Practical guides on Fortinet, Cisco, Linux, Python, and AI from a network engineer with 35 years of experience.https://michealgarner.co.uk/en-gbhttps://michealgarner.co.uk/blog/cve-2026-0322-on-pan-os-high-privileges-required-root-delivered/https://michealgarner.co.uk/blog/cve-2026-0322-on-pan-os-high-privileges-required-root-delivered/CVE-2026-0322 is an authenticated code injection in the PAN-OS management interface that gives root. It scores 8.6, it is being exploited, and the score undersells why you should patch now.Fri, 16 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/peerstitch-what-a-fortimanager-compromise-leaves-behind-after-you-patch-it/https://michealgarner.co.uk/blog/peerstitch-what-a-fortimanager-compromise-leaves-behind-after-you-patch-it/Unit 42 describes a memory-only FortiGate implant, PEERSTITCH, deployed after a FortiManager breach and a CVE-2025-61624 privilege escalation. The patch closes the doors. It does not revoke what was already stolen.Fri, 16 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-1-the-product-map-for-cloudvision-agni-and-the-710p/https://michealgarner.co.uk/blog/arista-sd-branch-part-1-the-product-map-for-cloudvision-agni-and-the-710p/A map of Arista's campus and branch stack: EOS switches, Wi-Fi 7 access points, CloudVision, CV-CUE and AGNI. What each piece does, where VeloCloud fits, and how this series is sourced.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-10-day-two-operations-upgrades-and-automation/https://michealgarner.co.uk/blog/arista-sd-branch-part-10-day-two-operations-upgrades-and-automation/Running the Arista branch after go-live: Smart System Upgrade, observability and endpoint troubleshooting in CloudVision, compliance checks, and the APIs and AVD options for automation.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-11-arista-vs-fortinet-cisco-and-juniper-for-the-branch/https://michealgarner.co.uk/blog/arista-sd-branch-part-11-arista-vs-fortinet-cisco-and-juniper-for-the-branch/A closing comparison of Arista CloudVision and AGNI against Fortinet, Cisco and Juniper branch stacks, with the trade-offs, a design checklist, and where the Arista approach fits.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-2-the-710p-16p-switch-poe-budget-and-port-layout/https://michealgarner.co.uk/blog/arista-sd-branch-part-2-the-710p-16p-switch-poe-budget-and-port-layout/What the Arista 710P-16P gives you: port mix, PoE standards and budget, uplinks, forwarding numbers and EOS requirements, plus how to size it against Wi-Fi 7 access points.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-3-onboarding-switches-to-cloudvision-with-ztp-and-terminat/https://michealgarner.co.uk/blog/arista-sd-branch-part-3-onboarding-switches-to-cloudvision-with-ztp-and-terminat/How a 710P gets into CloudVision: token onboarding, TerminAttr streaming, ZTP, and the first-run gotchas around AAA. Documented from Arista's CloudVision guides, not run.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-4-cloudvision-studios-port-profiles-and-change-control/https://michealgarner.co.uk/blog/arista-sd-branch-part-4-cloudvision-studios-port-profiles-and-change-control/How CloudVision builds campus configuration: the Studios, the workspace and change-control workflow, and port profiles for data, voice and guest. With the EOS config each profile generates.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-5-wi-fi-7-access-points-and-cv-cue-wireless-management/https://michealgarner.co.uk/blog/arista-sd-branch-part-5-wi-fi-7-access-points-and-cv-cue-wireless-management/Arista's Wi-Fi 7 access point range, what separates the models, and how CV-CUE manages SSIDs, roles and wireless security. Documented from Arista specs and Test Drive guides.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-6-agni-explained-networks-segments-and-role-profiles/https://michealgarner.co.uk/blog/arista-sd-branch-part-6-agni-explained-networks-segments-and-role-profiles/The AGNI object model in plain terms: access devices, networks, segments, role profiles and clients. Plus onboarding, PKI, UPSK, guest access, integrations and licensing, from Arista's datasheet.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-7-configuring-radsec-between-eos-switches-and-agni/https://michealgarner.co.uk/blog/arista-sd-branch-part-7-configuring-radsec-between-eos-switches-and-agni/The certificate and SSL profile work needed to bring up RadSec from an Arista switch to AGNI, done by hand and then through the eos_agni_radsec Ansible role, with a review of what the role does and does not do.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-8-wired-8021x-and-mab-policy-with-agni-on-eos/https://michealgarner.co.uk/blog/arista-sd-branch-part-8-wired-8021x-and-mab-policy-with-agni-on-eos/The wired access policy end to end: EOS 802.1X and MAC-based authentication config, an EAP-TLS network with MAC fallback in AGNI, and the commands to verify a session from the switch and the platform.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-sd-branch-part-9-wireless-eap-tls-upsk-and-guest-portal-policy-with-agni/https://michealgarner.co.uk/blog/arista-sd-branch-part-9-wireless-eap-tls-upsk-and-guest-portal-policy-with-agni/Wireless access policy with AGNI and CV-CUE: RadSec for access points, an EAP-TLS SSID, UPSK for IoT, and a captive-portal guest SSID with VXLAN tunnelling. Documented from Arista's published lab material.Wed, 14 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-76504-and-ciscos-october-2026-fixes-sd-wan-manager-nx-os-apic-and-licen/https://michealgarner.co.uk/blog/cve-2026-76504-and-ciscos-october-2026-fixes-sd-wan-manager-nx-os-apic-and-licen/One exploited Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504, CVSS 9.8, on CISA KEV) and a seven-day-later batch of 14 advisories covering NX-OS, APIC and License On-Prem, including a CVSS 10.0 that is not the one being exploited.Sun, 11 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortibleed-update-the-fbi-and-secret-service-advisory-and-the-fortimail-zero-day/https://michealgarner.co.uk/blog/fortibleed-update-the-fbi-and-secret-service-advisory-and-the-fortimail-zero-day/The FBI and Secret Service now put FortiBleed at 86,644 compromised FortiGates and say attackers are locking admins out. Separately, FortiMail CVE-2026-104286 (CVSS 9.8) was exploited before a patch existed. What changed, what is unrelated, and what to check.Sun, 11 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortigate-bgp-cookbook-part-1-dual-isp-edge-recipes/https://michealgarner.co.uk/blog/fortigate-bgp-cookbook-part-1-dual-isp-edge-recipes/Six FortiGate BGP recipes for a dual-homed internet edge: stop being a transit AS, accept only a default route, steer traffic in both directions, advertise a prefix with no connected route, originate a default, and authenticate the session with TCP-AO.Sat, 10 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortigate-bgp-cookbook-part-2-verify-and-debug/https://michealgarner.co.uk/blog/fortigate-bgp-cookbook-part-2-verify-and-debug/The commands I run after every FortiGate BGP change: read the session, compare received and advertised routes before and after policy, soft-clear safely, triage a session that will not establish, and run BGP debug without leaving it on.Sat, 10 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/forticlient-ems-745-the-fix-for-one-critical-bug-the-first-version-hit-by-the-ne/https://michealgarner.co.uk/blog/forticlient-ems-745-the-fix-for-one-critical-bug-the-first-version-hit-by-the-ne/FortiClient EMS 7.4.5 fixed CVE-2026-21643 and was the first version affected by CVE-2026-35616. Both are critical and unauthenticated. Affected versions, fixed builds and the 7.4.7 upgrade traps, from Fortinet's own advisories.Thu, 08 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-9-alternatives-and-handing-off-to-the-blue-team/https://michealgarner.co.uk/blog/host-based-detection-part-9-alternatives-and-handing-off-to-the-blue-team/OSSEC, Sysmon, auditd, osquery, Falco, and commercial EDR, compared honestly against Wazuh. Then a straight list of what the next series still has to do, now that a real domain controller and two real managers exist to test it against.Thu, 01 Oct 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-8-active-response-or-when-wazuh-hits-back/https://michealgarner.co.uk/blog/host-based-detection-part-8-active-response-or-when-wazuh-hits-back/Every other module in this series watches and tells you. Active response acts on its own. What the mechanism actually looks like, and a real lockout story from elsewhere on this site that explains why the timeout matters.Wed, 30 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-7-how-a-log-line-becomes-an-alert/https://michealgarner.co.uk/blog/host-based-detection-part-7-how-a-log-line-becomes-an-alert/A raw log line becomes an alert in exactly two steps: decode, then match. How Wazuh's default ruleset already covers SSH, PAM, and sudo with zero custom rules, and where a shipped check turned out to be wrong.Tue, 29 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-6-file-integrity-monitoring-and-rootcheck/https://michealgarner.co.uk/blog/host-based-detection-part-6-file-integrity-monitoring-and-rootcheck/FIM, rootcheck, and SCA all answer some version of is this system still what I think it is, and none of them should be trusted blind. What each one actually checks, with real findings from a real run.Mon, 28 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-5-enrolling-a-real-mixed-fleet/https://michealgarner.co.uk/blog/host-based-detection-part-5-enrolling-a-real-mixed-fleet/A manager with no agents is an expensive way to look at an empty dashboard. What actually happens enrolling a real Raspberry Pi, and separately a genuinely mixed Linux-and-Windows lab fleet, into Wazuh.Fri, 25 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-4-standing-up-a-manager-two-different-ways/https://michealgarner.co.uk/blog/host-based-detection-part-4-standing-up-a-manager-two-different-ways/Two real Wazuh managers already exist on this site's infrastructure, built for opposite reasons. What the contrast between a shared homelab instance and a disposable lab one actually teaches about sizing and placement.Thu, 24 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-3-agent-manager-indexer-dashboard-and-what-50-changes/https://michealgarner.co.uk/blog/host-based-detection-part-3-agent-manager-indexer-dashboard-and-what-50-changes/Agent, manager, indexer, dashboard: how Wazuh's pieces fit together in the 4.14.x line both of this site's real deployments run, and what a still-in-beta 5.0 changes underneath all of it.Wed, 23 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-2-from-ossec-to-wazuh-and-what-actually-changed/https://michealgarner.co.uk/blog/host-based-detection-part-2-from-ossec-to-wazuh-and-what-actually-changed/OSSEC didn't stagnate the way it's often described, and Wazuh's 2015 fork happened for specific, checkable reasons. The real history behind the tool already running on two of this site's own boxes.Tue, 22 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/certificate-required-credentials-not-cve-2026-93952-and-the-second-velocloud-orc/https://michealgarner.co.uk/blog/certificate-required-credentials-not-cve-2026-93952-and-the-second-velocloud-orc/Arista's SA 0183 discloses CVE-2026-93952, an actively exploited CVSS 10.0 flaw in on-prem VeloCloud Orchestrator that only bites when Edges authenticate with certificates. Fixes exist for 5.2 and 6.4, not yet 6.1 or 7.0, and July's patched builds are still exposed.Tue, 22 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/host-based-detection-part-1-what-a-hids-sees-that-a-nids-never-will/https://michealgarner.co.uk/blog/host-based-detection-part-1-what-a-hids-sees-that-a-nids-never-will/This site has years of network-side detection content and almost none of the host-based half. Starting a nine-part series to fix that, built around two Wazuh deployments that already exist rather than a fresh lab.Mon, 21 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checked-out-not-checked-inside-plugin4shells-zero-click-hit-on-four-ai-coding-ag/https://michealgarner.co.uk/blog/checked-out-not-checked-inside-plugin4shells-zero-click-hit-on-four-ai-coding-ag/A SHA pin is supposed to mean a plugin can never silently change under you. AIR Security found that four major AI coding agents check out the pinned commit but never confirm they landed on it, and a git ref collision is enough to swap in different code while the pin still looks honored.Sun, 20 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-1-history-editions-and-the-shape-of-the-framework/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-1-history-editions-and-the-shape-of-the-framework/Where Metasploit came from, what Framework vs Pro actually means today, and why a series about the most-covered tool in offensive security still has something to add.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-10-network-level-detection-engineering/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-10-network-level-detection-engineering/What a network monitor can actually see in the meterpreter handshake and default transports, deliberately narrowed to the wire, since host-based detection is a separate series once its lab work lands.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-11-rpc-and-msgrpc-automation/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-11-rpc-and-msgrpc-automation/msfrpcd, MessagePack vs JSON-RPC, virtual consoles, and how the framework exposes itself to outside code, real source, the same layer AI Part 7 and Part 12's MCP server both build on top of.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-12-msfmcpd-rapid7s-own-mcp-server/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-12-msfmcpd-rapid7s-own-mcp-server/Five weeks after this site wired an LLM into Metasploit through a third-party MCP project, Rapid7 shipped a first-party one, with a safety model worth comparing directly against both that community project and this site's own MCP server.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-13-database-workspaces-loot-and-credential-tracking/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-13-database-workspaces-loot-and-credential-tracking/The persistence layer underneath everything Parts 11 and 12 exposed: workspaces, hosts, services, vulnerabilities, credentials, and loot, and why an engagement's findings outlive any single msfconsole session.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-2-framework-internals-modules-mixins-and-the-datastore/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-2-framework-internals-modules-mixins-and-the-datastore/What Msf::Module actually is, why it's built from nineteen separate mixins instead of one class, and how the datastore turns 'set RHOSTS' into something every module type understands the same way.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-3-payload-architecture-and-what-msfvenom-actually-buil/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-3-payload-architecture-and-what-msfvenom-actually-buil/Singles vs. stagers vs. stages, what msfvenom is actually assembling, and the real encoder list behind a tool that's still doing the same job it did in 2003.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-4-meterpreters-tlv-wire-protocol-from-real-protocol-so/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-4-meterpreters-tlv-wire-protocol-from-real-protocol-so/What actually goes over the wire once a meterpreter session is established: the packet header, the TLV encoding scheme, and how AES got layered on top of a protocol that started out XOR-obfuscated.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-5-transports-compared/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-5-transports-compared/reverse_tcp, reverse_https, bind_tcp, and the less obvious handlers the real framework ships, including two built specifically for pivoting through AWS rather than a raw socket.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-9-evasion-in-2026-honestly-assessed/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-9-evasion-in-2026-honestly-assessed/What encoders, the dedicated evasion module category, and Metasploit 6.5's new features do and don't buy against modern AV and EDR, without recycling the 2015 version of this advice.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-6-cve-2014-3120-a-real-module-and-three-things-windows/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-6-cve-2014-3120-a-real-module-and-three-things-windows/Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-7-a-different-door-the-same-wall/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-7-a-different-door-the-same-wall/Part 6 hit Windows Defender three times from an Elasticsearch MVEL exploit. Part 7 tries a completely different door — an unauthenticated SYSTEM-level Jenkins Groovy console — and finds exactly the same wall waiting on the other side.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-14-closing-the-loop/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-14-closing-the-loop/Thirteen parts of internals, thirteen posts of "here's how the framework works." This one's different: no new commands, just going back through what actually happened in the lab and matching it up against the theory.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/metasploit-deep-dive-part-8-pivoting-into-the-blind-spot/https://michealgarner.co.uk/blog/metasploit-deep-dive-part-8-pivoting-into-the-blind-spot/Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/three-cves-one-deadline-and-a-bug-that-waited-thirteen-years-this-weeks-linux-ke/https://michealgarner.co.uk/blog/three-cves-one-deadline-and-a-bug-that-waited-thirteen-years-this-weeks-linux-ke/CISA added three actively exploited Linux kernel CVEs to its KEV catalog this week with a two-day federal patch deadline. A fourth, a thirteen-year-old Open vSwitch bug with a public root exploit, hasn't made that list yet. Here's what each one actually does.Sat, 19 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/enrichment-has-to-come-first-adding-ioc-lookups-to-the-n8n-alert-router/https://michealgarner.co.uk/blog/enrichment-has-to-come-first-adding-ioc-lookups-to-the-n8n-alert-router/Extending the Wazuh-to-chat n8n pipeline with an AbuseIPDB enrichment step ahead of the threshold decision — plus a real, source-level dig into why n8n's workflow static data silently stopped persisting inside the Code node's newer isolated-vm sandbox.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-1-the-chain-and-the-fault-were-chasing/https://michealgarner.co.uk/blog/proving-the-path-part-1-the-chain-and-the-fault-were-chasing/A companion series to Day in the Life of a Packet, framed around diagnosis rather than architecture: one Teams call that stayed choppy long after the dashboards said everything had recovered, and the nine-stage chain I used to prove where the packet actually was.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-2-ingress-and-session/https://michealgarner.co.uk/blog/proving-the-path-part-2-ingress-and-session/Before touching SD-WAN or routing, the session table tells you whether the flow you're chasing predates the event you're investigating. For the choppy Teams call, that one field settles more than the dashboard did.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-3-policy-route-and-routing/https://michealgarner.co.uk/blog/proving-the-path-part-3-policy-route-and-routing/The pinned session predates the fault. Before blaming SD-WAN or routing for what's happening now, I need to know what a brand-new flow to the same destination would actually do today, and that's a different question from what the config says on paper.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-4-sd-wan-member-sla-and-rule-selection/https://michealgarner.co.uk/blog/proving-the-path-part-4-sd-wan-member-sla-and-rule-selection/The health-check history shows a breach, a failover, and a recovery, all working exactly as designed. Which raises the real question: if SD-WAN did its job correctly, why did the call stay broken?Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-5-policynat-and-ipsec/https://michealgarner.co.uk/blog/proving-the-path-part-5-policynat-and-ipsec/The tunnel the pinned session is using never went down. The policy it matched hasn't changed. Both of those facts are true, and neither of them means the session's path was healthy the whole time it mattered.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proving-the-path-part-6-egress-npu-offload-and-the-verdict/https://michealgarner.co.uk/blog/proving-the-path-part-6-egress-npu-offload-and-the-verdict/Every stage checked out clean on its own terms. The fix isn't clearing everything and hoping, it's one targeted action once the evidence points at a single cause. Closing the series with the full false-conclusions list and the discipline behind it.Fri, 18 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/close-enough-to-matter-inside-cve-2026-58704-on-pixels-cellular-modem/https://michealgarner.co.uk/blog/close-enough-to-matter-inside-cve-2026-58704-on-pixels-cellular-modem/Google patched an actively exploited elevation-of-privilege bug in the Pixel modem this month, alongside 109 other fixes that got far less attention. What's actually confirmed, what isn't, and who's doing more of the finding now.Thu, 17 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/alert-fatigue-is-a-routing-problem-a-wazuh-to-chat-pipeline-in-n8n/https://michealgarner.co.uk/blog/alert-fatigue-is-a-routing-problem-a-wazuh-to-chat-pipeline-in-n8n/A noisy SIEM is its own security problem — the fix isn't more alerts, it's better routing. Building and testing a Wazuh-to-chat pipeline in n8n, and two real bugs the build itself turned up.Wed, 16 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-12-the-verdict/https://michealgarner.co.uk/blog/old-kit-new-kit-part-12-the-verdict/All ten pairs, pulled together — the scoreboard, the nine findings that kept recurring across posts, the lab-build lessons that never made a single pair post, and the actual verdict: detection depends on configuration, not on which decade wrote the tool.Tue, 15 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-11-ad-enumeration-bloodhound-and-certipy-vs-ldapsearch-and-/https://michealgarner.co.uk/blog/old-kit-new-kit-part-11-ad-enumeration-bloodhound-and-certipy-vs-ldapsearch-and-/Enumerating a fresh Active Directory domain two ways — ldapsearch and net rpc against bloodhound-python and certipy-ad — including a full ESC1 certificate exploit, and checking what each one actually leaves in Wazuh.Mon, 14 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-shell-game-part-1-introduction/https://michealgarner.co.uk/blog/the-shell-game-part-1-introduction/The first post in a series testing whether thirty-odd years of Bash habit is still the right call or just what came pre-installed. Bash, Zsh, and Fish, run for real on a dedicated lab VM, verdict included.Sat, 12 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-shell-game-part-2-bash-the-universal-baseline/https://michealgarner.co.uk/blog/the-shell-game-part-2-bash-the-universal-baseline/Part 2 of The Shell Game series. History, tab completion, globbing, and a real automation script on a fresh Debian 13 VM, establishing the plain, uncoloured baseline that Zsh and Fish get judged against.Sat, 12 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-shell-game-part-3-zsh-same-compatibility-better-daily-driver/https://michealgarner.co.uk/blog/the-shell-game-part-3-zsh-same-compatibility-better-daily-driver/Part 3 of The Shell Game. Zsh runs Part 2's script and a real, years-old .bash_aliases file unmodified, recurses glob patterns Bash can't without an option, and hard-errors on things Bash quietly ignores.Sat, 12 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-shell-game-part-4-fish-the-outsider/https://michealgarner.co.uk/blog/the-shell-game-part-4-fish-the-outsider/Part 4 of The Shell Game. Fish breaks outright on a real .bash_aliases file and hangs rather than erroring on a pasted Bash for-loop, but ships working completions, autosuggestions, and syntax highlighting with nothing configured.Sat, 12 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-shell-game-part-5-making-it-portable/https://michealgarner.co.uk/blog/the-shell-game-part-5-making-it-portable/Part 5 of The Shell Game. Adopting Kali's real .zshrc and version-controlling a years-old .bash_aliases file for the first time surfaces a silently-dropped config line, a CLI-name collision, two GitHub auth hurdles, and a prompt that ate a pasted command.Sat, 12 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-10-remote-access-evil-winrm-vs-psexec-and-manual-rdp/https://michealgarner.co.uk/blog/old-kit-new-kit-part-10-remote-access-evil-winrm-vs-psexec-and-manual-rdp/Running psexec, manual RDP, and evil-winrm against the same weak local admin credential on target-win2022, and checking what each one actually leaves in Wazuh.Fri, 11 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-velocloud-edge-ha-part-1-how-failover-actually-works-and-cve-2026-86106/https://michealgarner.co.uk/blog/arista-velocloud-edge-ha-part-1-how-failover-actually-works-and-cve-2026-86106/On 9 September 2026 Arista disclosed four VeloCloud Edge and Gateway CVEs in one batch. This one, CVE-2026-86106, lives entirely inside the HA peer channel between two Edges, so Part 1 goes deep on how that channel actually works before explaining the bug in it.Fri, 11 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-velocloud-edge-ha-part-2-cve-2026-86107-cve-2026-86108-cve-2026-86109-and/https://michealgarner.co.uk/blog/arista-velocloud-edge-ha-part-2-cve-2026-86107-cve-2026-86108-cve-2026-86109-and/The other three VeloCloud Edge and Gateway CVEs from Arista's 9 September 2026 batch: a VCMP tunnel crash, an OS command injection in the management workflow, and a signature-validation gap in the update mechanism. All three share their fixed releases with Part 1's HA bypass.Fri, 11 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-class-different-door-cve-2026-0310-and-pan-oss-second-root-rce-buffer-overf/https://michealgarner.co.uk/blog/same-class-different-door-cve-2026-0310-and-pan-oss-second-root-rce-buffer-overf/CVE-2026-0310 gives PAN-OS its second unauthenticated root-RCE buffer overflow of the year. A close comparison with May's CVE-2026-0300, and what the pattern says about perimeter firewalls generally.Fri, 11 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-9-pivoting-chisel-vs-ssh--d-socat/https://michealgarner.co.uk/blog/old-kit-new-kit-part-9-pivoting-chisel-vs-ssh--d-socat/Two classic pivoting options cost wildly different amounts to actually deploy on Windows, chisel gets caught and quarantined by name the moment it touches disk — and the SIEM