Blog
Technical articles, deep dives, and commentary on networking and technology.
-
One Fabric, One Agent: Where Security Fabric Ends and FortiSASE Begins
Security Fabric is the automation and visibility layer tying Fortinet devices together. FortiSASE is a cloud-delivered PoP that speaks the same fabric language. Neither is a bolt-on to the other, and the FortiClient agent is the thing that makes the seam disappear.
-
Same Job, Different Shell Part 1: Reachability and Continuous Monitoring
ping and Test-Connection do the same job, but which PowerShell version you're on changes both the syntax and, in one tested case, what the tool actually reports. Part 1 of a series pairing Windows and Linux networking commands, with a real PS 5.1 vs 7.6 discrepancy found along the way.
-
Same Job, Different Shell Part 10: Packet Capture
tcpdump against pktmon: when rule tables and connection state stop answering the question, packet capture does. A real captured TCP handshake and a real captured DNS query/response pair, on both platforms.
-
Same Job, Different Shell Part 11: The Complete Cheat Sheet
Every command pair from this series, reachability through packet capture, in one table, plus which PowerShell cmdlets actually change behavior between versions and which don't. The closing part of the Windows/Linux networking command comparison series.
-
Same Job, Different Shell Part 2: Path Tracing
traceroute and tracert answer "which hops did this take", but the protocol each one probes with matters more than people realize. A real sandbox test where the same destination gave two different route pictures depending on whether the probe was UDP or TCP.
-
Same Job, Different Shell Part 3: Interface and IP Configuration
ip addr, ifconfig, ipconfig, Get-NetIPAddress, Get-NetAdapter: five commands that all answer "what's my address", none of which return quite the same shape of answer. Part 3 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 4: Routing Tables
ip route, route -n, route print, Get-NetRoute: reading a routing table is the same question on both platforms, why is this packet going that way, but Windows answers it with a metric that Linux's route table doesn't expose the same way at all.
-
Same Job, Different Shell Part 5: DNS Lookups and Resolution
dig, nslookup, and resolvectl against Resolve-DnsName and ipconfig /displaydns, with real query output captured live against both authoritative-adjacent and recursive resolvers, plus the caching layer most people forget to check first.
-
Same Job, Different Shell Part 6: Active Connections and Sockets
ss, netstat, and Get-NetTCPConnection all answer "what's connected to what right now", but only one platform ties a connection straight back to a process name without a second lookup. Part 6 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 7: ARP and Neighbor Tables
ip neigh, arp -a, and Get-NetNeighbor read the same table: which MAC address answers for which IP on your local subnet. Windows names the entry states more precisely than Linux does, and Part 7 maps them directly against each other.
-
Same Job, Different Shell Part 8: Port and Service Testing
nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.
-
Same Job, Different Shell Part 9: Firewall Status, Read-Only
iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.
-
Threat Intelligence and FortiGuard Tuning: Making IPS Signatures Actually Work for You
FortiGuard ships new IPS signatures constantly and most of them arrive with a default action nobody chose deliberately. The difference between a tuned IPS deployment and a noisy one isn't the signature database, it's what you do with the defaults.
-
Text Processing for Network Engineers Part 11: Tracing a Bad ACL Across the Fleet, Start to Finish
A maintenance-window ACL push goes out to 150 branch firewalls. A subset break. This part ties every tool from the series together, regex, grep, sed, awk, vim, diff, find and xargs, to find the affected devices, understand why only some of them broke, and fix all of them correctly in one pass.
-
Text Processing for Network Engineers Part 10: Encoding, Line Endings, and the Gotchas That Break Your Scripts
Every tool in this series assumes plain Unix text. A config pasted from Windows, pulled over a serial console, or exported by an older device's SNMP agent frequently isn't, and the failure it causes looks exactly like a bug in your pattern instead of what it actually is.
-
24 Billion Credentials, 36 Sources, and 27 Records Actually Tagged "Redline"
Headlines called it the biggest credential leak in history. The researchers who found it can't say how many duplicates it contains or who ran the database. Here's what's verifiably inside the "24 billion password leak," and why one real detail matters more than the headline number.
-
A Backdoor Named forticloud-sync: Inside the Gunra Ransomware Advisory and Two Fortinet CVEs From Early 2025
Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 8: An Ansible Control Node, a Second Pi, and What changed=0 Actually Proves
Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
Text Processing for Network Engineers Part 9: find, xargs, and Safe Bulk Operations Across a Config Tree
Turning "run this check against every config backup from the last 24 hours" from a manual loop into a single composable pipeline, and the null-byte-delimited habit that stops a filename with a space in it from quietly breaking your script.
-
Text Processing for Network Engineers Part 8: diff, patch, and Comparing Configs Before You Push
Unified diff format, comparing whole config-backup trees with diff -r, and generating a patch once and applying it fleet-wide. Plus why a generic line-by-line diff eventually needed a config-aware tool built specifically for FortiGate syntax.
-
Text Processing for Network Engineers Part 7: nano and Picking the Right Editor for the Job
nano won't win a features argument against vim, and that's fine. On-screen keybindings, no modal editing to fight under pressure, and the $EDITOR variable that decides which one opens when crontab or visudo calls for an editor.
-
Text Processing for Network Engineers Part 6: vim on a Box With No GUI
Macros, visual block mode, and the :g command: the vim features that matter when you're editing a config on a jump box at 3am with nothing but a serial console and no GUI in reach.
-
Text Processing for Network Engineers Part 5: cut, sort, uniq, tr, and the Rest of the Supporting Cast
grep, sed, and awk get all the attention, but the tools that glue them into a working pipeline are cut, sort, uniq, tr, column, and paste. Building a top-talkers report and a unique-source-IP list from a flow log using nothing but these.
-
Five Minutes and an Empty Port Part 1: A Field Guide to Network Implant Hardware, and Why This Still Works
Opening a series on the pocket-sized hardware that turns thirty seconds of physical access into a foothold: a history of the category, a threat model for why it still works in 2026, and a taxonomy of the three tool families this series covers before it turns to defense.
-
Five Minutes and an Empty Port Part 10: The Closing Checklist and a Vendor Comparison
Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.
-
Five Minutes and an Empty Port Part 2: Shark Jack, Packet Squirrel, and LAN Turtle
The three purpose-built Hak5 wired implants compared on what they actually do between plug-in and pull-out: Shark Jack's quick-strike recon and exfil, Packet Squirrel's inline man-in-the-middle, and LAN Turtle's long-term covert remote access.
-
Five Minutes and an Empty Port Part 3: Bash Bunny, Key Croc, and O.MG Cable, or Why 802.1X Never Sees This Coming
The USB HID family, Rubber Ducky, Bash Bunny, Key Croc, and O.MG Cable, attacks the endpoint by exploiting a design decision from the 1990s: a USB keyboard is implicitly trusted, and no network control this series covers can see it happen.
-
Five Minutes and an Empty Port Part 4: WiFi Pineapple, Flipper Zero, and the ESP32 Marauder
The wireless family needs no cable and no physical port at all, just proximity to the air. WiFi Pineapple's PineAP suite, the Flipper Zero's ESP32 Marauder add-on, and bare ESP32 deauther boards compared honestly, including what MAC randomization has actually killed since 2014.
-
Five Minutes and an Empty Port Part 5: Building a Real Call-Home Dropbox on a Raspberry Pi 4
A real LAN Turtle-style dropbox built and tested live on a Raspberry Pi 4: a cloud-init race condition that took three rebuilds to diagnose, and a Cloudflare Tunnel call-home path proven end to end with a real reboot-recovery test.
-
Five Minutes and an Empty Port Part 6: A Full Walkthrough, From Empty Port to Persistent Access
A single illustrative engagement chaining every tool family from Parts 2 through 5 into one narrative, from a five-minute reception-desk recon to a persistent call-home channel, closing on real cost and dwell-time numbers before the series turns to defense.
-
Five Minutes and an Empty Port Part 7: Port Security and the Layer 2 Hygiene Most Networks Already Own
The defensive turn starts at the layer that would have stopped Part 6's persistent dropbox outright: port security, DHCP snooping, Dynamic ARP Inspection, and the rest of the Layer 2 hygiene most switches can already do without buying anything new.
-
Five Minutes and an Empty Port Part 8: 802.1X, MAB, and the NAC Platforms Behind the Curtain
Port security answers whether a device is the one already learned on a port. 802.1X and the NAC platforms behind it answer the harder question: whether this specific identity, on this specific device, should be on the network at all.
-
Five Minutes and an Empty Port Part 9: MAC Filtering, USB Device Control, and Wireless IDS
Closing the defensive arc: MAC OUI and vendor filtering with an honest look at how easily it's defeated, OS-level USB device control for the HID vector Part 3 was built around, and wireless IDS for the one attack in this series MAC randomization never touched.
-
Checking Your Own Public Footprint Part 1: Why Registrars, Defaults, and Time All Drift
A practical series on auditing what's publicly known about you: domain records, usernames, code, and history. Part 1 covers why the audit is worth doing at all, even if nothing has gone wrong yet.
-
Checking Your Own Public Footprint Part 2: Reading Your Own WHOIS, RDAP, and Certificate History
A walkthrough of the whois command, how .uk individual privacy actually works, how RDAP bootstrapping finds the right server, and pulling your own certificate transparency history from crt.sh.
-
Checking Your Own Public Footprint Part 3: What a Username Reveals, and How to Check It Safely
Using Maigret to check what accounts are tied to a username, run against a purpose-built decoy identity rather than a real handle, and why an automated match count needs a second look before you trust it.
-
Checking Your Own Public Footprint Part 4: Code, Secrets, and What's Sitting in Your Own Repos
Scanning your own public repositories for leaked secrets with gitleaks and TruffleHog, checking what's publicly indexed about your own IP space with Shodan's InternetDB, and what's hiding in a file's metadata.
-
Checking Your Own Public Footprint Part 5: The Wayback Machine, Dorking, and a Safe Way to Check Breaches
Finding stale pre-privacy WHOIS snapshots on the Wayback Machine, basic search-engine dorking against your own name, and checking passwords against real breach data without ever sending the password anywhere.
-
Checking Your Own Public Footprint Part 6: Closing the Gaps You Just Found
The actual registrar privacy toggle, the Nominet individual opt-out request, requesting removal of a stale archived page, and the general hygiene changes worth making once, not per finding.
-
Checking Your Own Public Footprint Part 7: Automating the Whole Audit With SpiderFoot
SpiderFoot automates most of what this series just did by hand in one pass. What it actually wraps, what it still can't do for you, and a short checklist to run the whole audit yourself.
-
NSE7 Part 1: Exam Blueprint and Study Roadmap
What the NSE 7 - Secure Networking Architect exam actually tests, how the blueprint's five domains break down by weight, the prerequisites, and the roadmap for the 13 parts that follow.
-
NSE7 Part 10: Designing SD-WAN Rules and Routing
The SD-WAN rule lookup process, application steering and learning, ISDB as a matching criterion, and the routing-table mechanics underneath it all: policy routes, the route lookup process, session tables, and what happens to routing mid-session under SNAT.
-
NSE7 Part 11: Advanced IPsec: Multihub, Multiregion, and Large Deployments
DPD modes, outbound NAT against interfaces with no IP, MTU and fragmentation, hardware offload and the NPU-Flag field, dual-hub topologies with BGP self-healing, and VRF-aware overlays for MSSP-scale deployments.
-
NSE7 Part 12: ADVPN: On-Demand Shortcuts and BGP on Loopback
Shortcut negotiation mechanics, IBGP and EBGP hub-and-spoke designs, shortcut timeout and dependent shortcuts, and what ADVPN 2.0 actually changes about a problem ADVPN 1.0 never fully solved.
-
NSE7 Part 13: A Full Design Walkthrough, and Exam Day
A two-region, dual-hub, ADVPN, VDOM-segmented MSSP design tying every domain in this series together, the diagnostic commands that confirm each layer is working, and the logistics of the exam itself.
-
NSE7 Part 2: Security Fabric at Enterprise Scale
Fabric Connectors versus external connectors, Automation Stitches, and the four integration use cases the NSE 7 blueprint names by name: SAML SSO, automated IoC quarantine, FortiNAC dynamic addressing, and FortiNDR.
-
NSE7 Part 3: High Availability, FGCP, FGSP, and Where VRRP Still Fits
Active-active load balancing, virtual clustering for VDOM partitioning, FGSP standalone session sync across asymmetric and cloud topologies, and the honest case for still reaching for VRRP.
-
NSE7 Part 4: VLANs and VDOMs at Enterprise Scale
The virtual LAN switch, the three VDOM types, and the segmentation and inter-VDOM-routing use cases that separate a lab VDOM demo from a real enterprise design.
-
NSE7 Part 5: Enterprise SD-WAN Fundamentals: DIA and Monitoring
SD-WAN's basic components at the architecture level, direct internet access topologies and best practices, and the monitoring surface (widgets, traffic logs, and events) that a live deployment actually gets judged on.
-
NSE7 Part 6: Central Management, ZTP and SD-WAN Manager on FortiManager
Zero-touch provisioning of SD-WAN branches, device blueprints and CSV import, and how FortiManager's SD-WAN-specific tooling (metadata variables, IPsec templates, and the overlay template) turns one hub-and-spoke design into hundreds of devices.
-
NSE7 Part 7: Security Profiles at Scale: SSL/SSH Inspection and UTM Performance
Certificate inspection versus full inspection as a design decision, the SNI check, false positives, and the honest performance cost of stacking web filtering, application control, IPS, and ISDB.
