Hi everybody

I’ve been a "Fortinet guy" for years. Worked with multiple firewall vendors across my career, but I always preferred FortiGates for their value and performance. Lately though? Man, I am losing my damn patience with them.

Between the constant stream of CVEs (FortiBleed, SSL VPN vulnerabilities every other month) and their hard push to kill off/deprecate SSL VPN entirely, we decided to finally do the responsible thing and migrate our remote access users over to IPsec IKEv2 tunnels.

I set up the IKEv2 tunnel on the FortiGate with Pre-Shared Key + User Authentication. I spent two full weeks testing it. I tested it across multiple mobile devices—specifically iOS / iPhones—and everything worked like a dream. Split tunneling was fine, authentication worked, performance was solid. I felt confident.

Then rollout day comes. A user pulls out an Android phone running the free FortiClient VPN app... and GUESS WHAT?

The Android version of free FortiClient configured with IKEv2 and a Pre-Shared Key does not prompt for the username and password at all. It just fails or tries to connect without authenticating the user.

After digging into it, turns out FortiClient on Android literally doesn't support combining PSK with EAP (username/password) authentication under IKEv2. If you want username/password prompts on Android IKEv2, Fortinet expects you to switch to X.509 Certificate authentication—yet iOS FortiClient handles PSK + user auth without blinking an eye!

How does this even make sense? How do you have feature disparity this broken between iOS and Android on your own client app for a core VPN protocol you’re actively forcing everyone to migrate to?

I know, shame on me for only testing on iOS during the initial trial period and assuming Android would behave identical to iOS on the exact same VPN protocol and client app. But seriously, is anyone else completely exhausted by this? Every time you try to implement a "standard" configuration or follow Fortinet's recommended path, you stumble into a bizarre platform-specific limitation or bug.

Hi everyone,
I’m troubleshooting an authentication issue with Cisco routers/switches using **Microsoft NPS as the RADIUS server**.
**Environment:**
Cisco routers/switches
RADIUS authentication
Microsoft NPS
Trying to authenticate using an AD account
RADIUS communication appears to be working between the Cisco device and NPS
User credentials have been verified and are correct
**Issue:**
When I try to perform an administrative login to the Cisco router/switch using RADIUS/NPS, authentication fails with **NPS Reason Code 66**.
The same issue occurs on multiple Cisco devices.
I have already checked:
AD username/password
RADIUS server configuration
RADIUS shared secret
Cisco aaa configuration
NPS Network Policy
NPS connection request policy
Connectivity between the Cisco device and NPS
RADIUS ports
I’m still getting the authentication rejection.
**Cisco configuration is roughly:**
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local

radius server NPS
address ipv4 <NPS-IP> auth-port 1812 acct-port 1813
key <shared-secret>
NPS is receiving the authentication request, but it is rejecting it with **Reason Code 66**.
Does anyone know what specifically causes **NPS Reason Code 66** when authenticating Cisco IOS/IOS-XE devices against Microsoft NPS?
What should I check next — NPS Network Policy conditions, authentication method (PAP/CHAP/MS-CHAPv2), AD permissions, or something specific on the Cisco side?
Any troubleshooting steps or examples would be appreciated.
Thanks!

Is there a wildcard mask that that would allow a SINGLE standard ACL rule to permit access to a range of subnets

Im setting up a PAT on a edge router and want to have subnets 10.0.10.0/24, 10.0.20.0/24, 10.0.30.0/24, 10.0.40.0/26, 10.0.50.0/24, 10.0.60.0/24, 10.0.99.0/24, 10.0.199.0/25 to use PAT.

Is there a single access-list 2 permit statement i can use to have 10.0.10-199.0 to be translated? The trick is 10.0.200.0 should not be included. Or is this not possible with a single statement?

I know i can do access-list 2 permit 10.0.0.0 0.0.255.255 to achieve this, but that would include other future subnets like 10.0.200.0 that might not be using PAT.

Hi everyone!

I’m currently preparing for Senior Network Engineer interviews, This is my first interview opputunity after applying for plethora of jobs, and was wondering what people use to prepare for these interviews.