watching the pivot host misses all of it, including the one thing that actually got caught.Thu, 10 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-8-web-screenshotting-gowitness-vs-manual-screenshotting/https://michealgarner.co.uk/blog/old-kit-new-kit-part-8-web-screenshotting-gowitness-vs-manual-screenshotting/A real 22x speedup and free structured metadata from gowitness's batch scanning against one-target-at-a-time manual headless screenshots — plus the series' first genuinely quiet, zero-alert pair since Part 4.Wed, 09 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-7-smb-enumeration-netexec-vs-enum4linux-and-smbclient/https://michealgarner.co.uk/blog/old-kit-new-kit-part-7-smb-enumeration-netexec-vs-enum4linux-and-smbclient/NetExec against enum4linux and smbclient for real SMB enumeration on a legacy Samba box and a hardened Windows Server 2022 host — the first Windows-agent Wazuh detection results in the series, and a genuine split decision between the two tools.Tue, 08 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-6-vulnerability-scanning-nuclei-vs-nmaps-vulnerability-scri/https://michealgarner.co.uk/blog/old-kit-new-kit-part-6-vulnerability-scanning-nuclei-vs-nmaps-vulnerability-scri/Nuclei's active-check templates against nmap's vulners-driven --script vuln, run for real against a lab metasploitable2 box and two Wazuh-monitored targets — plus the richest, most diverse Wazuh alert haul this series has produced yet.Mon, 07 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/no-cve-required-the-ted-backdoor-hiding-inside-your-own-haproxy-build/https://michealgarner.co.uk/blog/no-cve-required-the-ted-backdoor-hiding-inside-your-own-haproxy-build/Rapid7 found a Linux implant compiled into HAProxy's own binary. No CVE, no patch, a recompiled build reports the same version string as a clean one. The mechanism, and why file integrity monitoring, not network visibility, is what would catch it.Sat, 05 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-day-two-advisories-ciscos-nexus-9000-root-rce-and-the-ios-xr-hardening-bund/https://michealgarner.co.uk/blog/same-day-two-advisories-ciscos-nexus-9000-root-rce-and-the-ios-xr-hardening-bund/Cisco's September 2 disclosures: an unauthenticated root RCE on ten Nexus 9000 models via two unrestricted TCP ports, and a seven-CVE IOS XR hardening bundle with no workaround anywhere in the product line. Plus why that second detail matters more than any CVSS score.Sat, 05 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-chain-nobodys-advisory-describes-fortisandboxs-three-cves-read-together/https://michealgarner.co.uk/blog/the-chain-nobodys-advisory-describes-fortisandboxs-three-cves-read-together/A follow-up to this site's CVE-2026-25089 post: a threat intel firm reports that bug chained with two more FortiSandbox CVEs (file-read plus privesc) for unauthenticated root in practice. What's confirmed by Fortinet's own advisories versus what's one firm's account, held carefully apart.Sat, 05 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-5-content-and-parameter-discovery-feroxbuster-and-ffuf-vs-d/https://michealgarner.co.uk/blog/old-kit-new-kit-part-5-content-and-parameter-discovery-feroxbuster-and-ffuf-vs-d/The first pair in the series with a real, unmissable Wazuh alert footprint — plus a real leaked ops file and a live directory-listing misconfig that only feroxbuster's crawling behaviour actually found.Fri, 04 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-4-service-and-tech-fingerprinting-httpx-toolkit-and-naabu-v/https://michealgarner.co.uk/blog/old-kit-new-kit-part-4-service-and-tech-fingerprinting-httpx-toolkit-and-naabu-v/This pair splits down the middle: naabu is 25-30x slower than nmap without root privileges, while httpx-toolkit clearly beats whatweb on speed, detail, and even leaves a quieter log trace doing it.Thu, 03 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-3-subdomain-and-dns-recon-amass-and-dnsx-vs-whois-dig-theha/https://michealgarner.co.uk/blog/old-kit-new-kit-part-3-subdomain-and-dns-recon-amass-and-dnsx-vs-whois-dig-theha/Sublist3r crashes outright on current Python, amass needs a CLI correction pass and downloads 58MB unannounced, and once both actually run, they agree completely: there was nothing more to find.Wed, 02 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-2-port-and-service-discovery-rustscan-vs-nmap/https://michealgarner.co.uk/blog/old-kit-new-kit-part-2-port-and-service-discovery-rustscan-vs-nmap/Rustscan's async port sweep is genuinely near-instant, but the moment a real workflow asks for service versions, it hands straight off to nmap — and that handoff is where the marketed speed advantage quietly disappears.Tue, 01 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/start-vnc-start-a-shell-inside-cve-2026-25089-on-fortisandbox/https://michealgarner.co.uk/blog/start-vnc-start-a-shell-inside-cve-2026-25089-on-fortisandbox/CVE-2026-25089 is a CVSS 9.8 unauthenticated OS command injection in FortiSandbox's Web UI, actively exploited since mid-June and on CISA's KEV list since July. No password, no CVE chaining, just a crafted request to a device that already sits inline reading everything suspicious you feed it.Tue, 01 Sep 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/old-kit-new-kit-part-1-introduction/https://michealgarner.co.uk/blog/old-kit-new-kit-part-1-introduction/Ten classic-vs-modern pentest tool pairs, one real isolated lab, one genuine Wazuh SIEM watching — every run, every timing figure, every log line real. This is the series intro, written last, once there were real findings to introduce.Mon, 31 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/piping-the-pentest-bash-redirection-tricks-for-turning-a-scan-into-a-target-list/https://michealgarner.co.uk/blog/piping-the-pentest-bash-redirection-tricks-for-turning-a-scan-into-a-target-list/Real nmap output piped through awk, tee, process substitution, and xargs to turn a subnet scan into a fanned-out target list. The subject is the redirection mechanics, not the brute-force tool sitting at the end of the pipe.Fri, 28 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/one-fabric-one-agent-where-security-fabric-ends-and-fortisase-begins/https://michealgarner.co.uk/blog/one-fabric-one-agent-where-security-fabric-ends-and-fortisase-begins/Security Fabric is the automation and visibility layer tying Fortinet devices together. FortiSASE is a cloud-delivered PoP that speaks the same fabric language. Neither is a bolt-on to the other, and the FortiClient agent is the thing that makes the seam disappear.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-1-reachability-and-continuous-monitoring/https://michealgarner.co.uk/blog/same-job-different-shell-part-1-reachability-and-continuous-monitoring/ping and Test-Connection do the same job, but which PowerShell version you're on changes both the syntax and, in one tested case, what the tool actually reports. Part 1 of a series pairing Windows and Linux networking commands, with a real PS 5.1 vs 7.6 discrepancy found along the way.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-10-packet-capture/https://michealgarner.co.uk/blog/same-job-different-shell-part-10-packet-capture/tcpdump against pktmon: when rule tables and connection state stop answering the question, packet capture does. A real captured TCP handshake and a real captured DNS query/response pair, on both platforms.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-11-the-complete-cheat-sheet/https://michealgarner.co.uk/blog/same-job-different-shell-part-11-the-complete-cheat-sheet/Every command pair from this series, reachability through packet capture, in one table, plus which PowerShell cmdlets actually change behavior between versions and which don't. The closing part of the Windows/Linux networking command comparison series.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-2-path-tracing/https://michealgarner.co.uk/blog/same-job-different-shell-part-2-path-tracing/traceroute and tracert answer "which hops did this take", but the protocol each one probes with matters more than people realize. A real sandbox test where the same destination gave two different route pictures depending on whether the probe was UDP or TCP.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-3-interface-and-ip-configuration/https://michealgarner.co.uk/blog/same-job-different-shell-part-3-interface-and-ip-configuration/ip addr, ifconfig, ipconfig, Get-NetIPAddress, Get-NetAdapter: five commands that all answer "what's my address", none of which return quite the same shape of answer. Part 3 of the Windows/Linux command comparison series.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-4-routing-tables/https://michealgarner.co.uk/blog/same-job-different-shell-part-4-routing-tables/ip route, route -n, route print, Get-NetRoute: reading a routing table is the same question on both platforms, why is this packet going that way, but Windows answers it with a metric that Linux's route table doesn't expose the same way at all.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-5-dns-lookups-and-resolution/https://michealgarner.co.uk/blog/same-job-different-shell-part-5-dns-lookups-and-resolution/dig, nslookup, and resolvectl against Resolve-DnsName and ipconfig /displaydns, with real query output captured live against both authoritative-adjacent and recursive resolvers, plus the caching layer most people forget to check first.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-6-active-connections-and-sockets/https://michealgarner.co.uk/blog/same-job-different-shell-part-6-active-connections-and-sockets/ss, netstat, and Get-NetTCPConnection all answer "what's connected to what right now", but only one platform ties a connection straight back to a process name without a second lookup. Part 6 of the Windows/Linux command comparison series.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-7-arp-and-neighbor-tables/https://michealgarner.co.uk/blog/same-job-different-shell-part-7-arp-and-neighbor-tables/ip neigh, arp -a, and Get-NetNeighbor read the same table: which MAC address answers for which IP on your local subnet. Windows names the entry states more precisely than Linux does, and Part 7 maps them directly against each other.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-8-port-and-service-testing/https://michealgarner.co.uk/blog/same-job-different-shell-part-8-port-and-service-testing/nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/same-job-different-shell-part-9-firewall-status-read-only/https://michealgarner.co.uk/blog/same-job-different-shell-part-9-firewall-status-read-only/iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.Thu, 27 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/threat-intelligence-and-fortiguard-tuning-making-ips-signatures-actually-work-fo/https://michealgarner.co.uk/blog/threat-intelligence-and-fortiguard-tuning-making-ips-signatures-actually-work-fo/FortiGuard ships new IPS signatures constantly and most of them arrive with a default action nobody chose deliberately. The difference between a tuned IPS deployment and a noisy one isn't the signature database, it's what you do with the defaults.Wed, 26 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-11-tracing-a-bad-acl-across-the-fleet/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-11-tracing-a-bad-acl-across-the-fleet/A maintenance-window ACL push goes out to 150 branch firewalls. A subset break. This part ties every tool from the series together, regex, grep, sed, awk, vim, diff, find and xargs, to find the affected devices, understand why only some of them broke, and fix all of them correctly in one pass.Tue, 25 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-10-encoding-line-endings-and-the-gotc/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-10-encoding-line-endings-and-the-gotc/Every tool in this series assumes plain Unix text. A config pasted from Windows, pulled over a serial console, or exported by an older device's SNMP agent frequently isn't, and the failure it causes looks exactly like a bug in your pattern instead of what it actually is.Mon, 24 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/24-billion-credentials-36-sources-and-27-records-actually-tagged-redline/https://michealgarner.co.uk/blog/24-billion-credentials-36-sources-and-27-records-actually-tagged-redline/Headlines called it the biggest credential leak in history. The researchers who found it can't say how many duplicates it contains or who ran the database. Here's what's verifiably inside the "24 billion password leak," and why one real detail matters more than the headline number.Sun, 23 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-backdoor-named-forticloud-sync-inside-the-gunra-ransomware-advisory-and-two-fo/https://michealgarner.co.uk/blog/a-backdoor-named-forticloud-sync-inside-the-gunra-ransomware-advisory-and-two-fo/Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.Sun, 23 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-1-scoping-the-rebuild-and-the-threat-model/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-1-scoping-the-rebuild-and-the-threat-model/The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-2-flashing-the-card-and-the-first-boot/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-2-flashing-the-card-and-the-first-boot/Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-3-locking-down-the-base-os/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-3-locking-down-the-base-os/Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-4-adding-totp-two-factor-authentication/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-4-adding-totp-two-factor-authentication/Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-5-cloudflare-tunnel-zero-trust-access-and-a-we/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-5-cloudflare-tunnel-zero-trust-access-and-a-we/Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-6-standing-up-a-wazuh-manager-and-why-the-vm-w/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-6-standing-up-a-wazuh-manager-and-why-the-vm-w/Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-7-wiring-the-pi-in-as-a-wazuh-agent/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-7-wiring-the-pi-in-as-a-wazuh-agent/Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-8-an-ansible-control-node-a-second-pi-and-what/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-8-an-ansible-control-node-a-second-pi-and-what/Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-9-the-closing-checklist-and-what-actually-chan/https://michealgarner.co.uk/blog/from-dropbox-to-daily-driver-part-9-the-closing-checklist-and-what-actually-chan/A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.Sat, 22 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-9-find-xargs-and-safe-bulk-operations/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-9-find-xargs-and-safe-bulk-operations/Turning "run this check against every config backup from the last 24 hours" from a manual loop into a single composable pipeline, and the null-byte-delimited habit that stops a filename with a space in it from quietly breaking your script.Fri, 21 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-8-diff-patch-and-comparing-configs-be/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-8-diff-patch-and-comparing-configs-be/Unified diff format, comparing whole config-backup trees with diff -r, and generating a patch once and applying it fleet-wide. Plus why a generic line-by-line diff eventually needed a config-aware tool built specifically for FortiGate syntax.Thu, 20 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-7-nano-and-picking-the-right-editor-f/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-7-nano-and-picking-the-right-editor-f/nano won't win a features argument against vim, and that's fine. On-screen keybindings, no modal editing to fight under pressure, and the $EDITOR variable that decides which one opens when crontab or visudo calls for an editor.Wed, 19 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-6-vim-on-a-box-with-no-gui/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-6-vim-on-a-box-with-no-gui/Macros, visual block mode, and the :g command: the vim features that matter when you're editing a config on a jump box at 3am with nothing but a serial console and no GUI in reach.Tue, 18 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-5-cut-sort-uniq-tr-and-the-rest-of-th/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-5-cut-sort-uniq-tr-and-the-rest-of-th/grep, sed, and awk get all the attention, but the tools that glue them into a working pipeline are cut, sort, uniq, tr, column, and paste. Building a top-talkers report and a unique-source-IP list from a flow log using nothing but these.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-1-a-field-guide-to-network-implant-hardware-/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-1-a-field-guide-to-network-implant-hardware-/Opening a series on the pocket-sized hardware that turns thirty seconds of physical access into a foothold: a history of the category, a threat model for why it still works in 2026, and a taxonomy of the three tool families this series covers before it turns to defense.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-10-the-closing-checklist-and-a-vendor-compar/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-10-the-closing-checklist-and-a-vendor-compar/Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-2-shark-jack-packet-squirrel-and-lan-turtle/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-2-shark-jack-packet-squirrel-and-lan-turtle/The three purpose-built Hak5 wired implants compared on what they actually do between plug-in and pull-out: Shark Jack's quick-strike recon and exfil, Packet Squirrel's inline man-in-the-middle, and LAN Turtle's long-term covert remote access.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-3-bash-bunny-key-croc-and-omg-cable-or-why-8/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-3-bash-bunny-key-croc-and-omg-cable-or-why-8/The USB HID family, Rubber Ducky, Bash Bunny, Key Croc, and O.MG Cable, attacks the endpoint by exploiting a design decision from the 1990s: a USB keyboard is implicitly trusted, and no network control this series covers can see it happen.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-4-wifi-pineapple-flipper-zero-and-the-esp32-/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-4-wifi-pineapple-flipper-zero-and-the-esp32-/The wireless family needs no cable and no physical port at all, just proximity to the air. WiFi Pineapple's PineAP suite, the Flipper Zero's ESP32 Marauder add-on, and bare ESP32 deauther boards compared honestly, including what MAC randomization has actually killed since 2014.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-5-building-a-real-call-home-dropbox-on-a-ras/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-5-building-a-real-call-home-dropbox-on-a-ras/A real LAN Turtle-style dropbox built and tested live on a Raspberry Pi 4: a cloud-init race condition that took three rebuilds to diagnose, and a Cloudflare Tunnel call-home path proven end to end with a real reboot-recovery test.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-6-a-full-walkthrough-from-empty-port-to-pers/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-6-a-full-walkthrough-from-empty-port-to-pers/A single illustrative engagement chaining every tool family from Parts 2 through 5 into one narrative, from a five-minute reception-desk recon to a persistent call-home channel, closing on real cost and dwell-time numbers before the series turns to defense.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-7-port-security-and-the-layer-2-hygiene-most/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-7-port-security-and-the-layer-2-hygiene-most/The defensive turn starts at the layer that would have stopped Part 6's persistent dropbox outright: port security, DHCP snooping, Dynamic ARP Inspection, and the rest of the Layer 2 hygiene most switches can already do without buying anything new.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-8-8021x-mab-and-the-nac-platforms-behind-the/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-8-8021x-mab-and-the-nac-platforms-behind-the/Port security answers whether a device is the one already learned on a port. 802.1X and the NAC platforms behind it answer the harder question: whether this specific identity, on this specific device, should be on the network at all.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-9-mac-filtering-usb-device-control-and-wirel/https://michealgarner.co.uk/blog/five-minutes-and-an-empty-port-part-9-mac-filtering-usb-device-control-and-wirel/Closing the defensive arc: MAC OUI and vendor filtering with an honest look at how easily it's defeated, OS-level USB device control for the HID vector Part 3 was built around, and wireless IDS for the one attack in this series MAC randomization never touched.Mon, 17 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-1-why-registrars-defaults-and-time-all-d/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-1-why-registrars-defaults-and-time-all-d/A practical series on auditing what's publicly known about you: domain records, usernames, code, and history. Part 1 covers why the audit is worth doing at all, even if nothing has gone wrong yet.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-2-reading-your-own-whois-rdap-and-certif/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-2-reading-your-own-whois-rdap-and-certif/A walkthrough of the whois command, how .uk individual privacy actually works, how RDAP bootstrapping finds the right server, and pulling your own certificate transparency history from crt.sh.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-3-what-a-username-reveals-and-how-to-che/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-3-what-a-username-reveals-and-how-to-che/Using Maigret to check what accounts are tied to a username, run against a purpose-built decoy identity rather than a real handle, and why an automated match count needs a second look before you trust it.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-4-code-secrets-and-whats-sitting-in-your/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-4-code-secrets-and-whats-sitting-in-your/Scanning your own public repositories for leaked secrets with gitleaks and TruffleHog, checking what's publicly indexed about your own IP space with Shodan's InternetDB, and what's hiding in a file's metadata.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-5-the-wayback-machine-dorking-and-a-safe/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-5-the-wayback-machine-dorking-and-a-safe/Finding stale pre-privacy WHOIS snapshots on the Wayback Machine, basic search-engine dorking against your own name, and checking passwords against real breach data without ever sending the password anywhere.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-6-closing-the-gaps-you-just-found/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-6-closing-the-gaps-you-just-found/The actual registrar privacy toggle, the Nominet individual opt-out request, requesting removal of a stale archived page, and the general hygiene changes worth making once, not per finding.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-7-automating-the-whole-audit-with-spider/https://michealgarner.co.uk/blog/checking-your-own-public-footprint-part-7-automating-the-whole-audit-with-spider/SpiderFoot automates most of what this series just did by hand in one pass. What it actually wraps, what it still can't do for you, and a short checklist to run the whole audit yourself.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-1-exam-blueprint-and-study-roadmap/https://michealgarner.co.uk/blog/nse7-part-1-exam-blueprint-and-study-roadmap/What the NSE 7 - Secure Networking Architect exam actually tests, how the blueprint's five domains break down by weight, the prerequisites, and the roadmap for the 13 parts that follow.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-10-designing-sd-wan-rules-and-routing/https://michealgarner.co.uk/blog/nse7-part-10-designing-sd-wan-rules-and-routing/The SD-WAN rule lookup process, application steering and learning, ISDB as a matching criterion, and the routing-table mechanics underneath it all: policy routes, the route lookup process, session tables, and what happens to routing mid-session under SNAT.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-11-advanced-ipsec-multihub-multiregion-and-large-deployments/https://michealgarner.co.uk/blog/nse7-part-11-advanced-ipsec-multihub-multiregion-and-large-deployments/DPD modes, outbound NAT against interfaces with no IP, MTU and fragmentation, hardware offload and the NPU-Flag field, dual-hub topologies with BGP self-healing, and VRF-aware overlays for MSSP-scale deployments.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-12-advpn-on-demand-shortcuts-and-bgp-on-loopback/https://michealgarner.co.uk/blog/nse7-part-12-advpn-on-demand-shortcuts-and-bgp-on-loopback/Shortcut negotiation mechanics, IBGP and EBGP hub-and-spoke designs, shortcut timeout and dependent shortcuts, and what ADVPN 2.0 actually changes about a problem ADVPN 1.0 never fully solved.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-13-a-full-design-walkthrough-and-exam-day/https://michealgarner.co.uk/blog/nse7-part-13-a-full-design-walkthrough-and-exam-day/A two-region, dual-hub, ADVPN, VDOM-segmented MSSP design tying every domain in this series together, the diagnostic commands that confirm each layer is working, and the logistics of the exam itself.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-2-security-fabric-at-enterprise-scale/https://michealgarner.co.uk/blog/nse7-part-2-security-fabric-at-enterprise-scale/Fabric Connectors versus external connectors, Automation Stitches, and the four integration use cases the NSE 7 blueprint names by name: SAML SSO, automated IoC quarantine, FortiNAC dynamic addressing, and FortiNDR.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-3-high-availability-fgcp-fgsp-and-where-vrrp-still-fits/https://michealgarner.co.uk/blog/nse7-part-3-high-availability-fgcp-fgsp-and-where-vrrp-still-fits/Active-active load balancing, virtual clustering for VDOM partitioning, FGSP standalone session sync across asymmetric and cloud topologies, and the honest case for still reaching for VRRP.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-4-vlans-and-vdoms-at-enterprise-scale/https://michealgarner.co.uk/blog/nse7-part-4-vlans-and-vdoms-at-enterprise-scale/The virtual LAN switch, the three VDOM types, and the segmentation and inter-VDOM-routing use cases that separate a lab VDOM demo from a real enterprise design.