Achei o portal Aruba Central Greenlak muito básico. Existe alguma API para coletar dados relacionados à utilização de canais, tentativas de reconexão, etc., no Aruba Central? Também não consegui encontrar um campo para capturas PCAP.

Existe alguma API?

Obrigado

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

I'm running ntopng Enterprise L with nProbe on Ubuntu. My Palo Alto PA-460 exports NetFlow v9 to nProbe, which forwards flows to ntopng over ZMQ.

The setup is working: ntopng identifies applications such as Microsoft 365, Teams, Cloudflare, Facebook, and Google.

My requirement is to see current throughput per application (Mbps) and each application's percentage of a 1 Gbps Internet circuit, ideally with one-minute historical timeseries. The view could also be in the past as well. Sometimes we will be asked "how much traffic did Teams suck up yesterday"? And they normally want to know in terms of overall percentage of the link.

I've enabled:

• Flow Exporters L7 Application: Per Application
• Flow Exporters/nProbes Timeseries Resolution: 1 minute
• Flow Exporters Interface Usage: enabled

The Live Flows page shows Actual Thpt per flow, and Aggregation shows application-level traffic totals, but I haven't found a view that shows aggregate current throughput per application and its percentage of circuit capacity.

Is this supported directly in ntopng 7.1 when the input is NetFlow via nProbe/ZMQ? If so, which page or configuration is required? If not, what is the recommended way to obtain this report?

The ask is coming from upper management. It seems like a simple ask, but I have not been able to get ntopng to produce the visual.

Hi
we are a Hyper V site, running Azure Local. ive got 2 clusters and have built 2 WLC VMs, following the documentation from Cisco about 3 nics, and labelling them trunking etc etc. upon a fresh build of the WLCs we seem to be happy. However when VMs migrate from one host to another within the cluster (as they will do for either performance reasons, or if you are taking a host down to perform maintenance on it), the HA seems to break. and the only way weve been able to get back is to tear down the WLCs and build them again.

currently, ive got one VM that only has 2 nics, its lost its HA one, and my other VM has somehow managed to change the naming of the nics that it has, so whilst they are still eth1, eth2 and eth3 at the hyper-visor level, they are 4 5 and 6.

does anyone have any ideas as to what might be happening. ive got a case logged with TAC, but we seem to be going round in circles a bit at the moment, and looking like i may need to build the WLCs again from scratch..... so figured id throw out to a wider audience.

Looking for recommendations for a wireless point to point bridge. Currently using ignitenet metrolinq 2.5 60-35. It's about 8 years old and I think one of the radios are going bad. I have spares but would rather replace with something new. This is for a business, and it is critical that I replace with something reliable. I'm familiar with ubiquiti, cambium, and mimosa, but looking for suggestions on what has worked for anyone else. The distance is a little over a mile. Thanks!

I operate a fleet of these diminutive serial console servers made by Opengear. Great devices, does exactly what it is supposed to do and very little else.

Also very, very resilient devices. If LEDs fire up, they can normally be recovered from a "it is dead, Jim"-state.

They are getting old, though. I don't trust Opengear to continue the product line. And very recently, software updates for these devices was locked behind their support portal. "To protect our customers" or something equally inane.

Dimwits.

I'd like to know what alternatives there are, and I struggle to find something comparatively small and simple as the ACM7000. (And various rebranded variants,)

Requirements: - 4-8 RJ45 serial ports - LTE connectivity - Dual Ethernet ports - CLI managment as a supported, practical option (serial console, ssh) - A vendor honoring the GPL

Suggestions, anyone?

Hey folks,
I am labing l2vpn EVPN with cisco modeling labs,

I am running a mix of XR and IOS-XE. I have everything set up for MP-BGP EVPN but I can't get my CE's to ping each other. Is this just a limitation of CML?

BGP's l2vpn evpn are up and healthy, Bridge-domain has the correct config, interfaces are encapulating the right vlan... I am stumped

I've recently been informed that my networking team is taking over responsibility of the security camera and building automation networks that were previously operated by our facilities team. Upper management decided that IT needed to take ownership of the infrastructure after months of battling what facilities reported to be "unsolvable" issues that kept crippling their system.

As one would expect, everything is in a terrible state. I'm not sure if there are 2 of the same make/model of switch in the environment. Growth was never planned, and was always organic. Facilities didn't understand how fiber worked and all of the cabling is exclusively some flavor of unshielded copper, even to external structures (light poles, signs, etc.). We operate in the former lightning capital of the world, so when we inevitably take a nearby strike, it would take out almost an entire facility's worth of equipment (network and industrial devices) at a time. The facilities team would then just buy whatever they could get their hands on in attempt to slap the network back together as fast as possible.

