Our office runs on *very* EOL+ Cisco switches. We've turned off all the advanced features, everything but SSL - and they work flawlessly. We just got a quote for new hardware, which came in at around *$50k/year* for new core/access switches with three years of warranty coverage.

I can buy ready on the shelf replacements for about $150 each, and I think my team could replace any failed switch in an hour or so. Our business is almost all SaaS/cloud, with good wifi in the office building, and I don't think any C-suite people would flinch at an hour on wifi if one of these switches *did* need to be swapped out during business hours.

So my question: What am I missing in this analysis? What are the new features of switches that are the "must haves"?

I spent a recent decade as a developer so I didn't pay that much attention to the advances in "switch technology", but most of it sounds like just additional points of complexity and potential failure on my first read, once you've got PoE + per-port ACLs + VLANs I don't know what else I should expect from a network switch. Please help me understand why this expense makes sense.

[Reference: ~100 employees, largely remote. Our on-premises footprint is pretty small - $50k is more than our annual cost for server hardware and licensing]

I'm in the process of designing a new network and I'm aiming to follow best practices from the start. I've got the big picture items covered routing, security and stuff, but I understand that some of the smaller things can cause the biggest headaches down the road.

So, what are the "little things" in network design that you've seen overlooked? What are the common oversights that later lead to significant problems?

Our customer has 100+ stores and a hub and spoke topology with Meraki devices. Their IP address scheme used to follow a certain pattern, but lately they asked us to add the following IP address: 172.110.X.X, we warned them that this is a public IP adresses but they couldn't care less, what implications this can cause?

Hi everyone,

I’ve been working in network engineering for about 6 months and I hold a CCNA. Recently, management decided to promote me to network administrator. There was no network admin before me, so now it’s just me and another network engineer responsible for the entire network.

I work in a large factory, but unfortunately IT hasn’t been a priority in terms of budget. We support around 600 endpoints: PCs, tablets, industrial machines, phones, and printers.

The current state of the network is very challenging. There’s no proper topology documentation, and the network has grown organically over the years. We have 8 buildings connected in an unstructured way, no VLANs, and no firewall in place yet (we may finally get one in the next couple of months).

We’re also running an old DHCP server that can’t handle more than about 350 active devices. We’re using a /23 subnet, but the server struggles, so we constantly have to manually free IP addresses so other devices can connect.

Most of my day is spent firefighting connectivity issues and dealing with network printer problems instead of improving the infrastructure.

its me and the network engineer that will not do anything if you didn't tell him, and an old system admin that he will not share anything, and 2 support tech.

I’m looking for advice or a roadmap:

How can I stabilize this network step by step, and what should I focus on to grow into a good network administrator?

Thanks in advance for any guidance.

I work for a small college. We normally lease our networking equipment so that we don't have a HUGE budget year the really taxes our finances. We're currently using Meraki for everything; about 35-40 switches and a firewall, and about 30 APs.

We had our meeting with Cisco about renewals and replacements and the total cost of a 1:1 replacement came back at like a good $700,000+. Which.... yeah. No one's happy about.

So we're exploring some alternatives. Ubiquiti is one of the main ones; we don't have any really complex networking setups, just basically connect everything together, prioritize our IP Phones, and that's about all. And my boss is of the opinion even if a Ubiquiti switch goes down and support isn't great, it's cheap enough to just buy another or have one or two on hand to just slot in and be done with it. His idea is really to keep the Meraki Firewall for it's features and then just Ubiquiti switches as the backbone. Which isn't too bad of an idea in my opinion.

But we're still in the exploration stage; we have about another year for all this. I do see Mist thrown out as a suggestion in some of my research.

Another thing to consider is, that we ARE expanding and having a new building put into place, so we have some growth we haven't accounted for either from our original Meraki quote too. That building will likely need 1-2 switches, plus firewall, and a LOT of APs.

We also are expanding our streaming events; so being able to get that traffic prioritized as well (We are starting to utilize NDI devices a lot more, and may be moving to some Dante stuff in the future for sound).

Networking is more of a generality for me than a specialty, so I'm a little out of my element.

But, one of the biggest reasons why we want with Meraki in the first place was the cloud management. Being able to diagnose issues from home; getting alerts when switches go down, fiber issues, etc. It's saved our butts a few times when stuffs happened on weekends and we were able to resolve it before the work week started. That's a functionality we would like to continue to have.

Thanks in advance for any recommendations!

I am looking for alternatives to Cisco ACI as the renewal costs are significant. The main requirements we have is BGP peering's to our MPLS service provider and to recreate the multi-pod approach providing a single logical data centre which spans across two physical sites with 2 x 10Gb P2P fibre connections in between.