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-5-enterprise-sd-wan-fundamentals-dia-and-monitoring/https://michealgarner.co.uk/blog/nse7-part-5-enterprise-sd-wan-fundamentals-dia-and-monitoring/SD-WAN's basic components at the architecture level, direct internet access topologies and best practices, and the monitoring surface (widgets, traffic logs, and events) that a live deployment actually gets judged on.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-6-central-management-ztp-and-sd-wan-manager-on-fortimanager/https://michealgarner.co.uk/blog/nse7-part-6-central-management-ztp-and-sd-wan-manager-on-fortimanager/Zero-touch provisioning of SD-WAN branches, device blueprints and CSV import, and how FortiManager's SD-WAN-specific tooling (metadata variables, IPsec templates, and the overlay template) turns one hub-and-spoke design into hundreds of devices.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-7-security-profiles-at-scale-sslssh-inspection-and-utm-performance/https://michealgarner.co.uk/blog/nse7-part-7-security-profiles-at-scale-sslssh-inspection-and-utm-performance/Certificate inspection versus full inspection as a design decision, the SNI check, false positives, and the honest performance cost of stacking web filtering, application control, IPS, and ISDB.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-8-ospf-for-enterprise-routing/https://michealgarner.co.uk/blog/nse7-part-8-ospf-for-enterprise-routing/The FortiOS-specific pieces the blueprint actually tests: access lists, prefix lists, route maps, redistribution, running OSPF over an IPsec interface, and ECMP with OSPF routes.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse7-part-9-bgp-for-enterprise-routing/https://michealgarner.co.uk/blog/nse7-part-9-bgp-for-enterprise-routing/Loopback interfaces as BGP sources, the neighbor-group command for scaling peer configuration, and optimizing for rapid convergence: route reflectors, the BFD parameter, and graceful-restart on FortiOS.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-one-dns-patch-thats-actually-wormable-inside-cve-2026-62878-on-windows-dns-s/https://michealgarner.co.uk/blog/the-one-dns-patch-thats-actually-wormable-inside-cve-2026-62878-on-windows-dns-s/August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/two-ways-to-lose-a-vpn-gateway-fortibleeds-credential-harvest-and-pan-oss-forged/https://michealgarner.co.uk/blog/two-ways-to-lose-a-vpn-gateway-fortibleeds-credential-harvest-and-pan-oss-forged/Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.Sun, 16 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/one-crafted-request-from-a-reload-inside-cve-2026-20349-on-cisco-secure-firewall/https://michealgarner.co.uk/blog/one-crafted-request-from-a-reload-inside-cve-2026-20349-on-cisco-secure-firewall/An unauthenticated attacker who can reach the Remote Access SSL VPN service on an ASA or FTD device can crash it with one crafted HTTP request. No login, no workaround, just a reload. What CVE-2026-20349 actually is, and why VPN-facing edges keep being the softest part of the firewall.Sat, 15 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/seven-cwes-one-advisory-ciscos-august-2026-ios-xe-hardening-release/https://michealgarner.co.uk/blog/seven-cwes-one-advisory-ciscos-august-2026-ios-xe-hardening-release/Cisco's IOS XE team ran the same internal-review model it used on Catalyst SD-WAN in August, grouping fixes by CWE class instead of shipping one CVE per bug. Seven CVE IDs, seven vulnerability classes, no known exploitation, and the same AI-assisted discovery line in the source section.Sat, 15 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-wildcard-that-wasnt-cve-2026-26035-and-fortiwebs-radius-admin-login-bypass/https://michealgarner.co.uk/blog/the-wildcard-that-wasnt-cve-2026-26035-and-fortiwebs-radius-admin-login-bypass/A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.Sat, 15 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/wearing-someone-elses-certificate-cve-2026-70468-and-fortimanagers-fgfm-trust-mo/https://michealgarner.co.uk/blog/wearing-someone-elses-certificate-cve-2026-70468-and-fortimanagers-fgfm-trust-mo/A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.Sat, 15 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-4-awk-and-turning-command-output-into/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-4-awk-and-turning-command-output-into/Fields, records, BEGIN/END blocks, and associative arrays: turning raw show-command and syslog output into bandwidth totals, error-rate tables, and per-source counts without a single line of Python.Fri, 14 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-3-sed-and-editing-configs-without-ope/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-3-sed-and-editing-configs-without-ope/Substitution, address ranges, in-place edits with a safety net, and the one command that turns "change this IP across 200 saved configs" from an afternoon of find-and-replace into a single line.Thu, 13 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-2-grep-and-searching-configs-and-logs/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-2-grep-and-searching-configs-and-logs/grep past -i and -v: context windows for pulling whole interface blocks, -o for extraction, -P for lookaheads, and recursive search across a folder of device config backups to find which boxes still reference a decommissioned server.Wed, 12 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-1-regex-the-pattern-language-everythi/https://michealgarner.co.uk/blog/text-processing-for-network-engineers-part-1-regex-the-pattern-language-everythi/Before grep, sed, awk, or vim make any sense, you need the pattern language underneath them. This part covers regex through network examples: IPv4/IPv6, MAC addresses, VLAN tags, interface names, and the BRE/ERE/PCRE dialect trap that bites people moving between tools.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-1-the-application-that-runs-between-autonomous-systems/https://michealgarner.co.uk/blog/bgp-deep-dive-part-1-the-application-that-runs-between-autonomous-systems/The first post in a deep dive into BGP. Why EGP failed, the two napkins that became RFC 1105, and the distinction that took a bad Halabi read and a good Doyle read to finally land: an IGP finds the best path inside a network you own, BGP negotiates policy between networks you don't.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-10-multiprotocol-bgp-or-how-one-session-learned-to-carry-ever/https://michealgarner.co.uk/blog/bgp-deep-dive-part-10-multiprotocol-bgp-or-how-one-session-learned-to-carry-ever/RFC 4760 turned BGP from an IPv4-unicast-only protocol into a generic reachability-advertisement transport. Here's how AFI/SAFI, MP_REACH_NLRI, and one session carrying multiple address families actually works.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-11-convergence-stability-and-scale/https://michealgarner.co.uk/blog/bgp-deep-dive-part-11-convergence-stability-and-scale/Route flap dampening, graceful restart, BFD, and ADD-PATH: four mechanisms that shape how fast, how stable, and how scalable a BGP deployment actually is.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-12-security-or-why-bgp-trusts-you-until-proven-otherwise/https://michealgarner.co.uk/blog/bgp-deep-dive-part-12-security-or-why-bgp-trusts-you-until-proven-otherwise/BGP was built on trust between operators, not cryptographic proof. Real hijack incidents, RPKI/ROV, BGPsec, and MANRS: what actually protects the internet's routing today.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-2-the-session-from-tcp-syn-to-established/https://michealgarner.co.uk/blog/bgp-deep-dive-part-2-the-session-from-tcp-syn-to-established/Part 2 of the BGP Deep Dive: TCP port 179 and why BGP needed a transport layer at all, the full six-state finite state machine from Idle to Established, what the OPEN message actually negotiates, and the hold timer, keepalive, and session-security mechanics underneath it.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-3-the-update-message-and-the-attribute-catalog-that-is-bgps-a/https://michealgarner.co.uk/blog/bgp-deep-dive-part-3-the-update-message-and-the-attribute-catalog-that-is-bgps-a/Part 3 of the BGP Deep Dive: the UPDATE message's real structure, RFC 4271's four categories of path attribute, and a walk through ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, and AGGREGATOR, including the classic unreachable-next-hop gotcha.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-4-the-best-path-algorithm-step-by-step/https://michealgarner.co.uk/blog/bgp-deep-dive-part-4-the-best-path-algorithm-step-by-step/Part 4 of the BGP Deep Dive: the full best path selection algorithm that consumes every attribute from Part 3, walked step by step from Cisco-proprietary Weight down to the final router-ID tiebreak, including why hot-potato routing is baked into step 8, not a separate design choice.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-5-ebgp-and-ibgp-are-not-the-same-protocol-wearing-one-name/https://michealgarner.co.uk/blog/bgp-deep-dive-part-5-ebgp-and-ibgp-are-not-the-same-protocol-wearing-one-name/Part 5 of the BGP Deep Dive: why AS_PATH loop prevention does nothing inside an AS, the iBGP split-horizon rule that actually prevents internal loops, and why that one rule is the direct, mechanical reason full-mesh iBGP exists at all.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-6-route-reflectors-and-confederations-two-ways-to-break-the-f/https://michealgarner.co.uk/blog/bgp-deep-dive-part-6-route-reflectors-and-confederations-two-ways-to-break-the-f/Part 6 of the BGP Deep Dive: RFC 4456 route reflection and RFC 5065 confederations, the two sanctioned ways to relax iBGP's full-mesh requirement from Part 5 without giving up its loop safety, plus the path-hiding tradeoff route reflection quietly introduces.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-7-communities-bgps-general-purpose-signaling-channel/https://michealgarner.co.uk/blog/bgp-deep-dive-part-7-communities-bgps-general-purpose-signaling-channel/Part 7 of the BGP Deep Dive: standard communities from RFC 1997, extended and large communities that fixed their real limitations, the three well-known values every implementation understands, and why the whole mechanism only works because two networks agree on what a number means.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-8-policy-in-practice-prefix-filters-as-path-filters-and-rfc-7/https://michealgarner.co.uk/blog/bgp-deep-dive-part-8-policy-in-practice-prefix-filters-as-path-filters-and-rfc-7/Part 8 of the BGP Deep Dive: the actual tools operators use to apply policy, prefix filtering, AS-path filtering, the route-map pattern every vendor implements some version of, and RFC 7454's real operational recommendations for filtering, max-prefix limits, and session hardening.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-deep-dive-part-9-traffic-engineering-or-why-outbound-is-easy-and-inbound-nev/https://michealgarner.co.uk/blog/bgp-deep-dive-part-9-traffic-engineering-or-why-outbound-is-easy-and-inbound-nev/Part 9 of the BGP Deep Dive: multihoming and traffic engineering using nothing but attributes this series has already covered. Outbound TE is a solved problem with LOCAL_PREF. Inbound TE never fully is, and this post explains why prepending, MED, and communities are all, honestly, best-effort.Tue, 11 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/natjack-what-a-nat-table-hijack-means-when-youre-the-one-designing-the-nat-bound/https://michealgarner.co.uk/blog/natjack-what-a-nat-table-hijack-means-when-youre-the-one-designing-the-nat-bound/NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.Mon, 10 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/one-csv-upload-from-root-inside-cve-2026-20245-on-cisco-catalyst-sd-wan-manager/https://michealgarner.co.uk/blog/one-csv-upload-from-root-inside-cve-2026-20245-on-cisco-catalyst-sd-wan-manager/A rogue peering connection, a password changed and quietly changed back, then one crafted CSV file that turned an admin session into root. Mandiant's writeup of CVE-2026-20245 is the missing middle chapter between this site's UAT-8616 post and August's hardening release.Mon, 10 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-13-monitoring-with-vmanage-and-vanalytics/https://michealgarner.co.uk/blog/sdwscs-part-13-monitoring-with-vmanage-and-vanalytics/The SDWSCS finale — module 13: operating everything the series deployed. vManage's security and Cloud OnRamp dashboards, the UTD and tunnel health signals worth alerting on, vAnalytics/Cisco SDWAN Analytics for trends and forecasting, and a day-2 runbook.Mon, 10 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-judgment-gap-just-got-numbers-two-2026-surveys-on-ai-pentesting-tools/https://michealgarner.co.uk/blog/the-judgment-gap-just-got-numbers-two-2026-surveys-on-ai-pentesting-tools/The AI Pentest Agents series closed by arguing these tools need a human checking their work, not replacing it. Two independent surveys published within weeks of that series wrapping just put real numbers on exactly that gap.Sun, 09 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/declare-yourself-trusted-inside-uat-8616s-three-year-run-against-cisco-catalyst-/https://michealgarner.co.uk/blog/declare-yourself-trusted-inside-uat-8616s-three-year-run-against-cisco-catalyst-/Two maximum-severity Cisco Catalyst SD-WAN authentication bypasses, one threat actor, three years of quiet control-plane access. What CVE-2026-20182 and CVE-2026-20127 actually broke, how UAT-8616 used it, and what the fix demands beyond patching.Sat, 08 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/marking-its-own-homework-inside-ciscos-august-2026-catalyst-sd-wan-hardening-rel/https://michealgarner.co.uk/blog/marking-its-own-homework-inside-ciscos-august-2026-catalyst-sd-wan-hardening-rel/Three months after UAT-8616 forced Cisco's hand on SD-WAN, a different kind of disclosure: an internal security review, five CWE-grouped CVEs up to CVSS 9.9, and an admission that some of the bugs were found by AI models, not people.Sat, 08 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-12-cloud-interconnect-and-onramp-for-colocation/https://michealgarner.co.uk/blog/sdwscs-part-12-cloud-interconnect-and-onramp-for-colocation/Modules 11–12 of SDWSCS: software-defined cloud interconnect with Megaport and Equinix — virtual routers and private cross-connects provisioned from vManage — and Cloud OnRamp for Colocation: CSP clusters, NFVIS, and vManage-orchestrated VNF service chains.Fri, 07 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-11-cloud-onramp-multicloud-aws-azure-gcp/https://michealgarner.co.uk/blog/sdwscs-part-11-cloud-onramp-multicloud-aws-azure-gcp/Module 10 of SDWSCS: extending the fabric into public cloud with Cloud OnRamp for Multicloud — cloud gateways built from Catalyst 8000Vs, AWS Transit Gateway and Cloud WAN, Azure vWAN, GCP NCC, and the tag-based intent mapping that connects VPCs to service VPNs.Thu, 06 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-10-cloud-onramp-for-saas/https://michealgarner.co.uk/blog/sdwscs-part-10-cloud-onramp-for-saas/Module 9 of SDWSCS: Cloud OnRamp for SaaS in deployment detail — vQoE probing and scoring, DIA vs gateway vs client access exits, the Microsoft 365 telemetry integration, Webex/Office/custom app lists, and verifying the path decisions it makes.Wed, 05 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-9-thousandeyes-monitoring-cloud-services/https://michealgarner.co.uk/blog/sdwscs-part-9-thousandeyes-monitoring-cloud-services/Module 8 of SDWSCS: deploying ThousandEyes enterprise agents in app hosting on Catalyst edges, test types and what each proves, the vManage integration, and building Microsoft 365 monitoring that turns 'Teams is slow' into an actionable path diagnosis.Tue, 04 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bitbang-cli-part-1-a-terminal-file-browser-and-proxy-over-webrtc-no-port-forward/https://michealgarner.co.uk/blog/bitbang-cli-part-1-a-terminal-file-browser-and-proxy-over-webrtc-no-port-forward/bitbang-cli is a single static Go binary that gets you a shell, file browser, and LAN proxy on a remote machine with no inbound port, no account, and no VPN client. Built from source and run for real, including a live P2P connection and a PIN-protected listener.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bitbang-cli-part-2-what-a-webrtc-reverse-shell-looks-like-from-the-wire/https://michealgarner.co.uk/blog/bitbang-cli-part-2-what-a-webrtc-reverse-shell-looks-like-from-the-wire/bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-45504-part-1-why-on-prem-exchange-is-an-active-directory-attack-surface/https://michealgarner.co.uk/blog/cve-2026-45504-part-1-why-on-prem-exchange-is-an-active-directory-attack-surface/On-prem Exchange has always been a heavily-trusted AD citizen, not a bolt-on app server. This series scopes a real, patched CVE against that history, and against a credential this blog already spent two other series getting a working password for.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-45504-part-2-inside-the-wopi-ssrf-and-arbitrary-file-read/https://michealgarner.co.uk/blog/cve-2026-45504-part-2-inside-the-wopi-ssrf-and-arbitrary-file-read/A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-45504-part-3-why-one-mailbox-credential-is-enough/https://michealgarner.co.uk/blog/cve-2026-45504-part-3-why-one-mailbox-credential-is-enough/svc-legacy-scan's cracked password has already powered two other series on this blog. CVE-2026-45504 shows what the same credential is worth against Exchange, with no ACL abuse and no privilege check required.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-45504-part-4-detection-hardening-and-patching-priority/https://michealgarner.co.uk/blog/cve-2026-45504-part-4-detection-hardening-and-patching-priority/Patch first. After that, EWS activity logging and outbound-traffic baselining are the two layers that catch this kind of abuse, closing the loop this series opened with a six-year-old cracked password.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-8-casb-dlp-and-securing-microsoft-365/https://michealgarner.co.uk/blog/sdwscs-part-8-casb-dlp-and-securing-microsoft-365/Module 7 of SDWSCS: the CASB layer riding on Umbrella SIG — shadow IT discovery, app controls, tenant restrictions for Microsoft 365, data loss prevention, and remote browser isolation. What each control needs from the SDWAN side to work.Mon, 03 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/hydra-vs-medusa-vs-ncrack-vs-patator-vs-metasploit-comparing-the-online-brute-fo/https://michealgarner.co.uk/blog/hydra-vs-medusa-vs-ncrack-vs-patator-vs-metasploit-comparing-the-online-brute-fo/Five tools solve the same problem, guessing a live service's credentials, with radically different designs. A verified comparison of Hydra, Medusa, Ncrack, Patator, and Metasploit's brute-force auxiliary modules: syntax, protocol coverage, concurrency model, and what each looks like to a defender.Sun, 02 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ssh-deep-dive-part-1-keys-clients-and-getting-connected-on-windows-macos-and-lin/https://michealgarner.co.uk/blog/ssh-deep-dive-part-1-keys-clients-and-getting-connected-on-windows-macos-and-lin/Why key-based auth beats a password, generating and installing a key, and the real differences between the OpenSSH client on Windows, macOS, and Linux. Part 1 of 3, followed by the config file/agent/multiplexing and -L/-R/-D/-J.Sun, 02 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ssh-deep-dive-part-2-the-config-file-agent-forwarding-and-multiplexing/https://michealgarner.co.uk/blog/ssh-deep-dive-part-2-the-config-file-agent-forwarding-and-multiplexing/Turning `ssh -i ~/.ssh/id_ed25519 michealg@192.168.1.63` into `ssh myhost`: the ~/.ssh/config file, per-host settings, ssh-agent so a passphrase isn't typed on every connection, and connection multiplexing to skip the handshake entirely.Sun, 02 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ssh-deep-dive-part-3-tunnels-and-jump-hosts--l--r--d-and--j/https://michealgarner.co.uk/blog/ssh-deep-dive-part-3-tunnels-and-jump-hosts--l--r--d-and--j/Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.Sun, 02 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/what-utm-actually-costs-you-ssltls-deep-inspection-internals-on-fortigate/https://michealgarner.co.uk/blog/what-utm-actually-costs-you-ssltls-deep-inspection-internals-on-fortigate/Certificate inspection reads the SNI and moves on. Deep inspection terminates the TLS session and re-signs the server's certificate with your own CA. What that costs in CPU, what it breaks in pinned apps, and why TLS 1.3 made the choice less optional.Sun, 02 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-fortigate-what-happens-when-you-actually-build-it/https://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-fortigate-what-happens-when-you-actually-build-it/I set out to build the BGP leak-target VRF route-leaking mechanism from my own earlier post, on a real FortiGate 70G. It hit three undocumented platform quirks in a row. The real answer turned out to be a static route over a VDOM-link — no BGP required.Sat, 01 Aug 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-1-creating-a-debian-13-vm-and-surviving-the-build-l/https://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-1-creating-a-debian-13-vm-and-surviving-the-build-l/Building a Debian 13 VM on Proxmox entirely from the qm command line: checking host resources, fetching the ISO with pvesh instead of the GUI, and a real boot-order bug that trapped the VM in its own installer.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-2-the-same-vm-via-cloud-init-and-what-it-actually-c/https://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-2-the-same-vm-via-cloud-init-and-what-it-actually-c/Building the same Debian 13 VM again, this time from a cloud image instead of the netinst ISO: qm disk import, cloud-init identity and networking, and a real comparison of what you gain and what you give up against Part 1's interactive install.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-3-jumping-between-pve-and-the-vm/https://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-3-jumping-between-pve-and-the-vm/Testing qm terminal, noVNC, and SSH against both VMs from this series, and finding a real quirk: when a VM's display is redirected to its serial console, noVNC and qm terminal turn out to be two viewers on the same channel, not two independent sessions.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-4-a-real-use-case-dns-with-unbound/https://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-4-a-real-use-case-dns-with-unbound/Putting the ISO-built VM to actual use as a DNS resolver with unbound, a real sudo gotcha from Part 1's install choices, and an hour spent debugging a phantom firewall that turned out to be a much simpler mistake.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-5-templates-clones-and-what-a-clone-actually-copies/https://michealgarner.co.uk/blog/proxmox-qm-cli-vm-build-part-5-templates-clones-and-what-a-clone-actually-copies/Closing the series by turning VM 103 into a reusable template with qm template and qm clone, and finding that a clone copies everything on disk, including identity files most people wouldn't think to check.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-7-umbrella-sig-deployment-and-dns-policies/https://michealgarner.co.uk/blog/sdwscs-part-7-umbrella-sig-deployment-and-dns-policies/Module 6 of SDWSCS: Umbrella SIG architecture and deployment — the automatic tunnel workflow from vManage, active/active vs active/backup designs, steering traffic into the SIG, and DNS security policies as the first (and cheapest) enforcement layer.Fri, 31 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-1-why-lab-and-how-to-choose/https://michealgarner.co.uk/blog/lab-environments-part-1-why-lab-and-how-to-choose/Opening a short series on the lab environment landscape with the question that actually decides which tool you want: what do you need the lab to be, not which GUI looks nicest.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-2-the-hypervisor-foundation/https://michealgarner.co.uk/blog/lab-environments-part-2-the-hypervisor-foundation/Before EVE-NG, GNS3, or CML, something has to run them. Proxmox, ESXi, and VMware Workstation compared as the compute layer underneath the rest of this series.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-3-network-emulation-platforms---eve-ng-gns3-and-pnetlab/https://michealgarner.co.uk/blog/lab-environments-part-3-network-emulation-platforms---eve-ng-gns3-and-pnetlab/The category most people mean by "network lab": real vendor images wired into a GUI topology, running on top of the hypervisor layer from Part 2. EVE-NG's 2026 licensing shift, the pnetlab fork it created room for, and where GNS3 sits outside all of it.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-4-vendor-official-all-in-one---cisco-modeling-labs-and-pac/https://michealgarner.co.uk/blog/lab-environments-part-4-vendor-official-all-in-one---cisco-modeling-labs-and-pac/Two Cisco-only platforms that solve the image licensing problem a different way: they ship the images, or don't need real ones at all. CML's 2026 free tier, and where Packet Tracer's simulation approach is a feature rather than a compromise.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-5-container-native---containerlab-and-netlab/https://michealgarner.co.uk/blog/lab-environments-part-5-container-native---containerlab-and-netlab/No GUI topology canvas, no full VMs: network operating systems as containers, topology as a YAML file. The same primitives the Container Networking and OSPF on Linux series already used, applied to network-OS containers instead of app containers.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/lab-environments-part-6-cloud-hosted-labs-and-picking-one/https://michealgarner.co.uk/blog/lab-environments-part-6-cloud-hosted-labs-and-picking-one/Closing the overview: renting the compute layer instead of owning it, a comparison across all five categories, and a plain decision framework. Proxmox is next, with the deep dives to follow.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-1-architecture-and-installation/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-1-architecture-and-installation/Opening the promised Proxmox deep dive: what Proxmox VE actually is under the hood (Debian, KVM, LXC, pmxcfs), the subscription model recapped in more depth, and how the pve host behind this site's own labs got its start.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-10-backup-and-disaster-recovery/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-10-backup-and-disaster-recovery/vzdump's three backup modes, retention scheduling that actually matches how homelabs get used, and Proxmox Backup Server as the companion product worth running instead of vzdump alone.