We already have a decent plan in place to upgrade the switches to a common platform with management, replace all of the copper uplinks with fiber, and home-run (de-daisy-chain) as many of the connections as possible, but my team isn't otherwise accustomed to operating equipment in industrial environments or outdoors.

I am trying to get up to speed as to which technologies would work best to protect these environments, and my primary concern is to limit/contain the amount of damage that occurs. The fiber and new switches have consumed most of my budget this fiscal year, so I'm looking to knock out the low hanging fruit as fast as I can, then propose a future budget item for the remaining improvements.

Do you find shielded cable to be effective for switch to device runs?

Do you find Ethernet surge to be effective? Do you recommend install them on one side of the connection or both? Do you have a preferred brand?

Any other tips/tricks/design considerations would be greatly appreciated.

Hey everyone. Just wanting to get thoughts on a setup I was considering for my Nexus pairs at 2 DC's. They are in a back to back vPC.

I've got 2 datacenters with multiple outlying buildings connecting to one or the other. Each of these DC's have 2 ISP's, firewalls in H/A, and a pair of Nexus switches. The ISP's come into an edge switch stack that's vPC'd back to the Nexus pair in their respective DC and carries the ISP vlan back to the firewall.

The only scenario where this becomes an issue is when I need to upgrade the edge stack. Since that stack has both primary and secondary ISP connections, that DC completely loses internet along with any buildings that are uplinked to that DC.

To deal with this I was thinking I'd add an SLA to the Nexus at each DC and track something public like 8.8.8.8 . Then I could use that to pull the static default and send traffic the other DC Nexus pair.

Thoughts? Is this the appropriate way to do this?

I considered just splitting the edge stack apart but there are a few other things attached to it that are lagged across the stack. Also, in the scenario I lose both ISP's at one DC I'd like to be able to easily send traffic to the other DC.

I have a single Aruba CX8100 switch and have configured it via GUI or CLI as necessary. I rarely ever touch it these days, it just works. Is having an Aruba Central license worth it? Seems a waste for a single switch. I already monitor it with Auvik.

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

I’m attempting to recover/port a phone number originally assigned under a legacy Southwestern Bell exchange (AT&T ILEC). The number is currently sitting dormant in AT&T’s underlying rate center block. Frontline support cannot release or reactivate the number because AT&T has completely retired/discontinued legacy copper landline service in the region. Looking for advice from telecom engineers, LNP specialists, or AT&T provisioning staff on how to bypass this brick wall.

I had to install Netskope for an organization replacing Checkpoint harmony SASE, All other Apps are working fine its getting routed from local to outside network via publisher, But for tally its not the same, Tally licence is not getting fetched even though publisher and taly prime is in the same subdomain, For the last 3 weeks im faced with this issue, Tickets have been raised, Issue escalated to Netskope territory manager but even they are not able to find a fix for this till now.

So do you guys have any clue or lead about why this keeps happening.

Hello all,
I work in a factory as automation engineer and i'm not network expert, anyway have been learning and doing some stuff in networks.

Now i have a challenge to connect a new isolated network from inside the factory to a corporate network outside de factory

We have that connection for other networks through a Fortinent 401E UTM firewall.. this FW was installed during an HMI upgrade.
As the Firewall have several spare ports idea was obviously to use one of the spare ports and configure the interface and the rules.

Problem is, i cannot get the Firewall to get the Port Link UP ....
I've tried connection the a Cisco port directly, cisco detects link up, leds blink in both devices then just lit..
Firewall GUI and CLI keep showing Link DOWN..

New network was supposed to be 192.168.10.1 /255.255.255.0
configured FW interface as 192.168.10.10 /255.255.255.0

I've tried configure a laptop with an ip of that new network (.3) and connected directly to the FW port... Same thing, Link Down..
tried another port.. Link Down..

I've been discussing back and forth with Copilot but no solution yet..

Is there anything hidden somewhere disabling the spare ports of the Firewall??
Any hint?
Thanks in advace

genuine question, how are you doing this? why not automate it?