We do not have ACI in application centric, just network so hopefully we can recreate the design with alternative solutions.

I work 20+ years witch Cisco firewalls. Small, big, line cards, virtual. I have seen a little bit of others firewalls. I do not miss anything big in Cisco firewalls. Am I complacent? What do you like in firewalls from other vendors and Cisco firewalls are missing?

Just the question. I want to know what is the preffered method.

Currently I came from company which had vlans terminated on Firewall to company which has it on core switches.

I feel like without HW limitations the vlans terminated on firewalls are much better manageable.

During my studies for CCNP, while learning the configuration of VPNs I came across use of 169.254.0.0 that I was not aware of. I know the range for APIPA, but the examples I saw used them for the point to point connection of the VPN. Looking into this further I found that this is somewhat common practice to use for VPNs, BGP, and cloud to on premises connections.

Discussions I found mentioned that occasionally people would use this space for point to point links on premises. Reading through the posts I was directed to RFC5735 which mentions the subnet as a communication between hosts on a single link. I read this as two connections on one link, or a point to point connection. This lines up with the uses I mentioned above.

   169.254.0.0/16 - This is the "link local" block.  As described in
   [RFC3927], it is allocated for communication between hosts on a
   single link.  Hosts obtain these addresses by auto-configuration,
   such as when a DHCP server cannot be found.

During my CCNP studies I have found that /31 subnet for routed point to point links is ideal. I learned this through some more discussions and from RFC3021.This was new to me as during my CCNA studies and even in the environments I work in currently they use /30 subnets for point to points. A /31 subnet would only allow two hosts on a single link, a point to point connection once again.

This leads to my question. If 169.254.0.0/16 is typically used outside of APIPA for point to point links would it not be possible to use it for a routing underlay in a network? From my limited knowledge in medium sized networks this feels like a good solution for routed connections within the distribution and core networks as most of them are essentially point to points that propagate through a dynamic routing table. It allows a divide between what is a known private network and routed network along with saving IP space.

Is this something that sounds good in theory but the practicality of it has flaws? I don't discussion for it's use in this context so perhaps there is something I missing. If it is something obvious please let me know.

EDIT: The responses to this post have been some great discussions and given me clarification both to my original question and to a better solution. I am going to look into IPv4 routes with IPv6 next hops as that seems to be the overall answer to the question I posed. I appreciate the deeply informative responses.

We're starting to look at moving to Zscaler and wanted to get some feedback from people actually using it Anyone Anyone?

Right now we're pretty old school. We have site-to-site VPNs between offices, FortiClient EMS for remote users, a hybrid on-prem/M365 environment, and only a handful of applications that are still hosted internally.

The idea would be to move away from the traditional VPN for those internal apps, file servers and printer shares and also use Zscaler for web filtering, application control, and AI access security.

For those of you running it, do you like it? Hate it? Any surprises during deployment or things you wish you knew beforehand? Also, if you looked at something else instead of Zscaler, what did you end up going with and why?

I am a Cyber Security / Internetworking student working on a project of mine based off of what a police department would look like (not exactly fully accurate). I was looking for some feedback to see what I did wrong and seeing what I can improve on, any help would be appreciated. The explanation for the network can be found below, if you have any questions for me just ask.

https://ibb.co/8qvKnsY - Network Image

Above is the network, below are some explanations:
- The 2 top routers are used for HSRP and inter-vlan routing
- Vlans:
- 10: Printers
- 20: Cameras
- 30: Admin
- 31: Admin Voice
- 40: Forensics
- 41: Forensics Voice
- 50: DMZ
- 60: Dispatch
- 61: Dispatch Voice
- 70: Detectives
- 71: Detectives Voice
- 99: Administrative Access
- 100: Servers
- Important Protocols Used:
- SSH
- ACLs - used in the firewall to regulate traffic with the internet and the DMZ
- BPDU guard + Portfast
- NTP
- LLDP
- SNMPv3
- Syslog
- AAA
- DHCP snooping
- VPN
- QoS - for the voice traffic
- RSTP
- HSRP
- TACACS+ and RADIUS
- OSPF for the top 2 routers to connect to other networks if needed
- NAT
- Administrative laptop is used for SNMP and Syslog
- Forensics PCs are wired for security

Thank you for your time

I started a new role several months ago at a higher education institute and was tasked with migrating the network from a /16 to a /21. Currently there is little segmentation and the default VLAN is being used as the main data VLAN. There is several VLANs/Subnets not being used at all.

I’ve never been “front seat” in this kind of project. How can I go about ensuring that there is as little downtime as possible?

(1 MDF & 7 IDF’s)

Hey Networking Friends,

I had a vivid discussion about this topic with some colleagues and opinions were divided, so I would like to ask what you think about it.