-
NSE7 Part 8: OSPF for Enterprise Routing
The FortiOS-specific pieces the blueprint actually tests: access lists, prefix lists, route maps, redistribution, running OSPF over an IPsec interface, and ECMP with OSPF routes.
-
NSE7 Part 9: BGP for Enterprise Routing
Loopback interfaces as BGP sources, the neighbor-group command for scaling peer configuration, and optimizing for rapid convergence: route reflectors, the BFD parameter, and graceful-restart on FortiOS.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
Two Ways to Lose a VPN Gateway: FortiBleed's Credential Harvest and PAN-OS's Forged Auth Cookie
Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.
-
One Crafted Request From a Reload: Inside CVE-2026-20349 on Cisco Secure Firewall ASA and FTD
An unauthenticated attacker who can reach the Remote Access SSL VPN service on an ASA or FTD device can crash it with one crafted HTTP request. No login, no workaround, just a reload. What CVE-2026-20349 actually is, and why VPN-facing edges keep being the softest part of the firewall.
-
Seven CWEs, One Advisory: Cisco's August 2026 IOS XE Hardening Release
Cisco's IOS XE team ran the same internal-review model it used on Catalyst SD-WAN in August, grouping fixes by CWE class instead of shipping one CVE per bug. Seven CVE IDs, seven vulnerability classes, no known exploitation, and the same AI-assisted discovery line in the source section.
-
The Wildcard That Wasn't: CVE-2026-26035 and FortiWeb's RADIUS Admin Login Bypass
A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.
-
Wearing Someone Else's Certificate: CVE-2026-70468 and FortiManager's FGFM Trust Model
A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.
-
Text Processing for Network Engineers Part 4: awk and Turning Command Output Into Reports
Fields, records, BEGIN/END blocks, and associative arrays: turning raw show-command and syslog output into bandwidth totals, error-rate tables, and per-source counts without a single line of Python.
-
Text Processing for Network Engineers Part 3: sed and Editing Configs Without Opening a Single File
Substitution, address ranges, in-place edits with a safety net, and the one command that turns "change this IP across 200 saved configs" from an afternoon of find-and-replace into a single line.
-
Text Processing for Network Engineers Part 2: grep and Searching Configs and Logs at Scale
grep past -i and -v: context windows for pulling whole interface blocks, -o for extraction, -P for lookaheads, and recursive search across a folder of device config backups to find which boxes still reference a decommissioned server.
-
Text Processing for Network Engineers Part 1: Regex, the Pattern Language Everything Else Depends On
Before grep, sed, awk, or vim make any sense, you need the pattern language underneath them. This part covers regex through network examples: IPv4/IPv6, MAC addresses, VLAN tags, interface names, and the BRE/ERE/PCRE dialect trap that bites people moving between tools.
-
BGP Deep Dive Part 1: The Application That Runs Between Autonomous Systems
The first post in a deep dive into BGP. Why EGP failed, the two napkins that became RFC 1105, and the distinction that took a bad Halabi read and a good Doyle read to finally land: an IGP finds the best path inside a network you own, BGP negotiates policy between networks you don't.
-
BGP Deep Dive Part 10: Multiprotocol BGP, or How One Session Learned to Carry Everything
RFC 4760 turned BGP from an IPv4-unicast-only protocol into a generic reachability-advertisement transport. Here's how AFI/SAFI, MP_REACH_NLRI, and one session carrying multiple address families actually works.
-
BGP Deep Dive Part 11: Convergence, Stability, and Scale
Route flap dampening, graceful restart, BFD, and ADD-PATH: four mechanisms that shape how fast, how stable, and how scalable a BGP deployment actually is.
-
BGP Deep Dive Part 12: Security, or Why BGP Trusts You Until Proven Otherwise
BGP was built on trust between operators, not cryptographic proof. Real hijack incidents, RPKI/ROV, BGPsec, and MANRS: what actually protects the internet's routing today.
-
BGP Deep Dive Part 2: The Session, From TCP SYN to Established
Part 2 of the BGP Deep Dive: TCP port 179 and why BGP needed a transport layer at all, the full six-state finite state machine from Idle to Established, what the OPEN message actually negotiates, and the hold timer, keepalive, and session-security mechanics underneath it.
-
BGP Deep Dive Part 3: The UPDATE Message and the Attribute Catalog That Is BGP's Actual Policy Engine
Part 3 of the BGP Deep Dive: the UPDATE message's real structure, RFC 4271's four categories of path attribute, and a walk through ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, and AGGREGATOR, including the classic unreachable-next-hop gotcha.
-
BGP Deep Dive Part 4: The Best Path Algorithm, Step by Step
Part 4 of the BGP Deep Dive: the full best path selection algorithm that consumes every attribute from Part 3, walked step by step from Cisco-proprietary Weight down to the final router-ID tiebreak, including why hot-potato routing is baked into step 8, not a separate design choice.
-
BGP Deep Dive Part 5: eBGP and iBGP Are Not the Same Protocol Wearing One Name
Part 5 of the BGP Deep Dive: why AS_PATH loop prevention does nothing inside an AS, the iBGP split-horizon rule that actually prevents internal loops, and why that one rule is the direct, mechanical reason full-mesh iBGP exists at all.
-
BGP Deep Dive Part 6: Route Reflectors and Confederations, Two Ways to Break the Full Mesh
Part 6 of the BGP Deep Dive: RFC 4456 route reflection and RFC 5065 confederations, the two sanctioned ways to relax iBGP's full-mesh requirement from Part 5 without giving up its loop safety, plus the path-hiding tradeoff route reflection quietly introduces.
-
BGP Deep Dive Part 7: Communities, BGP's General-Purpose Signaling Channel
Part 7 of the BGP Deep Dive: standard communities from RFC 1997, extended and large communities that fixed their real limitations, the three well-known values every implementation understands, and why the whole mechanism only works because two networks agree on what a number means.
-
BGP Deep Dive Part 8: Policy in Practice, Prefix Filters, AS-Path Filters, and RFC 7454
Part 8 of the BGP Deep Dive: the actual tools operators use to apply policy, prefix filtering, AS-path filtering, the route-map pattern every vendor implements some version of, and RFC 7454's real operational recommendations for filtering, max-prefix limits, and session hardening.
-
BGP Deep Dive Part 9: Traffic Engineering, or Why Outbound Is Easy and Inbound Never Fully Is
Part 9 of the BGP Deep Dive: multihoming and traffic engineering using nothing but attributes this series has already covered. Outbound TE is a solved problem with LOCAL_PREF. Inbound TE never fully is, and this post explains why prepending, MED, and communities are all, honestly, best-effort.
-
NatJack: What a NAT-Table Hijack Means When You're the One Designing the NAT Boundary
NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.
-
One CSV Upload From Root: Inside CVE-2026-20245 on Cisco Catalyst SD-WAN Manager
A rogue peering connection, a password changed and quietly changed back, then one crafted CSV file that turned an admin session into root. Mandiant's writeup of CVE-2026-20245 is the missing middle chapter between this site's UAT-8616 post and August's hardening release.
-
SDWSCS Part 13: Monitoring with vManage & vAnalytics
The SDWSCS finale — module 13: operating everything the series deployed. vManage's security and Cloud OnRamp dashboards, the UTD and tunnel health signals worth alerting on, vAnalytics/Cisco SDWAN Analytics for trends and forecasting, and a day-2 runbook.
-
The Judgment Gap Just Got Numbers: Two 2026 Surveys on AI Pentesting Tools
The AI Pentest Agents series closed by arguing these tools need a human checking their work, not replacing it. Two independent surveys published within weeks of that series wrapping just put real numbers on exactly that gap.
-
Declare Yourself Trusted: Inside UAT-8616's Three-Year Run Against Cisco Catalyst SD-WAN
Two maximum-severity Cisco Catalyst SD-WAN authentication bypasses, one threat actor, three years of quiet control-plane access. What CVE-2026-20182 and CVE-2026-20127 actually broke, how UAT-8616 used it, and what the fix demands beyond patching.
-
Marking Its Own Homework: Inside Cisco's August 2026 Catalyst SD-WAN Hardening Release
Three months after UAT-8616 forced Cisco's hand on SD-WAN, a different kind of disclosure: an internal security review, five CWE-grouped CVEs up to CVSS 9.9, and an admission that some of the bugs were found by AI models, not people.
-
SDWSCS Part 12: Cloud Interconnect & OnRamp for Colocation
Modules 11–12 of SDWSCS: software-defined cloud interconnect with Megaport and Equinix — virtual routers and private cross-connects provisioned from vManage — and Cloud OnRamp for Colocation: CSP clusters, NFVIS, and vManage-orchestrated VNF service chains.
-
SDWSCS Part 11: Cloud OnRamp Multicloud — AWS, Azure & GCP
Module 10 of SDWSCS: extending the fabric into public cloud with Cloud OnRamp for Multicloud — cloud gateways built from Catalyst 8000Vs, AWS Transit Gateway and Cloud WAN, Azure vWAN, GCP NCC, and the tag-based intent mapping that connects VPCs to service VPNs.
-
SDWSCS Part 10: Cloud OnRamp for SaaS
Module 9 of SDWSCS: Cloud OnRamp for SaaS in deployment detail — vQoE probing and scoring, DIA vs gateway vs client access exits, the Microsoft 365 telemetry integration, Webex/Office/custom app lists, and verifying the path decisions it makes.
-
SDWSCS Part 9: ThousandEyes — Monitoring Cloud Services
Module 8 of SDWSCS: deploying ThousandEyes enterprise agents in app hosting on Catalyst edges, test types and what each proves, the vManage integration, and building Microsoft 365 monitoring that turns 'Teams is slow' into an actionable path diagnosis.
-
BitBang CLI Part 1: A Terminal, File Browser, and Proxy Over WebRTC, No Port Forwarding
bitbang-cli is a single static Go binary that gets you a shell, file browser, and LAN proxy on a remote machine with no inbound port, no account, and no VPN client. Built from source and run for real, including a live P2P connection and a PIN-protected listener.
-
BitBang CLI Part 2: What a WebRTC Reverse Shell Looks Like From the Wire
bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.
-
CVE-2026-45504 Part 1: Why On-Prem Exchange Is an Active Directory Attack Surface
On-prem Exchange has always been a heavily-trusted AD citizen, not a bolt-on app server. This series scopes a real, patched CVE against that history, and against a credential this blog already spent two other series getting a working password for.
-
CVE-2026-45504 Part 2: Inside the WOPI SSRF and Arbitrary File Read
A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.
-
CVE-2026-45504 Part 3: Why One Mailbox Credential Is Enough
svc-legacy-scan's cracked password has already powered two other series on this blog. CVE-2026-45504 shows what the same credential is worth against Exchange, with no ACL abuse and no privilege check required.
-
CVE-2026-45504 Part 4: Detection, Hardening, and Patching Priority
Patch first. After that, EWS activity logging and outbound-traffic baselining are the two layers that catch this kind of abuse, closing the loop this series opened with a six-year-old cracked password.
-
SDWSCS Part 8: CASB, DLP & Securing Microsoft 365
Module 7 of SDWSCS: the CASB layer riding on Umbrella SIG — shadow IT discovery, app controls, tenant restrictions for Microsoft 365, data loss prevention, and remote browser isolation. What each control needs from the SDWAN side to work.
-
Hydra vs Medusa vs Ncrack vs Patator vs Metasploit: Comparing the Online Brute-Force Tools
Five tools solve the same problem, guessing a live service's credentials, with radically different designs. A verified comparison of Hydra, Medusa, Ncrack, Patator, and Metasploit's brute-force auxiliary modules: syntax, protocol coverage, concurrency model, and what each looks like to a defender.
-
SSH Deep Dive Part 1: Keys, Clients, and Getting Connected on Windows, macOS, and Linux
Why key-based auth beats a password, generating and installing a key, and the real differences between the OpenSSH client on Windows, macOS, and Linux. Part 1 of 3, followed by the config file/agent/multiplexing and -L/-R/-D/-J.
-
SSH Deep Dive Part 2: The Config File, Agent Forwarding, and Multiplexing
Turning `ssh -i ~/.ssh/id_ed25519 [email protected]` into `ssh myhost`: the ~/.ssh/config file, per-host settings, ssh-agent so a passphrase isn't typed on every connection, and connection multiplexing to skip the handshake entirely.
-
SSH Deep Dive Part 3: Tunnels and Jump Hosts, -L, -R, -D, and -J
Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.
-
What UTM Actually Costs You: SSL/TLS Deep Inspection Internals on FortiGate
Certificate inspection reads the SNI and moves on. Deep inspection terminates the TLS session and re-signs the server's certificate with your own CA. What that costs in CPU, what it breaks in pinned apps, and why TLS 1.3 made the choice less optional.
-
Route Leaking Between VRFs on FortiGate: What Happens When You Actually Build It
I set out to build the BGP leak-target VRF route-leaking mechanism from my own earlier post, on a real FortiGate 70G. It hit three undocumented platform quirks in a row. The real answer turned out to be a static route over a VDOM-link — no BGP required.
-
Proxmox qm CLI VM Build, Part 1: Creating a Debian 13 VM and Surviving the Build Loop of Death
Building a Debian 13 VM on Proxmox entirely from the qm command line: checking host resources, fetching the ISO with pvesh instead of the GUI, and a real boot-order bug that trapped the VM in its own installer.
-
Proxmox qm CLI VM Build, Part 2: The Same VM via Cloud-Init, and What It Actually Costs You
Building the same Debian 13 VM again, this time from a cloud image instead of the netinst ISO: qm disk import, cloud-init identity and networking, and a real comparison of what you gain and what you give up against Part 1's interactive install.