I'm working as a network testing engineer in a good org. I'm learning quite well about a lot of protocols and I have around 6 years experience now. I don't know if working testing is going to be a good option for me in the future because I feel the scope is limited. To give an example, for testing we build a topology with devices similar to customers and then configure the protocol and try various scenarios and file issues on them. So I feel like this is going to be the same. What are some of the other career options that I can look out for, I feel like customer facing jobs would have more scope for me going forward, any opinions on this?

Any recommendations for a simple device that can aggregate SPAN from multiple devices and fan out to security devices? We have a Gigamon fabric (required to manage the device) and one device. This is expensive and more than the small environment needs. We just need SPAN aggregation with deduplication, VLAN filtering capabilities, and managed from the device itself, either CLI or Web i/f.

Hi everyone,
I’m testing a permanent Ethernet run between a patch panel and a wall outlet with a Zoerax wire tracker/cable tester.
When I connect the main unit directly to the remote receiver using a known-good patch cable, the LEDs on the receiver light up sequentially from 1 to 8.
When I test the permanent Ethernet run, the main unit still cycles through 1–8, but the receiver LEDs light up in this order:
3–6–1–4–2–5–7–8
The G LED stays off.
The Ethernet connection itself works, and the wiring appears to follow the colour coding on the LSA patch panel and wall outlet.
Does this sequence mean the conductors are actually miswired, or could it be related to how this particular tester works? I don’t want to re-terminate the installation unnecessarily if the reading is being misinterpreted.
Also, is the G LED simply for the cable shield?
Thanks for any help!

​

I am working on a system design for a wireless internet overhaul in a condominium building. The physical overview consists of an enterprise gateway, such as Omada or Ubiquiti, with an SFP connection to a managed PoE switch feeding access points. It is a four-story building with five units per floor, totaling twenty units. For bidding purposes, I am assuming one available repurposed phone Cat5e cable per unit. The current incoming WAN is terrible, and having twenty basic ISP-provided routers running in close proximity heavily compounds the issue. The condo association is open to making quality wireless internet a complex-wide amenity provided by the association, replacing the current poor subscription model.

​No major commercial ISPs service the complex, so my current plan is to deploy one Starlink kit per building to serve twenty units. The Starlink unit would be placed in bridge mode, feeding an enterprise gateway followed by enough access points to ensure adequate coverage in all units. My LAN and RF strategy is to broadcast individual SSIDs for each unit, assigning each unit to its own isolated VLAN with a bandwidth throttle. I intend to deploy Wi-Fi 7 access points with maximum channel separation. Spreading out channel congestion while introducing a vastly superior base network speed should dramatically improve performance, as my assumption is that the core issue right now is twenty consumer routers clashing on overlapping channels.

​While this isn't an ideal network topology, residents are desperate for a working solution. My walkthroughs showed almost zero wired connections in use, and the demographic here largely doesn't care about a wired drop. However, if a wired requirement does arise, I can pivot to one access point per unit utilizing at least one built-in Ethernet port on the chosen access point model.

Furthermore, this complex houses a large population of elderly residents, and over the last several months there have been multiple instances where people could not reach emergency services due to network failures. Simply being able to access wifi calling and/or utilize network based monitoring equipment would be a massive relief. Solving this reliability crisis is the primary driver behind this bid.

​TLDR: I want to use one Starlink satellite linking an enterprise gateway to provide twenty condos with a segregated VLAN SSID each, then extrapolate that concept across eight additional identical buildings. Is it a violation of Starlink's terms of service to provide internet to twenty condos per satellite, given that roughly half to three-quarters are lightly used vacation homes? Assuming proper access point placement and RF distribution, is channel diversity coupled with VLAN per-unit isolation a reasonable angle of attack to deliver usable Wi-Fi to twenty condos over a single shared connection?

Hi everyone,

I run three L3-separated server clusters, with 12 servers each. Each server has a dual-port Mellanox ConnectX-3 connected to a pair of Arista leaf switches.

Hardware:

• Leaves: Arista DCS-7280QR-C72-R
• Spines: Arista DCS-7280CR2A-30-F
• NICs: ConnectX-3, mlx4_en, firmware 2.42.5000
• Server connections: 40G SR4 optics over approximately 1m MPO cables
• Optics: mostly Arista-labelled QSFP-SR4 / QSFP-40G-SR4, with some Cisco-Finisar

The issue is increasing RX/TX error counters. Errors can appear on either end: sometimes the server NIC, sometimes the Arista switch. Replacing the transceiver fixes the errors on the affected connection, but I keep encountering this again over time, roughly weekly/monthly. It feels like I’m endlessly replacing optics.