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-11-pci-and-gpu-passthrough/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-11-pci-and-gpu-passthrough/Handing a real GPU or PCI device directly to a VM through IOMMU and VFIO, the IOMMU grouping problem that catches most first attempts, and the use cases that actually justify the setup work.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-12-users-permissions-and-the-api/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-12-users-permissions-and-the-api/Realms, roles, and ACLs underneath the GUI, scoped API tokens for automation, and where Terraform and Ansible actually fit against the same API surface the web GUI itself uses.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-13-monitoring-maintenance-and-homelab-best-practices/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-13-monitoring-maintenance-and-homelab-best-practices/Closing the deep dive: watching the whole stack with Prometheus and Grafana, ongoing repository and certificate maintenance, and a homelab best-practices checklist pulling every part of this series into one place.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-2-storage-architecture/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-2-storage-architecture/Every storage type Proxmox supports, what content each one can actually hold, and the local-versus-shared distinction that quietly decides whether live migration and HA are even possible later.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-3-zfs-the-default-recommendation/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-3-zfs-the-default-recommendation/Pools, RAIDZ versus mirrors, the RAM math ZFS actually needs, and the one setting (ARC sizing) that trips up more homelab builds than any other single ZFS decision.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-4-networking---bridges-vlans-and-sdn/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-4-networking---bridges-vlans-and-sdn/From the single vmbr0 bridge the installer creates, through VLAN-aware bridges and bonding, to the newer SDN stack with EVPN and BGP over VXLAN, and where the extra complexity is actually worth it in a homelab.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-5-the-built-in-firewall/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-5-the-built-in-firewall/Three separate levels, datacenter, node, and VM, each guarding a different kind of traffic, plus security groups and IP sets for keeping rule sets manageable as a homelab grows.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-6-vms-vs-lxc-containers/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-6-vms-vs-lxc-containers/Full hardware virtualization and OS-level containers are both first-class in Proxmox. The actual decision between them, and why unprivileged containers should be the default rather than the exception.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-7-clustering-and-quorum/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-7-clustering-and-quorum/What actually happens when a second node joins: corosync, pmxcfs synchronization made real, the quorum math behind how many nodes can fail before the cluster stops trusting itself, and why two nodes is a genuinely awkward number.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-8-high-availability/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-8-high-availability/HA groups, the watchdog-based fencing that makes automatic failover safe, and an honest answer to whether HA is worth the complexity in a homelab at all.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/proxmox-deep-dive-part-9-ceph-hyperconverged-storage/https://michealgarner.co.uk/blog/proxmox-deep-dive-part-9-ceph-hyperconverged-storage/Ceph turns the cluster's own nodes into shared storage, no external NAS required, at the cost of a genuinely higher complexity and hardware floor than most homelabs actually need.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-6-sase-architecture-and-use-cases/https://michealgarner.co.uk/blog/sdwscs-part-6-sase-architecture-and-use-cases/Module 5 of SDWSCS: what SASE actually is once the marketing is stripped away — the SSE service stack, how Cisco assembles it from Catalyst SDWAN, Umbrella, Duo and ThousandEyes, and the use cases where cloud-delivered enforcement beats on-box or chained designs.Thu, 30 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-1-history-community-edition-and-where-it-sits-in-an-en/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-1-history-community-edition-and-where-it-sits-in-an-en/Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-2-sharphound-and-what-it-actually-collects/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-2-sharphound-and-what-it-actually-collects/SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-3-ingestion-postgres-neo4j-and-the-go-api/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-3-ingestion-postgres-neo4j-and-the-go-api/How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-4-cypher-and-the-built-in-attack-path-queries/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-4-cypher-and-the-built-in-attack-path-queries/Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-5-kerberoasting-and-as-rep-roasting-through-the-graph/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-5-kerberoasting-and-as-rep-roasting-through-the-graph/BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-6-from-genericall-to-a-working-credential/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-6-from-genericall-to-a-working-credential/Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-7-detecting-sharphound-and-ldap-based-acl-abuse/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-7-detecting-sharphound-and-ldap-based-acl-abuse/What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bloodhound-deep-dive-part-8-a-full-walkthrough-from-foothold-to-a-graph-confirme/https://michealgarner.co.uk/blog/bloodhound-deep-dive-part-8-a-full-walkthrough-from-foothold-to-a-graph-confirme/Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-8-the-windows-target-and-what-nuke-mode-never-touched/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-8-the-windows-target-and-what-nuke-mode-never-touched/Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-9-what-a-pen-tester-without-sn1per-would-have-found/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-9-what-a-pen-tester-without-sn1per-would-have-found/The same Windows target, worked by hand with nmap, curl, and two modern credential tools, set against what Sn1per's own automated run actually delivered. Closing post for the Sn1per Deep Dive series.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-5-secure-dia-and-service-chaining/https://michealgarner.co.uk/blog/sdwscs-part-5-secure-dia-and-service-chaining/Module 4 of SDWSCS: assembling the embedded stack into a secure Direct Internet Access design, then service chaining — OMP service routes, control and data policy steering, and the dedicated-security patterns for traffic that must transit a real firewall.Wed, 29 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-7-verified-with-root/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-7-verified-with-root/Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.Tue, 28 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-4-content-filtering-url-filtering-and-tls-ssl-decryption/https://michealgarner.co.uk/blog/sdwscs-part-4-content-filtering-url-filtering-and-tls-ssl-decryption/Module 3 of SDWSCS: URL filtering with categories and web reputation, block pages, and the TLS/SSL decryption proxy — CA design choices, the decrypt policy, undecryptable traffic handling, and why decryption is the feature that needs a change-management plan.Tue, 28 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-3-on-premises-threat-prevention-firewall-ips-and-amp/https://michealgarner.co.uk/blog/sdwscs-part-3-on-premises-threat-prevention-firewall-ips-and-amp/Module 2 of SDWSCS: deploying the application-aware enterprise firewall, Snort-based IPS with its three signature sets, and AMP file reputation with Threat Grid sandboxing — plus fail-open vs fail-close and the verification commands for each.Mon, 27 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-1-from-recon-script-to-attack-surface-platform/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-1-from-recon-script-to-attack-surface-platform/Sn1per orchestrates 90+ tools into one scan. This opens a new series on how it actually works, verified from the real Community Edition source rather than the marketing page.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-2-what-discover-and-recon-mode-actually-run/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-2-what-discover-and-recon-mode-actually-run/Sn1per's discover and recon modes chain together nmap, Amass, Subfinder, Sublist3r, crt.sh, and Shodan into one deduplicated target list. Read directly from the Community Edition source, with a real correction from root-verified testing.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-3-web-mode-sc0pe-and-the-vulnerability-scoring-engine/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-3-web-mode-sc0pe-and-the-vulnerability-scoring-engine/Sn1per's sc0pe engine is a directory of tiny declarative bash templates, each matching one header or one string, rolled up into a single per-host risk score. Read from the real source, with two real bugs confirmed by later root-verified testing.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-4-workspaces-reporting-and-the-professional-2026-architect/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-4-workspaces-reporting-and-the-professional-2026-architect/What Sn1per Professional 2026 adds over the free Community Edition, documented from the vendor's own release notes since the Pro engine isn't in the public source tree.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-5-what-an-automated-sweep-looks-like-from-the-blue-teams-s/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-5-what-an-automated-sweep-looks-like-from-the-blue-teams-s/Sn1per's default scan modes fire real, unconditional exploit attempts against old CVEs the instant a banner matches. That's expensive for an attacker to hide and cheap for a defender to detect, and root-verified testing found a genuine defensive win too.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sn1per-deep-dive-part-6-a-full-sweep-against-northbridge-freight/https://michealgarner.co.uk/blog/sn1per-deep-dive-part-6-a-full-sweep-against-northbridge-freight/Applying Sn1per's real recon-to-exploit logic, mode by mode, against a small local lab, then handing off to Impacket and Pivoting and Tunneling for the part the automation can't do.Sun, 26 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-2-the-sd-wan-security-model-and-unified-security-policy/https://michealgarner.co.uk/blog/sdwscs-part-2-the-sd-wan-security-model-and-unified-security-policy/Module 1 of the SDWSCS syllabus: why DIA changed the threat model, the four security deployment patterns, what actually runs on a Catalyst edge (zone-based firewall vs the UTD container), and the unified security policy framework that ties it together.Fri, 24 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-1-from-namespaces-to-a-container-network-by-/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-1-from-namespaces-to-a-container-network-by-/Before Docker automates any of it, build a container network by hand: two network namespaces, a veth pair each, a Linux bridge, and one iptables NAT rule. Everything Docker does later is this, generated for you.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-10-a-full-walkthrough-chasing-a-cross-node-c/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-10-a-full-walkthrough-chasing-a-cross-node-c/A checkout service scales out, starts failing calls to a payment gateway on a different node, and the failure turns out to be two separate problems stacked on top of each other. A start-to-finish walkthrough using every technique from this series.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-2-dockers-default-bridge-model-unpacked/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-2-dockers-default-bridge-model-unpacked/Install Docker and run the same two-container topology from Part 1 with docker run instead of ip netns. Then read the actual iptables rules and docker0 bridge Docker generated, line for line, against the ones written by hand.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-3-docker-network-drivers-compared/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-3-docker-network-drivers-compared/bridge, host, macvlan, ipvlan, and none are not five ways to do the same thing. Each one trades away a specific piece of isolation, performance, or addressing flexibility. A driver-by-driver comparison with the actual tradeoff each makes.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-4-multi-host-overlay-networking-and-the-vxla/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-4-multi-host-overlay-networking-and-the-vxla/A Docker Swarm overlay network makes containers on different hosts look like they share a bridge. VXLAN encapsulation is how, and it costs 50 bytes of every packet's MTU budget, the same overhead this series already covered from the tunneling side.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-5-what-cni-actually-is/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-5-what-cni-actually-is/Kubernetes doesn't use Docker's networking model. It defines a plugin interface instead, CNI, with a lifecycle of exactly two verbs. Why one-IP-per-pod forced that split, and what a CNI plugin actually does when a pod starts.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-6-cni-plugins-compared-flannel-calico-and-ci/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-6-cni-plugins-compared-flannel-calico-and-ci/Three CNI plugins solve the same ADD-verb reachability problem three different ways: VXLAN encapsulation, BGP-distributed routes, and an eBPF datapath. The architecture and datapath differences, not a feature-checklist bake-off.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-7-ebpf-native-networking-and-the-end-of-kube/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-7-ebpf-native-networking-and-the-end-of-kube/kube-proxy's default iptables mode chain-walks a rule per backend, per packet. Cilium's kube-proxy replacement skips that entirely, at the socket layer, before a packet is even built. What kube-proxy actually does, and what changes when eBPF replaces it.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-8-network-policy-enforcement-compared-iptabl/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-8-network-policy-enforcement-compared-iptabl/The same Kubernetes NetworkPolicy resource gets enforced completely differently depending on the CNI plugin underneath it. Calico's default path turns it into iptables rule chains; Cilium turns it into eBPF map lookups keyed on pod identity. Same intent, different mechanism, different failure modes.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/container-networking-deep-dive-part-9-troubleshooting-container-networking/https://michealgarner.co.uk/blog/container-networking-deep-dive-part-9-troubleshooting-container-networking/A vendor-neutral methodology for the five failure modes that account for most container networking outages: conntrack exhaustion, VXLAN MTU fragmentation, DNS-in-pod failures, cross-node connectivity breaks, and tcpdump inside a network namespace.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-on-linux-part-1-a-brief-history-of-routing-on-linux/https://michealgarner.co.uk/blog/ospf-on-linux-part-1-a-brief-history-of-routing-on-linux/The first post in a companion series to OSPF Deep Dive: how Linux went from a kernel that could route packets but not speak a routing protocol, through GNU Zebra and Quagga, to FRRouting. History first, because the config in Part 3 makes more sense once you know why it looks the way it does.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-on-linux-part-2-why-frrouting-is-the-defacto-choice/https://michealgarner.co.uk/blog/ospf-on-linux-part-2-why-frrouting-is-the-defacto-choice/The zebra/protocol-daemon/vtysh architecture from the inside, FRR against its one real remaining competitor, BIRD, and why FRR's Cisco-shaped CLI is a genuine advantage for this specific series rather than a cosmetic one.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-on-linux-part-3-installing-and-configuring-ospf-with-frr/https://michealgarner.co.uk/blog/ospf-on-linux-part-3-installing-and-configuring-ospf-with-frr/Getting FRR onto a Linux box for real: the package, the users it creates without asking, the daemon on/off switch in /etc/frr/daemons, and the first router ospf block in vtysh. Verified against a real install, not written from memory.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-on-linux-part-4-wiring-lab-lnx-into-the-ospf-deep-dive-lab/https://michealgarner.co.uk/blog/ospf-on-linux-part-4-wiring-lab-lnx-into-the-ospf-deep-dive-lab/Adding a fourth router to CORE-CSR, BRANCH-FGT, and EDGE-MX: a Linux box running the FRR config from Part 3, walked from Down to Full against the neighbor state machine from OSPF Deep Dive Part 1, with an LSDB parity check across all four platforms.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-on-linux-part-5-troubleshooting-ospf-on-linux/https://michealgarner.co.uk/blog/ospf-on-linux-part-5-troubleshooting-ospf-on-linux/The closing post: OSPF Deep Dive Part 11's three-vendor show-command table extended to four with FRR's vtysh, then the failure modes that only exist on Linux, ip_forward, a firewall dropping protocol 89, multicast group membership, the wrong network namespace, veth MTU, and tcpdump on the wire.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwscs-part-1-course-overview-and-study-roadmap/https://michealgarner.co.uk/blog/sdwscs-part-1-course-overview-and-study-roadmap/Kicking off a thirteen-part series on Cisco's SDWSCS syllabus — SDWAN security and cloud solutions. Part 1 explains what the course covers, how it extends ENSDWI, maps all thirteen modules and eleven labs to this series, and sets out a realistic study plan.Thu, 23 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-1-neighbor-states-drbdr-election-and-network-types/https://michealgarner.co.uk/blog/ospf-deep-dive-part-1-neighbor-states-drbdr-election-and-network-types/The first post in a full OSPF series covering Cisco, FortiOS, and Junos: the hello protocol, the neighbor state machine, why DR/BDR election exists, and the network types that decide whether an election happens at all.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-10-a-vendor-neutral-troubleshooting-methodology/https://michealgarner.co.uk/blog/ospf-deep-dive-part-10-a-vendor-neutral-troubleshooting-methodology/A structured way to diagnose OSPF problems that works on any vendor, because it's built on the neighbor state machine from Part 1, not on any platform's specific commands: what state is it stuck at, and what does that state rule in or out.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-11-show-commands-and-the-lsdb-side-by-side/https://michealgarner.co.uk/blog/ospf-deep-dive-part-11-show-commands-and-the-lsdb-side-by-side/The same neighbor table, interface state, and LSDB, read through three different command sets: Cisco IOS/IOS-XE, FortiOS, and Junos, mapped side by side against the CORE-CSR/BRANCH-FGT/EDGE-MX lab from this series.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-12-a-multi-vendor-outage-start-to-finish/https://michealgarner.co.uk/blog/ospf-deep-dive-part-12-a-multi-vendor-outage-start-to-finish/A closing walkthrough on the CORE-CSR/BRANCH-FGT/EDGE-MX lab: a complaint with no down interfaces and no failed adjacencies anywhere, a red herring that turns out to be real but irrelevant, and a root cause that traces straight back to Part 3's reference-bandwidth warning.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-2-lsa-types-and-the-area-type-hierarchy/https://michealgarner.co.uk/blog/ospf-deep-dive-part-2-lsa-types-and-the-area-type-hierarchy/What actually travels in the LSDB: the seven LSA types that matter in practice, and how stub, totally stubby, NSSA, and totally NSSA areas each filter a different subset of them.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-3-the-spf-algorithm-cost-and-route-selection/https://michealgarner.co.uk/blog/ospf-deep-dive-part-3-the-spf-algorithm-cost-and-route-selection/How a full LSDB actually becomes a routing table: Dijkstra's algorithm, the reference-bandwidth cost trap every vendor shares, and why intra-area, inter-area, and external routes are preferred in that exact order regardless of cost.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-4-virtual-links-summarization-and-redistribution/https://michealgarner.co.uk/blog/ospf-deep-dive-part-4-virtual-links-summarization-and-redistribution/Fixing the lab's missing backbone connection with a virtual link, then summarizing at the ABR and redistributing a static route at the NSSA's ASBR, with working syntax on Cisco, FortiOS, and Junos for each.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-5-ospfv3-and-running-ospf-over-ipv6/https://michealgarner.co.uk/blog/ospf-deep-dive-part-5-ospfv3-and-running-ospf-over-ipv6/OSPFv3 isn't OSPFv2 with bigger addresses. It separates topology from addressing, drops built-in authentication in favor of IPsec, and runs over link-local addresses by default, plus the per-vendor syntax to bring it up on Cisco, FortiOS, and Junos.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-6-authentication-and-security-hardening/https://michealgarner.co.uk/blog/ospf-deep-dive-part-6-authentication-and-security-hardening/What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-7-cisco-iosios-xe-implementation-and-gotchas/https://michealgarner.co.uk/blog/ospf-deep-dive-part-7-cisco-iosios-xe-implementation-and-gotchas/CORE-CSR's actual configuration: process ID scope, the network-statement vs interface-based config split, the passive-interface-default trap, and why raising reference-bandwidth only ever warns once, locally, at configuration time.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-8-fortios-implementation-and-gotchas/https://michealgarner.co.uk/blog/ospf-deep-dive-part-8-fortios-implementation-and-gotchas/BRANCH-FGT's configuration: why FortiOS has no passive-interface-default equivalent, how OSPF scopes to a VDOM, the router-id selection rule that actually differs from Cisco's, and how OSPF interacts with SD-WAN policy routes.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ospf-deep-dive-part-9-junos-implementation-and-gotchas/https://michealgarner.co.uk/blog/ospf-deep-dive-part-9-junos-implementation-and-gotchas/EDGE-MX's configuration: why Junos never adds an interface to OSPF by accident, the policy-based redistribution model, and the one default that catches Cisco and FortiOS engineers off guard, OSPF outranking eBGP by default.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-12-management-operations-and-exam-day/https://michealgarner.co.uk/blog/ensdwi-part-12-management-operations-and-exam-day/Blueprint domain 6.0 — vManage AAA, monitoring and alarms, REST API monitoring, and software image management — then a revision strategy for the whole blueprint and what to expect on exam day. Series finale.Wed, 22 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-1-contrail-service-orchestration-and-the-srxnfx-c/https://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-1-contrail-service-orchestration-and-the-srxnfx-c/Before Session Smart Routing, Juniper's enterprise SD-WAN ran on Contrail Service Orchestration — an SDN/NFV control plane repurposed for site connectivity, provisioning SRX firewalls and NFX universal CPE. This post walks the architecture as it actually shipped.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-2-e-hub-p-hub-and-the-anatomy-of-a-hub-and-spoke-/https://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-2-e-hub-p-hub-and-the-anatomy-of-a-hub-and-spoke-/Contrail's hub-and-spoke model ran on two hub roles — the customer-owned enterprise hub and the multi-tenant provider hub. Routing, VRF segmentation, and traffic-flow mechanics of both, and why the model got heavy at scale.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-3-why-contrail-lost-the-enterprise-and-the-pivot-/https://michealgarner.co.uk/blog/contrail-sd-wan-deep-dive-part-3-why-contrail-lost-the-enterprise-and-the-pivot-/Closing the Contrail arc: a straight comparison against Viptela, VeloCloud, and CloudGenix, what CSO's architecture cost it competitively, and the specific rationale Juniper gave for retiring it in favour of Session Smart Routing.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-contrail-to-session-smart-a-history-of-junipers-sd-wan-journey/https://michealgarner.co.uk/blog/from-contrail-to-session-smart-a-history-of-junipers-sd-wan-journey/Juniper has shipped two structurally different SD-WAN products under one brand: Contrail Service Orchestration, born out of an SDN/NFV controller, and Session Smart Routing, born out of a 2014 session-border-controller team's bet that tunnels were the wrong abstraction. This is how one became the other.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-1-128-technology-and-the-tunnel-free/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-1-128-technology-and-the-tunnel-free/Session Smart Routing didn't start as a Juniper project — it started as a session border controller team's bet that SD-WAN's entire tunnel-based premise was solving the wrong problem. This post covers 128 Technology's origin and the architectural break it made.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-2-secure-vector-routing-tenants-serv/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-2-secure-vector-routing-tenants-serv/How Secure Vector Routing actually forwards a session: the tenant/service data model, the metadata the ingress router stamps on the first packet, and why that's enough to route symmetrically without a tunnel.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-3-session-smart-conductor-mist-and-t/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-3-session-smart-conductor-mist-and-t/Session Smart Routers can be managed by an on-premises Conductor or by the Mist cloud. What each control plane actually does, how the multitenant policy model gets distributed, and how to choose between them.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-4-wan-assurance-marvis-and-ai-native/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-4-wan-assurance-marvis-and-ai-native/What "AI-native WAN" concretely means on the Mist side of Juniper's SD-WAN stack: WAN Assurance's telemetry model, Marvis's self-driving remediation, and where the AI layer actually earns its keep versus where it's a dashboard feature.