-
Proxmox qm CLI VM Build, Part 3: Jumping Between pve and the VM
Testing qm terminal, noVNC, and SSH against both VMs from this series, and finding a real quirk: when a VM's display is redirected to its serial console, noVNC and qm terminal turn out to be two viewers on the same channel, not two independent sessions.
-
Proxmox qm CLI VM Build, Part 4: A Real Use Case, DNS with Unbound
Putting the ISO-built VM to actual use as a DNS resolver with unbound, a real sudo gotcha from Part 1's install choices, and an hour spent debugging a phantom firewall that turned out to be a much simpler mistake.
-
Proxmox qm CLI VM Build, Part 5: Templates, Clones, and What a Clone Actually Copies
Closing the series by turning VM 103 into a reusable template with qm template and qm clone, and finding that a clone copies everything on disk, including identity files most people wouldn't think to check.
-
SDWSCS Part 7: Umbrella SIG — Deployment & DNS Policies
Module 6 of SDWSCS: Umbrella SIG architecture and deployment — the automatic tunnel workflow from vManage, active/active vs active/backup designs, steering traffic into the SIG, and DNS security policies as the first (and cheapest) enforcement layer.
-
Lab Environments Part 1: Why Lab, and How to Choose
Opening a short series on the lab environment landscape with the question that actually decides which tool you want: what do you need the lab to be, not which GUI looks nicest.
-
Lab Environments Part 2: The Hypervisor Foundation
Before EVE-NG, GNS3, or CML, something has to run them. Proxmox, ESXi, and VMware Workstation compared as the compute layer underneath the rest of this series.
-
Lab Environments Part 3: Network Emulation Platforms - EVE-NG, GNS3, and pnetlab
The category most people mean by "network lab": real vendor images wired into a GUI topology, running on top of the hypervisor layer from Part 2. EVE-NG's 2026 licensing shift, the pnetlab fork it created room for, and where GNS3 sits outside all of it.
-
Lab Environments Part 4: Vendor-Official All-in-One - Cisco Modeling Labs and Packet Tracer
Two Cisco-only platforms that solve the image licensing problem a different way: they ship the images, or don't need real ones at all. CML's 2026 free tier, and where Packet Tracer's simulation approach is a feature rather than a compromise.
-
Lab Environments Part 5: Container-Native - containerlab and netlab
No GUI topology canvas, no full VMs: network operating systems as containers, topology as a YAML file. The same primitives the Container Networking and OSPF on Linux series already used, applied to network-OS containers instead of app containers.
-
Lab Environments Part 6: Cloud-Hosted Labs, and Picking One
Closing the overview: renting the compute layer instead of owning it, a comparison across all five categories, and a plain decision framework. Proxmox is next, with the deep dives to follow.
-
Proxmox Deep Dive Part 1: Architecture and Installation
Opening the promised Proxmox deep dive: what Proxmox VE actually is under the hood (Debian, KVM, LXC, pmxcfs), the subscription model recapped in more depth, and how the pve host behind this site's own labs got its start.
-
Proxmox Deep Dive Part 10: Backup and Disaster Recovery
vzdump's three backup modes, retention scheduling that actually matches how homelabs get used, and Proxmox Backup Server as the companion product worth running instead of vzdump alone.
-
Proxmox Deep Dive Part 11: PCI and GPU Passthrough
Handing a real GPU or PCI device directly to a VM through IOMMU and VFIO, the IOMMU grouping problem that catches most first attempts, and the use cases that actually justify the setup work.
-
Proxmox Deep Dive Part 12: Users, Permissions, and the API
Realms, roles, and ACLs underneath the GUI, scoped API tokens for automation, and where Terraform and Ansible actually fit against the same API surface the web GUI itself uses.
-
Proxmox Deep Dive Part 13: Monitoring, Maintenance, and Homelab Best Practices
Closing the deep dive: watching the whole stack with Prometheus and Grafana, ongoing repository and certificate maintenance, and a homelab best-practices checklist pulling every part of this series into one place.
-
Proxmox Deep Dive Part 2: Storage Architecture
Every storage type Proxmox supports, what content each one can actually hold, and the local-versus-shared distinction that quietly decides whether live migration and HA are even possible later.
-
Proxmox Deep Dive Part 3: ZFS, the Default Recommendation
Pools, RAIDZ versus mirrors, the RAM math ZFS actually needs, and the one setting (ARC sizing) that trips up more homelab builds than any other single ZFS decision.
-
Proxmox Deep Dive Part 4: Networking - Bridges, VLANs, and SDN
From the single vmbr0 bridge the installer creates, through VLAN-aware bridges and bonding, to the newer SDN stack with EVPN and BGP over VXLAN, and where the extra complexity is actually worth it in a homelab.
-
Proxmox Deep Dive Part 5: The Built-In Firewall
Three separate levels, datacenter, node, and VM, each guarding a different kind of traffic, plus security groups and IP sets for keeping rule sets manageable as a homelab grows.
-
Proxmox Deep Dive Part 6: VMs vs LXC Containers
Full hardware virtualization and OS-level containers are both first-class in Proxmox. The actual decision between them, and why unprivileged containers should be the default rather than the exception.
-
Proxmox Deep Dive Part 7: Clustering and Quorum
What actually happens when a second node joins: corosync, pmxcfs synchronization made real, the quorum math behind how many nodes can fail before the cluster stops trusting itself, and why two nodes is a genuinely awkward number.
-
Proxmox Deep Dive Part 8: High Availability
HA groups, the watchdog-based fencing that makes automatic failover safe, and an honest answer to whether HA is worth the complexity in a homelab at all.
-
Proxmox Deep Dive Part 9: Ceph Hyperconverged Storage
Ceph turns the cluster's own nodes into shared storage, no external NAS required, at the cost of a genuinely higher complexity and hardware floor than most homelabs actually need.
-
SDWSCS Part 6: SASE — Architecture & Use Cases
Module 5 of SDWSCS: what SASE actually is once the marketing is stripped away — the SSE service stack, how Cisco assembles it from Catalyst SDWAN, Umbrella, Duo and ThousandEyes, and the use cases where cloud-delivered enforcement beats on-box or chained designs.
-
BloodHound Deep Dive Part 1: History, Community Edition, and Where It Sits in an Engagement
Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.
-
BloodHound Deep Dive Part 2: SharpHound and What It Actually Collects
SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.
-
BloodHound Deep Dive Part 3: Ingestion, Postgres, Neo4j, and the Go API
How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.
-
BloodHound Deep Dive Part 4: Cypher and the Built-In Attack Path Queries
Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
BloodHound Deep Dive Part 6: From GenericAll to a Working Credential
Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.
-
BloodHound Deep Dive Part 7: Detecting SharpHound and LDAP-Based ACL Abuse
What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.
-
BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential
Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.
-
Sn1per Deep Dive Part 8: The Windows Target and What Nuke Mode Never Touched
Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.
-
Sn1per Deep Dive Part 9: What a Pen Tester Without Sn1per Would Have Found
The same Windows target, worked by hand with nmap, curl, and two modern credential tools, set against what Sn1per's own automated run actually delivered. Closing post for the Sn1per Deep Dive series.
-
SDWSCS Part 5: Secure DIA & Service Chaining
Module 4 of SDWSCS: assembling the embedded stack into a secure Direct Internet Access design, then service chaining — OMP service routes, control and data policy steering, and the dedicated-security patterns for traffic that must transit a real firewall.
-
Sn1per Deep Dive Part 7: Verified With Root
Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.
-
SDWSCS Part 4: Content Filtering — URL Filtering & TLS/SSL Decryption
Module 3 of SDWSCS: URL filtering with categories and web reputation, block pages, and the TLS/SSL decryption proxy — CA design choices, the decrypt policy, undecryptable traffic handling, and why decryption is the feature that needs a change-management plan.
-
SDWSCS Part 3: On-Premises Threat Prevention — Firewall, IPS & AMP
Module 2 of SDWSCS: deploying the application-aware enterprise firewall, Snort-based IPS with its three signature sets, and AMP file reputation with Threat Grid sandboxing — plus fail-open vs fail-close and the verification commands for each.
-
Sn1per Deep Dive Part 1: From Recon Script to Attack Surface Platform
Sn1per orchestrates 90+ tools into one scan. This opens a new series on how it actually works, verified from the real Community Edition source rather than the marketing page.
-
Sn1per Deep Dive Part 2: What Discover and Recon Mode Actually Run
Sn1per's discover and recon modes chain together nmap, Amass, Subfinder, Sublist3r, crt.sh, and Shodan into one deduplicated target list. Read directly from the Community Edition source, with a real correction from root-verified testing.
-
Sn1per Deep Dive Part 3: Web Mode, Sc0pe, and the Vulnerability Scoring Engine
Sn1per's sc0pe engine is a directory of tiny declarative bash templates, each matching one header or one string, rolled up into a single per-host risk score. Read from the real source, with two real bugs confirmed by later root-verified testing.
-
Sn1per Deep Dive Part 4: Workspaces, Reporting, and the Professional 2026 Architecture
What Sn1per Professional 2026 adds over the free Community Edition, documented from the vendor's own release notes since the Pro engine isn't in the public source tree.
-
Sn1per Deep Dive Part 5: What an Automated Sweep Looks Like From the Blue Team's Side
Sn1per's default scan modes fire real, unconditional exploit attempts against old CVEs the instant a banner matches. That's expensive for an attacker to hide and cheap for a defender to detect, and root-verified testing found a genuine defensive win too.
-
Sn1per Deep Dive Part 6: A Full Sweep Against Northbridge Freight
Applying Sn1per's real recon-to-exploit logic, mode by mode, against a small local lab, then handing off to Impacket and Pivoting and Tunneling for the part the automation can't do.
-
SDWSCS Part 2: The SDWAN Security Model & Unified Security Policy
Module 1 of the SDWSCS syllabus: why DIA changed the threat model, the four security deployment patterns, what actually runs on a Catalyst edge (zone-based firewall vs the UTD container), and the unified security policy framework that ties it together.
-
Container Networking Deep Dive Part 1: From Namespaces to a Container Network by Hand
Before Docker automates any of it, build a container network by hand: two network namespaces, a veth pair each, a Linux bridge, and one iptables NAT rule. Everything Docker does later is this, generated for you.
-
Container Networking Deep Dive Part 10: A Full Walkthrough, Chasing a Cross-Node Connectivity Bug
A checkout service scales out, starts failing calls to a payment gateway on a different node, and the failure turns out to be two separate problems stacked on top of each other. A start-to-finish walkthrough using every technique from this series.
-
Container Networking Deep Dive Part 2: Docker's Default Bridge Model, Unpacked
Install Docker and run the same two-container topology from Part 1 with docker run instead of ip netns. Then read the actual iptables rules and docker0 bridge Docker generated, line for line, against the ones written by hand.
-
Container Networking Deep Dive Part 3: Docker Network Drivers Compared
bridge, host, macvlan, ipvlan, and none are not five ways to do the same thing. Each one trades away a specific piece of isolation, performance, or addressing flexibility. A driver-by-driver comparison with the actual tradeoff each makes.
-
Container Networking Deep Dive Part 4: Multi-Host Overlay Networking and the VXLAN Underneath It
A Docker Swarm overlay network makes containers on different hosts look like they share a bridge. VXLAN encapsulation is how, and it costs 50 bytes of every packet's MTU budget, the same overhead this series already covered from the tunneling side.
-
Container Networking Deep Dive Part 5: What CNI Actually Is
Kubernetes doesn't use Docker's networking model. It defines a plugin interface instead, CNI, with a lifecycle of exactly two verbs. Why one-IP-per-pod forced that split, and what a CNI plugin actually does when a pod starts.
-
Container Networking Deep Dive Part 6: CNI Plugins Compared, Flannel, Calico, and Cilium
Three CNI plugins solve the same ADD-verb reachability problem three different ways: VXLAN encapsulation, BGP-distributed routes, and an eBPF datapath. The architecture and datapath differences, not a feature-checklist bake-off.
-
Container Networking Deep Dive Part 7: eBPF-Native Networking and the End of kube-proxy
kube-proxy's default iptables mode chain-walks a rule per backend, per packet. Cilium's kube-proxy replacement skips that entirely, at the socket layer, before a packet is even built. What kube-proxy actually does, and what changes when eBPF replaces it.
-
Container Networking Deep Dive Part 8: Network Policy Enforcement Compared, iptables vs eBPF
The same Kubernetes NetworkPolicy resource gets enforced completely differently depending on the CNI plugin underneath it. Calico's default path turns it into iptables rule chains; Cilium turns it into eBPF map lookups keyed on pod identity. Same intent, different mechanism, different failure modes.
-
Container Networking Deep Dive Part 9: Troubleshooting Container Networking
A vendor-neutral methodology for the five failure modes that account for most container networking outages: conntrack exhaustion, VXLAN MTU fragmentation, DNS-in-pod failures, cross-node connectivity breaks, and tcpdump inside a network namespace.
-
OSPF on Linux Part 1: A Brief History of Routing on Linux
The first post in a companion series to OSPF Deep Dive: how Linux went from a kernel that could route packets but not speak a routing protocol, through GNU Zebra and Quagga, to FRRouting. History first, because the config in Part 3 makes more sense once you know why it looks the way it does.
-
OSPF on Linux Part 2: Why FRRouting Is the Defacto Choice
The zebra/protocol-daemon/vtysh architecture from the inside, FRR against its one real remaining competitor, BIRD, and why FRR's Cisco-shaped CLI is a genuine advantage for this specific series rather than a cosmetic one.
