve ever seen (with the exception that things are at least mostly labeled). I’m a sole network engineer for a branch location of a national organization and management is on the other side of the country, so I don’t know if they have any idea how bad it is.

I’m guessing the ideal is probably somewhere in the middle? I could easily spend 40 hours a week cleaning this mess up to my former director’s standard, but I doubt my new boss actually wants me to go that far. So I was curious how strict others are about cable management to know what’s typical.

A new windows update has broken NTLMv1. Any devices using EAP-PEAP will not be able to connect. A registry key must be changed to fix it.

• Open Registry Editor as an administrator.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
• Create a new 32-bit DWORD value named BlockNtlmv1SSO if it does not already exist.
• Set its value to 0.
• Restart your PC and check whether the Wi-Fi connection works again.

https://www.neowin.net/news/microsoft-admits-windows-11-kb5127648-kb5126646-break-wpa-8021x-auth-shares-fix/

FYI

I own public IP 1.1.1.0/24 (names have been changed to protect the innocent) and peer with two ISP's (US Signal and ACD Net).  Primary path for this space is ACD (we prepend our AS to our US Signal advertisement).   Fat, dumb and happy (or so we thought).

When we egress 1.1.1.0/24 via ACD but there are some random sites (address spaces) we can not access (staples.com, random.gov, etc...).   Though EVERYTHING else works without issue (SSL VPN, P2P VPN, 95% of other web sites, streaming, etc...).  

When I fail my ACD connection then this space is routed over US Signal and everything works perfectly.  We have two other /24’s and they work great regardless of pathing.  It’s only one address space (1.1.1.0/24) going over ACD Net (through US Signal it routes perfectly).   

Anyone experience something similar?  I’m guessing it’s related to asynchronous routing but have no idea how to resolve/troubleshoot.  Carrier support has not been a lot of help.

As always, thanks!

Hi Team,
As outlined below, we would like to configure vEdge to perform routing in VPN 0 so that NTP can be synchronized between legacy network devices and servers.
(Due to the network architecture, communication needs to take place over the underlay.)
***********************************************
Legacy network devices
 |
VPN 0(Gi 0/0)
vEdge
VPN 0(Gi 0/1)
 |
Server
***********************************************
With the configuration described above, legacy network devices cannot communicate with the server. Even pings are failing (NG).
We checked the routing table and vEdge ACL settings, but found no issues.
We are stuck and unsure of the cause, but are there any restrictions or limitations regarding devices under vEdge communicating with each other via VPN 0?

We did the segmentation on the card environment properly. Own VLANs, firewall between it and everything else, and the assessor had no complaints about any of it. Then he asked where the logs go. Turns out everything on the estate ships to the same collector, card environment included. So the collector is in scope, and so is anything that can read from it. Not quite the answer I thought I was walking in with.

Did you split your logging to keep scope tight, or just accept the collector is in scope and lock access down hard?

what are practices ISP network operators having for tracking BGP advertisement changes through , BGP community history tracking .

when and at which stage community on certain ISP own prefix / their customers prefixes changed ? displaying the changes .

As the title says really. What is typically "normal"?

What makes you perk up and look further?

I can see the usual automated recons and corrolating using webstorm centre and other sources.

But sometimes I see a burst of interest to our servers, which makes me think someone has found something interesting enough to cause more probing.

Interested to hear peoples stories.

I'm currently troubleshooting a network issue where laptops on the company network are receiving IP addresses from a DHCP scope associated with the Telephony VLAN instead of the Admin VLAN.

No changes have been made in the data room, on the switches, or on the network configuration to my knowledge. However, new devices are consistently being assigned to the wrong VLAN.

Could someone explain what could cause this behavior? What should I check first to identify whether the issue is related to switch port configuration, DHCP relay settings, VLAN assignment policies, or another network component?

Any insights or troubleshooting suggestions would be appreciated.

Hi everyone,

​Does anyone know where I can rent "dirty" IP blocks at a lower rate?

​I have been searching on Google for a while, but almost all IP leasing providers exclusively advertise clean IP subnets. I also couldn't find much useful information about leasing dirty IP ranges on LowEndTalk or WebHostingTalk.

​Currently, the going market rate for a clean RIPE /24 subnet is roughly $100–$120/month. Because my budget is limited, I am hoping to lease a dirty /24 block for around $50+/month.

​Part of these IPs will be used for legitimate, research-oriented web crawlers. Since this activity could potentially affect IP reputation anyway, I would rather avoid paying a premium for clean space and just lease IP blocks that already have poor or burned reputation.

​Does anyone have recommendations or know of any platforms/brokers offering discounted subnets with existing reputation issues?

​Any advice or pointers would be greatly appreciated!