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-5-zero-trust-by-default-the-ssr-secu/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-5-zero-trust-by-default-the-ssr-secu/Because SVR classifies every session against a tenant and a service before forwarding a single packet, deny-by-default segmentation is a property of the routing engine itself. What that buys, what it doesn't, and how SRX fills the gap.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-6-cloud-onramp-and-multicloud/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-6-cloud-onramp-and-multicloud/Extending Secure Vector Routing into AWS and Azure: virtual SSR instances, cloud regions treated as ordinary sites in the tenant/service model, and how that compares to the tunnel-based cloud onramp patterns already covered on this site.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-7-the-mpls-cutover-playbook/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-7-the-mpls-cutover-playbook/A practical staged cutover from legacy MPLS to Session Smart Routing — overlay-first coexistence, tenant/service modelling before a single circuit changes, and why SVR's tunnel-free design changes the risk profile of the cutover weekend itself.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-8-failure-modes-scale-limits-and-a-f/https://michealgarner.co.uk/blog/juniper-session-smart-sd-wan-deep-dive-part-8-failure-modes-scale-limits-and-a-f/Series finale. What happens to the data plane when Conductor or Mist goes dark, where SSR's scale story sits, and Session Smart Routing lined up against Fortinet, Cisco/Viptela, Arista/VeloCloud, and Palo Alto/Prisma — five philosophies, one underlying question.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-1-from-cloudgenix-to-app-defined-sase/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-1-from-cloudgenix-to-app-defined-sase/Starting an eight-part deep dive into Palo Alto Prisma SDWAN — the fourth control-plane philosophy this site has covered, after Fortinet, Arista/VeloCloud, and Cisco/Viptela. Part 1 covers the CloudGenix lineage, the 2020 acquisition, and what 'app-defined' actually means before we touch a single ION device.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-2-ion-strata-cloud-manager-and-the-planes/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-2-ion-strata-cloud-manager-and-the-planes/The ION device line from 1000 to 9000, physical and virtual, and Strata Cloud Manager — the cloud-only console that absorbed the old CloudGenix Portal. Part 2 maps Prisma SDWAN onto the planes framework this site has used for Fortinet, Arista, and Cisco, and explains why there's no controller box to rack.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-3-appfabric-and-path-selection/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-3-appfabric-and-path-selection/How AppFabric actually builds its full-mesh Secure Fabric Links, why circuit categories and labels stand in for TLOCs, and how per-flow path selection works when there's no routing protocol advertising a route in the first place. The mechanics behind Part 1's philosophical claim.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-4-data-plane-app-id-qos-and-control-mode/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-4-data-plane-app-id-qos-and-control-mode/What App-ID actually classifies at the packet level, how Adaptive QoS measures real circuit capacity instead of trusting a configured bandwidth number, and the practical operational differences between an ION in Control mode and one still in Analytics.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-5-security-prisma-access-and-cloudblades/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-5-security-prisma-access-and-cloudblades/What the ION's local Zone-Based Firewall actually covers, where the line to Prisma Access gets drawn, and how CloudBlades chains in Zscaler, Netskope, and AWS Transit Gateway without touching the branch device. This is the post where 'app-defined SASE' from Part 1 stops being a tagline.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-6-cloud-onramp-and-multicloud/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-6-cloud-onramp-and-multicloud/Prisma SDWAN treats a VPC or VNet as just another data centre: a pair of virtual IONs joins the fabric, and a CloudBlade automates the cloud-native plumbing around them — Transit VNETs and vWAN Hub association on Azure, Transit Gateway attachment on AWS. How that compares to Cisco's and Fortinet's cloud onramp designs already on this site.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-7-the-mpls-cutover-playbook/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-7-the-mpls-cutover-playbook/A per-site MPLS-to-Prisma-SDWAN migration playbook built around the Analytics-to-Control progression from Part 3: zero-touch bootstrap, a genuinely evidence-based baseline before anything changes behaviour, a bounded rollback window per site, and a decommission sequence that doesn't ask anyone to trust the fabric on day one.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-8-failure-modes-scale-limits-and-vendor-comparison/https://michealgarner.co.uk/blog/palo-alto-prisma-sd-wan-deep-dive-part-8-failure-modes-scale-limits-and-vendor-comparison/Series finale. What actually happens when Strata Cloud Manager goes dark, where Prisma SDWAN's scale limits sit, and an honest, direct comparison against Fortinet's collapsed model and Cisco's fully decoupled one — the fourth philosophy, lined up against the three already covered on this site.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-11-qos-and-application-quality-of-experience/https://michealgarner.co.uk/blog/ensdwi-part-11-qos-and-application-quality-of-experience/Blueprint 5.4 and 5.5: the WAN Edge QoS pipeline — classification, marking, policing, shaping, scheduling, queuing — plus per-tunnel and adaptive QoS, then App-QoE: TCP optimization, DRE, packet duplication, FEC, and AppNav.Tue, 21 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-10-security-service-insertion-embedded-and-cloud-delivered/https://michealgarner.co.uk/blog/ensdwi-part-10-security-service-insertion-embedded-and-cloud-delivered/Blueprint 5.1–5.3: service insertion with OMP service routes, the embedded security stack — app-aware firewall, Snort IPS, URL filtering, AMP, SSL/TLS proxy, TrustSec — and cloud security integration with Umbrella DNS and SIG tunnels.Mon, 20 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-1-from-assistant-to-autonomous-swarm/https://michealgarner.co.uk/blog/ai-pentest-agents-part-1-from-assistant-to-autonomous-swarm/A new wave of AI pentesting agents landed in the space of two weeks in July 2026. This opens a series on what they actually do, how they differ from each other, and how they differ from the raw LLM-plus-nmap-plus-Metasploit approach this site already tried in AI Part 7.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-2-inside-pentestcodes-coordinator-and-engagement-state/https://michealgarner.co.uk/blog/ai-pentest-agents-part-2-inside-pentestcodes-coordinator-and-engagement-state/A close read of PentestCode's actual README: the strategist-coordinator design, the thirteen agents, the engagement-state graph with Dijkstra/Yen's K-shortest attack paths, the eighteen mandatory tools, and the honest limitations section the project ships with itself.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-3-pentestgpt-and-the-academic-case-for-reasoning-generati/https://michealgarner.co.uk/blog/ai-pentest-agents-part-3-pentestgpt-and-the-academic-case-for-reasoning-generati/PentestGPT is the oldest project in this series by a wide margin — a USENIX Security 2024 paper before it was a product. What its three-module design got right early, what changed in its 2026 agentic rewrite, and what its own published benchmark numbers actually say.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-4-pentagi-and-the-cost-of-docker-root/https://michealgarner.co.uk/blog/ai-pentest-agents-part-4-pentagi-and-the-cost-of-docker-root/PentAGI takes the opposite infrastructure bet from PentestCode: full Docker sandboxing instead of a root-free binary, which buys real isolation at the cost of a docker.sock privilege model worth understanding before you install it.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-5-nodezero-xbow-and-what-production-safe-actually-means/https://michealgarner.co.uk/blog/ai-pentest-agents-part-5-nodezero-xbow-and-what-production-safe-actually-means/NodeZero and XBOW aren't developer tools you install — they're commercial platforms with real production track records, real customers, and a review-before-submission discipline the open-source entrants in this series don't have to answer to.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-6-fingerprinting-the-swarm-a-defenders-read-on-agent-nois/https://michealgarner.co.uk/blog/ai-pentest-agents-part-6-fingerprinting-the-swarm-a-defenders-read-on-agent-nois/PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-7-installing-pentestcode-and-where-the-sandbox-runs-out-o/https://michealgarner.co.uk/blog/ai-pentest-agents-part-7-installing-pentestcode-and-where-the-sandbox-runs-out-o/The sandbox verified PentestCode's root-free install claim, then ran out of road on an LLM credential. The real run happened on the Proxmox lab: three independent root vectors on Metasploitable2, $9.64, and a critic agent that caught a real technical error.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-pentest-agents-part-8-does-the-human-pentester-still-have-a-job/https://michealgarner.co.uk/blog/ai-pentest-agents-part-8-does-the-human-pentester-still-have-a-job/Closing out the series: what changes for a working pentester when tools like this exist, why every project in this series still insists on a human in the loop somewhere, and how this question echoes the one this site already asked about Ansible.Sun, 19 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-home-lab-honeypot-watching-what-actually-knocks-on-your-door/https://michealgarner.co.uk/blog/building-a-home-lab-honeypot-watching-what-actually-knocks-on-your-door/A ~50-line Python TCP honeypot, tested live in a sandbox with real logged connection attempts, deployable on Herald behind an nftables DNAT rule — what a low-interaction canary actually catches and why that's worth more than it sounds.Sat, 18 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/dns-tunneling-and-covert-c2-iodine-dnscat2-and-catching-it-on-the-wire/https://michealgarner.co.uk/blog/dns-tunneling-and-covert-c2-iodine-dnscat2-and-catching-it-on-the-wire/DNS is the one protocol almost every egress policy leaves wide open. iodine's real --help output and dnscat2's documented client/server model show why — plus the query-entropy and NXDOMAIN signals that actually catch it, tied back into the CONTOSO.LOCAL pivoting lab.Sat, 18 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/living-off-the-land-certutil-mshta-rundll32-and-bitsadmin-as-attacker-primitives/https://michealgarner.co.uk/blog/living-off-the-land-certutil-mshta-rundll32-and-bitsadmin-as-attacker-primitives/The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.Sat, 18 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cve-2026-56155-and-cve-2026-20833-why-patch-tuesday-keeps-rediscovering-the-impa/https://michealgarner.co.uk/blog/cve-2026-56155-and-cve-2026-20833-why-patch-tuesday-keeps-rediscovering-the-impa/July 2026's record Patch Tuesday shipped a Kerberoasting CVE and an AD FS key-theft zero-day that map almost exactly onto techniques from the Impacket Deep Dive series. Real transcripts from that series, held up against four CVEs, to show why the same trust-chain weaknesses keep resurfacing.Fri, 17 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-9-data-policies-segmentation-aar-and-dia/https://michealgarner.co.uk/blog/ensdwi-part-9-data-policies-segmentation-aar-and-dia/Blueprint 4.2–4.5: centralized data policy at the edge, VPN segmentation and per-VPN topologies, application-aware routing with SLA classes and BFD measurements, and direct Internet access with NAT fallback.Fri, 17 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-1-the-hash-landscape-and-why-off/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-1-the-hash-landscape-and-why-off/Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-2-hashcat-fundamentals-and-the-g/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-2-hashcat-fundamentals-and-the-g/Verified against a real hashcat v6.2.6 install and a published RTX 4090 benchmark run: the actual attack-mode syntax, the real mode numbers for NTLM, Kerberoast, and AS-REP, and what it genuinely costs — in dollars, not hand-waving — to exhaust a keyspace against each one.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-3-john-the-ripper-core-vs-jumbo-/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-3-john-the-ripper-core-vs-jumbo-/apt install john does not give you a tool that can crack a Kerberoast hash — verified firsthand, not assumed. The distinction between core John the Ripper and the Jumbo community fork, and the cases where JtR earns a place next to hashcat rather than duplicating it.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-4-building-wordlists-that-actual/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-4-building-wordlists-that-actual/rockyou.txt is fourteen million real, breached passwords from 2009 — and it's the wrong tool the moment a target has any pattern to its passwords at all. Verified cewl and crunch syntax for building wordlists that actually match how a specific organization names things.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-5-the-rule-engine-best64-and-wri/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-5-the-rule-engine-best64-and-wri/B4ckup$SQL2024 isn't in any wordlist — it's a wordlist entry plus a predictable transform. Walking hashcat's real, bundled best64.rule line by line, what its 102 rules actually do, and writing a custom rule for the one leetspeak substitution best64 doesn't cover.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-6-mask-and-hybrid-attacks-and-th/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-6-mask-and-hybrid-attacks-and-th/No wordlist, no rules — masks build candidates character-position by character-position, and a 40,824-line "compliant password" mask set bundled with hashcat covers realistic complexity-policy shapes 65,000 times more efficiently than blind brute force. The keyspace math for why.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-7-cracking-contosolocal-end-to-e/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-7-cracking-contosolocal-end-to-e/Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-8-the-defensive-mirror-passphras/https://michealgarner.co.uk/blog/password-cracking-and-wordlist-engineering-part-8-the-defensive-mirror-passphras/Seven parts of offense, closing with the defense that actually follows from it: why bcrypt/scrypt/Argon2 cost tuning matters more than complexity rules, what NIST SP 800-63B Revision 4 actually changed about rotation, and what specifically would have stopped both CONTOSO.LOCAL cracks.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-1-why-pivoting-is-just-routing-with-extra-steps/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-1-why-pivoting-is-just-routing-with-extra-steps/Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-2-chisel-and-the-http-tunnel-that-looks-like-nothing/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-2-chisel-and-the-http-tunnel-that-looks-like-nothing/Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-3-ligolo-ng-and-tunneling-without-proxychains/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-3-ligolo-ng-and-tunneling-without-proxychains/ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-4-what-tunneling-does-to-your-packets-mtu-fragmentat/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-4-what-tunneling-does-to-your-packets-mtu-fragmentat/Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-5-double-pivots-multi-hop-chains-and-catching-them-f/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-5-double-pivots-multi-hop-chains-and-catching-them-f/Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pivoting-and-tunneling-part-6-defense-in-depth-segmentation-egress-filtering-and/https://michealgarner.co.uk/blog/pivoting-and-tunneling-part-6-defense-in-depth-segmentation-egress-filtering-and/The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-8-control-policies/https://michealgarner.co.uk/blog/ensdwi-part-8-control-policies/Blueprint 4.1: the centralized policy framework, how control policy is evaluated at vSmart, match/action anatomy, and the canonical topologies — hub-and-spoke, regional mesh, and TLOC preference steering — built entirely by filtering routing information.Thu, 16 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-7-omp-tlocs-routing-protocols-multicast-and-config-groups/https://michealgarner.co.uk/blog/ensdwi-part-7-omp-tlocs-routing-protocols-multicast-and-config-groups/Blueprint 3.3–3.7: configuring OMP and TLOCs, service-side OSPF/BGP/EIGRP and VRRP with their loop-prevention markers, multicast over the overlay, and the configuration-group/feature-profile model that v1.2 added to the exam.Wed, 15 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-1-why-real-red-teams-skip-the-metasploit-tutorials/https://michealgarner.co.uk/blog/impacket-deep-dive-part-1-why-real-red-teams-skip-the-metasploit-tutorials/Every beginner tutorial teaches Nmap, Hydra, and a Metasploit one-liner. Nobody assessing a real Windows domain works that way — they live in Impacket. Part 1: what it actually is, the lab this series runs against, and a verified tour of the toolkit.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-10-defense-in-depth-and-detection/https://michealgarner.co.uk/blog/impacket-deep-dive-part-10-defense-in-depth-and-detection/Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-2-domain-recon-without-a-single-exploit/https://michealgarner.co.uk/blog/impacket-deep-dive-part-2-domain-recon-without-a-single-exploit/Before any password is cracked or any exploit fires, a Windows domain will hand an unauthenticated or low-privilege connection its entire user list, computer list, and RID space. Part 2: GetADUsers, lookupsid, rpcdump, and samrdump — and how to stop them talking.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-3-as-rep-roasting-with-getnpuserspy/https://michealgarner.co.uk/blog/impacket-deep-dive-part-3-as-rep-roasting-with-getnpuserspy/One unset checkbox — Kerberos pre-authentication — turns a domain account into a crackable hash that any authenticated, or sometimes any unauthenticated, client can request. Part 3: GetNPUsers.py, what AS-REP roasting actually exploits, and how to close it.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-4-kerberoasting-with-getuserspns/https://michealgarner.co.uk/blog/impacket-deep-dive-part-4-kerberoasting-with-getuserspns/Any authenticated domain user can request a service ticket for any account with a registered SPN, and that ticket is encrypted with the service account's own password hash. Part 4: GetUserSPNs, why pre-auth doesn't save you here, and the gMSA fix.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-5-ntlmrelayx-and-the-passwordless-hijack/https://michealgarner.co.uk/blog/impacket-deep-dive-part-5-ntlmrelayx-and-the-passwordless-hijack/ntlmrelayx.py never cracks a password. It intercepts an NTLM authentication attempt already in flight and replays it, live, to a second target — turning a coerced login into administrative access before the victim's own request even completes.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-6-the-ghost-shells-wmiexec-smbexec-and-atexec/https://michealgarner.co.uk/blog/impacket-deep-dive-part-6-the-ghost-shells-wmiexec-smbexec-and-atexec/Four Impacket scripts get you a remote shell on a Windows host, and they all abuse a different legitimate management protocol to do it. Part 6: wmiexec, smbexec, atexec, and dcomexec compared against classic PsExec, and why one of them is dramatically quieter than the rest.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-7-secretsdumppy-sam-lsa-and-dcsync/https://michealgarner.co.uk/blog/impacket-deep-dive-part-7-secretsdumppy-sam-lsa-and-dcsync/One shell on one member server is a foothold. secretsdump.py is what turns it into the entire domain's password material — local SAM hashes, cached domain logons, LSA secrets, and, if the account is right, every credential in Active Directory via DCSync.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-8-forging-tickets-with-ticketerpy/https://michealgarner.co.uk/blog/impacket-deep-dive-part-8-forging-tickets-with-ticketerpy/With the krbtgt hash from Part 7 in hand, an attacker doesn't need any account's password ever again. ticketer.py forges Kerberos tickets outright — Golden Tickets for full-domain impersonation, Silver Tickets for a single quiet service, both bypassing the domain controller entirely.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/impacket-deep-dive-part-9-the-full-chain-foothold-to-domain-admin/https://michealgarner.co.uk/blog/impacket-deep-dive-part-9-the-full-chain-foothold-to-domain-admin/Eight posts, eight tools, one domain. Part 9 runs CONTOSO.LOCAL's compromise start to finish, in the order a real intrusion actually uses these techniques — one phished workstation to a persistent, forged Domain Admin ticket.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/netcat-the-swiss-army-knife-of-tcpip-a-deep-dive/https://michealgarner.co.uk/blog/netcat-the-swiss-army-knife-of-tcpip-a-deep-dive/Netcat's origins and the OpenBSD/GNU fork split, core socket mechanics, file transfer and port scanning, bind vs reverse shells (with the mkfifo workaround for -e-less builds), and HTTP banner grabbers, mock servers, and relays — with firewall-testing use cases throughout.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-hidden-kali-linux-shield-how-firejail-sandboxes-dangerous-exploits-without-t/https://michealgarner.co.uk/blog/the-hidden-kali-linux-shield-how-firejail-sandboxes-dangerous-exploits-without-t/Firejail wraps any process in Linux namespaces, seccomp-bpf, and capability drops in milliseconds — no VM spin-up. How it actually isolates a process, real GitHub-PoC and exploit-testing workflows, and the root-user gotcha that quietly guts it on Kali.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-6-wan-edge-deployment-ztp-bootstrap-and-tloc-extension/https://michealgarner.co.uk/blog/ensdwi-part-6-wan-edge-deployment-ztp-bootstrap-and-tloc-extension/Blueprint 3.1 and 3.2: onboarding edges with ZTP, PnP, and bootstrap; data-centre and regional-hub designs; circuit termination and TLOC extension; dynamic tunnels; and how the underlay and overlay exchange routes.Tue, 14 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-1-what-ansible-is-and-why-agentless-still-wins/https://michealgarner.co.uk/blog/ansible-deep-dive-part-1-what-ansible-is-and-why-agentless-still-wins/Kicking off a thirteen-part Ansible series. Part 1 covers what Ansible actually is, the push-based agentless model and why it still matters against Chef/Puppet/Salt, the control node/managed node mental model, installing Ansible, and your first ad-hoc command against a real inventory.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-10-lab-automating-a-cisco-and-fortigate-fleet-with-ansibl/https://michealgarner.co.uk/blog/ansible-deep-dive-part-10-lab-automating-a-cisco-and-fortigate-fleet-with-ansibl/Part 10, the second lab: network-specific Ansible modules against a mixed Cisco IOS and FortiGate fleet — cisco.ios facts and config, fortinet.fortios firewall policy objects, connection: network_cli vs httpapi, and a config-drift check playbook.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-11-error-handling-in-anger-blocks-rescue-and-partial-fail/https://michealgarner.co.uk/blog/ansible-deep-dive-part-11-error-handling-in-anger-blocks-rescue-and-partial-fail/Part 11: block/rescue/always for structured error handling, ignore_errors vs failed_when vs ignore_unreachable, max_fail_percentage and any_errors_fatal, and retries/until for polling a service until it's actually ready.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-12-best-practices-the-style-guide-i-actually-follow/https://michealgarner.co.uk/blog/ansible-deep-dive-part-12-best-practices-the-style-guide-i-actually-follow/Part 12: the Ansible conventions worth treating as non-negotiable — naming, idempotency discipline, directory layout, secrets, tagging restraint, testing gates, and the failure modes that show up once a project outlives its author's memory of writing it.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-13-does-ansible-still-matter-in-an-mcpai-world/https://michealgarner.co.uk/blog/ansible-deep-dive-part-13-does-ansible-still-matter-in-an-mcpai-world/Part 13, the closing piece: if an AI agent can SSH in and fix things itself, do playbooks, idempotency, and config management still matter? A case for yes — argued through the same MCP server that writes this very site.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-2-inventory-static-dynamic-and-everything-in-between/https://michealgarner.co.uk/blog/ansible-deep-dive-part-2-inventory-static-dynamic-and-everything-in-between/Part 2 of the Ansible series: INI vs YAML inventory, groups and nested groups, host_vars/group_vars, patterns and limits, and moving to dynamic inventory plugins (AWS, and a network-specific example) once static files stop scaling.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-3-playbooks-tasks-and-the-idempotency-contract/https://michealgarner.co.uk/blog/ansible-deep-dive-part-3-playbooks-tasks-and-the-idempotency-contract/Part 3: plays and tasks, modules vs shell/command, the idempotency contract that makes Ansible safe to re-run, handlers and notify, check mode and diff mode, and tags for selectively running part of a playbook.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-4-variables-facts-and-jinja2-templating/https://michealgarner.co.uk/blog/ansible-deep-dive-part-4-variables-facts-and-jinja2-templating/Part 4: where variables come from, gathering and using facts, the Jinja2 syntax underneath when/template/filters, common filters worth knowing, and building real config templates for both servers and network devices.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-5-roles-and-ansible-galaxy-structuring-projects-that-scal/https://michealgarner.co.uk/blog/ansible-deep-dive-part-5-roles-and-ansible-galaxy-structuring-projects-that-scal/Part 5: the standard role directory layout, defaults vs vars, role dependencies, ansible-galaxy for installing community roles and collections, and requirements.yml for pinning what a project depends on.