-
OSPF on Linux Part 3: Installing and Configuring OSPF with FRR
Getting FRR onto a Linux box for real: the package, the users it creates without asking, the daemon on/off switch in /etc/frr/daemons, and the first router ospf block in vtysh. Verified against a real install, not written from memory.
-
OSPF on Linux Part 4: Wiring LAB-LNX into the OSPF Deep Dive Lab
Adding a fourth router to CORE-CSR, BRANCH-FGT, and EDGE-MX: a Linux box running the FRR config from Part 3, walked from Down to Full against the neighbor state machine from OSPF Deep Dive Part 1, with an LSDB parity check across all four platforms.
-
OSPF on Linux Part 5: Troubleshooting OSPF on Linux
The closing post: OSPF Deep Dive Part 11's three-vendor show-command table extended to four with FRR's vtysh, then the failure modes that only exist on Linux, ip_forward, a firewall dropping protocol 89, multicast group membership, the wrong network namespace, veth MTU, and tcpdump on the wire.
-
SDWSCS Part 1: Course Overview & Study Roadmap
Kicking off a thirteen-part series on Cisco's SDWSCS syllabus — SDWAN security and cloud solutions. Part 1 explains what the course covers, how it extends ENSDWI, maps all thirteen modules and eleven labs to this series, and sets out a realistic study plan.
-
OSPF Deep Dive Part 1: Neighbor States, DR/BDR Election, and Network Types
The first post in a full OSPF series covering Cisco, FortiOS, and Junos: the hello protocol, the neighbor state machine, why DR/BDR election exists, and the network types that decide whether an election happens at all.
-
OSPF Deep Dive Part 10: A Vendor-Neutral Troubleshooting Methodology
A structured way to diagnose OSPF problems that works on any vendor, because it's built on the neighbor state machine from Part 1, not on any platform's specific commands: what state is it stuck at, and what does that state rule in or out.
-
OSPF Deep Dive Part 11: Show Commands and the LSDB, Side by Side
The same neighbor table, interface state, and LSDB, read through three different command sets: Cisco IOS/IOS-XE, FortiOS, and Junos, mapped side by side against the CORE-CSR/BRANCH-FGT/EDGE-MX lab from this series.
-
OSPF Deep Dive Part 12: A Multi-Vendor Outage, Start to Finish
A closing walkthrough on the CORE-CSR/BRANCH-FGT/EDGE-MX lab: a complaint with no down interfaces and no failed adjacencies anywhere, a red herring that turns out to be real but irrelevant, and a root cause that traces straight back to Part 3's reference-bandwidth warning.
-
OSPF Deep Dive Part 2: LSA Types and the Area Type Hierarchy
What actually travels in the LSDB: the seven LSA types that matter in practice, and how stub, totally stubby, NSSA, and totally NSSA areas each filter a different subset of them.
-
OSPF Deep Dive Part 3: The SPF Algorithm, Cost, and Route Selection
How a full LSDB actually becomes a routing table: Dijkstra's algorithm, the reference-bandwidth cost trap every vendor shares, and why intra-area, inter-area, and external routes are preferred in that exact order regardless of cost.
-
OSPF Deep Dive Part 4: Virtual Links, Summarization, and Redistribution
Fixing the lab's missing backbone connection with a virtual link, then summarizing at the ABR and redistributing a static route at the NSSA's ASBR, with working syntax on Cisco, FortiOS, and Junos for each.
-
OSPF Deep Dive Part 5: OSPFv3 and Running OSPF Over IPv6
OSPFv3 isn't OSPFv2 with bigger addresses. It separates topology from addressing, drops built-in authentication in favor of IPsec, and runs over link-local addresses by default, plus the per-vendor syntax to bring it up on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 6: Authentication and Security Hardening
What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 7: Cisco IOS/IOS-XE Implementation and Gotchas
CORE-CSR's actual configuration: process ID scope, the network-statement vs interface-based config split, the passive-interface-default trap, and why raising reference-bandwidth only ever warns once, locally, at configuration time.
-
OSPF Deep Dive Part 8: FortiOS Implementation and Gotchas
BRANCH-FGT's configuration: why FortiOS has no passive-interface-default equivalent, how OSPF scopes to a VDOM, the router-id selection rule that actually differs from Cisco's, and how OSPF interacts with SD-WAN policy routes.
-
OSPF Deep Dive Part 9: Junos Implementation and Gotchas
EDGE-MX's configuration: why Junos never adds an interface to OSPF by accident, the policy-based redistribution model, and the one default that catches Cisco and FortiOS engineers off guard, OSPF outranking eBGP by default.
-
ENSDWI Part 12: Management, Operations, and Exam Day
Blueprint domain 6.0 — vManage AAA, monitoring and alarms, REST API monitoring, and software image management — then a revision strategy for the whole blueprint and what to expect on exam day. Series finale.
-
Contrail SD-WAN Deep Dive Part 1: Contrail Service Orchestration and the SRX/NFX CPE Model
Before Session Smart Routing, Juniper's enterprise SD-WAN ran on Contrail Service Orchestration — an SDN/NFV control plane repurposed for site connectivity, provisioning SRX firewalls and NFX universal CPE. This post walks the architecture as it actually shipped.
-
Contrail SD-WAN Deep Dive Part 2: E-Hub, P-Hub, and the Anatomy of a Hub-and-Spoke Overlay
Contrail's hub-and-spoke model ran on two hub roles — the customer-owned enterprise hub and the multi-tenant provider hub. Routing, VRF segmentation, and traffic-flow mechanics of both, and why the model got heavy at scale.
-
Contrail SD-WAN Deep Dive Part 3: Why Contrail Lost the Enterprise, and the Pivot to Session Smart
Closing the Contrail arc: a straight comparison against Viptela, VeloCloud, and CloudGenix, what CSO's architecture cost it competitively, and the specific rationale Juniper gave for retiring it in favour of Session Smart Routing.
-
From Contrail to Session Smart: A History of Juniper's SD-WAN Journey
Juniper has shipped two structurally different SD-WAN products under one brand: Contrail Service Orchestration, born out of an SDN/NFV controller, and Session Smart Routing, born out of a 2014 session-border-controller team's bet that tunnels were the wrong abstraction. This is how one became the other.
-
Juniper Session Smart SD-WAN Deep Dive Part 1: 128 Technology and the Tunnel-Free Premise
Session Smart Routing didn't start as a Juniper project — it started as a session border controller team's bet that SD-WAN's entire tunnel-based premise was solving the wrong problem. This post covers 128 Technology's origin and the architectural break it made.
-
Juniper Session Smart SD-WAN Deep Dive Part 2: Secure Vector Routing — Tenants, Services, and Session Metadata
How Secure Vector Routing actually forwards a session: the tenant/service data model, the metadata the ingress router stamps on the first packet, and why that's enough to route symmetrically without a tunnel.
-
Juniper Session Smart SD-WAN Deep Dive Part 3: Session Smart Conductor, Mist, and the Two Control Planes
Session Smart Routers can be managed by an on-premises Conductor or by the Mist cloud. What each control plane actually does, how the multitenant policy model gets distributed, and how to choose between them.
-
Juniper Session Smart SD-WAN Deep Dive Part 4: WAN Assurance, Marvis, and AI-Native Operations
What "AI-native WAN" concretely means on the Mist side of Juniper's SD-WAN stack: WAN Assurance's telemetry model, Marvis's self-driving remediation, and where the AI layer actually earns its keep versus where it's a dashboard feature.
-
Juniper Session Smart SD-WAN Deep Dive Part 5: Zero Trust by Default — the SSR Security Model
Because SVR classifies every session against a tenant and a service before forwarding a single packet, deny-by-default segmentation is a property of the routing engine itself. What that buys, what it doesn't, and how SRX fills the gap.
-
Juniper Session Smart SD-WAN Deep Dive Part 6: Cloud Onramp and Multicloud
Extending Secure Vector Routing into AWS and Azure: virtual SSR instances, cloud regions treated as ordinary sites in the tenant/service model, and how that compares to the tunnel-based cloud onramp patterns already covered on this site.
-
Juniper Session Smart SD-WAN Deep Dive Part 7: The MPLS Cutover Playbook
A practical staged cutover from legacy MPLS to Session Smart Routing — overlay-first coexistence, tenant/service modelling before a single circuit changes, and why SVR's tunnel-free design changes the risk profile of the cutover weekend itself.
-
Juniper Session Smart SD-WAN Deep Dive Part 8: Failure Modes, Scale Limits, and a Five-Way Vendor Comparison
Series finale. What happens to the data plane when Conductor or Mist goes dark, where SSR's scale story sits, and Session Smart Routing lined up against Fortinet, Cisco/Viptela, Arista/VeloCloud, and Palo Alto/Prisma — five philosophies, one underlying question.
-
Palo Alto Prisma SDWAN Deep Dive Part 1: From CloudGenix to App-Defined SASE
Starting an eight-part deep dive into Palo Alto Prisma SDWAN — the fourth control-plane philosophy this site has covered, after Fortinet, Arista/VeloCloud, and Cisco/Viptela. Part 1 covers the CloudGenix lineage, the 2020 acquisition, and what 'app-defined' actually means before we touch a single ION device.
-
Palo Alto Prisma SDWAN Deep Dive Part 2: ION, Strata Cloud Manager, and the Planes
The ION device line from 1000 to 9000, physical and virtual, and Strata Cloud Manager — the cloud-only console that absorbed the old CloudGenix Portal. Part 2 maps Prisma SDWAN onto the planes framework this site has used for Fortinet, Arista, and Cisco, and explains why there's no controller box to rack.
-
Palo Alto Prisma SDWAN Deep Dive Part 3: AppFabric and Path Selection Without a Routing Protocol
How AppFabric actually builds its full-mesh Secure Fabric Links, why circuit categories and labels stand in for TLOCs, and how per-flow path selection works when there's no routing protocol advertising a route in the first place. The mechanics behind Part 1's philosophical claim.
-
Palo Alto Prisma SDWAN Deep Dive Part 4: The Data Plane — App-ID, Adaptive QoS, and Control vs Analytics Mode
What App-ID actually classifies at the packet level, how Adaptive QoS measures real circuit capacity instead of trusting a configured bandwidth number, and the practical operational differences between an ION in Control mode and one still in Analytics.
-
Palo Alto Prisma SDWAN Deep Dive Part 5: Security — Prisma Access, Clean Pipe, and CloudBlades
What the ION's local Zone-Based Firewall actually covers, where the line to Prisma Access gets drawn, and how CloudBlades chains in Zscaler, Netskope, and AWS Transit Gateway without touching the branch device. This is the post where 'app-defined SASE' from Part 1 stops being a tagline.
-
Palo Alto Prisma SDWAN Deep Dive Part 6: Cloud Onramp and Multicloud
Prisma SDWAN treats a VPC or VNet as just another data centre: a pair of virtual IONs joins the fabric, and a CloudBlade automates the cloud-native plumbing around them — Transit VNETs and vWAN Hub association on Azure, Transit Gateway attachment on AWS. How that compares to Cisco's and Fortinet's cloud onramp designs already on this site.
-
Palo Alto Prisma SDWAN Deep Dive Part 7: The MPLS Cutover Playbook
A per-site MPLS-to-Prisma-SDWAN migration playbook built around the Analytics-to-Control progression from Part 3: zero-touch bootstrap, a genuinely evidence-based baseline before anything changes behaviour, a bounded rollback window per site, and a decommission sequence that doesn't ask anyone to trust the fabric on day one.
-
Palo Alto Prisma SDWAN Deep Dive Part 8: Failure Modes, Scale Limits, and a Vendor Comparison Checklist
Series finale. What actually happens when Strata Cloud Manager goes dark, where Prisma SDWAN's scale limits sit, and an honest, direct comparison against Fortinet's collapsed model and Cisco's fully decoupled one — the fourth philosophy, lined up against the three already covered on this site.
-
ENSDWI Part 11: QoS and Application Quality of Experience
Blueprint 5.4 and 5.5: the WAN Edge QoS pipeline — classification, marking, policing, shaping, scheduling, queuing — plus per-tunnel and adaptive QoS, then App-QoE: TCP optimization, DRE, packet duplication, FEC, and AppNav.
-
ENSDWI Part 10: Security — Service Insertion, Embedded, and Cloud-Delivered
Blueprint 5.1–5.3: service insertion with OMP service routes, the embedded security stack — app-aware firewall, Snort IPS, URL filtering, AMP, SSL/TLS proxy, TrustSec — and cloud security integration with Umbrella DNS and SIG tunnels.
-
AI Pentest Agents Part 1: From Assistant to Autonomous Swarm
A new wave of AI pentesting agents landed in the space of two weeks in July 2026. This opens a series on what they actually do, how they differ from each other, and how they differ from the raw LLM-plus-nmap-plus-Metasploit approach this site already tried in AI Part 7.
-
AI Pentest Agents Part 2: Inside PentestCode's Coordinator and Engagement State
A close read of PentestCode's actual README: the strategist-coordinator design, the thirteen agents, the engagement-state graph with Dijkstra/Yen's K-shortest attack paths, the eighteen mandatory tools, and the honest limitations section the project ships with itself.
-
AI Pentest Agents Part 3: PentestGPT and the Academic Case for Reasoning, Generation, Parsing
PentestGPT is the oldest project in this series by a wide margin — a USENIX Security 2024 paper before it was a product. What its three-module design got right early, what changed in its 2026 agentic rewrite, and what its own published benchmark numbers actually say.