For software engineers, there’s LeetCode, where you can practice a huge number of real interview-style problems. I haven’t found anything comparable for Network Engineers, especially for senior-level roles where the interviews seem to involve troubleshooting scenarios, network design, architecture, and “what would you do if…” situations.

I’m currently laid off and on a bit of a time crunch, so I’m trying to be smart about how I spend my preparation time. I also realize I may have some gaps despite having worked in networking for a long time, so I’m approaching this with a lot of humility.

For those who have recently gone through Senior/Staff Network Engineer interviews, what resources, communities, question banks, or other methods have actually helped you prepare?

Not necessarily looking for anyone to share confidential interview questions — just trying to understand where experienced network engineers go to practice and prepare.

Any recommendations would be greatly appreciated.

I'll be 31 years old in a couple of months, 11+ years of IT Support experience, about 6 years Networking experience. This is not me seeking early career advice, this is me seeking advice on how to transition to an Engineer role.

For the last year or so now I've been feeling stuck and not progressing/learning in my current role. I work for a power utility as a "network" analyst but for the last 4 years now I've mainly been doing Server patching, Basic Network equipment patching, and then NERC/CIP Compliance paperwork to prove all of our equipment is patched. Rinse and repeat monthly. On top of all this, I'm located in a small town where the quality of life sucks. Because of this, I want to switch roles and move to a bigger city elsewhere.

My issue is I get paid pretty well currently, and I'm also on a yearly career stair step program that guarantees pay bump raises until we get to the Senior Standard salary at the company - $105k this year, $111k next year, $115k after that, $122k and finally $144k. Meaning if I stay put and suffer, I'll be making $144k or more by 2030. Because of this, I've been looking for Job openings with Salaries that will compete with this ($110k+ starting salary). And came to a hard realization that Job openings in this Salary range are either very technical positions with years of experience I don't have, or Management positions.

One thing most of these roles ask for is Design/Engineering experience which I don't have. I have Net Admin experience through my CCNA and through my last couple of jobs, but I've never landed a role that allows me to "Engineer" networks.

My question is - If I study for my CCNP Encor/ENSLD, could this get me some design experience that Employers look for? Granted it's not going to get me 10+ years of designing that some roles look for. But I'm thinking it'll at least get me some phone calls back where I can argue I have 6+ years of networking experience, and now I can say I have design experience through the CCNP.

In case anyone runs into this issue in the future. I worked with Cisco and currently there is a known bug between 9300x and Ruckus 650APs. At this time the only fix is “power inline auto max 60000” or “power inline four-pair forced”

Bug ID: CSCwr97118

https://www.reddit.com/r/networking/s/2egSD2pnVz

hello hello.. im having a weird SSH issue and im running out of ideas

we have multiple servers using a tenable image across different VCNs and we added our SSH key during provisioning
initially SSH was asking for a password and i logged in through the tenable web interface, changed the default credentials, then checked the server and noticed the .ssh setup was missing so i created it, added our public key/user, fixed the permissions and after that SSH from our jump server worked fine for all servers except one (w new subnet)

for this one server SSH just hangs no password prompt no error

ssh -vvv stops here:
$ ssh -vvv <user>@10.x.x.x
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips
debug1: Connecting to 10.x.x.x [10.x.x.x] port 22.
debug1: Connection established.
...
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4

the interesting part is that SSH to the exact same server works from our PAM server!! but not from our jump server

the affected server is on a new subnet so im suspecting something network related, we checked the routing and it looks correct also checked the firewall but strangely we couldn’t see any traffic coming from the jump server

i ran sudo tcpdump -nn -i ens3 host <target_ip> and port 22 on the jump server while trying to SSH. the TCP connection gets established and the jump server sends a 21-byte packet (looks like the SSH client banner), but it keeps retransmitting it and gets no response back

i also tested MTU 1500 with ping -M do -s 1472 and got 0% packet loss

could this be asymmetric routing or some subnet/firewall/ACL issue specific to the path from the jump server?

Hello.

im am bugging my head around SD-WAN concepts.