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-6-variable-precedence-and-ansible-vault-secrets-done-righ/https://michealgarner.co.uk/blog/ansible-deep-dive-part-6-variable-precedence-and-ansible-vault-secrets-done-righ/Part 6: the full variable precedence ladder from role defaults to extra-vars, then Ansible Vault end to end — encrypting whole files and single strings, vault IDs for multiple secret tiers, and keeping vault passwords out of the repo entirely.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-7-ansiblecfg-performance-and-scaling-to-hundreds-of-hosts/https://michealgarner.co.uk/blog/ansible-deep-dive-part-7-ansiblecfg-performance-and-scaling-to-hundreds-of-hosts/Part 7: the ansible.cfg precedence and the settings that actually matter, forks and the linear/free strategies, SSH pipelining and ControlPersist, fact caching, and Mitogen as the option to know about even if you don't reach for it.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-8-testing-ansible-molecule-ansible-lint-and-ci-pipelines/https://michealgarner.co.uk/blog/ansible-deep-dive-part-8-testing-ansible-molecule-ansible-lint-and-ci-pipelines/Part 8: ansible-lint and its rule categories, Molecule for spinning up disposable Docker/VM targets and asserting real state with Testinfra, idempotency testing (running a role twice and asserting nothing changed the second time), and wiring it all into GitHub Actions.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ansible-deep-dive-part-9-lab-zero-to-production-a-three-tier-web-app-from-bare-m/https://michealgarner.co.uk/blog/ansible-deep-dive-part-9-lab-zero-to-production-a-three-tier-web-app-from-bare-m/Part 9, the first lab: a role-based playbook standing up a load balancer, two app servers, and PostgreSQL from bare Ubuntu boxes — vault-protected credentials, templated HAProxy/env config, notify chains, and a rolling deploy with serial.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-5-certificates-device-lists-and-control-plane-troubleshooting/https://michealgarner.co.uk/blog/ensdwi-part-5-certificates-device-lists-and-control-plane-troubleshooting/Blueprint 2.3 and 2.4: the certificate trust model end to end — root CA options, controller CSRs, the WAN Edge authorized serial list — then the systematic control-connection troubleshooting flow behind most ENSDWI exhibit questions.Mon, 13 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-4-controller-deployment-cloud-on-prem-scale-and-redundancy/https://michealgarner.co.uk/blog/ensdwi-part-4-controller-deployment-cloud-on-prem-scale-and-redundancy/Blueprint 2.1 and 2.2: Cisco-hosted vs on-premises controllers, hosting platform requirements, installing the vManage/vBond/vSmart trio, and the scalability and redundancy rules — clustering, affinity, and how many of each you actually need.Fri, 10 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-3-edge-platforms-and-cloud-onramp/https://michealgarner.co.uk/blog/ensdwi-part-3-edge-platforms-and-cloud-onramp/Finishing blueprint domain 1.0: the cEdge and vEdge platform families and how to pick between them, then all four Cloud OnRamp variants — SaaS, IaaS, Colocation, and Multicloud/Interconnect — at the depth the exam actually tests.Thu, 09 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-2-architecture-planes-components-and-multi-region-fabric/https://michealgarner.co.uk/blog/ensdwi-part-2-architecture-planes-components-and-multi-region-fabric/Blueprint domain 1.1: the four planes and their components, OMP's three route types, TLOCs, IPsec vs GRE encapsulation, BFD's dual role, and Multi-Region Fabric — the v1.2 addition that older study material misses entirely.Wed, 08 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ensdwi-part-1-exam-syllabus-and-study-roadmap/https://michealgarner.co.uk/blog/ensdwi-part-1-exam-syllabus-and-study-roadmap/Kicking off a twelve-part study series for the Cisco 300-415 ENSDWI exam. Part 1 breaks down the v1.2 blueprint domain by domain, maps every topic to a part of this series, and covers exam logistics, lab options, and how to study for a 90-minute concentration exam.Tue, 07 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-1-components-controllers-and-the-four-plane/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-1-components-controllers-and-the-four-plane/Starting a ten-part deep dive into Cisco Catalyst SDWAN. Part 1 covers the Viptela lineage, the four controller planes (vManage, vSmart, vBond, WAN Edge), the certificate trust model, and the control-connection bring-up sequence.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-10-failure-modes-scale-limits-and-a-vendor-/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-10-failure-modes-scale-limits-and-a-vendor-/Part 10, the finale: what actually breaks (vBond, vSmart, vManage) and what doesn't when it does, vManage's documented scale ceiling, and a head-to-head of OMP/TLOC against Fortinet ADVPN, Arista DMPO, and VeloCloud.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-2-omp-the-overlay-management-protocol/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-2-omp-the-overlay-management-protocol/Part 2 of the Cisco Catalyst SDWAN series: what OMP actually carries between WAN Edge and vSmart — OMP routes, TLOC routes, and service routes — how best-path selection and multipath differ from BGP, and why the overlay/underlay split is the whole point.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-3-tlocs-color-and-centralized-policy/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-3-tlocs-color-and-centralized-policy/Part 3 of the Cisco Catalyst SDWAN series: what TLOC color actually constrains, how restrict/no-restrict shapes which tunnels can form, and how centralized control policy on vSmart turns that into enforced topology — full mesh, hub-and-spoke, or anything between.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-4-bfd-app-route-slas-and-cedge-forwarding/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-4-bfd-app-route-slas-and-cedge-forwarding/Part 4: how BFD over every data tunnel drives both fast failure detection and continuous SLA measurement, how app-route policy steers on that data, and where cEdge's IOS-XE forwarding pipeline diverges from legacy vEdge.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-5-topology-walkthroughs-dual-transport-dia-/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-5-topology-walkthroughs-dual-transport-dia-/Part 5: VPN segmentation (transport vs. service VPNs), a worked dual-MPLS-plus-Internet branch design, direct internet access for local breakout, and TLOC extension for sites with no WAN circuit of their own.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-6-cloud-onramp-for-saas-and-iaas/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-6-cloud-onramp-for-saas-and-iaas/Part 6: how Cloud OnRamp for SaaS continuously measures per-app, per-transport path quality to pick the best local breakout, and how Cloud OnRamp for IaaS extends the fabric directly into AWS and Azure as cloud-resident sites.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-7-sig-secure-firewall-and-edge-security/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-7-sig-secure-firewall-and-edge-security/Part 7: how DIA traffic gets inspected without a hub backhaul — Cisco Secure Internet Gateway integration, the on-box UTD container on cEdge, and how this converges with the broader SASE shift other vendors are making too.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-8-automation-vmanage-api-terraform-and-ansi/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-8-automation-vmanage-api-terraform-and-ansi/Part 8: why vManage's API-first design means automating Catalyst SDWAN looks nothing like CLI-scraping individual boxes, and where Terraform's declarative model and Ansible's procedural model each fit.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-9-the-mpls-to-sd-wan-cutover-playbook/https://michealgarner.co.uk/blog/cisco-catalyst-sd-wan-deep-dive-part-9-the-mpls-to-sd-wan-cutover-playbook/Part 9: a phased, coexistence-based migration sequence from legacy MPLS to Catalyst SDWAN — pilot sites first, hubs last, explicit rollback triggers, and why ripping MPLS out in one weekend is the wrong instinct.Mon, 06 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-8-kali-20262s-nine-new-tools-and-the-mcp-server-with-150-more-behind-it/https://michealgarner.co.uk/blog/ai-part-8-kali-20262s-nine-new-tools-and-the-mcp-server-with-150-more-behind-it/Kali 2026.2 shipped nine new tools, one an AI CLI by default. I installed and ran every one I could in a rootless sandbox, then looked behind the curtain at a 17,000-line MCP server wrapping 150+ tools, and Kali's own local-LLM stack. No fabricated output.Sat, 04 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-9-from-draft-only-to-whole-site-the-v24-tool-surface-and-the-rails-behin/https://michealgarner.co.uk/blog/ai-part-9-from-draft-only-to-whole-site-the-v24-tool-surface-and-the-rails-behin/Parts 7 and 8 went out to other people's tool servers. This one comes home. v2.4 turns my blog's MCP server from a draft-publishing surface into one that can read, grep, write, and illustrate the whole site — and the interesting part was never the tools. It was the guardrails.Sat, 04 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sd-wan-control-plane-showdown-three-philosophies-for-solving-the-same-problem/https://michealgarner.co.uk/blog/sd-wan-control-plane-showdown-three-philosophies-for-solving-the-same-problem/Fortinet collapses control onto the data-plane device. Arista/VeloCloud collocates it on a multi-tenant Gateway. Cisco/Viptela decouples it fully into vSmart and OMP. Three architectures covered on this site, lined up side by side, right before the Cisco series picks up the third one.Fri, 03 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-brief-history-of-sd-wan-controllers-viptela-velocloud-cloudgenix-and-why-cisco/https://michealgarner.co.uk/blog/a-brief-history-of-sd-wan-controllers-viptela-velocloud-cloudgenix-and-why-cisco/Three startups solved SDWAN's control-plane problem within a year of each other. Two got bought by exactly the company you'd expect; one brand didn't survive. The acquisition history of Viptela, VeloCloud, and CloudGenix — and why Cisco still runs two unrelated SDWAN stacks today.Thu, 02 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-three-planes-management-control-and-data-and-why-every-sd-wan-argument-comes/https://michealgarner.co.uk/blog/the-three-planes-management-control-and-data-and-why-every-sd-wan-argument-comes/A vendor-neutral primer on the management, control, and data planes — what each actually does, why management-vs-control is the distinction everyone blurs, and a three-question test you can run against any SDWAN platform regardless of vendor.Wed, 01 Jul 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cilium-kubernetes-networking-and-security-built-on-ebpf/https://michealgarner.co.uk/blog/cilium-kubernetes-networking-and-security-built-on-ebpf/Cilium replaces iptables-based kube-proxy and overlay CNIs with eBPF programs on the kernel datapath. Connects back to namespaces, veth pairs, nftables, and eBPF/XDP, then covers identity-based network policy and Hubble observability.Tue, 30 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-7-when-an-llm-gets-nmap-and-metasploit-as-tools/https://michealgarner.co.uk/blog/ai-part-7-when-an-llm-gets-nmap-and-metasploit-as-tools/I wired an LLM into nmap and Metasploit against a deliberately vulnerable lab. The exploit worked — a real, server-verified root shell — but the sharper finding was the models themselves: a 7B fabricated its tool output wholesale, an 8B mangled its arguments, and only a 32B drove the tools honestly. No fabricated transcripts — the model's included.Tue, 30 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nmap-and-the-scripting-engine-a-network-engineers-field-guide-to-nse/https://michealgarner.co.uk/blog/nmap-and-the-scripting-engine-a-network-engineers-field-guide-to-nse/Nmap's scan engine and NSE scripting framework are as useful for firewall change validation and inventory work as for security assessments. Covers scan types, timing, NSE categories, writing a custom script, and practical recipes for network engineers.Mon, 29 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/strncpy-is-finally-gone-what-linux-72-rc1-means-for-kernel-security/https://michealgarner.co.uk/blog/strncpy-is-finally-gone-what-linux-72-rc1-means-for-kernel-security/Linus opened the 7.2 merge window and tagged 7.2-rc1 — and with it, strncpy() is finally gone from the kernel tree. Six years, 362 commits, 70 contributors. Here's what the function actually did wrong, why it took so long to kill, and why removal beats deprecation.Sun, 28 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/linux-network-namespaces-isolated-network-stacks-without-a-hypervisor/https://michealgarner.co.uk/blog/linux-network-namespaces-isolated-network-stacks-without-a-hypervisor/Network namespaces give a process its own interfaces, routing table, iptables rules, and sockets — completely isolated from the host. They underpin Docker, Kubernetes, and VPNs. This post covers how they work and how to use them hands-on.Fri, 26 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nftables-the-modern-netfilter-framework-every-network-engineer-should-know/https://michealgarner.co.uk/blog/nftables-the-modern-netfilter-framework-every-network-engineer-should-know/nftables replaced iptables as the default Linux firewall framework years ago, but most existing guides and scripts still assume iptables syntax. This post covers the nftables model properly — tables, chains, sets, maps — and how to think about it coming from an iptables or FortiGate policy background.Thu, 25 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ebpf-and-bpftrace-network-observability-without-touching-the-packet-path/https://michealgarner.co.uk/blog/ebpf-and-bpftrace-network-observability-without-touching-the-packet-path/eBPF lets you attach tiny programs to kernel hooks — TCP state changes, socket events, XDP ingress — with zero packet-path overhead and no kernel modules. bpftrace makes it scriptable. This post covers both for network engineers.Wed, 24 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bash-patterns-every-network-engineer-should-know/https://michealgarner.co.uk/blog/bash-patterns-every-network-engineer-should-know/Most network engineers write bash defensively, copying patterns from old scripts without understanding why they work. This post covers the patterns that actually matter — strict mode, parallel SSH fan-out, retry logic, and structured output — with an emphasis on what breaks when you skip them.Tue, 23 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/deeper-than-tcpdump-nic-diagnostics-with-ethtool-and-protocol-analysis-with-tsha/https://michealgarner.co.uk/blog/deeper-than-tcpdump-nic-diagnostics-with-ethtool-and-protocol-analysis-with-tsha/ethtool exposes the NIC hardware state that sits below anything tcpdump can see — link negotiation, ring buffers, offload settings, error counters. tshark adds full protocol decode on top of tcpdump's capture model. Together they cover the diagnostic gap between 'the cable is fine' and 'I can read every field in this packet.'Mon, 22 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/linux-vrfs-route-isolation-without-the-namespace-overhead/https://michealgarner.co.uk/blog/linux-vrfs-route-isolation-without-the-namespace-overhead/Linux VRFs give you FortiGate-VDOM-style routing table separation on a single network stack, without the full isolation (and overhead) of network namespaces. This post covers the l3mdev model, VRF creation, route leaking, and when VRFs are the right tool versus namespaces.Fri, 19 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/jq-for-network-engineers-parsing-apis-routing-tables-and-structured-logs/https://michealgarner.co.uk/blog/jq-for-network-engineers-parsing-apis-routing-tables-and-structured-logs/jq is the missing piece between modern JSON-emitting tools — ip -j, ss -j, REST APIs — and the shell. This post covers the filter language properly: selection, mapping, construction, and the patterns that come up constantly when automating network infrastructure.Thu, 18 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/replacing-netstat-with-ss-a-network-engineers-diagnostic-guide/https://michealgarner.co.uk/blog/replacing-netstat-with-ss-a-network-engineers-diagnostic-guide/ss is the modern replacement for netstat — faster, richer, and capable of exposing per-socket TCP internals that netstat never could. This post covers the filter syntax, TCP state analysis, and the diagnostics that matter when troubleshooting live connections.Wed, 17 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/beyond-ifconfig-the-ip-command-reference-every-network-engineer-needs/https://michealgarner.co.uk/blog/beyond-ifconfig-the-ip-command-reference-every-network-engineer-needs/The ip command from iproute2 replaced ifconfig and route over a decade ago, but most guides still treat it as a drop-in substitute. This post covers the full model — interfaces, addresses, routes, policy routing, ARP, and live monitoring — with practical examples aimed at network engineers.Tue, 16 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/traffic-control-under-the-hood-a-linux-tc-deep-dive-for-network-engineers/https://michealgarner.co.uk/blog/traffic-control-under-the-hood-a-linux-tc-deep-dive-for-network-engineers/tc is the Linux traffic control subsystem behind netem, HTB shaping, and DSCP-aware queuing. This post explains the model properly — qdiscs, classes, filters — then builds a practical lab rig for testing SDWAN Performance SLA thresholds and QoS behaviour.Mon, 15 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-1/https://michealgarner.co.uk/blog/python-for-network-engineers-part-1/The first post in a 12-part series covering Python for network engineers from first principles to production automation. We cover why Python is still the right choice in 2026, how to set up a modern development environment, and how to use AI tools as a genuine pair programmer throughout your learning journey.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-10/https://michealgarner.co.uk/blog/python-for-network-engineers-part-10/Part 10 of the Python for Network Engineers series. NAPALM provides a vendor-agnostic Python interface to network devices — the same code collects state or replaces configuration on Arista, Cisco, Juniper, or Fortinet without modification. We cover getters, config replace, dry-run validation, and the config diff workflow.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-11/https://michealgarner.co.uk/blog/python-for-network-engineers-part-11/Part 11 of the Python for Network Engineers series. Nornir is a pure-Python automation framework that runs tasks across an inventory in parallel. We cover YAML inventory, task functions, result handling, host/group filtering, and the Netmiko and NAPALM plugins — bringing together everything from the series into one coherent framework.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-12/https://michealgarner.co.uk/blog/python-for-network-engineers-part-12/The final post in the Python for Network Engineers series. We look at how to put AI tools to work inside the automation workflows we've built — config review, fleet-wide AI-assisted parsing, a minimal MCP server that lets an AI agent call your automation scripts directly, and the discipline that keeps AI-assisted automation safe.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-2/https://michealgarner.co.uk/blog/python-for-network-engineers-part-2/Part 2 of the Python for Network Engineers series. We cover Python's core data types — strings, numbers, booleans, files, lists, and tuples — with every example drawn from real network engineering scenarios.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-3/https://michealgarner.co.uk/blog/python-for-network-engineers-part-3/Part 3 of the Python for Network Engineers series. Dictionaries model device state. Sets expose VLAN drift between switches in one line. Comprehensions replace verbose loops. Exception handling keeps automation running when devices misbehave.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-4/https://michealgarner.co.uk/blog/python-for-network-engineers-part-4/Part 4 of the Python for Network Engineers series. Functions make your automation reusable and testable. Regular expressions parse the CLI output that structured tools can't reach. Modules turn a script into a project.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-5/https://michealgarner.co.uk/blog/python-for-network-engineers-part-5/Part 5 of the Python for Network Engineers series. We connect to real network devices over SSH using Netmiko, run show commands, push configuration, and build a multi-device inventory collector — with a Containerlab lab you can run at home.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-6/https://michealgarner.co.uk/blog/python-for-network-engineers-part-6/Part 6 of the Python for Network Engineers series. Raw CLI output is a string — not data. We cover TextFSM templates, the NTC-templates library, Genie parsers, and AI-assisted parsing for commands where no community template exists.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-7/https://michealgarner.co.uk/blog/python-for-network-engineers-part-7/Part 7 of the Python for Network Engineers series. YAML for human-maintained inventory and config files. JSON for API responses and storing collected data. Pydantic to validate that what you read actually matches what you expect before it reaches your automation logic.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-8/https://michealgarner.co.uk/blog/python-for-network-engineers-part-8/Part 8 of the Python for Network Engineers series. Jinja2 turns structured data into device configuration. Variables, loops, conditionals, filters, macros, and template inheritance — with Arista, Cisco, and Fortinet examples throughout.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/python-for-network-engineers-part-9/https://michealgarner.co.uk/blog/python-for-network-engineers-part-9/Part 9 of the Python for Network Engineers series. Every modern network platform exposes a REST API. We cover the requests library, authentication patterns, pagination, error handling, and two real-world examples: Arista eAPI against our existing lab, and the FortiManager JSON-RPC API.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/chronos-keeps-time-building-an-enterprise-grade-ntp-service-with-chrony-and-inte/https://michealgarner.co.uk/blog/chronos-keeps-time-building-an-enterprise-grade-ntp-service-with-chrony-and-inte/Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.Sun, 14 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/one-box-many-firewalls-a-practical-guide-to-fortigate-vdoms/https://michealgarner.co.uk/blog/one-box-many-firewalls-a-practical-guide-to-fortigate-vdoms/Virtual domains let a single FortiGate behave as several independent firewalls — separate routing tables, policies, and administrative boundaries on shared hardware. When that's the right tool, when a VRF is the better one, and how inter-VDOM routing actually moves a packet between them.Fri, 12 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/watching-the-fabric-fortianalyzer-and-fortimonitor-for-sd-wan-sla-observability/https://michealgarner.co.uk/blog/watching-the-fabric-fortianalyzer-and-fortimonitor-for-sd-wan-sla-observability/The operational bookend to the SDWAN design series — how FortiAnalyzer and FortiMonitor turn the performance-SLA assumptions baked into your hub placement and resilience design into something you can actually alert on, trend, and defend with data months later.Thu, 11 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-cutover-playbook-migrating-from-mpls-to-sd-wan-without-a-bad-weekend/https://michealgarner.co.uk/blog/the-cutover-playbook-migrating-from-mpls-to-sd-wan-without-a-bad-weekend/A phased, dual-running migration plan for moving a branch off MPLS and onto SDWAN — route-map-based preference during transition, what to validate before each cutover step, and the rollback triggers that keep a bad change from becoming an outage.Wed, 10 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ipsec-deep-dive-part-1-esp-ah-and-how-ike-phase-1-actually-brings-a-tunnel-up/https://michealgarner.co.uk/blog/ipsec-deep-dive-part-1-esp-ah-and-how-ike-phase-1-actually-brings-a-tunnel-up/IPsec underpins every Fortinet SDWAN overlay this blog has built, and it's never had its own deep dive. Part 1 fixes that: the SA model, ESP vs AH, tunnel vs transport, and a message-by-message walk through IKEv1 main mode, aggressive mode, and IKEv2.Wed, 10 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ipsec-deep-dive-part-2-phase-2-child-sas-and-the-anatomy-of-an-esp-packet/https://michealgarner.co.uk/blog/ipsec-deep-dive-part-2-phase-2-child-sas-and-the-anatomy-of-an-esp-packet/Phase 1 built a control channel and protected nothing. Part 2 covers the negotiation that actually moves data: quick mode and child SAs, traffic selectors, PFS, rekeying, and anti-replay — then dissects an ESP packet field by field, down to the MTU math.Wed, 10 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ipsec-deep-dive-part-3-nat-vs-ipsec-nat-t-port-forwarding-and-the-fortinet-sd-wa/https://michealgarner.co.uk/blog/ipsec-deep-dive-part-3-nat-vs-ipsec-nat-t-port-forwarding-and-the-fortinet-sd-wa/NAT breaks IPsec three distinct ways — AH's ICV, ESP's missing ports, and IKE's rewritten source port. Part 3 covers each break, how NAT-D detects it and NAT-T's UDP 4500 encapsulation repairs it, when port forwarding is still required, and what it all means for SDWAN spokes behind CPE NAT.Wed, 10 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/policed-not-just-routed-traffic-shaping-and-qos-internals-on-fortinet-sd-wan/https://michealgarner.co.uk/blog/policed-not-just-routed-traffic-shaping-and-qos-internals-on-fortinet-sd-wan/Application-aware routing decides which path a flow takes. Shaping decides what happens to it once it's there — shaping profiles, per-IP and per-policy shapers, queue assignment, and how it all interacts with NP7 hardware offload.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-1-stream-overview-exam-structure-and-the-secure-networking-stack/https://michealgarner.co.uk/blog/nse6-part-1-stream-overview-exam-structure-and-the-secure-networking-stack/What the NSE6 Secure Networking specialist stream covers, how the four product exam tracks fit together, and how FortiAuthenticator, FortiSwitch, FortiAP, and FortiNAC form a joined-up access-layer security story.