-
AI Pentest Agents Part 4: PentAGI and the Cost of Docker Root
PentAGI takes the opposite infrastructure bet from PentestCode: full Docker sandboxing instead of a root-free binary, which buys real isolation at the cost of a docker.sock privilege model worth understanding before you install it.
-
AI Pentest Agents Part 5: NodeZero, XBOW, and What Production-Safe Actually Means
NodeZero and XBOW aren't developer tools you install — they're commercial platforms with real production track records, real customers, and a review-before-submission discipline the open-source entrants in this series don't have to answer to.
-
AI Pentest Agents Part 6: Fingerprinting the Swarm, a Defender's Read on Agent Noise
PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?
-
AI Pentest Agents Part 7: Installing PentestCode, and Where the Sandbox Runs Out of Road
The sandbox verified PentestCode's root-free install claim, then ran out of road on an LLM credential. The real run happened on the Proxmox lab: three independent root vectors on Metasploitable2, $9.64, and a critic agent that caught a real technical error.
-
AI Pentest Agents Part 8: Does the Human Pentester Still Have a Job
Closing out the series: what changes for a working pentester when tools like this exist, why every project in this series still insists on a human in the loop somewhere, and how this question echoes the one this site already asked about Ansible.
-
Building a Home Lab Honeypot: Watching What Actually Knocks on Your Door
A ~50-line Python TCP honeypot, tested live in a sandbox with real logged connection attempts, deployable on Herald behind an nftables DNAT rule — what a low-interaction canary actually catches and why that's worth more than it sounds.
-
DNS Tunneling and Covert C2: iodine, dnscat2, and Catching It on the Wire
DNS is the one protocol almost every egress policy leaves wide open. iodine's real --help output and dnscat2's documented client/server model show why — plus the query-entropy and NXDOMAIN signals that actually catch it, tied back into the CONTOSO.LOCAL pivoting lab.
-
Living Off the Land: certutil, mshta, rundll32, and Bitsadmin as Attacker Primitives
The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.
-
CVE-2026-56155 and CVE-2026-20833: Why Patch Tuesday Keeps Rediscovering the Impacket Series
July 2026's record Patch Tuesday shipped a Kerberoasting CVE and an AD FS key-theft zero-day that map almost exactly onto techniques from the Impacket Deep Dive series. Real transcripts from that series, held up against four CVEs, to show why the same trust-chain weaknesses keep resurfacing.
-
ENSDWI Part 9: Data Policies, Segmentation, App-Aware Routing, and DIA
Blueprint 4.2–4.5: centralized data policy at the edge, VPN segmentation and per-VPN topologies, application-aware routing with SLA classes and BFD measurements, and direct Internet access with NAT fallback.
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.
-
Password Cracking and Wordlist Engineering Part 2: Hashcat Fundamentals and the GPU Economics of Cracking
Verified against a real hashcat v6.2.6 install and a published RTX 4090 benchmark run: the actual attack-mode syntax, the real mode numbers for NTLM, Kerberoast, and AS-REP, and what it genuinely costs — in dollars, not hand-waving — to exhaust a keyspace against each one.
-
Password Cracking and Wordlist Engineering Part 3: John the Ripper, Core vs Jumbo, and When to Reach for It
apt install john does not give you a tool that can crack a Kerberoast hash — verified firsthand, not assumed. The distinction between core John the Ripper and the Jumbo community fork, and the cases where JtR earns a place next to hashcat rather than duplicating it.
-
Password Cracking and Wordlist Engineering Part 4: Building Wordlists That Actually Work
rockyou.txt is fourteen million real, breached passwords from 2009 — and it's the wrong tool the moment a target has any pattern to its passwords at all. Verified cewl and crunch syntax for building wordlists that actually match how a specific organization names things.
-
Password Cracking and Wordlist Engineering Part 5: The Rule Engine, best64, and Writing Your Own Mutations
B4ckup$SQL2024 isn't in any wordlist — it's a wordlist entry plus a predictable transform. Walking hashcat's real, bundled best64.rule line by line, what its 102 rules actually do, and writing a custom rule for the one leetspeak substitution best64 doesn't cover.
-
Password Cracking and Wordlist Engineering Part 6: Mask and Hybrid Attacks, and the Keyspace Math Behind Them
No wordlist, no rules — masks build candidates character-position by character-position, and a 40,824-line "compliant password" mask set bundled with hashcat covers realistic complexity-policy shapes 65,000 times more efficiently than blind brute force. The keyspace math for why.
-
Password Cracking and Wordlist Engineering Part 7: Cracking CONTOSO.LOCAL End to End
Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.
-
Password Cracking and Wordlist Engineering Part 8: The Defensive Mirror — Passphrases, KDFs, and Why Rotation Policies Miss the Point
Seven parts of offense, closing with the defense that actually follows from it: why bcrypt/scrypt/Argon2 cost tuning matters more than complexity rules, what NIST SP 800-63B Revision 4 actually changed about rotation, and what specifically would have stopped both CONTOSO.LOCAL cracks.
-
Pivoting and Tunneling Part 1: Why Pivoting Is Just Routing With Extra Steps
Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.
-
Pivoting and Tunneling Part 2: Chisel and the HTTP Tunnel That Looks Like Nothing
Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.
-
Pivoting and Tunneling Part 3: ligolo-ng and Tunneling Without Proxychains
ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.
-
Pivoting and Tunneling Part 4: What Tunneling Does to Your Packets — MTU, Fragmentation, and PMTUD Inside a Tunnel
Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.
-
Pivoting and Tunneling Part 5: Double Pivots, Multi-Hop Chains, and Catching Them From the Wire
Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.
-
ENSDWI Part 8: Control Policies
Blueprint 4.1: the centralized policy framework, how control policy is evaluated at vSmart, match/action anatomy, and the canonical topologies — hub-and-spoke, regional mesh, and TLOC preference steering — built entirely by filtering routing information.
-
ENSDWI Part 7: OMP, TLOCs, Routing Protocols, Multicast, and Config Groups
Blueprint 3.3–3.7: configuring OMP and TLOCs, service-side OSPF/BGP/EIGRP and VRRP with their loop-prevention markers, multicast over the overlay, and the configuration-group/feature-profile model that v1.2 added to the exam.
-
Impacket Deep Dive Part 1: Why Real Red Teams Skip the Metasploit Tutorials
Every beginner tutorial teaches Nmap, Hydra, and a Metasploit one-liner. Nobody assessing a real Windows domain works that way — they live in Impacket. Part 1: what it actually is, the lab this series runs against, and a verified tour of the toolkit.
-
Impacket Deep Dive Part 10: Defense in Depth and Detection
Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.
-
Impacket Deep Dive Part 2: Domain Recon Without a Single Exploit
Before any password is cracked or any exploit fires, a Windows domain will hand an unauthenticated or low-privilege connection its entire user list, computer list, and RID space. Part 2: GetADUsers, lookupsid, rpcdump, and samrdump — and how to stop them talking.
-
Impacket Deep Dive Part 3: AS-REP Roasting with GetNPUsers.py
One unset checkbox — Kerberos pre-authentication — turns a domain account into a crackable hash that any authenticated, or sometimes any unauthenticated, client can request. Part 3: GetNPUsers.py, what AS-REP roasting actually exploits, and how to close it.
-
Impacket Deep Dive Part 4: Kerberoasting with GetUserSPNs
Any authenticated domain user can request a service ticket for any account with a registered SPN, and that ticket is encrypted with the service account's own password hash. Part 4: GetUserSPNs, why pre-auth doesn't save you here, and the gMSA fix.
-
Impacket Deep Dive Part 5: ntlmrelayx and the Passwordless Hijack
ntlmrelayx.py never cracks a password. It intercepts an NTLM authentication attempt already in flight and replays it, live, to a second target — turning a coerced login into administrative access before the victim's own request even completes.
-
Impacket Deep Dive Part 6: The Ghost Shells — wmiexec, smbexec, and atexec
Four Impacket scripts get you a remote shell on a Windows host, and they all abuse a different legitimate management protocol to do it. Part 6: wmiexec, smbexec, atexec, and dcomexec compared against classic PsExec, and why one of them is dramatically quieter than the rest.
-
Impacket Deep Dive Part 7: secretsdump.py, SAM, LSA, and DCSync
One shell on one member server is a foothold. secretsdump.py is what turns it into the entire domain's password material — local SAM hashes, cached domain logons, LSA secrets, and, if the account is right, every credential in Active Directory via DCSync.
-
Impacket Deep Dive Part 8: Forging Tickets with ticketer.py
With the krbtgt hash from Part 7 in hand, an attacker doesn't need any account's password ever again. ticketer.py forges Kerberos tickets outright — Golden Tickets for full-domain impersonation, Silver Tickets for a single quiet service, both bypassing the domain controller entirely.
-
Impacket Deep Dive Part 9: The Full Chain, Foothold to Domain Admin
Eight posts, eight tools, one domain. Part 9 runs CONTOSO.LOCAL's compromise start to finish, in the order a real intrusion actually uses these techniques — one phished workstation to a persistent, forged Domain Admin ticket.
-
Netcat: The Swiss Army Knife of TCP/IP, A Deep Dive
Netcat's origins and the OpenBSD/GNU fork split, core socket mechanics, file transfer and port scanning, bind vs reverse shells (with the mkfifo workaround for -e-less builds), and HTTP banner grabbers, mock servers, and relays — with firewall-testing use cases throughout.
-
The Hidden Kali Linux Shield: How Firejail Sandboxes Dangerous Exploits Without the VM Overhead
Firejail wraps any process in Linux namespaces, seccomp-bpf, and capability drops in milliseconds — no VM spin-up. How it actually isolates a process, real GitHub-PoC and exploit-testing workflows, and the root-user gotcha that quietly guts it on Kali.
-
ENSDWI Part 6: WAN Edge Deployment — ZTP, Bootstrap, and TLOC Extension
Blueprint 3.1 and 3.2: onboarding edges with ZTP, PnP, and bootstrap; data-centre and regional-hub designs; circuit termination and TLOC extension; dynamic tunnels; and how the underlay and overlay exchange routes.
-
Ansible Deep Dive Part 1: What Ansible Is, and Why Agentless Still Wins
Kicking off a thirteen-part Ansible series. Part 1 covers what Ansible actually is, the push-based agentless model and why it still matters against Chef/Puppet/Salt, the control node/managed node mental model, installing Ansible, and your first ad-hoc command against a real inventory.
-
Ansible Deep Dive Part 10 Lab: Automating a Cisco and FortiGate Fleet With Ansible
Part 10, the second lab: network-specific Ansible modules against a mixed Cisco IOS and FortiGate fleet — cisco.ios facts and config, fortinet.fortios firewall policy objects, connection: network_cli vs httpapi, and a config-drift check playbook.
-
Ansible Deep Dive Part 11: Error Handling in Anger — Blocks, Rescue, and Partial Failures
Part 11: block/rescue/always for structured error handling, ignore_errors vs failed_when vs ignore_unreachable, max_fail_percentage and any_errors_fatal, and retries/until for polling a service until it's actually ready.
-
Ansible Deep Dive Part 12: Best Practices — the Style Guide I Actually Follow
Part 12: the Ansible conventions worth treating as non-negotiable — naming, idempotency discipline, directory layout, secrets, tagging restraint, testing gates, and the failure modes that show up once a project outlives its author's memory of writing it.
-
Ansible Deep Dive Part 13: Does Ansible Still Matter in an MCP/AI World?
Part 13, the closing piece: if an AI agent can SSH in and fix things itself, do playbooks, idempotency, and config management still matter? A case for yes — argued through the same MCP server that writes this very site.
-
Ansible Deep Dive Part 2: Inventory — Static, Dynamic, and Everything In Between
Part 2 of the Ansible series: INI vs YAML inventory, groups and nested groups, host_vars/group_vars, patterns and limits, and moving to dynamic inventory plugins (AWS, and a network-specific example) once static files stop scaling.
-
Ansible Deep Dive Part 3: Playbooks, Tasks, and the Idempotency Contract
Part 3: plays and tasks, modules vs shell/command, the idempotency contract that makes Ansible safe to re-run, handlers and notify, check mode and diff mode, and tags for selectively running part of a playbook.
-
Ansible Deep Dive Part 4: Variables, Facts, and Jinja2 Templating
Part 4: where variables come from, gathering and using facts, the Jinja2 syntax underneath when/template/filters, common filters worth knowing, and building real config templates for both servers and network devices.
-
Ansible Deep Dive Part 5: Roles and Ansible Galaxy — Structuring Projects That Scale
Part 5: the standard role directory layout, defaults vs vars, role dependencies, ansible-galaxy for installing community roles and collections, and requirements.yml for pinning what a project depends on.
-
Ansible Deep Dive Part 6: Variable Precedence and Ansible Vault — Secrets Done Right
Part 6: the full variable precedence ladder from role defaults to extra-vars, then Ansible Vault end to end — encrypting whole files and single strings, vault IDs for multiple secret tiers, and keeping vault passwords out of the repo entirely.
-
Ansible Deep Dive Part 7: ansible.cfg, Performance, and Scaling to Hundreds of Hosts
Part 7: the ansible.cfg precedence and the settings that actually matter, forks and the linear/free strategies, SSH pipelining and ControlPersist, fact caching, and Mitogen as the option to know about even if you don't reach for it.