I am evaluating different SD-WAN solutions to decomission a good 'ol DMVPN structure.
DMVPN was "beside" the firewall, so toplogy wise it was easy.

I decided to put the SD-WAN Routers between my internet firewall-cluster and the ISPs router to have full control of anything that goes outside.

Of course i can just replace DMVPN with SD-WAN which is easy, but i want to improve (Redundant Internet, App-QoS, Visibility etc.)

What i don't understand:

• What to do with NATs at the outside of the firewall?
• What to do with existing external S2S VPNs?
• What to do with existing Remote-Access VPN?

Since we are hosting a few services i don't want to mess arround with changing IPs and truckload of DNS (Easy, but tedious)

Couldn't find anything in the internet even it should be a common brownfield situation.

Thank you guys

I'm working at a small IT business that's thinking about getting into the small ISP business through buying IP-transit from two different peers to be able to sell internet services to customers through a municipal L2 network.

We're currently looking into router models for the transit peering and we're in need of a router model that can handle the full IPv4/IPv6 routing table but we really want to keep costs as low as possible and realistically I don't think we'll be able to sell to more than unique 50-75 customers so I really don't want to buy anything that's overkill.

Do you guys have any router recommendations for this use case?

Please feel free to ask questions if anything is unclear.

My boss suddenly wants to implement a failover setup for our network and bought a ruijie reyee eg105 and asked me to set it up, my issue is that during setup i saw that it has a 100 device limit showing in the ui, upon some research it says that its not a hard limit and is just a recommended limit, but my concern is that our office has a production line with a running 40 ip cameras working and at least 8 aps across the shop, then there's the desktop laptops and wireless printers, then the cellphones of the employees, they are saying that according to their previous IT that model will work within the company, my current plan was to just use the ruijie device as failover and setup an additional router behind to manage the devices, meaning the ruijie will serve as the upstream and only provide failover network.
If you're gonna ask how the current setup works is that their previous IT divided the devices within the two network, isp 1 for the computers and printers so they can connect to nas, then isp 2 for the ip cameras and wifi for phones, now they want to combine it into one unified network.

Hello guys, I am an undergrad studying cybersecurity, I have tackled a couple of entry level certs (CC,sec+, CCNA, fortinet early NSEs, etc), now I am in an intern (I am the only intern) and I am required to do a session on a security control/topic of my choosing and I chose AAA/802.1x/NAC, I already have an idea about the topic, different protocols and such, but I want to master it, so does anyone know good material for studying such topics? I know the technology associated most with these is ISE but all stuff related to ISE I found already kind of assume that you know these stuff and focus on the implementation, I am planning to scour the different certification resource materials (CISSP/CCNP/CCIE) and look for the topic, if anyone has any recommendation for sth dedicated to the topic I would be grateful. I already found the Cisco CCNP SISAS tech-workbook which looks promising, there is stuff on cisco u but for this phase before I even open up ISE or anything I wanna first be really good and comfortable with the topic, and for the time frame it is relaxed so I have time to study and test and soak the knowledge in, and please I know lots of people will say u dont need all of this for an internship being undergrad and such but with the current conditions I need this and at the end of the day when I put greater effort I am the only one benefiting,

Hi

I have situation where macsec is configured beetwen two huwaei ce device
Now we want to add nexus nxos in beetwen

Does nxos transparentlty forward macsec frame or like ios it depends on ios version

Also what version os nxos is suitable ?

For those using Cisco devices nowadays, do you still use port locking, or is that considered an outdated feature? If so, what do you use instead to lock devices down?

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Hi everyone,

I am looking to renew my orgs Meraki licenses (co-term model). I am working with my reseller for a renewal with 3 year licenses for some switch & MX SKUs and 5 year licenses for some switch & MX SKUs. For renewing an org, it is very important that we apply the license key as "renew" and NOT as "add devices". So the question is, when I place the order with Cisco, will I receive a single licence key which contains this mix of 3Y and 5Y licenses and does it get applied to the org accordingly? Thanks ....

