Trying to figure out the best way to implement a failover path between 2 paths of different speeds (25Gbps vs 1Gbps). Any recommendations or should I just let STP do it's thing?

                                           /- OS2 Fiber @ 25Gbps -\
Paloalto (L3/Gateway) - Cisco Switch (A) -                         - Cisco Switch (B) - Access Switches - Endpoint VLANS
                                           \--   1Gbps Backup   --/

• The Paloalto is the gateway/router & provides policies/restrictions between VLANS/subnets
• Cisco switches A & B are L3/VRF/VXLAN capable (C9500-48Y4C-A)
• The 25Gb path is a leased/dark fiber pair that runs through an area where there’s an extremely small, but non-zero chance, of an something severing the connection.
• The 1Gb backup path would be a wireless bridge between the locations (verified as possible)
• Budget prevents an additional fiber ran on an alternative path.

If formatting doesn't look right:
Paloalto (L3/Gateway) - Cisco Switch (A) - (25Gb path or 1Gb path) - Cisco Switch (B) - Access Switches - Endpoint VLANS

Edited to add path information

We have one switch in the IT core rack acting as our querier. IGMP enabled on 3 switches in our 3 studios. Our IT management company is saying these switches don’t do strict priority but rather a weighted priority. Each switch has a Dante Vlan.

I ran into some shows where web gui control traffic was clearly conflicting with audio. But I wasn’t seeing any late packets in Dante controller.

We want ptp clocking to be highest priority then Dante audio, followed by gui control then the rest would be best effort. I am unsure how weighted priority works vs strict priority. I know it’s not what audinate recommends. My IP’s are all static IP for when the sound cart disconnects from the dhcp server to shoot in location. On location everything works fine, on set with heavy multicast flows we run into issues with web gui control traffic conflicting with audio.

Eventually we will be bridging a 2110 video system on its own Vlan.

My question is if the following mapping should be able to work with whatever weighted QoS management system the IT provider is using and what I need to put for hardware gui control. We have one device where the control port is bridged into the secondary Dante port so it can run over one IP (as per the manual).

I’m not a network engineer but I’m trying to figure out if these switches truly don’t support strict priority and what I can make happen with weighted priority.

We do have a ptp grandmaster on its way, so I’m hoping this can fix some of the issues, but we do have a high end recorder acting as the clock leader until domain manager and two other studios become fully operational. The error I ran into was all on one stage/studio

Requested QoS priority order (highest to lowest):

1. Time-critical Dante PTP
2. DSCP 56 / CS7
3. Dante audio and PTP v2
4. DSCP 46 / EF
5. Equipment GUI/control
6. DCSP?
7. Remaining best-effort traffic
8. DSCP 0 / CS0

Has anyone moved Nokia SR-OS Network Group Encryption (NGE) key management off NFM-P and into their own tooling? Looking for anyone who’s actually done it.

Were you able to recover the NFM-P-side shared/custom key so the existing SA keys could be kept?

Or did you just re-key onto your own keys across all nodes and drop NFM-P?

Does the ONT need to report specific OMCI MIB capabilities (via MIB Upload) to the Nokia 7360 OLT before the OLT will trigger the pland-cfgfile and dnload-cfgfile download process?

I know if you want to download the latest IOS/Firmware for a Cisco router/switch then you need a valid smartnet contract or a software entitlement contract.

Historically we've always insisted that each router has it's own Cisco smartnet or software license contract for entitlement.

Obviously this technically isn't required as if you have one router which is under support then there is nothing stopping you downloading that software and putting it on 20 of the same model routers.

What is Cisco's stance on this however? Is it the understanding that if you have software entitlement for a Cisco router (Let's say ASR9001) then you only need it for a single unit and can download the software to put on as many ASR9001's as you please? Or is it the stance that if you have 10 x ASR9001's that you do officially need software cover on 10 units?

thanks

Why can we send a packet, and have it reach the front door of a server / router, tell the server / router about it's arrival, and the receiving server / router can't do a thing about it's arrival?

In order for the packet to even inform the server / router about it's arrival, it has to somehow interact with the server / router. The packet is at minimum saying "hi" to the server / router. It has to interact with the serve / router. Even with "meta information"

How is this interaction possible? What's the science behind it?

What's the propelling force behind the packet being sent? Why does this propelling force lead the packet right to the front door of a server / router, which may not even consent to the packet's arrival?

There are so many connected devices on the internet. Keeping in mind security, but also efficiency, you still have to allow a packet to reach till the front door of a server / router, and then do security checks

And if a packet is making it's way towards a server / router, that server / router can't even stop that packet, since the server / router doesn't even know about the packet's existence yet

The packet has to, on some level, interact with a server / router. The server / router has to become aware of it's presence somehow. Even if this is purely in the context of electrical engineering (I don't know anything about it), the packet still has to have an interaction with the server / router

If we track a packet's "position" during all instances of time, since the time it was created, till the time it reached the server / router, just before interacting with it, how do we explain how it got there? And then, how can an interaction be forced with the server / router? Is there some type of universally accepted "waiver" where electronic systems are allowed to "touch" each other in this way?

Of course, security can kick in as soon as the packet "touches" the server / router, however, why is the touch allowed? Wouldn't that also cause a vulnerability? I guess that's why DDOS attacks are possible?

Two analogies;

Analogy 1:

A person is a packet, a store is a server. The person doesn't need permission from the store to drive up to the street. The person physically walks up to the door and pushes it with their body. At that point the store can stop the person, vet them etc. However, the store can't really prevent the exact moment the person makes physical contact with the door. Even if the store does, the employees have to see the person.

Nonetheless, the store has to interact with the person. Whether it's the door that is touched, or the employees see the person (light rays hit their eyes), a physical interaction has occurred.

For a server / router to "feel the touch" of a packet, or see it, or be made aware of it's presence in ANY way, it has to know about it, from somewhere. An interaction was forced upon the server / router

In terms of packets, how did the person physically walk up to the store?

Why is the person allowed to walk up to the store? Why couldn't the store stop them beforehand? Is it because the city roads are public, just like how a server / router doesn't control the networking channels that allow packets to get to it?

Why doesn't the store have any control over the person making their way from the street to their door?

Is there some sort of consent waived to make a server / router publicly accessible? Just like the store has consented to it's front door being placed facing on a public road?

Analogy 2:

A piece of paper taped on a rock is a packet. A barn with a door is a server / router

The rock is thrown at the barn. It hits the door, and it's not allowed entry at that moment. However, the barn (server / router) hears the knock, and knows a packet tried to enter it. An interaction had to have occurred for the barn to know a rock hit it's door. If the rock missed, the barn never knows

What is the analogy in terms of packets and servers / routers to the rock hitting the barn door?

Is there also some type of wear and tear on the servers / routers when packets "hit" them, since these are systems that exist in the physical world? Just like the rocks hitting the barn door will eventually dent it

Does a specific server / router in a network "consent" to be the server / router that receives almost any packet? And it does checks on that packet, and if that packet is good-to-go, it sends it to the other servers / routers in the network?

The barn door in this analogy is consenting to take the force of the rocks, in order to act as a barrier to protect the inside of the barn from packets it does not want to receive in that moment

-------------------------------------------------------------------------------------------------------------

The main question is, what is the exact driving mechanism that allows a packet to even reach the front door of a sever / router?

Firstly, how does a server log IP addresses from which it gets packets?

Secondly, what's stopping a server from keeping false or even inaccurate logs?

If a server is subpoenaed, and they give IP logs, how does one even verify if the server logged everything properly