-
Ansible Deep Dive Part 8: Testing Ansible — Molecule, ansible-lint, and CI Pipelines
Part 8: ansible-lint and its rule categories, Molecule for spinning up disposable Docker/VM targets and asserting real state with Testinfra, idempotency testing (running a role twice and asserting nothing changed the second time), and wiring it all into GitHub Actions.
-
Ansible Deep Dive Part 9 Lab: Zero to Production — a Three-Tier Web App From Bare Metal
Part 9, the first lab: a role-based playbook standing up a load balancer, two app servers, and PostgreSQL from bare Ubuntu boxes — vault-protected credentials, templated HAProxy/env config, notify chains, and a rolling deploy with serial.
-
ENSDWI Part 5: Certificates, Device Lists, and Control-Plane Troubleshooting
Blueprint 2.3 and 2.4: the certificate trust model end to end — root CA options, controller CSRs, the WAN Edge authorized serial list — then the systematic control-connection troubleshooting flow behind most ENSDWI exhibit questions.
-
ENSDWI Part 4: Controller Deployment — Cloud, On-Prem, Scale, and Redundancy
Blueprint 2.1 and 2.2: Cisco-hosted vs on-premises controllers, hosting platform requirements, installing the vManage/vBond/vSmart trio, and the scalability and redundancy rules — clustering, affinity, and how many of each you actually need.
-
ENSDWI Part 3: Edge Platforms and Cloud OnRamp
Finishing blueprint domain 1.0: the cEdge and vEdge platform families and how to pick between them, then all four Cloud OnRamp variants — SaaS, IaaS, Colocation, and Multicloud/Interconnect — at the depth the exam actually tests.
-
ENSDWI Part 2: Architecture — Planes, Components, and Multi-Region Fabric
Blueprint domain 1.1: the four planes and their components, OMP's three route types, TLOCs, IPsec vs GRE encapsulation, BFD's dual role, and Multi-Region Fabric — the v1.2 addition that older study material misses entirely.
-
ENSDWI Part 1: Exam Syllabus & Study Roadmap
Kicking off a twelve-part study series for the Cisco 300-415 ENSDWI exam. Part 1 breaks down the v1.2 blueprint domain by domain, maps every topic to a part of this series, and covers exam logistics, lab options, and how to study for a 90-minute concentration exam.
-
Cisco Catalyst SDWAN Deep Dive Part 1: Components, Controllers, and the Four Planes
Starting a ten-part deep dive into Cisco Catalyst SDWAN. Part 1 covers the Viptela lineage, the four controller planes (vManage, vSmart, vBond, WAN Edge), the certificate trust model, and the control-connection bring-up sequence.
-
Cisco Catalyst SDWAN Deep Dive Part 10: Failure Modes, Scale Limits, and a Vendor Comparison
Part 10, the finale: what actually breaks (vBond, vSmart, vManage) and what doesn't when it does, vManage's documented scale ceiling, and a head-to-head of OMP/TLOC against Fortinet ADVPN, Arista DMPO, and VeloCloud.
-
Cisco Catalyst SDWAN Deep Dive Part 2: OMP, the Overlay Management Protocol
Part 2 of the Cisco Catalyst SDWAN series: what OMP actually carries between WAN Edge and vSmart — OMP routes, TLOC routes, and service routes — how best-path selection and multipath differ from BGP, and why the overlay/underlay split is the whole point.
-
Cisco Catalyst SDWAN Deep Dive Part 3: TLOCs, Color, and Centralized Policy
Part 3 of the Cisco Catalyst SDWAN series: what TLOC color actually constrains, how restrict/no-restrict shapes which tunnels can form, and how centralized control policy on vSmart turns that into enforced topology — full mesh, hub-and-spoke, or anything between.
-
Cisco Catalyst SDWAN Deep Dive Part 4: BFD, App-Route SLAs, and cEdge Forwarding
Part 4: how BFD over every data tunnel drives both fast failure detection and continuous SLA measurement, how app-route policy steers on that data, and where cEdge's IOS-XE forwarding pipeline diverges from legacy vEdge.
-
Cisco Catalyst SDWAN Deep Dive Part 5: Topology Walkthroughs — Dual Transport, DIA, and TLOC Extension
Part 5: VPN segmentation (transport vs. service VPNs), a worked dual-MPLS-plus-Internet branch design, direct internet access for local breakout, and TLOC extension for sites with no WAN circuit of their own.
-
Cisco Catalyst SDWAN Deep Dive Part 6: Cloud OnRamp for SaaS and IaaS
Part 6: how Cloud OnRamp for SaaS continuously measures per-app, per-transport path quality to pick the best local breakout, and how Cloud OnRamp for IaaS extends the fabric directly into AWS and Azure as cloud-resident sites.
-
Cisco Catalyst SDWAN Deep Dive Part 7: SIG, Secure Firewall, and Edge Security
Part 7: how DIA traffic gets inspected without a hub backhaul — Cisco Secure Internet Gateway integration, the on-box UTD container on cEdge, and how this converges with the broader SASE shift other vendors are making too.
-
Cisco Catalyst SDWAN Deep Dive Part 8: Automation — vManage API, Terraform, and Ansible
Part 8: why vManage's API-first design means automating Catalyst SDWAN looks nothing like CLI-scraping individual boxes, and where Terraform's declarative model and Ansible's procedural model each fit.
-
Cisco Catalyst SDWAN Deep Dive Part 9: The MPLS-to-SDWAN Cutover Playbook
Part 9: a phased, coexistence-based migration sequence from legacy MPLS to Catalyst SDWAN — pilot sites first, hubs last, explicit rollback triggers, and why ripping MPLS out in one weekend is the wrong instinct.
-
AI Part 8: Kali 2026.2's Nine New Tools, and the MCP Server With 150 More Behind It
Kali 2026.2 shipped nine new tools, one an AI CLI by default. I installed and ran every one I could in a rootless sandbox, then looked behind the curtain at a 17,000-line MCP server wrapping 150+ tools, and Kali's own local-LLM stack. No fabricated output.
-
AI Part 9: From Draft-Only to Whole-Site — the v2.4 Tool Surface and the Rails Behind It
Parts 7 and 8 went out to other people's tool servers. This one comes home. v2.4 turns my blog's MCP server from a draft-publishing surface into one that can read, grep, write, and illustrate the whole site — and the interesting part was never the tools. It was the guardrails.
-
SDWAN Control Plane Showdown: Three Philosophies for Solving the Same Problem
Fortinet collapses control onto the data-plane device. Arista/VeloCloud collocates it on a multi-tenant Gateway. Cisco/Viptela decouples it fully into vSmart and OMP. Three architectures covered on this site, lined up side by side, right before the Cisco series picks up the third one.
-
A Brief History of SDWAN Controllers: Viptela, VeloCloud, CloudGenix, and Why Cisco Runs Two SDWAN Stacks
Three startups solved SDWAN's control-plane problem within a year of each other. Two got bought by exactly the company you'd expect; one brand didn't survive. The acquisition history of Viptela, VeloCloud, and CloudGenix — and why Cisco still runs two unrelated SDWAN stacks today.
-
The Three Planes: Management, Control, and Data — and Why Every SDWAN Argument Comes Back to Them
A vendor-neutral primer on the management, control, and data planes — what each actually does, why management-vs-control is the distinction everyone blurs, and a three-question test you can run against any SDWAN platform regardless of vendor.
-
Cilium: Kubernetes Networking and Security Built on eBPF
Cilium replaces iptables-based kube-proxy and overlay CNIs with eBPF programs on the kernel datapath. Connects back to namespaces, veth pairs, nftables, and eBPF/XDP, then covers identity-based network policy and Hubble observability.
-
AI Part 7: When an LLM Gets Nmap and Metasploit as Tools
I wired an LLM into nmap and Metasploit against a deliberately vulnerable lab. The exploit worked — a real, server-verified root shell — but the sharper finding was the models themselves: a 7B fabricated its tool output wholesale, an 8B mangled its arguments, and only a 32B drove the tools honestly. No fabricated transcripts — the model's included.
-
Nmap and the Scripting Engine: A Network Engineer's Field Guide to NSE
Nmap's scan engine and NSE scripting framework are as useful for firewall change validation and inventory work as for security assessments. Covers scan types, timing, NSE categories, writing a custom script, and practical recipes for network engineers.
-
strncpy Is Finally Gone: What Linux 7.2-rc1 Means for Kernel Security
Linus opened the 7.2 merge window and tagged 7.2-rc1 — and with it, strncpy() is finally gone from the kernel tree. Six years, 362 commits, 70 contributors. Here's what the function actually did wrong, why it took so long to kill, and why removal beats deprecation.
-
Linux Network Namespaces: Isolated Network Stacks Without a Hypervisor
Network namespaces give a process its own interfaces, routing table, iptables rules, and sockets — completely isolated from the host. They underpin Docker, Kubernetes, and VPNs. This post covers how they work and how to use them hands-on.
-
nftables: The Modern Netfilter Framework Every Network Engineer Should Know
nftables replaced iptables as the default Linux firewall framework years ago, but most existing guides and scripts still assume iptables syntax. This post covers the nftables model properly — tables, chains, sets, maps — and how to think about it coming from an iptables or FortiGate policy background.
-
eBPF and bpftrace: Network Observability Without Touching the Packet Path
eBPF lets you attach tiny programs to kernel hooks — TCP state changes, socket events, XDP ingress — with zero packet-path overhead and no kernel modules. bpftrace makes it scriptable. This post covers both for network engineers.
-
Bash Patterns Every Network Engineer Should Know
Most network engineers write bash defensively, copying patterns from old scripts without understanding why they work. This post covers the patterns that actually matter — strict mode, parallel SSH fan-out, retry logic, and structured output — with an emphasis on what breaks when you skip them.
-
Deeper Than tcpdump: NIC Diagnostics with ethtool and Protocol Analysis with tshark
ethtool exposes the NIC hardware state that sits below anything tcpdump can see — link negotiation, ring buffers, offload settings, error counters. tshark adds full protocol decode on top of tcpdump's capture model. Together they cover the diagnostic gap between 'the cable is fine' and 'I can read every field in this packet.'
-
Linux VRFs: Route Isolation Without the Namespace Overhead
Linux VRFs give you FortiGate-VDOM-style routing table separation on a single network stack, without the full isolation (and overhead) of network namespaces. This post covers the l3mdev model, VRF creation, route leaking, and when VRFs are the right tool versus namespaces.
-
jq for Network Engineers: Parsing APIs, Routing Tables, and Structured Logs
jq is the missing piece between modern JSON-emitting tools — ip -j, ss -j, REST APIs — and the shell. This post covers the filter language properly: selection, mapping, construction, and the patterns that come up constantly when automating network infrastructure.
-
Replacing netstat with ss: A Network Engineer's Diagnostic Guide
ss is the modern replacement for netstat — faster, richer, and capable of exposing per-socket TCP internals that netstat never could. This post covers the filter syntax, TCP state analysis, and the diagnostics that matter when troubleshooting live connections.
-
Beyond ifconfig: The ip Command Reference Every Network Engineer Needs
The ip command from iproute2 replaced ifconfig and route over a decade ago, but most guides still treat it as a drop-in substitute. This post covers the full model — interfaces, addresses, routes, policy routing, ARP, and live monitoring — with practical examples aimed at network engineers.
-
Traffic Control Under the Hood: A Linux tc Deep Dive for Network Engineers
tc is the Linux traffic control subsystem behind netem, HTB shaping, and DSCP-aware queuing. This post explains the model properly — qdiscs, classes, filters — then builds a practical lab rig for testing SDWAN Performance SLA thresholds and QoS behaviour.
-
Python for Network Engineers — Part 1: Why Python in 2026, Environment Setup, and Your AI Pair Programmer
The first post in a 12-part series covering Python for network engineers from first principles to production automation. We cover why Python is still the right choice in 2026, how to set up a modern development environment, and how to use AI tools as a genuine pair programmer throughout your learning journey.
-
Python for Network Engineers — Part 10: NAPALM — Vendor-Agnostic Network Automation
Part 10 of the Python for Network Engineers series. NAPALM provides a vendor-agnostic Python interface to network devices — the same code collects state or replaces configuration on Arista, Cisco, Juniper, or Fortinet without modification. We cover getters, config replace, dry-run validation, and the config diff workflow.
-
Python for Network Engineers — Part 11: Nornir — Parallel Automation at Scale
Part 11 of the Python for Network Engineers series. Nornir is a pure-Python automation framework that runs tasks across an inventory in parallel. We cover YAML inventory, task functions, result handling, host/group filtering, and the Netmiko and NAPALM plugins — bringing together everything from the series into one coherent framework.
-
Python for Network Engineers — Part 12: AI-Assisted Network Automation
The final post in the Python for Network Engineers series. We look at how to put AI tools to work inside the automation workflows we've built — config review, fleet-wide AI-assisted parsing, a minimal MCP server that lets an AI agent call your automation scripts, and the discipline that keeps AI-assisted automation safe.
-
Python for Network Engineers — Part 2: Strings, Numbers, Files, Lists, and Tuples
Part 2 of the Python for Network Engineers series. We cover Python's core data types — strings, numbers, booleans, files, lists, and tuples — with every example drawn from real network engineering scenarios.
-
Python for Network Engineers — Part 3: Dictionaries, Sets, Comprehensions, and Exceptions
Part 3 of the Python for Network Engineers series. Dictionaries model device state. Sets expose VLAN drift between switches in one line. Comprehensions replace verbose loops. Exception handling keeps automation running when devices misbehave.
-
Python for Network Engineers — Part 4: Functions, Regular Expressions, and Modules
Part 4 of the Python for Network Engineers series. Functions make your automation reusable and testable. Regular expressions parse the CLI output that structured tools can't reach. Modules turn a script into a project.