The MPO cables are short, with no visible damage or tight bends.

A recent inventory found that 69 of 70 readable server optics have EEPROM manufacture dates from 2011–2017. I don’t know their complete operating history.

All NICs were flashed from their original InfiniBand configuration for Ethernet use. Several still report QCBT/TCBT part numbers in VPD while reporting an FCB firmware identity. That mismatch comes from our flashing history; most ports operate at 40GbE.

Some diagnostic findings:

• NIC chip temperatures across all 36 servers were 47–62°C, with no NIC thermal warnings found in current kernel logs.
• Some host counters are FIFO drops rather than CRC errors, so I’m treating those separately from the suspected optical issues.

I’m considering replacing the short optical connections with passive 40G QSFP+ DACs, initially keeping the CX3s. I’m also considering upgrading to native dual-port 40G ConnectX-4 cards.

I’d appreciate advice on:

1. Have you seen this pattern with older QSFP optics: increasing errors that stop after replacing a transceiver?
2. Could aging optics reasonably explain the repeated replacements, or would you investigate something else first?
3. Has anyone experienced similar behaviour with ConnectX-3 cards flashed from InfiniBand to Ethernet?
4. Would you trial DACs with the existing NICs first, or replace the NICs too?
5. Any specific DAC compatibility pitfalls between Arista and Mellanox?

For those managing restrictive outbound firewall rules or allowlists in production environments, how do you keep track of changes to vendor network requirements?

For example, when a SaaS/cloud vendor changes:

- IP ranges or CIDRs

- FQDNs / service endpoints

- required ports or protocols

Do you rely on vendor mailing lists, documentation pages, scripts, vendor APIs, change tickets, or something else?

I’m especially curious about environments where multiple vendors have to be tracked.

Have you ever had a connectivity issue because a vendor changed something and the firewall/allowlist wasn’t updated in time?

And roughly how much manual effort does keeping these rules current create for your team?

I’m looking to compare notes on OOB network design. How do you access your devices during a production network outage, and what does your general setup look like?
For example, do you use cellular console servers, a separate management network, jump hosts, or a combination? How do you connect to remote sites, and where do you place gateways and access controls?
Interested in what’s worked well for you, especially for a multi-site enterprise.

Hello,

I recently did a fireware/OS update to a UDM pro max. After I did this our main switch (USW-48-G2) started spamming STP flaps to the Aggregation switch (USW Pro Aggregation) and another down stream switch. There were no config changes or anything like that. The network goes down about every 30 minutes and then stops flapping.

Firewall->Aggregation Switch->Main switch.

I swapped the main switch with the exact same model and set it up to go to the aggregation swtich. This has no flapped once and it has the same config just on different ports. Not sure if the switch just happened to die the same time we did an update or if this is a possibility after and update.

Thank you

Hi All,

I'm looking to see what others have deployed for similar Datacenter builds. We have a Datacenter refresh kicking off in the next 2 years and wanted to get ahead of it. Our current deployment is Cisco ACI with 2 spines and 30 leaf switches. We're looking to step away from ACI all together and move towards a Cisco Nexus deployment of some kind.

I see VXLAN EVPN recommended everywhere but that might be overkill for us. We only hosts 75 SVI\Vlans in our ACI environment. We also have about 125 VMware hosts deployed in active\passive deployment and some with VPC deployments. The only requirement we'd like for the new deployment to have, is send traffic to our Fortinet firewall when traffic is coming in and out of the Datacenter which I think we can handle with routing.

What have others done for their refresh? Still in the very early stage of researching.

I've always struggled with the best naming scheme. In the data center it seems obvious, but on the campus/branch endpoint side I'm a bit lost and I'm open to any suggestions. Here are my thoughts

Sequential is ok on the remote end, but on the patch panel end it gets tricky to patch them into the switches in a logical sequence while keeping the cabling tidy. You'd need longer cables with a crossover/horizontal cable organizer, so tracing cables is a pain.

If we use the 1 patch panel to 1 switch method and short cables, we could name them PP1-D01, PP2-D01, PP1-D02, PP2-D02. It may be confusing for users, but tracing cables would be more straightforward, and it makes patching things to two switches a lot easier. It gets tricky if we need to add a third switch though, adding in pairs is possible but more expensive.

I've also seen people put the switch # and interface # on the labels, but that doesn't seem to scale well either

What's your preference? Got any key factors to consider? Any videos or channels worth checking out?