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-10-fortiap-rogue-detection-wireless-ids-mesh-and-troubleshooting/https://michealgarner.co.uk/blog/nse6-part-10-fortiap-rogue-detection-wireless-ids-mesh-and-troubleshooting/WIDS rogue AP classification and containment, wireless IDS signature types, FortiAP mesh topology with root and leaf APs, OfficeExtender remote AP split-tunnel deployment, and the diagnostic commands and common failure patterns for the FCA-FAP exam troubleshooting section.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-11-fortinac-architecture-network-discovery-and-device-profiling/https://michealgarner.co.uk/blog/nse6-part-11-fortinac-architecture-network-discovery-and-device-profiling/NAC concepts and where FortiNAC sits in the Security Fabric, Control and Application server roles, HA architecture, how FortiNAC discovers network devices via SNMP and SSH, passive and active endpoint discovery, and the fingerprinting methods that determine what type of device is on each port.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-12-fortinac-access-policies-coa-and-vlan-enforcement/https://michealgarner.co.uk/blog/nse6-part-12-fortinac-access-policies-coa-and-vlan-enforcement/The FortiNAC policy model — groups, access values, and network access policies — how RADIUS and CoA enforce VLAN assignment on FortiSwitch and third-party switches, logical networks for VLAN abstraction, and the end-to-end 802.1X enforcement flow from endpoint connect to VLAN assignment.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-13-fortinac-endpoint-compliance-agents-and-host-isolation/https://michealgarner.co.uk/blog/nse6-part-13-fortinac-endpoint-compliance-agents-and-host-isolation/Persistent, dissolvable, and agentless posture assessment methods, compliance rules and remediation actions, quarantine VLAN and isolation workflow, guest self-registration and sponsor approval, BYOD certificate onboarding, and MDM integration with Intune, Jamf, and FortiClient EMS.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-14-fortinac-ha-reporting-and-end-to-end-troubleshooting/https://michealgarner.co.uk/blog/nse6-part-14-fortinac-ha-reporting-and-end-to-end-troubleshooting/FortiNAC HA failover mechanics, MySQL replication, syslog/FAZ integration, alarm framework, built-in and custom reports, and a systematic troubleshooting guide for discovery failures, enforcement problems, and 802.1X issues — with a complete end-to-end trace of a new endpoint joining.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-2-fortiauthenticator-architecture-and-local-authentication/https://michealgarner.co.uk/blog/nse6-part-2-fortiauthenticator-architecture-and-local-authentication/FortiAuthenticator deployment modes, hardware vs VM sizing, initial setup, local user and group management, password policies, account lockout, and the admin interfaces you use to build out a working identity store before you plug in LDAP or RADIUS.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-3-fortiauthenticator-radius-service-ldap-integration-and-remote-auth/https://michealgarner.co.uk/blog/nse6-part-3-fortiauthenticator-radius-service-ldap-integration-and-remote-auth/How FortiAuthenticator acts as a RADIUS server for FortiGate, FortiSwitch, and other NAS devices; configuring realms and routing; integrating with Active Directory via LDAP; and the diagnostic commands that expose exactly where an authentication flow breaks.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-4-fortitoken-2fa-certificate-management-and-the-self-service-portal/https://michealgarner.co.uk/blog/nse6-part-4-fortitoken-2fa-certificate-management-and-the-self-service-portal/Adding a second factor with FortiToken hardware and mobile tokens, certificate authority configuration and SCEP enrollment, and setting up the self-service portal for password reset, token activation, and guest account management with sponsor approval.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-5-fortiswitch-hardware-fortilink-managed-mode-and-initial-provisioning/https://michealgarner.co.uk/blog/nse6-part-5-fortiswitch-hardware-fortilink-managed-mode-and-initial-provisioning/FortiSwitch hardware families and PoE considerations, how FortiLink turns a FortiGate into a wired switching controller, the discovery and authorisation process for bringing a switch under management, and firmware management from the FortiGate GUI.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-6-fortiswitch-vlans-rstp-link-aggregation-and-stacking-design/https://michealgarner.co.uk/blog/nse6-part-6-fortiswitch-vlans-rstp-link-aggregation-and-stacking-design/VLAN trunking and access port configuration under FortiLink, RSTP bridge priority and port roles, static and LACP link aggregation, MCLAG dual-homing for access-layer resilience, and QoS trust modes for DSCP/CoS remarking at the network edge.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-7-fortiswitch-8021x-mac-authentication-bypass-and-port-security/https://michealgarner.co.uk/blog/nse6-part-7-fortiswitch-8021x-mac-authentication-bypass-and-port-security/Port-level 802.1X authentication with FortiAuthenticator as the RADIUS backend, EAP method selection, dynamic VLAN assignment from RADIUS attributes, MAC Authentication Bypass for non-supplicant devices, sticky MAC port security, and CoA-triggered VLAN changes mid-session.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-8-fortiap-hardware-capwap-discovery-and-ap-provisioning/https://michealgarner.co.uk/blog/nse6-part-8-fortiap-hardware-capwap-discovery-and-ap-provisioning/Wi-Fi 6 fundamentals and the key 802.11 standards, FortiAP hardware families and PoE requirements, how CAPWAP connects APs to the FortiGate wireless controller, the four AP discovery methods, WTP profile configuration, and the authorisation and firmware management workflow.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse6-part-9-fortiap-ssids-wireless-security-modes-and-rf-management/https://michealgarner.co.uk/blog/nse6-part-9-fortiap-ssids-wireless-security-modes-and-rf-management/SSID and VAP configuration options, every wireless security mode from Open to WPA3-Enterprise, dynamic VLAN assignment via RADIUS for wireless, captive portal integration with FortiAuthenticator, band steering, and the RF management tools that keep channels clean in dense deployments.Tue, 09 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/zero-trust-meets-the-overlay-converging-ztna-and-sd-wan-on-fortinet/https://michealgarner.co.uk/blog/zero-trust-meets-the-overlay-converging-ztna-and-sd-wan-on-fortinet/The capstone to the SDWAN series: how Fortinet's ZTNA tags and access proxy let you fold per-application, identity-aware access control directly into the SDWAN fabric — built on the RADIUS/TACACS AAA backend and the PKI you already stood up for IPsec.Mon, 08 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pairing-a-fortigate-and-fortiswitch-the-right-way-part-1-get-the-firmware-right-/https://michealgarner.co.uk/blog/pairing-a-fortigate-and-fortiswitch-the-right-way-part-1-get-the-firmware-right-/Before a FortiGate and FortiSwitch will even talk to each other over FortiLink, both need to be on compatible, fully-patched firmware — and NTP/DNS need to be solid. Part 1 covers the upgrade plan we should have run before touching FortiLink at all.Mon, 08 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/pairing-a-fortigate-and-fortiswitch-the-right-way-part-2-fortilink-and-where-we-/https://michealgarner.co.uk/blog/pairing-a-fortigate-and-fortiswitch-the-right-way-part-2-fortilink-and-where-we-/The FortiLink handshake looks trivial in the docs: cable it in, authorize, done. Ours didn't go that way. Part 2 walks the correct pairing process, then dissects exactly where — and why — our first attempt stalled, with the redo plan for when we factory-reset both boxes.Mon, 08 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-1-the-architecture-decision/https://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-1-the-architecture-decision/FortiManager-as-CA vs. a dedicated external CA for certificate-based IPsec on Fortinet SDWAN: the honest trade-offs, SCEP vs EST, CRL vs OCSP, certificate lifetime philosophy, and why "who is your CA" is the real question hiding inside "switch to certificates."Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-2-standing-up-the-pki/https://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-2-standing-up-the-pki/Standing up a real PKI for Fortinet SDWAN IPsec: offline root, online issuing CA, a certificate role scoped to IPsec end entities, an EST front-end, CRL/OCSP placed where the chicken-and-egg overlay problem can't reach it, and FortiManager's much smaller supporting role.Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-3-enrollment-automation-and-the-cu/https://michealgarner.co.uk/blog/beyond-psk-pki-for-fortinet-sd-wan-ipsec-part-3-enrollment-automation-and-the-cu/Closing the series: solving EST's bootstrap-credential problem on purpose, monitoring certificate renewal at scale before it becomes an outage, and executing the PSK-to-certificate cutover — explicitly diffed against the FMG-as-CA migration path.Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cloud-on-ramp-part-1-the-architecture-decision-and-aws-transit-gateway/https://michealgarner.co.uk/blog/cloud-on-ramp-part-1-the-architecture-decision-and-aws-transit-gateway/Hub Placement Part 3 said the hub goes where the VPC is. This post answers the question that raises immediately: how does it actually get there? BGP-over-IPsec to AWS Transit Gateway, ASN selection, and mapping on-prem VRFs onto TGW route tables.Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/cloud-on-ramp-part-2-azure-virtual-wan-and-a-dual-cloud-resilience-design/https://michealgarner.co.uk/blog/cloud-on-ramp-part-2-azure-virtual-wan-and-a-dual-cloud-resilience-design/Azure Virtual WAN looks like AWS Transit Gateway from a distance — a managed hub that attachments plug into. Up close, the BGP mechanics, the route-propagation model, and the failure modes all differ in ways that decide whether a dual-cloud on-ramp actually survives a bad day.Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/local-internet-breakout-in-practice-sd-wan-zones-rules-and-a-multi-vrf-guest-wi-/https://michealgarner.co.uk/blog/local-internet-breakout-in-practice-sd-wan-zones-rules-and-a-multi-vrf-guest-wi-/How SDWAN zones, members, and performance-SLA rules actually decide where a session breaks out — and a full walkthrough of giving Guest Wi-Fi its own VRF, its own zone, and a local internet path that never touches the corporate tunnel.Sun, 07 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-1-the-traditional-model-hubs-in-the-dc/https://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-1-the-traditional-model-hubs-in-the-dc/Why hubs traditionally sit in the DC, the job they actually do there, how they protect FMG/FAZ, and how BGP on loopback ties it together. Part 1 of a series that goes on to challenge the assumption that the hub belongs in the DC at all.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-2-the-mssp-shift-when-the-hub-becomes-custome/https://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-2-the-mssp-shift-when-the-hub-becomes-custome/What changes when one FMG/FAZ pair manages many customers through ADOMs: the hub stops being "the DC's hub" and becomes a per-customer design decision, with its own routing domain, AS plan, and placement logic.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-3-cloud-sase-and-the-death-of-the-dc-as-the-d/https://michealgarner.co.uk/blog/fortinet-sd-wan-hub-placement-part-3-cloud-sase-and-the-death-of-the-dc-as-the-d/Closing out the hub-placement series: what changes about hub design when the destination is Azure, AWS, or GCP rather than a DC, and what changes again for customers migrating from a DC-centric WAN to a SASE-centric one.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/from-dscp-to-deep-packet-inspection-why-sd-wan-application-aware-routing-killed-/https://michealgarner.co.uk/blog/from-dscp-to-deep-packet-inspection-why-sd-wan-application-aware-routing-killed-/A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-packet-never-lies-advanced-tcpdump-recipes-for-the-enterprise-engineer/https://michealgarner.co.uk/blog/the-packet-never-lies-advanced-tcpdump-recipes-for-the-enterprise-engineer/Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/why-deep-packet-inspection-dpi-breaks-guest-wi-fi-and-how-to-fix-it-on-fortinet-/https://michealgarner.co.uk/blog/why-deep-packet-inspection-dpi-breaks-guest-wi-fi-and-how-to-fix-it-on-fortinet-/Full SSL Inspection looks like the obvious way to secure a guest or BYOD network on FortiGate — until certificate warnings, crashed apps, and "No Internet" errors flood the helpdesk. Here's why DPI breaks guest Wi-Fi, and the certificate-inspection-plus-ISDB architecture that actually works.Sat, 06 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-1-system-health-routi/https://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-1-system-health-routi/Part 1 of a 3-part deep-dive CLI reference for the NSE 4 exam. Covers get system status, get system performance status, interface and NIC diagnostics, the routing table RIB vs FIB, ARP, and ping-options — with live output breakdowns and exam-pressure indicators for every command.Wed, 03 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-2-session-table-packe/https://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-2-session-table-packe/Part 2 of 3 in the NSE 4 CLI reference series. Deep-dives into FortiOS session table internals — filtering, reading, and clearing sessions — then covers the packet sniffer verbosity levels 1–6 and the full debug flow chain with line-by-line breakdown of successful vs. dropped traces.Wed, 03 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-3-vpn-ha/https://michealgarner.co.uk/blog/the-ultimate-fortios-cli-reference-for-the-nse-4-exam-part-3-vpn-ha/Part 3 of 3 in the NSE 4 CLI reference series. Covers IPsec VPN diagnostics (IKE gateway state, tunnel SAs, SPI counter discrepancies), SSL-VPN authentication traces, and HA cluster mechanics — election criteria, heartbeat state, and configuration synchronisation verification via checksum hashes.Wed, 03 Jun 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/how-i-use-claude-to-help-run-this-blog-and-why-you-should-try-it/https://michealgarner.co.uk/blog/how-i-use-claude-to-help-run-this-blog-and-why-you-should-try-it/I built a custom MCP server so Claude can write and deploy posts directly to this site. Here's how it works, and an honest look at where AI fits into my workflow.Sat, 30 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-1-mpls-only-site-architecture/https://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-1-mpls-only-site-architecture/A deep dive into how VeloCloud SDWAN connects MPLS-only branch sites via Partner Gateways — covering the NNI, underlay BGP peering, and why MPLS-only edges present a unique onboarding challenge.Fri, 29 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-2-onboarding-an-mpls-only-edge/https://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-2-onboarding-an-mpls-only-edge/A step-by-step walkthrough of how an MPLS-only VeloCloud Edge activates using a temporary internet path injected into the MPLS VRF, what changes once the VCMP tunnels are up, and how the production routing state differs from the onboarding state.Fri, 29 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-3-taming-the-default-route-at-the-nni/https://michealgarner.co.uk/blog/velocloud-sd-wan-and-partner-gateways-part-3-taming-the-default-route-at-the-nni/Why a 0/0 leaking from the MPLS underlay into a VeloCloud Partner Gateway is dangerous, how to filter it at the NNI, and the VeloCloud best practice approach to default route handling — with BGP policy examples.Fri, 29 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-route-dampening-part-1-the-flapping-problem-exponential-decay-and-cisco-conf/https://michealgarner.co.uk/blog/bgp-route-dampening-part-1-the-flapping-problem-exponential-decay-and-cisco-conf/A deep dive into how BGP route dampening works: the 1990s internet instability that created it, the exponential decay algorithm behind it, every Cisco parameter explained, and a full configuration and verification reference.Thu, 28 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/bgp-route-dampening-part-2-rfc-7454-bfd-and-where-dampening-still-belongs/https://michealgarner.co.uk/blog/bgp-route-dampening-part-2-rfc-7454-bfd-and-where-dampening-still-belongs/Why the IETF now discourages global BGP route dampening, how Bidirectional Forwarding Detection interacts with it, what RFC 7454 actually says, and the specific modern scenarios where dampening remains the right answer.Thu, 28 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-1-gmdss-sea-areas-and-why-the-src-exists/https://michealgarner.co.uk/blog/rya-src-part-1-gmdss-sea-areas-and-why-the-src-exists/An exam-grade walk through the Global Maritime Distress and Safety System — the four Sea Areas, the players that regulate it, and why a UK boater needs an SRC to legally key the PTT.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-10-how-to-pass-the-src-exam-structure-timing-and-day-of/https://michealgarner.co.uk/blog/rya-src-part-10-how-to-pass-the-src-exam-structure-timing-and-day-of/A practical guide to actually passing the SRC — eligibility documents, the £76 fee, what's in the written paper and the practical assessment, a two-week study plan, the common gotchas the examiner watches for, and what to do on the day.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-11-practice-exam-50-questions-paper-a-and-paper-b/https://michealgarner.co.uk/blog/rya-src-part-11-practice-exam-50-questions-paper-a-and-paper-b/Two 25-question practice papers covering the full RYA SRC syllabus — multi-choice and short-answer, with full worked explanations in the answer key. Sit each paper timed (45 minutes), mark honestly, revise the misses.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-2-vhf-channels-frequencies-and-propagation/https://michealgarner.co.uk/blog/rya-src-part-2-vhf-channels-frequencies-and-propagation/The VHF marine band channel-by-channel — what CH16, CH70, CH13, CH67, CH80 and the M channels are for, why CH70 is sacred, how to estimate range from antenna heights, and the simplex/duplex distinctions that come up in the exam.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-3-the-vhf-set-controls-antennas-and-power/https://michealgarner.co.uk/blog/rya-src-part-3-the-vhf-set-controls-antennas-and-power/Front-panel by front-panel — squelch, hi/lo power, dual-watch, the DSC distress button under the flap, why antenna height matters more than antenna gain on a sailboat, and the battery routines that keep a handheld working when you actually need it.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-4-dsc-and-mmsi-how-the-radio-calls-other-radios/https://michealgarner.co.uk/blog/rya-src-part-4-dsc-and-mmsi-how-the-radio-calls-other-radios/Digital Selective Calling unpacked — the four call priorities, the four call types, the nine-digit MMSI structure and what each prefix means, the nature-of-distress menu options, and what happens if a small craft tries to acknowledge a distress alert in Sea Area A1 (don't).Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-5-distress-dsc-alerts-mayday-and-mayday-relay/https://michealgarner.co.uk/blog/rya-src-part-5-distress-dsc-alerts-mayday-and-mayday-relay/The full distress procedure end to end — pressing the DSC button, the voice MAYDAY format you'll be examined on, who controls distress traffic, what SEELONCE MAYDAY and SEELONCE FEENEE mean, and when to send a MAYDAY RELAY for someone else.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-6-urgency-safety-and-routine-voice-procedure/https://michealgarner.co.uk/blog/rya-src-part-6-urgency-safety-and-routine-voice-procedure/PAN-PAN, SECURITE, and the routine voice procedure — when to use which, the radio-medical call, the IMO Standard Marine Communication Phrases, the NATO phonetic alphabet, prowords, and what to do with an unanswered or garbled call.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-7-epirbs-sarts-and-navtex/https://michealgarner.co.uk/blog/rya-src-part-7-epirbs-sarts-and-navtex/The rest of GMDSS that the SRC syllabus covers — 406 MHz Cospas-Sarsat EPIRBs and how to register them, the difference between AIS-SART and Radar-SART, PLBs and MOB beacons, and the NAVTEX message format including which letter codes you can never reject.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-8-protecting-distress-frequencies-false-alerts-testing-and-guard-ba/https://michealgarner.co.uk/blog/rya-src-part-8-protecting-distress-frequencies-false-alerts-testing-and-guard-ba/The rules that keep the distress system credible — what's protected on CH16 and CH70, why CH15, 17, 75 and 76 are low-power guard bands, how to test a DSC set without launching a lifeboat, and the exact procedure for cancelling a false distress alert.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/rya-src-part-9-regulations-licences-watchkeeping-and-who-makes-the-rules/https://michealgarner.co.uk/blog/rya-src-part-9-regulations-licences-watchkeeping-and-who-makes-the-rules/The regulatory layer of the SRC syllabus — ITU, CEPT, Ofcom, MCA and what each does; the operator licences (SRC, ROC, LRC, GOC) and the station licences (Ship Radio Licence vs Ship Portable Radio Licence); watchkeeping obligations, record keeping, secrecy, and the prohibited transmissions list.Thu, 21 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-1-the-two-template-engines/https://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-1-the-two-template-engines/Part 1 of three. FortiManager hosts two distinct template engines — classic CLI templates and Jinja CLI templates — and they aren't interchangeable. Thesis: Jinja for shape-varying network plumbing, CLI templates for shape-fixed system config, and a real deployment uses both.Fri, 15 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-2-anatomy-and-patterns/https://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-2-anatomy-and-patterns/Part 2 of three. We open Fortinet's sdwan-advpn-reference repo and read it end-to-end: the dynamic-bgp-on-lo directory, the four reference Project Templates, the inventory contract that feeds them, and the three Jinja patterns the templates lean on heaviest — loops, ipaddr derivation, and imports.Fri, 15 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-3-psk-to-cert-with-fmg-as-ca/https://michealgarner.co.uk/blog/fortinet-sd-wan-jinja-orchestrator-part-3-psk-to-cert-with-fmg-as-ca/Part 3 of three. We take the single-hub PSK example from the reference repo and migrate it to certificate-based IPSec, with FortiManager as the CA. FMG CA setup, per-device enrolment, Project Template flag flip, what changes in the rendered config and what doesn't.Fri, 15 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-1-components-gateways-and-the-three-planes/https://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-1-components-gateways-and-the-three-planes/First post in a five-part deep dive on Arista (VMware) SDWAN. We start with the components — Edges, Cloud Gateways, Partner Gateways, Orchestrator, Controller — and the three planes that bind them. Sets up a UK ISP scenario that the rest of the series will pick apart.Tue, 12 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-2-routing-overlay-underlay-bgp-and-the-gatew/https://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-2-routing-overlay-underlay-bgp-and-the-gatew/Part 2 of five. How prefixes get into the overlay, how the Gateway redistributes them, the three Cloud VPN modes, BGP at the Edge and the Partner Gateway, and the route-selection logic that decides which underlay a flow ends up on.Tue, 12 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-3-the-data-plane-vcmp-dmpo-and-per-flow-stee/https://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-3-the-data-plane-vcmp-dmpo-and-per-flow-stee/Part 3 of five. Wire-level look at VCMP encapsulation, the DMPO measurement loop, Business Policy and per-flow steering, and the on-path remediation (FEC, duplication, jitter buffer) that lets the overlay tolerate underlays that misbehave.Tue, 12 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-4-topology-walkthroughs-mpls-only-meets-inte/https://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-4-topology-walkthroughs-mpls-only-meets-inte/Part 4 of five. The GlobalCo packet-flow walkthroughs — Newcastle to HQ, Bristol to HQ, Chicago to a UK Cloud Gateway (why it fails), and the headline: MPLS-only Chicago talking to Internet-only Shanghai via a Partner Gateway, hop by hop.Tue, 12 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-5-best-practice-failure-modes-and-a-design-c/https://michealgarner.co.uk/blog/arista-vmware-sd-wan-deep-dive-part-5-best-practice-failure-modes-and-a-design-c/Part 5 of five. Gateway design rules, Partner Gateway sizing, segmentation, security service insertion, MTU, the failure modes that catch teams the first time, and a one-page design checklist for an Arista (VMware) SDWAN rollout.Tue, 12 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/finding-the-hop-thats-eating-your-packets-pmtud-sweeper/https://michealgarner.co.uk/blog/finding-the-hop-thats-eating-your-packets-pmtud-sweeper/A per-hop Path-MTU sweeper that binary-searches the largest DF-set packet each hop will pass, then names the router that's clamping your tunnel. ICMP, UDP, TCP-SYN, end-to-end TCP MSS — pick the probe your network actually lets through.Sun, 10 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/who-sent-that-rst-forensic-classification-of-tcp-resets-with-rst-forensics/https://michealgarner.co.uk/blog/who-sent-that-rst-forensic-classification-of-tcp-resets-with-rst-forensics/A pure-Python classifier that takes a TCP RST and tells you whether the server, a mid-path firewall, or the client actually sent it. Six independent scorers — TTL, IP-ID, window, options, sequence, and timing — vote on the origin so the verdict is reproducible instead of tribal.Sun, 10 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/diffing-fortigate-configs-the-way-an-admin-reads-them-fgt-config-diff/https://michealgarner.co.uk/blog/diffing-fortigate-configs-the-way-an-admin-reads-them-fgt-config-diff/A small Python tool that parses FortiGate configs into a tree, aligns nodes by section path and edit key, and reports what was added, removed, or modified — in the language of policies and objects, not unified-diff line numbers. CLI plus a Flask web UI.Sat, 09 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/spectre-meltdown-checker-auditing-cpu-vulnerability-mitigations-on-linux/https://michealgarner.co.uk/blog/spectre-meltdown-checker-auditing-cpu-vulnerability-mitigations-on-linux/A deep dive into spectre-meltdown-checker — how it actually works under the hood, what it tells you that /sys/devices/system/cpu/vulnerabilities does not, the alternative tools (lscpu, vendor microcode checkers, in-tree kernel reporting), and when to reach for each one on a production Linux box.Sat, 09 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-1-design-and-assumptions/https://michealgarner.co.uk/blog/sdwan-resilience-part-1-design-and-assumptions/A multi-part deep dive into building a resilient Fortinet SDWAN on a real, slightly unfashionable topology — HA FortiManager, dual hubs in active/standby, no DCI, and an independent DCE. Part 1 lays out the topology, the AS plan, and challenges the design choices up front.