-
Python for Network Engineers — Part 5: Netmiko — SSH Automation Across Vendors
Part 5 of the Python for Network Engineers series. We connect to real network devices over SSH using Netmiko, run show commands, push configuration, and build a multi-device inventory collector — with a Containerlab lab you can run at home.
-
Python for Network Engineers — Part 6: Parsing CLI Output — From Regex to AI
Part 6 of the Python for Network Engineers series. Raw CLI output is a string — not data. We cover TextFSM templates, the NTC-templates library, Genie parsers, and AI-assisted parsing for commands where no community template exists.
-
Python for Network Engineers — Part 7: YAML, JSON, and Validating Your Inventory with Pydantic
Part 7 of the Python for Network Engineers series. YAML for human-maintained inventory and config files. JSON for API responses and storing collected data. Pydantic to validate that what you read actually matches what you expect before it reaches your automation logic.
-
Python for Network Engineers — Part 8: Jinja2 — Generating Configs at Scale
Part 8 of the Python for Network Engineers series. Jinja2 turns structured data into device configuration. Variables, loops, conditionals, filters, macros, and template inheritance — with Arista, Cisco, and Fortinet examples throughout.
-
Python for Network Engineers — Part 9: REST APIs — The Modern Control Plane
Part 9 of the Python for Network Engineers series. Every modern network platform exposes a REST API. We cover the requests library, authentication patterns, pagination, error handling, and two real-world examples: Arista eAPI against our existing lab, and the FortiManager JSON-RPC API.
-
Chronos Keeps Time: Building an Enterprise-Grade NTP Service with chrony and Integrating it with FortiGate
Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.
-
One Box, Many Firewalls: A Practical Guide to FortiGate VDOMs
Virtual domains let a single FortiGate behave as several independent firewalls — separate routing tables, policies, and administrative boundaries on shared hardware. When that's the right tool, when a VRF is the better one, and how inter-VDOM routing actually moves a packet between them.
-
Watching the Fabric: FortiAnalyzer and FortiMonitor for SDWAN SLA Observability
The operational bookend to the SDWAN design series — how FortiAnalyzer and FortiMonitor turn the performance-SLA assumptions baked into your hub placement and resilience design into something you can actually alert on, trend, and defend with data months later.
-
The Cutover Playbook: Migrating from MPLS to SDWAN Without a Bad Weekend
A phased, dual-running migration plan for moving a branch off MPLS and onto SDWAN — route-map-based preference during transition, what to validate before each cutover step, and the rollback triggers that keep a bad change from becoming an outage.
-
IPsec Deep Dive Part 1: ESP, AH, and How IKE Phase 1 Actually Brings a Tunnel Up
IPsec underpins every Fortinet SDWAN overlay this blog has built, and it's never had its own deep dive. Part 1 fixes that: the SA model, ESP vs AH, tunnel vs transport, and a message-by-message walk through IKEv1 main mode, aggressive mode, and IKEv2.
-
IPsec Deep Dive Part 2: Phase 2, Child SAs, and the Anatomy of an ESP Packet
Phase 1 built a control channel and protected nothing. Part 2 covers the negotiation that actually moves data: quick mode and child SAs, traffic selectors, PFS, rekeying, and anti-replay — then dissects an ESP packet field by field, down to the MTU math.
-
IPsec Deep Dive Part 3: NAT vs IPsec — NAT-T, Port Forwarding, and the Fortinet SDWAN Reality
NAT breaks IPsec three distinct ways — AH's ICV, ESP's missing ports, and IKE's rewritten source port. Part 3 covers each break, how NAT-D detects it and NAT-T's UDP 4500 encapsulation repairs it, when port forwarding is still required, and what it all means for SDWAN spokes behind CPE NAT.
-
Policed, Not Just Routed: Traffic Shaping and QoS Internals on Fortinet SDWAN
Application-aware routing decides which path a flow takes. Shaping decides what happens to it once it's there — shaping profiles, per-IP and per-policy shapers, queue assignment, and how it all interacts with NP7 hardware offload.
-
NSE6 Part 1: Stream Overview, Exam Structure, and the Secure Networking Stack
What the NSE6 Secure Networking specialist stream covers, how the four product exam tracks fit together, and how FortiAuthenticator, FortiSwitch, FortiAP, and FortiNAC form a joined-up access-layer security story.
-
NSE6 Part 10: FortiAP Rogue Detection, Wireless IDS, Mesh, and Troubleshooting
WIDS rogue AP classification and containment, wireless IDS signature types, FortiAP mesh topology with root and leaf APs, OfficeExtender remote AP split-tunnel deployment, and the diagnostic commands and common failure patterns for the FCA-FAP exam troubleshooting section.
-
NSE6 Part 11: FortiNAC Architecture, Network Discovery, and Device Profiling
NAC concepts and where FortiNAC sits in the Security Fabric, Control and Application server roles, HA architecture, how FortiNAC discovers network devices via SNMP and SSH, passive and active endpoint discovery, and the fingerprinting methods that determine what type of device is on each port.
-
NSE6 Part 12: FortiNAC Access Policies, CoA, and VLAN Enforcement
The FortiNAC policy model — groups, access values, and network access policies — how RADIUS and CoA enforce VLAN assignment on FortiSwitch and third-party switches, logical networks for VLAN abstraction, and the end-to-end 802.1X enforcement flow from endpoint connect to VLAN assignment.
-
NSE6 Part 13: FortiNAC Endpoint Compliance, Agents, and Host Isolation
Persistent, dissolvable, and agentless posture assessment methods, compliance rules and remediation actions, quarantine VLAN and isolation workflow, guest self-registration and sponsor approval, BYOD certificate onboarding, and MDM integration with Intune, Jamf, and FortiClient EMS.
-
NSE6 Part 14: FortiNAC HA, Reporting, and End-to-End Troubleshooting
FortiNAC HA failover mechanics, MySQL replication, syslog/FAZ integration, alarm framework, built-in and custom reports, and a systematic troubleshooting guide for discovery failures, enforcement problems, and 802.1X issues — with a complete end-to-end trace of a new endpoint joining.
-
NSE6 Part 2: FortiAuthenticator Architecture and Local Authentication
FortiAuthenticator deployment modes, hardware vs VM sizing, initial setup, local user and group management, password policies, account lockout, and the admin interfaces you use to build out a working identity store before you plug in LDAP or RADIUS.
-
NSE6 Part 3: FortiAuthenticator RADIUS Service, LDAP Integration, and Remote Auth
How FortiAuthenticator acts as a RADIUS server for FortiGate, FortiSwitch, and other NAS devices; configuring realms and routing; integrating with Active Directory via LDAP; and the diagnostic commands that expose exactly where an authentication flow breaks.
-
NSE6 Part 4: FortiToken 2FA, Certificate Management, and the Self-Service Portal
Adding a second factor with FortiToken hardware and mobile tokens, certificate authority configuration and SCEP enrollment, and setting up the self-service portal for password reset, token activation, and guest account management with sponsor approval.
-
NSE6 Part 5: FortiSwitch Hardware, FortiLink Managed Mode, and Initial Provisioning
FortiSwitch hardware families and PoE considerations, how FortiLink turns a FortiGate into a wired switching controller, the discovery and authorisation process for bringing a switch under management, and firmware management from the FortiGate GUI.
-
NSE6 Part 6: FortiSwitch VLANs, RSTP, Link Aggregation, and Stacking Design
VLAN trunking and access port configuration under FortiLink, RSTP bridge priority and port roles, static and LACP link aggregation, MCLAG dual-homing for access-layer resilience, and QoS trust modes for DSCP/CoS remarking at the network edge.
-
NSE6 Part 7: FortiSwitch 802.1X, MAC Authentication Bypass, and Port Security
Port-level 802.1X authentication with FortiAuthenticator as the RADIUS backend, EAP method selection, dynamic VLAN assignment from RADIUS attributes, MAC Authentication Bypass for non-supplicant devices, sticky MAC port security, and CoA-triggered VLAN changes mid-session.
-
NSE6 Part 8: FortiAP Hardware, CAPWAP Discovery, and AP Provisioning
Wi-Fi 6 fundamentals and the key 802.11 standards, FortiAP hardware families and PoE requirements, how CAPWAP connects APs to the FortiGate wireless controller, the four AP discovery methods, WTP profile configuration, and the authorisation and firmware management workflow.
-
NSE6 Part 9: FortiAP SSIDs, Wireless Security Modes, and RF Management
SSID and VAP configuration options, every wireless security mode from Open to WPA3-Enterprise, dynamic VLAN assignment via RADIUS for wireless, captive portal integration with FortiAuthenticator, band steering, and the RF management tools that keep channels clean in dense deployments.
-
Zero Trust Meets the Overlay: Converging ZTNA and SDWAN on Fortinet
The capstone to the SDWAN series: how Fortinet's ZTNA tags and access proxy let you fold per-application, identity-aware access control directly into the SDWAN fabric — built on the RADIUS/TACACS AAA backend and the PKI you already stood up for IPsec.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 1: Get the Firmware Right First
Before a FortiGate and FortiSwitch will even talk to each other over FortiLink, both need to be on compatible, fully-patched firmware — and NTP/DNS need to be solid. Part 1 covers the upgrade plan we should have run before touching FortiLink at all.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 2: FortiLink, and Where We Actually Went Wrong
The FortiLink handshake looks trivial in the docs: cable it in, authorize, done. Ours didn't go that way. Part 2 walks the correct pairing process, then dissects exactly where — and why — our first attempt stalled, with the redo plan for when we factory-reset both boxes.
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 1 — The Architecture Decision
FortiManager-as-CA vs. a dedicated external CA for certificate-based IPsec on Fortinet SDWAN: the honest trade-offs, SCEP vs EST, CRL vs OCSP, certificate lifetime philosophy, and why "who is your CA" is the real question hiding inside "switch to certificates."
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 2 — Standing Up the PKI
Standing up a real PKI for Fortinet SDWAN IPsec: offline root, online issuing CA, a certificate role scoped to IPsec end entities, an EST front-end, CRL/OCSP placed where the chicken-and-egg overlay problem can't reach it, and FortiManager's much smaller supporting role.
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 3 — Enrollment, Automation, and the Cutover
Closing the series: solving EST's bootstrap-credential problem on purpose, monitoring certificate renewal at scale before it becomes an outage, and executing the PSK-to-certificate cutover — explicitly diffed against the FMG-as-CA migration path.
-
Cloud On-Ramp Part 1: The Architecture Decision and AWS Transit Gateway
Hub Placement Part 3 said the hub goes where the VPC is. This post answers the question that raises immediately: how does it actually get there? BGP-over-IPsec to AWS Transit Gateway, ASN selection, and mapping on-prem VRFs onto TGW route tables.
-
Cloud On-Ramp Part 2: Azure Virtual WAN and a Dual-Cloud Resilience Design
Azure Virtual WAN looks like AWS Transit Gateway from a distance — a managed hub that attachments plug into. Up close, the BGP mechanics, the route-propagation model, and the failure modes all differ in ways that decide whether a dual-cloud on-ramp actually survives a bad day.
-
Local Internet Breakout in Practice: SDWAN Zones, Rules, and a Multi-VRF Guest Wi-Fi Walkthrough
How SDWAN zones, members, and performance-SLA rules actually decide where a session breaks out — and a full walkthrough of giving Guest Wi-Fi its own VRF, its own zone, and a local internet path that never touches the corporate tunnel.
-
Fortinet SDWAN Hub Placement Part 1: The Traditional Model — Hubs in the DC
Why hubs traditionally sit in the DC, the job they actually do there, how they protect FMG/FAZ, and how BGP on loopback ties it together. Part 1 of a series that goes on to challenge the assumption that the hub belongs in the DC at all.
-
Fortinet SDWAN Hub Placement Part 2: The MSSP Shift — When the Hub Becomes Customer-Centric
What changes when one FMG/FAZ pair manages many customers through ADOMs: the hub stops being "the DC's hub" and becomes a per-customer design decision, with its own routing domain, AS plan, and placement logic.
-
Fortinet SDWAN Hub Placement Part 3: Cloud, SASE, and the Death of "The DC" as the Default
Closing out the hub-placement series: what changes about hub design when the destination is Azure, AWS, or GCP rather than a DC, and what changes again for customers migrating from a DC-centric WAN to a SASE-centric one.
-
From DSCP to Deep Packet Inspection: Why SDWAN Application-Aware Routing Killed Traditional QoS
A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.
-
The Packet Never Lies: Advanced tcpdump Recipes for the Enterprise Engineer
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
Why Deep Packet Inspection (DPI) Breaks Guest Wi-Fi (And How to Fix It on Fortinet FortiGate)
Full SSL Inspection looks like the obvious way to secure a guest or BYOD network on FortiGate — until certificate warnings, crashed apps, and "No Internet" errors flood the helpdesk. Here's why DPI breaks guest Wi-Fi, and the certificate-inspection-plus-ISDB architecture that actually works.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 1: System Health & Routing
Part 1 of a 3-part deep-dive CLI reference for the NSE 4 exam. Covers get system status, get system performance status, interface and NIC diagnostics, the routing table RIB vs FIB, ARP, and ping-options — with live output breakdowns and exam-pressure indicators for every command.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 2: Session Table & Packet Flow
Part 2 of 3 in the NSE 4 CLI reference series. Deep-dives into FortiOS session table internals — filtering, reading, and clearing sessions — then covers the packet sniffer verbosity levels 1–6 and the full debug flow chain with line-by-line breakdown of successful vs. dropped traces.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 3: VPN & HA
Part 3 of 3 in the NSE 4 CLI reference series. Covers IPsec VPN diagnostics (IKE gateway state, tunnel SAs, SPI counter discrepancies), SSL-VPN authentication traces, and HA cluster mechanics — election criteria, heartbeat state, and configuration synchronisation verification via checksum hashes.