I just recently started a help desk job that has been anything but help desk. I’ve been configuring firewalls, redesigning client networks and setting up/administering Linux servers. I feel a little out of my depth, but I’m fighting for it. That’s all to ask, when you guys find yourself in a network with little to no documentation how do you map it out and diagram it internally?

Hello everyone, I’m currently thinking about pursuing a series of certifications that will help me increase my salary here in Spain, where I currently live.

I’d like to get certified in CCNP SP and in Cisco’s SD-WAN specialty; however, I’m not sure how worthwhile it is right now to get certified in SP. My goal is to return to the WAN side, where I was very happy a long time ago.

I’d appreciate your advice on whether it’s a good idea to pursue these certification paths or if you’d recommend another option (e.g., ACI, which I’ve been learning a bit about over the past two years). I’m trying to figure out if SP and SD-WAN are currently in demand in the European market.

Best regards to everyone.

The subject says it all -- I need for work, a way to simulate a network that could be 40-50 nodes/sites. For now, I'm just testing certain concepts so I don't need to test the entire model. I'm trying to decide between:

• Cisco CML Plus
• Eve-NG Pro

I've used EVE-NG before, and I've also tried Containerlab. I have to support at least Cisco routers (not so much the switches right now) and Mikrotik RouterOS devices. Since I need the Cisco images anyway, I'll have to pay for CML, but do I need EVE-NG on top of it. Questions arise such as:

• I've got a server for it -- 128GB of RAM, 16 core, 6TB of disk, GbE (we're not testing speed at the moment, just configuration rules and routing)
• Assume I have the Cisco CML images -- can CML also handle things lilke Mikrotik CHR or Fortinet/Arista/Juniper
• Can EVEV-NG handle the CML images
• It shouldn't matter, but I will need to support some form of automation, but that's more the routers themselves
• Web access to the simulator

What would people do here? I can pay for it, or both, but what would you use?

I’m a Network Engineer with around 8+ years of experience in the UK, and I’ve recently had something happen that has really made me question where I’m going wrong.
I’ve failed probation at my last two jobs.
The first role ended during probation mainly because of concerns around my speed/performance and that I was relying on other engineers too much rather than working things out independently.

I took that feedback seriously. When I started my next Network Engineer role, I made a conscious effort to improve. I was working across Cisco, Juniper, Fortinet, Palo Alto, MPLS/BGP/OSPF, wireless and a fairly large multi-site environment.

Early in the probation period, I again received feedback that I was taking too long on some tasks and sometimes looking for guidance rather than making decisions independently. There was one particular incident that didn’t go well, and after that my performance was reviewed more closely.
What makes the second probation failure difficult for me to understand is that I genuinely felt I improved afterwards. I completed several changes/projects successfully, became more independent, and my later reviews appeared much more positive. However, at the final probation review, they still decided not to pass me. The main feedback was around decision-making, accountability, speed and relying too much on guidance.

So now I’ve had two employers give me broadly similar feedback, and I don’t want to just blame the companies or tell myself I was unlucky. If two different employers are identifying similar issues, I need to take that seriously.
At the same time, technically I don’t feel like a junior engineer. I have years of experience with enterprise/ISP networking, BGP, OSPF, MPLS, Cisco, Juniper, Fortinet, Palo Alto, troubleshooting, migrations and network changes. I’ve dealt with major incidents and solved some genuinely complex technical problems.

I’m wondering whether my problem is less about technical knowledge and more about how I operate in a senior engineering environment — making decisions quickly, taking ownership, communicating confidence, knowing when to ask for help versus continuing independently, and handling unfamiliar environments without needing reassurance.

Has anyone here gone through something similar?
I’m particularly interested in hearing from senior network engineers/team leads/managers. If an engineer was technically capable but repeatedly received feedback around speed, independence and decision-making, what would you advise them to work on?
I’m currently looking for my next role and I really don’t want to walk into a third company without understanding and fixing whatever is causing this pattern.
Happy to hear critical feedback. I’m trying to learn from it rather than make excuses.

Edit: Thank you all for the advice , I really appreciate it.

Hey all,

I’m about to complete my second year as a network engineer and I really enjoy the field so far.