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-2-bgp-on-loopback/https://michealgarner.co.uk/blog/sdwan-resilience-part-2-bgp-on-loopback/Why we peer BGP on loopbacks instead of tunnel-interface IPs, the FortiOS dynamic-IPsec config that makes it work, the spoke-side reciprocal config, and why hub-to-hub iBGP is the wrong answer in a no-DCI active/standby topology.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-3-dc-to-dce-routing-static-ospf-and-bgp/https://michealgarner.co.uk/blog/sdwan-resilience-part-3-dc-to-dce-routing-static-ospf-and-bgp/The hub FortiGate has to glue the spoke overlay to the data-centre environment that hosts the services. Static, OSPF, and eBGP each work — but only two of them fail correctly when the DCE peering goes down on one DC and not the other.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-4-bfd-and-convergence-tuning/https://michealgarner.co.uk/blog/sdwan-resilience-part-4-bfd-and-convergence-tuning/Default BGP timers detect failure in three minutes. That's unacceptable for active/standby SDWAN. This post is the timer-math: DPD vs BFD on tunnels, BFD-for-BGP, holdtime ratios, the Graceful Restart trade-off, and what convergence numbers each combination actually delivers.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-5-performance-slas-and-service-steering/https://michealgarner.co.uk/blog/sdwan-resilience-part-5-performance-slas-and-service-steering/BGP and BFD catch every failure that takes a tunnel or session with it. They don't catch the failure where everything looks healthy at the network layer but the application is gone. That's the gap SDWAN Performance SLAs fill — and the place where careful health-check design earns its keep.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/sdwan-resilience-part-6-building-it-right-full-dci-and-dual-active-advpn/https://michealgarner.co.uk/blog/sdwan-resilience-part-6-building-it-right-full-dci-and-dual-active-advpn/The first five parts defended a topology with real constraints. This final post is the version without those constraints — Fortinet's reference design: full DCI, dual-active ADVPN, iBGP between hubs, symmetric routing, ECMP across both paths. The full shebang.Fri, 08 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/designing-an-arista-sd-wan-spoke-with-enhanced-ha-dual-dia-and-ospf/https://michealgarner.co.uk/blog/designing-an-arista-sd-wan-spoke-with-enhanced-ha-dual-dia-and-ospf/Building a resilient Arista (formerly VeloCloud) SDWAN spoke: two Edges in Enhanced HA, two DIA circuits wired the optimal way, a multi-VLAN LAN, OSPF for route exchange, and the caveats that bite in practice.Sun, 03 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/generating-a-constant-stream-of-web-traffic-with-python/https://michealgarner.co.uk/blog/generating-a-constant-stream-of-web-traffic-with-python/A small, polite Python script that round-robins through ten popular public sites at a configurable rate — useful for homelab traffic, exercising a proxy, or learning the requests library. Walks through the full code, the safety rails, and how to run it under tmux.Sun, 03 May 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/adding-vendor-route-table-parsers-to-route-compare-and-why-the-work-lives-on-a-b/https://michealgarner.co.uk/blog/adding-vendor-route-table-parsers-to-route-compare-and-why-the-work-lives-on-a-b/A follow-up on the route-compare tool: I taught it to read raw show ip route, get router info routing-table all, show route, and show routing route output directly — no Excel cleanup step. The work lives on a branch rather than on main, and this is why.Thu, 30 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-1-ingress-np7-and-the-fast/https://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-1-ingress-np7-and-the-fast/Where the packet is born on a 50G FortiGate. From the wire and DMA, through the NP7 SoC's session cache, IPSA, NTurbo, and the moment a packet either flies through hardware or crosses the bridge into the kernel slow path.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-2-stateful-inspection-sess/https://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-2-stateful-inspection-sess/The packet has been punted from the NP7 to the kernel. Now FortiOS does the things ASICs cannot: IP integrity, DoS sensors, RPF, session table lookup, helpers, and the state machine that decides whether this is a brand new flow or one we already know.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-3-routing-policy-routes-an/https://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-3-routing-policy-routes-an/The packet has a session entry and now needs to know where to go. FortiOS resolves that in a strict order: policy routes, then SDWAN service rules, then the FIB. Each layer has its own logic, its own match criteria, and its own diagnostic surface.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-4-firewall-policy-nat-and-/https://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-4-firewall-policy-nat-and-/Routing told the packet where it's going. Firewall policy decides whether it's allowed, NAT rewrites it, and security profiles inspect it. Inside the iprope chain, central NAT vs policy NAT, VIPs, IP pools, and the flow-vs-proxy UTM pipeline.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-5-egress-npu-offload-and-t/https://michealgarner.co.uk/blog/a-day-in-the-life-of-a-packet-on-a-50g-fortigate-part-5-egress-npu-offload-and-t/The packet is decided. Now it has to actually leave. Egress shaping, NPU offload re-evaluation, IPsec encap, ARP, transmit. Then a single-page reference of every diagnose, get, and show command from across this series.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/comparing-route-tables-between-two-sources-a-small-python-tool-for-audits-and-mi/https://michealgarner.co.uk/blog/comparing-route-tables-between-two-sources-a-small-python-tool-for-audits-and-mi/A self-contained Python utility that takes two Excel route lists, normalises every prefix through ipaddress, finds exact matches and overlaps, preserves invalid entries for audit, and writes a colour-coded Excel report plus CSVs. Includes install guide and full source.Wed, 29 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/configuring-radius-admin-auth-on-fortigate-sd-wan-rbac-and-three-user-profiles-p/https://michealgarner.co.uk/blog/configuring-radius-admin-auth-on-fortigate-sd-wan-rbac-and-three-user-profiles-p/Part 2 of 2 on RADIUS for FortiGate SDWAN. Walks through the FortiOS config end-to-end — RADIUS server entry, group-to-profile mapping via VSA, three worked RBAC examples (senior engineer, NOC operator, compliance auditor), and the verification commands you'll need.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-exam-syllabus-study-roadmap-part-1-of-10/https://michealgarner.co.uk/blog/nse5-exam-syllabus-study-roadmap-part-1-of-10/Part 1 of a 10-part study series for the Fortinet NSE 5 / FCP FortiManager Administrator certification. Covers the exam logistics, the official curriculum grouped into topic buckets, and the roadmap for the rest of the series.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-10-advanced-features-and-integrations/https://michealgarner.co.uk/blog/nse5-part-10-advanced-features-and-integrations/Part 10 — the final post in the NSE5 study series. Covers the advanced features that make FortiManager more than a config pusher: FortiGuard distribution, scripting, the JSON-RPC API, SSO, and FortiAnalyzer integration.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-2-initial-configuration-and-system-settings/https://michealgarner.co.uk/blog/nse5-part-2-initial-configuration-and-system-settings/Part 2 of the NSE5 study series — covers the day-one FortiManager configuration: network, admin access, system time, DNS, FortiGuard, OFTP, the on-disk file structure, and the diagnostic commands worth memorising before anything else.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-3-high-availability/https://michealgarner.co.uk/blog/nse5-part-3-high-availability/Part 3 of the NSE5 study series — covers the FortiManager HA cluster: primary and secondary roles, the sync mechanics, monitor IPs, manual vs automatic failover, and what to do when the cluster splits.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-4-administrative-domains-adoms/https://michealgarner.co.uk/blog/nse5-part-4-administrative-domains-adoms/Part 4 of the NSE5 study series — covers Administrative Domains: normal vs advanced ADOMs, version locking, ADOM modes, RBAC scope, and the per-ADOM revision history that underpins the rest of the FortiManager workflow.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-5-device-registration-and-provisioning/https://michealgarner.co.uk/blog/nse5-part-5-device-registration-and-provisioning/Part 5 of the NSE5 study series — covers device registration: the FGFM tunnel, manual vs automatic registration, model devices, zero-touch provisioning, and the install operations that turn a registered device into a managed device.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-6-device-level-configuration-and-templates/https://michealgarner.co.uk/blog/nse5-part-6-device-level-configuration-and-templates/Part 6 of the NSE5 study series — covers the FortiManager template engine: provisioning templates, CLI templates, SDWAN, IPsec, and certificate templates, and how they compose into a single per-device install.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-7-policy-and-objects/https://michealgarner.co.uk/blog/nse5-part-7-policy-and-objects/Part 7 of the NSE5 study series — covers ADOM-level policy management: policy packages, the object database, dynamic objects, install previews, install logs, and the cleanup workflows that keep the database lean.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-8-workflow-workspace-mode-and-revision-control/https://michealgarner.co.uk/blog/nse5-part-8-workflow-workspace-mode-and-revision-control/Part 8 of the NSE5 study series — covers workspace mode and the workflow approval engine: ADOM locking, read/write sessions, the workflow state machine, and how to recover an ADOM that two admins are fighting over.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse5-part-9-diagnostics-and-troubleshooting/https://michealgarner.co.uk/blog/nse5-part-9-diagnostics-and-troubleshooting/Part 9 of the NSE5 study series — covers the FortiManager diagnostic toolbox: device-manager diagnostics, the FGFM tunnel, install-failure forensics, oftpd, packet capture, and the debug commands worth knowing under exam pressure.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/radius-vs-tacacs-on-fortigate-sd-wan-choosing-the-right-aaa-backend-part-1-of-2/https://michealgarner.co.uk/blog/radius-vs-tacacs-on-fortigate-sd-wan-choosing-the-right-aaa-backend-part-1-of-2/Part 1 of 2 on RADIUS for FortiGate SDWAN. Covers the protocol differences vs TACACS+, the RADIUS server options worth knowing (NPS, FortiAuthenticator, FreeRADIUS, ISE, Okta, Duo, Entra), and when each protocol is the right call for FortiOS.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/resilient-dns-at-home-building-an-ha-pi-hole-pair-on-raspberry-pi/https://michealgarner.co.uk/blog/resilient-dns-at-home-building-an-ha-pi-hole-pair-on-raspberry-pi/A complete walkthrough for installing Pi-hole on a Raspberry Pi running current Raspbian, then turning a single box into a highly available pair using keepalived and Orbital Sync — with the config examples and show commands you'll actually use.Tue, 28 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-1-lab-goals-compute-sizing-and-proxm/https://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-1-lab-goals-compute-sizing-and-proxm/Part 1 of a five-part series on building a FortiManager lab on Proxmox. Covers lab goals, compute sizing for FMG and FGT VMs, host prerequisites, and a clean Proxmox 8.x baseline before the qcow2 build in Part 2.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-2-obtaining-the-image-qcow2-conversi/https://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-2-obtaining-the-image-qcow2-conversi/Part 2 of the FortiManager-on-Proxmox series. Walks through obtaining the KVM image from the Fortinet portal, validating the qcow2 files, building the VM shell with the right machine type and SCSI controller, importing both disks, and first-boot verification.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-3-proxmox-networking-linux-bridges-v/https://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-3-proxmox-networking-linux-bridges-v/Part 3 of the FortiManager-on-Proxmox series. Designs the four-segment lab network, compares Linux bridges, VLAN-aware bridges and Proxmox SDN, walks through the /etc/network/interfaces shape, and explains why the lab bridges should never have an IP on the host.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-4-a-lab-edge-fortigate-vm-in-front-o/https://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-4-a-lab-edge-fortigate-vm-in-front-o/Part 4 of the FortiManager-on-Proxmox series. Builds a FortiGate-VM as the lab edge in front of FortiManager, with four NICs mapped to the lab bridges, a scoped policy set, FortiGuard pinhole, local-in policy hardening, and the deny-with-log rule that proves the boundary works.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-5-registering-managed-fortigates-ado/https://michealgarner.co.uk/blog/building-a-fortimanager-lab-on-proxmox-part-5-registering-managed-fortigates-ado/Part 5 of the FortiManager-on-Proxmox series. Builds two managed FortiGate VMs, registers them via FGFM through the lab edge, splits them across two ADOMs, deploys a shared policy package with FMG, exercises revision history and rollback, and turns the lab into a snapshotted training platform.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/fortios-766-sd-wan-vrf1-transport-and-loopback-design/https://michealgarner.co.uk/blog/fortios-766-sd-wan-vrf1-transport-and-loopback-design/A refined VRF reference design for FortiOS 7.6.6 — transport in VRF 1, separate transport and management loopbacks, complete management-plane pinning, and NPU-VLINK guidance for inter-VRF acceleration.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/mp-bgp-and-vrfs-on-fortigate-sd-wan/https://michealgarner.co.uk/blog/mp-bgp-and-vrfs-on-fortigate-sd-wan/A practical reference design using MP-BGP (VPNv4) and VRFs on FortiOS to keep management (VRF20), customer SDWAN (VRF30), and Guest Wi-Fi DIA (VRF99) isolated end-to-end. Includes config, traffic flows, and the gotchas that bite people in production.Mon, 27 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-1-why-i-gave-claude-write-access-to-my-site/https://michealgarner.co.uk/blog/ai-part-1-why-i-gave-claude-write-access-to-my-site/A year ago I would have called this irresponsible. Today an MCP server lets Claude write to my site. The trust model isn't "I trust the model" — it's "I trust the blast radius".Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-2-the-minimum-viable-mcp-server/https://michealgarner.co.uk/blog/ai-part-2-the-minimum-viable-mcp-server/A personal MCP server is a tiny HTTP service. The spec accommodates a lot of complexity that, if you're the only user, you can stop building. Here's the inventory of what I have running, and what I deliberately left out.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-3-designing-tools-for-an-llm/https://michealgarner.co.uk/blog/ai-part-3-designing-tools-for-an-llm/The verb in the tool name is the most important part. Descriptions answer the questions a chooser asks, not the questions a maintainer asks. Allowlists fail closed; blocklists fail open. Error messages are also instructions.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-4-safety-rails/https://michealgarner.co.uk/blog/ai-part-4-safety-rails/About two hundred lines of code, none of them clever, all of them the reason I sleep fine with the service running. Allowlists, atomic writes, an audit log, and a manual rollback path.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-5-prompt-driven-authoring-in-practice/https://michealgarner.co.uk/blog/ai-part-5-prompt-driven-authoring-in-practice/What's it actually like to use? The honest answer, including where the loop is tight, where it's still clumsy, and the three things I'd warn anyone trying this.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ai-part-6-connector-quirks-and-what-id-do-differently/https://michealgarner.co.uk/blog/ai-part-6-connector-quirks-and-what-id-do-differently/Six months in. The cache layer you don't see, OAuth refresh edge cases, and the short list of decisions I'd make differently if I were doing this again from scratch.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/building-a-polished-cli-tool-with-click-and-rich-packaging-network-automation-fo/https://michealgarner.co.uk/blog/building-a-polished-cli-tool-with-click-and-rich-packaging-network-automation-fo/Turn a working network-automation script into a tool your colleagues will use — moving from argparse to Click, formatted output with Rich, environment-loaded secrets, and pip-installable packaging.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/iptables-to-nftables-migrating-production-firewalls-without-downtime/https://michealgarner.co.uk/blog/iptables-to-nftables-migrating-production-firewalls-without-downtime/A working engineer's guide to moving from iptables to nftables on production Linux firewalls — the mental model shift, where iptables-translate misleads you, atomic ruleset swaps, and a clean rollback strategy that means a bad migration costs you seconds, not your weekend.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/linux-networking-from-the-ground-up-network-namespaces-veth-pairs-and-building-a/https://michealgarner.co.uk/blog/linux-networking-from-the-ground-up-network-namespaces-veth-pairs-and-building-a/Build a real multi-router BGP and OSPF lab on a single Linux box using network namespaces, veth pairs, and FRRouting — no VMs, no containers, no GNS3. A practical walk-through of the primitives that GNS3, Docker, and Kubernetes are quietly using under the hood.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/napalm-vs-netmiko-vendor-agnostic-config-vs-raw-cli-and-when-you-want-both/https://michealgarner.co.uk/blog/napalm-vs-netmiko-vendor-agnostic-config-vs-raw-cli-and-when-you-want-both/A practical comparison of NAPALM and Netmiko for network automation — where Netmiko's raw CLI access is the right answer, where NAPALM's compare/replace/rollback abstraction earns its keep, and the hybrid pattern that most production tooling actually settles on.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/netmiko-in-practice-from-a-show-command-script-to-a-repeatable-audit-tool/https://michealgarner.co.uk/blog/netmiko-in-practice-from-a-show-command-script-to-a-repeatable-audit-tool/A working network engineer's guide to Netmiko — starting from a small repo of mine that runs show commands across a JSON inventory, and extending it into something you can use as a real audit tool with structured output, concurrency, secure credentials, and a sane dry-run for config changes.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/network-emulation-with-netem-simulating-latency-loss-jitter-and-bandwidth-constr/https://michealgarner.co.uk/blog/network-emulation-with-netem-simulating-latency-loss-jitter-and-bandwidth-constr/A practical guide to using Linux's NETEM qdisc to bend networks to your will — adding latency, loss, jitter, duplication, reordering, and bandwidth caps so you can test how applications and protocols actually behave when the network is anything other than perfect.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nornir-for-network-engineers-running-automation-across-an-inventory-at-scale/https://michealgarner.co.uk/blog/nornir-for-network-engineers-running-automation-across-an-inventory-at-scale/A practical introduction to Nornir for engineers whose Netmiko script has grown too big — inventory plugins, structured tasks, parallelism, filtering by site or role, and integrating Netmiko, NAPALM, and pyATS as connection plugins. The framework you reach for once one box has become a hundred.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/parsing-show-command-output-textfsm-genie-and-ttp-for-structured-data/https://michealgarner.co.uk/blog/parsing-show-command-output-textfsm-genie-and-ttp-for-structured-data/A practical comparison of the three main ways to turn Cisco show output into structured Python data — TextFSM with NTC Templates, Genie/pyATS, and TTP — with worked examples and rules of thumb for picking the right one.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-cisco-ios-from-bgp-first-principles-to-advanced-ma/https://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-cisco-ios-from-bgp-first-principles-to-advanced-ma/A practical end-to-end walkthrough of route leaking between VRFs on Cisco IOS — starting with the BGP and VRF fundamentals you need to actually understand what's happening, the static and MP-BGP options for the leak itself, and the route-map machinery that lets you control exactly what crosses.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/ssh-hardening-beyond-the-basics-certificate-authorities-bastion-patterns-and-ses/https://michealgarner.co.uk/blog/ssh-hardening-beyond-the-basics-certificate-authorities-bastion-patterns-and-ses/A production-grade SSH setup that goes beyond disabling password auth — running your own SSH CA with short-lived user and host certificates, ProxyJump bastions, ForceCommand restrictions, and recording sessions with tlog and auditd.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/tcpdump-deep-dive-bpf-filters-capture-rotation-and-cross-mapping-to-fortigates-d/https://michealgarner.co.uk/blog/tcpdump-deep-dive-bpf-filters-capture-rotation-and-cross-mapping-to-fortigates-d/A practical, command-heavy guide to getting real value out of tcpdump — precise BPF filters, production-grade ring-buffer captures, and a side-by-side mapping to FortiGate's diagnose sniffer packet so you can switch between the two without losing your place.Sun, 26 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-exam-syllabus-study-roadmap-part-1-of-10/https://michealgarner.co.uk/blog/nse4-exam-syllabus-study-roadmap-part-1-of-10/Part 1 of a study series for the Fortinet NSE 4 / FCP FortiGate Administrator certification. Covers exam logistics, the official 16-lesson curriculum grouped into topic buckets, and the roadmap for the rest of the series.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-10-high-availability/https://michealgarner.co.uk/blog/nse4-part-10-high-availability/Part 10 — the final post in the NSE4 study series. Covers FGCP, active-passive vs active-active, heartbeat and monitor interfaces, session synchronisation, failover behaviour, and the diagnostic output you'll be asked to interpret.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-2-initial-configuration-the-security-fabric/https://michealgarner.co.uk/blog/nse4-part-2-initial-configuration-the-security-fabric/Part 2 of the NSE4 study series — covers the day-one FortiGate configuration (interfaces, operation modes, admin access, DHCP, FortiGuard) and how the Security Fabric stitches multiple FortiGates and Fortinet products together.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-3-firewall-policies-nat/https://michealgarner.co.uk/blog/nse4-part-3-firewall-policies-nat/Part 3 of the NSE4 study series — firewall policy structure, lookup order, NGFW modes, central vs policy NAT, source NAT pools, virtual IPs, and the session helpers behind protocol fixups.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-4-authentication-fsso-certificates/https://michealgarner.co.uk/blog/nse4-part-4-authentication-fsso-certificates/Part 4 of the NSE4 study series — local and remote authentication (LDAP, RADIUS), captive portal, Fortinet Single Sign-On (FSSO) modes, and certificate operations including SSL deep inspection.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-5-logging-monitoring-diagnostics/https://michealgarner.co.uk/blog/nse4-part-5-logging-monitoring-diagnostics/Part 5 of the NSE4 study series — log categories and severity, local vs remote storage, FortiAnalyzer and syslog forwarding, threat weight scoring, and the diagnostic commands you actually reach for under pressure.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-6-security-profiles-web-app-control-av-ips-dos/https://michealgarner.co.uk/blog/nse4-part-6-security-profiles-web-app-control-av-ips-dos/Part 6 of the NSE4 study series — the five security profiles you attach to firewall policies: web filter, application control, antivirus, intrusion prevention, and denial-of-service.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-7-ssl-vpn/https://michealgarner.co.uk/blog/nse4-part-7-ssl-vpn/Part 7 of the NSE4 study series — SSL VPN modes (web, tunnel, full), portals, realms, MFA, split tunnelling and the diagnostic commands for tracking down a stuck client.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-8-ipsec-vpn/https://michealgarner.co.uk/blog/nse4-part-8-ipsec-vpn/Part 8 of the NSE4 study series — IKEv1 vs IKEv2, route-based vs policy-based, site-to-site and dial-up, NAT traversal, dead peer detection, and the two diagnostic commands that separate a Phase 1 problem from a Phase 2 problem.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/nse4-part-9-routing-sd-wan/https://michealgarner.co.uk/blog/nse4-part-9-routing-sd-wan/Part 9 of the NSE4 study series — static and policy routing, distance vs priority, RPF, OSPF and BGP basics, and how SDWAN turns a pile of WAN links into a single steered zone with performance SLAs.Sat, 25 Apr 2026 00:00:00 GMThttps://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-fortigate-why-its-trickier-than-you-think/https://michealgarner.co.uk/blog/route-leaking-between-vrfs-on-fortigate-why-its-trickier-than-you-think/VRF route leaking is a daily reality in any multi-tenant or shared-services network design. On FortiGate it's harder to find — and harder to get right — than the equivalent on Cisco or Juniper. Here's how to do it, why it's easy to miss, and the practical pitfalls.Sat, 25 Apr 2026 00:00:00 GMT