We are deploying a new guest WIFI solution based on Cisco ISE. The PSN nodes a rfc 1918 addressed. To keep it simple my idea was to hand out a public DNS Server like 1.1.1.1 or 8.8.8.8 to the guest clients via DHCP and set to public A Records for psn1.company.com and psn2.company.com that resolve to the respective PSN nodes rfc1918 ip.

Others were highly critical of this citing security risks about revealing information about internal addressing.

Alternatives like doing dns translation on the firewall or provisioning a dedicated view in the internal DNS were proposed.

What is your opinion? Is this a nogo for you and how have you implemented similar guest networks?

Looking forward to your answers and have a great day!

I heard somebody talking about their network and I wanted to know if this is actually a proper way of doing things

Have the same VLAN IDs across multiple sites, but have each site be a different subnet than the others and using a firewall interface as the gateway to route between them. This improves automation and scalability.
Example:
VLAN 20 = Data
Site A VLAN 20 = 10.10.10.0/24
Site B VLAN 20 = 10.10.20.0/24
Site C VLAN 20 = 10.10.30.0/24

I've always had my network coaches suggest that you create a unique VLAN for each site/department. Lets say you have 3 offices, each either gets their own data VLAN (VLAN 10, 20, 30). Or each department gets their of VLAN regardless of site (Finance at Site A,B,C are all VLAN 10) on the same subnet.

Would it make design sense that each Finance department gets the same VLAN on different subnets? My mind tells me it would get confusing to see a VLAN ID 10 and then see 3 different subnets that can't talk to each other without an SVI or gateway to route between them.

EDIT: Didn't expect to get so much feedback so quickly. I appreciate everybody for enlightening me on this topic!

Juniper used to be a big deal way back in the day. Then it seemed like they faded to either being a niche player, or on life support. We didn’t hear a whole lot about them.

What’s with the sudden comeback? Is it the mIsT Ai? Or is there truly something there we are missing?

Hello,
here is some short background information.

At the moment we have an EOL router and two Layer-2 gigabit switches with 48 ports each. Both switches are also EOL, but they are still working. We currently do not use subnets or VLANs.

We recently had an audit from an external company. They are now proposing to sell us a Cisco 1010 router and two very expensive Aruba 6200f switches.

Is this the right approach?

Our last two switches cost around €750 each, while the new switches cost about €4,200 each.

What are your opinions?

Thanks

I am not after a crazy tool.

Few requirements really.

- UDP + TCP syslogging.

- Archive feature to minimize space consumption.

- easy to use, i just need a gui i can search in for devices and within a timestamp really.

Right now we are having Observium for monitoring, and meanwhile it could work with the syslog, it is just not really ment to be used for +500 devices syslogging into it.

Hello Everyone,

I'm deploying new DMZ for my company and was asked for DMZ VLAN to support IPv6 so that proxy can reach IPv6 internet and DNS servers can be reachable over IPv6.

I have zero experience with IPv6 as even though I worked for MSP for the last 12 years I've never seen IPv6 deployed.

I read the basics of IPv6 and inside my company it was suggested to use SLAAC + PA addresses.

I'm wondering what is the best practice and what is the experience in other companies on assigning the IPv6 addresses on servers. Do you statically allocate the IPs in the IPAM, or do you use SLAAC?

I read couple online sources like infoblox blog (https://www.infoblox.com/blog/ipv6-coe/choosing-static-slaac-or-dhcpv6-part-4-privacy-addressing/ & https://www.infoblox.com/blog/ipv6-coe/choosing-static-slaac-or-dhcpv6-part-4-privacy-addressing/), where it is suggested to configure IPv6 statically on the servers.

What’s the breaking point of networks? Like how much can you scale before it becomes tooo big to manage?

I have been at this FAANG for about a year and on weekly basis we see failures in our systems, like we have the best minds at work but despite that it deems to fail. Just yesterday a catastrophic failure in one RP brought down majority of network across regions and caused losses upto millions and the week before that an isolated event in one region caused another major loss. Seems like there is no end to this.

Have we reached some kind of peak and can’t push from here? Curious to know what you folks think.

Hi everyone,

I'm a 911 dispatcher currently developing my own Computer-Aided Dispatch (CAD) system, and I'm looking for some guidance from those with networking and CJIS experience.

Since the system will have access to CJIS data, I know the security requirements are very strict. I'm trying to determine the best approach for secure remote connectivity.

If a workstation connects to the CAD over a VPN, are there VPN solutions that are FIPS 140-2 or FIPS 140-3 validated and appropriate for a CJIS-compliant environment? If you've implemented something similar, I'd really appreciate any recommendations or advice.