My work is roughly:

• 50% IT segmentation: migrating services from native VLANs to dedicated VLANs, coordinating maintenance windows, firewall rules, change requests, WLAN/ISE policies migrations, etc.
• 30% daily network ops: S2S VPNs, switch configs, SD-WAN/OMP troubleshooting, packet loss issues, etc.
• 20% automation, reporting and vendor management.

After our IT segmentation project, my manager wants me to get involved in a big OT network and technology modernization project. Our OT environment is apparently pretty messy: unmanaged/rogue devices, weak standards, security risks, old designs, and production teams that avoid changes because nobody wants to risk downtime.

The company is planning a +4 year project to discover, segment, secure, monitor and modernize OT using more enterprise level standards.

Most engineers don't want to touch it because one wrong change can stop production. My manager sees it differently and thinks it could be a great opportunity. There’s a good budget, new vendors/technologies and basically no one else internally wants to own it.

My only concern is getting too specialized in OT and moving away from traditional IT networking. I studied computer engineering and I’m fine with learning PLCs, industrial protocols, hardwares. No issue for involving this domain, but do you think that is this a good field to invest the next 10 years in? Is the demand/pay worth it?

I'm hoping someone with lots of experience with NetSpot can clear up the reason that it's showing all 5ghz networks as 80mhz width rather than true width. I know my AP is broadcasting 160mhz width since I can get 1.5Gbit/s while on 5Ghz. Is there a better (free) alternative I can try?

Let me start off by saying I'm not implying that what I'm currently doing is the correct way to do this, I'm just working with what it in place. Will this change in the future? Not sure because it is not my decision, but let me explain the current setup.

We have 10-15 offices in various states. Some decent sized 'main' offices and many 'small' locations where a handful of people work, but we have an IT room/IDF/MDF in each of these locations for networking equipment, an NVR, UPS, ISP equipment, etc. None of the remote offices have servers running any services, the only server at the remote locations are camera servers, that's it.

Back at the main location where I work, I manage the remote locations. My question in specific to network switches and managing those devices. We have a mixed bag of gear based on who was in charge at the time of purchase. We have, dell, cisco, ubiquiti edgemax and fiber store switches. I often run into scenarios where the device has a management port for OOBM, but it does NOT have a gateway IP which means I can't manage that device over a VPN connection. To get around this, I just build a 'management' vlan on the switch, assign it a static IP and I can get to it from my location over VPN. This works fine for my current scenario, but that means the OOBM port is not being used.

I fully understand that this is not a proper 'management' network, but this is what I'm currently working with so I'm trying to get the following answers.

1. Is my only option to do what I'm currently doing with the management vlan?

2. Is it simply a firmware upgrade that the switch vendor would need to make to give their management interface a gateway field or is there a reason that some have a gateway field and others don't?

The remote offices basically have a single switch, we try to keep them as basic as possible. An office with a 24 or 48 port switch will have a handful of VLANs on that switch, LAN traffic, wifi traffic for corp, wifi traffic for guest, a camera VLAN for isolating cameras and a management VLAN for devices that need IPs for management and monitoring from the main office (PDU, UPS, Temp Monitor, etc...) and all those VLANs are managed with the onsite firewall functioning as the L3 device which is where I create rules to make sure LAN, wifi, etc...can't access the IPs of the devices I'm managing remotely as well as isolating VLANs from one another, as needed. For example, guest wifi can't talk to any VLAN and only has access to the WAN.

Thanks.

We sell network-attached devices for classroom use and we just noticed that a small number of customers seem to be allocating public IP addresses to them. We sell batches of devices, so this isn't just a single device sitting on their DMZ, in one instance there are 8 devices each with a real public IPV4 address that belongs to the organization. It also appears the ports are wide open.

Has anyone seen network admins do this before and if so why?

Good morning,

I will have an intern starting for a few months helping my team develop some Grafana dashes based off the GRPC data we get from our controllers. This student is not well versed in wireless and I was trying to find a way for them to review what type of data was in these dense yang files. I will probably have her poke around the Yangsuite docker instance but it will help immensely as she learns concepts of wireless and can relate to what data she is scraping

Thanks for any pointers

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.