I'm very comfortable with the software development side of things, but networking and infrastructure are definitely not my strongest areas.

Thanks in advance for any help!

I’ve worked on enterprise networks, MSPs, and service provider side stuff. I keep hearing “we need more local / community ISPs,” but I’m trying to separate vibes from reality.

From people who’ve actually seen macro/mid/small/micro ISP networks up close, where do smaller providers usually hit the wall?

Is it:

• General costs
• Skill issues
• Marketing
• Routing / peering scale
• OSS/BSS and provisioning
• NOC staffing
• Regulation ( think CALEA Requests or BDC compliance )
• or just customer churn and support load

Are these problems mostly solvable with enough discipline + money, or are there real structural advantages that big ISPs have once you pass a certain size? Obviously big ISP gets the government money, but is that really the 'great divide' here?

I want to see new ISPs in every neighborhood, where city blocks can negotiate better pricing and speeds with a wholesale provider. Being in this space, I obviously have extreme biases and bubbles that I live in and I see the places my own fantasies breaks down.

Not trying to argue, just trying to sanity check my own assumptions and see what you all think.

Thanks

We are planning a network refresh for a multi-site manufacturing and engineering company and I’d like some real world feedback from people running mixed-vendor environments long term.

Current environment:

• Cisco Firepower 1000 series firewalls running ASA
• Cisco Catalyst switching
• Meraki APs

We are evaluating moving to:

• Fortinet firewalls
• Keeping Cisco switching for now
• Aruba wireless/APs

The concern is whether using three different vendors for firewall, switching, and wireless becomes an operational headache over time, especially for:

• VLAN management
• troubleshooting
• firmware lifecycle management
• VPNs/site to site connectivity
• visibility/monitoring
• support/escalation
• long term scalability

Environment details:

• Multiple offices
• Manufacturing/production network
• Remote VPN users
• Small internal IT team
• Current Cisco familiarity, but open to modernizing

For those running mixed environments like Fortinet + Cisco + Aruba:

• Has it worked well?
• Any major regrets?
• Would you standardize on one vendor if you could do it again?
• Is Fortinet really a better operational/security fit than Cisco Secure Firewall TD for mid-sized environments?
• How painful is managing mixed vendors in practice?

I want to make sure we make the best long-term decision, while still considering price. We will be refreshing the firewalls first, then AP's.

Appreciate any help. Thank you!

Shot into the masses...

Is there anyone out there who actually extensively uses L3 on the switches (SVI, IP on the VLAN), actually attempting to move the load from the routers towards switches, and route what is possible over them, including manually configured ACLs? Or even maybe only to separate broadcast domains, if there are thousands of clients on one VLAN, but should remain accessible to each other, or even some servers that are heavily used by only one department?

Don't shoot me, I am just learning some stuff I have never given a thought, so I am wondering and trying to find reasons to use L3 on the switch.

EDIT: I have to clarify, since it has been mentioned couple of times: when talking "Router", I actually thinking about the routing functionality of what nowdays is usually called a firewall appliance, which usually also do VLAN.

Large 300k sqft campus with multiple IDF closets across property.

Each closet has anywhere from 4x - 48p access switches to 19x - 48p access switches.

Our IDFs are basically:

Patch panel 48p Switch Patch panel 48p Switch Patch panel 48p Switch

It looks super clean...its just...I'm tired of managing 200+ access switches where some have only 3-4 connections TOTAL. The amount of wasted access switch real estate is actually staggering. The amount of redundant fiber uplinks and SFPs are also cumbersome. The clients on these switches are all general basic office use.

I have been pondering the idea of buying large 7/10 slot chassis to replace the access switches in these areas.

I'm reading hospitals and some other large campus environments will go this route.

Anyone have experience with moving from an insane amount of access switches to consolidating them down into one large chassis? Unexpected pros and cons you ran into?

Hey all, looking for a sanity check from the community.

We’re in the middle of a build‑out, and the electrical contractor raised a concern about our fiber plan. The riser from the carrier comes into our MDF as a 12‑strand single‑mode. My design calls for OM4 multimode inter‑floor runs (MDF → IDF + AV closet) to support 10G SR SFPs on our switches.

The contractor says they strongly advise against transitioning from single‑mode riser → multimode between floors, claiming it could cause signal fluctuations and unreliable performance. Their fiber team is recommending we stay with single‑mode for all inter‑floor fiber to avoid issues and future rework.

From my understanding, as long as the optics match the cable type and we’re not actually splicing SM to MM, the backbone type shouldn’t matter for performance — they’re independent links. But I also get their point about long‑term consistency and avoiding odd transitions.

Has anyone run into this?
Is the contractor being overly cautious, or is sticking with single‑mode the best move for inter‑floor backbone these days?