-
How I Use Claude to Help Run This Blog (and Why You Should Try It)
I built a custom MCP server so Claude can write and deploy posts directly to this site. Here's how it works, and an honest look at where AI fits into my workflow.
-
VeloCloud SDWAN and Partner Gateways Part 1: MPLS-Only Site Architecture
A deep dive into how VeloCloud SDWAN connects MPLS-only branch sites via Partner Gateways — covering the NNI, underlay BGP peering, and why MPLS-only edges present a unique onboarding challenge.
-
VeloCloud SDWAN and Partner Gateways Part 2: Onboarding an MPLS-Only Edge
A step-by-step walkthrough of how an MPLS-only VeloCloud Edge activates using a temporary internet path injected into the MPLS VRF, what changes once the VCMP tunnels are up, and how the production routing state differs from the onboarding state.
-
VeloCloud SDWAN and Partner Gateways Part 3: Taming the Default Route at the NNI
Why a 0/0 leaking from the MPLS underlay into a VeloCloud Partner Gateway is dangerous, how to filter it at the NNI, and the VeloCloud best practice approach to default route handling — with BGP policy examples.
-
BGP Route Dampening Part 1: The Flapping Problem, Exponential Decay, and Cisco Configuration
A deep dive into how BGP route dampening works: the 1990s internet instability that created it, the exponential decay algorithm behind it, every Cisco parameter explained, and a full configuration and verification reference.
-
BGP Route Dampening Part 2: RFC 7454, BFD, and Where Dampening Still Belongs
Why the IETF now discourages global BGP route dampening, how Bidirectional Forwarding Detection interacts with it, what RFC 7454 actually says, and the specific modern scenarios where dampening remains the right answer.
-
RYA SRC Part 1 — GMDSS, Sea Areas, and Why the SRC Exists
An exam-grade walk through the Global Maritime Distress and Safety System — the four Sea Areas, the players that regulate it, and why a UK boater needs an SRC to legally key the PTT.
-
RYA SRC Part 10 — How to Pass the SRC Exam: Structure, Timing, and Day-of
A practical guide to actually passing the SRC — eligibility documents, the £76 fee, what's in the written paper and the practical assessment, a two-week study plan, the common gotchas the examiner watches for, and what to do on the day.
-
RYA SRC Part 11 — Practice Exam: 50 Questions (Paper A and Paper B)
Two 25-question practice papers covering the full RYA SRC syllabus — multi-choice and short-answer, with full worked explanations in the answer key. Sit each paper timed (45 minutes), mark honestly, revise the misses.
-
RYA SRC Part 2 — VHF Channels, Frequencies, and Propagation
The VHF marine band channel-by-channel — what CH16, CH70, CH13, CH67, CH80 and the M channels are for, why CH70 is sacred, how to estimate range from antenna heights, and the simplex/duplex distinctions that come up in the exam.
-
RYA SRC Part 3 — The VHF Set: Controls, Antennas, and Power
Front-panel by front-panel — squelch, hi/lo power, dual-watch, the DSC distress button under the flap, why antenna height matters more than antenna gain on a sailboat, and the battery routines that keep a handheld working when you actually need it.
-
RYA SRC Part 4 — DSC and MMSI: How the Radio Calls Other Radios
Digital Selective Calling unpacked — the four call priorities, the four call types, the nine-digit MMSI structure and what each prefix means, the nature-of-distress menu options, and what happens if a small craft tries to acknowledge a distress alert in Sea Area A1 (don't).
-
RYA SRC Part 5 — Distress: DSC Alerts, MAYDAY, and MAYDAY RELAY
The full distress procedure end to end — pressing the DSC button, the voice MAYDAY format you'll be examined on, who controls distress traffic, what SEELONCE MAYDAY and SEELONCE FEENEE mean, and when to send a MAYDAY RELAY for someone else.
-
RYA SRC Part 6 — Urgency, Safety, and Routine Voice Procedure
PAN-PAN, SECURITE, and the routine voice procedure — when to use which, the radio-medical call, the IMO Standard Marine Communication Phrases, the NATO phonetic alphabet, prowords, and what to do with an unanswered or garbled call.
-
RYA SRC Part 7 — EPIRBs, SARTs, and NAVTEX
The rest of GMDSS that the SRC syllabus covers — 406 MHz Cospas-Sarsat EPIRBs and how to register them, the difference between AIS-SART and Radar-SART, PLBs and MOB beacons, and the NAVTEX message format including which letter codes you can never reject.
-
RYA SRC Part 8 — Protecting Distress Frequencies: False Alerts, Testing, and Guard Bands
The rules that keep the distress system credible — what's protected on CH16 and CH70, why CH15, 17, 75 and 76 are low-power guard bands, how to test a DSC set without launching a lifeboat, and the exact procedure for cancelling a false distress alert.
-
RYA SRC Part 9 — Regulations: Licences, Watchkeeping, and Who Makes the Rules
The regulatory layer of the SRC syllabus — ITU, CEPT, Ofcom, MCA and what each does; the operator licences (SRC, ROC, LRC, GOC) and the station licences (Ship Radio Licence vs Ship Portable Radio Licence); watchkeeping obligations, record keeping, secrecy, and the prohibited transmissions list.
-
Fortinet SDWAN Jinja Orchestrator — Part 1: The Two Template Engines
Part 1 of three. FortiManager hosts two distinct template engines — classic CLI templates and Jinja CLI templates — and they aren't interchangeable. Thesis: Jinja for shape-varying network plumbing, CLI templates for shape-fixed system config, and a real deployment uses both.
-
Fortinet SDWAN Jinja Orchestrator — Part 2: Anatomy and Patterns
Part 2 of three. We open Fortinet's sdwan-advpn-reference repo and read it end-to-end: the dynamic-bgp-on-lo directory, the four reference Project Templates, the inventory contract that feeds them, and the three Jinja patterns the templates lean on heaviest — loops, ipaddr derivation, and imports.
-
Fortinet SDWAN Jinja Orchestrator — Part 3: PSK to Cert With FMG as CA
Part 3 of three. We take the single-hub PSK example from the reference repo and migrate it to certificate-based IPSec, with FortiManager as the CA. FMG CA setup, per-device enrolment, Project Template flag flip, what changes in the rendered config and what doesn't.
-
Arista (VMware) SDWAN Deep Dive — Part 1: Components, Gateways, and the Three Planes
First post in a five-part deep dive on Arista (VMware) SDWAN. We start with the components — Edges, Cloud Gateways, Partner Gateways, Orchestrator, Controller — and the three planes that bind them. Sets up a UK ISP scenario that the rest of the series will pick apart.
-
Arista (VMware) SDWAN Deep Dive — Part 2: Routing — Overlay, Underlay, BGP, and the Gateway as Route Reflector
Part 2 of five. How prefixes get into the overlay, how the Gateway redistributes them, the three Cloud VPN modes, BGP at the Edge and the Partner Gateway, and the route-selection logic that decides which underlay a flow ends up on.
-
Arista (VMware) SDWAN Deep Dive — Part 3: The Data Plane — VCMP, DMPO, and Per-Flow Steering
Part 3 of five. Wire-level look at VCMP encapsulation, the DMPO measurement loop, Business Policy and per-flow steering, and the on-path remediation (FEC, duplication, jitter buffer) that lets the overlay tolerate underlays that misbehave.
-
Arista (VMware) SDWAN Deep Dive — Part 4: Topology Walkthroughs — MPLS-only meets Internet-only Across Continents
Part 4 of five. The GlobalCo packet-flow walkthroughs — Newcastle to HQ, Bristol to HQ, Chicago to a UK Cloud Gateway (why it fails), and the headline: MPLS-only Chicago talking to Internet-only Shanghai via a Partner Gateway, hop by hop.
-
Arista (VMware) SDWAN Deep Dive — Part 5: Best Practice, Failure Modes, and a Design Checklist
Part 5 of five. Gateway design rules, Partner Gateway sizing, segmentation, security service insertion, MTU, the failure modes that catch teams the first time, and a one-page design checklist for an Arista (VMware) SDWAN rollout.
-
Finding the Hop That's Eating Your Packets: pmtud-sweeper
A per-hop Path-MTU sweeper that binary-searches the largest DF-set packet each hop will pass, then names the router that's clamping your tunnel. ICMP, UDP, TCP-SYN, end-to-end TCP MSS — pick the probe your network actually lets through.
-
Who Sent That RST? Forensic Classification of TCP Resets with rst-forensics
A pure-Python classifier that takes a TCP RST and tells you whether the server, a mid-path firewall, or the client actually sent it. Six independent scorers — TTL, IP-ID, window, options, sequence, and timing — vote on the origin so the verdict is reproducible instead of tribal.
-
Diffing FortiGate configs the way an admin reads them — fgt-config-diff
A small Python tool that parses FortiGate configs into a tree, aligns nodes by section path and edit key, and reports what was added, removed, or modified — in the language of policies and objects, not unified-diff line numbers. CLI plus a Flask web UI.
-
spectre-meltdown-checker: Auditing CPU Vulnerability Mitigations on Linux
A deep dive into spectre-meltdown-checker — how it actually works under the hood, what it tells you that /sys/devices/system/cpu/vulnerabilities does not, the alternative tools (lscpu, vendor microcode checkers, in-tree kernel reporting), and when to reach for each one on a production Linux box.
-
SDWAN Resilience Part 1: Design and Assumptions
A multi-part deep dive into building a resilient Fortinet SDWAN on a real, slightly unfashionable topology — HA FortiManager, dual hubs in active/standby, no DCI, and an independent DCE. Part 1 lays out the topology, the AS plan, and challenges the design choices up front.
-
SDWAN Resilience Part 2: BGP on Loopback
Why we peer BGP on loopbacks instead of tunnel-interface IPs, the FortiOS dynamic-IPsec config that makes it work, the spoke-side reciprocal config, and why hub-to-hub iBGP is the wrong answer in a no-DCI active/standby topology.
-
SDWAN Resilience Part 3: DC to DCE Routing — Static, OSPF, and BGP
The hub FortiGate has to glue the spoke overlay to the data-centre environment that hosts the services. Static, OSPF, and eBGP each work — but only two of them fail correctly when the DCE peering goes down on one DC and not the other.
-
SDWAN Resilience Part 4: BFD and Convergence Tuning
Default BGP timers detect failure in three minutes. That's unacceptable for active/standby SDWAN. This post is the timer-math: DPD vs BFD on tunnels, BFD-for-BGP, holdtime ratios, the Graceful Restart trade-off, and what convergence numbers each combination actually delivers.
-
SDWAN Resilience Part 5: Performance SLAs and Service Steering
BGP and BFD catch every failure that takes a tunnel or session with it. They don't catch the failure where everything looks healthy at the network layer but the application is gone. That's the gap SDWAN Performance SLAs fill — and the place where careful health-check design earns its keep.
-
SDWAN Resilience Part 6: Building It Right — Full DCI and Dual-Active ADVPN
The first five parts defended a topology with real constraints. This final post is the version without those constraints — Fortinet's reference design: full DCI, dual-active ADVPN, iBGP between hubs, symmetric routing, ECMP across both paths. The full shebang.
-
Designing an Arista SDWAN Spoke with Enhanced HA, Dual DIA, and OSPF
Building a resilient Arista (formerly VeloCloud) SDWAN spoke: two Edges in Enhanced HA, two DIA circuits wired the optimal way, a multi-VLAN LAN, OSPF for route exchange, and the caveats that bite in practice.
-
Generating a Constant Stream of Web Traffic with Python
A small, polite Python script that round-robins through ten popular public sites at a configurable rate — useful for homelab traffic, exercising a proxy, or learning the requests library. Walks through the full code, the safety rails, and how to run it under tmux.
-
Adding Vendor Route-Table Parsers to route-compare, and Why the Work Lives on a Branch
A follow-up on the route-compare tool: I taught it to read raw show ip route, get router info routing-table all, show route, and show routing route output directly — no Excel cleanup step. The work lives on a branch rather than on main, and this is why.
-
A Day in the Life of a Packet on a 50G FortiGate, Part 1: Ingress, NP7, and the Fast Path
Where the packet is born on a 50G FortiGate. From the wire and DMA, through the NP7 SoC's session cache, IPSA, NTurbo, and the moment a packet either flies through hardware or crosses the bridge into the kernel slow path.
-
A Day in the Life of a Packet on a 50G FortiGate, Part 2: Stateful Inspection, Session Lookup, and Anti-Spoofing
The packet has been punted from the NP7 to the kernel. Now FortiOS does the things ASICs cannot: IP integrity, DoS sensors, RPF, session table lookup, helpers, and the state machine that decides whether this is a brand new flow or one we already know.
-
A Day in the Life of a Packet on a 50G FortiGate, Part 3: Routing, Policy Routes, and SDWAN Service Rules
The packet has a session entry and now needs to know where to go. FortiOS resolves that in a strict order: policy routes, then SDWAN service rules, then the FIB. Each layer has its own logic, its own match criteria, and its own diagnostic surface.
-
A Day in the Life of a Packet on a 50G FortiGate, Part 4: Firewall Policy, NAT, and Security Profiles
Routing told the packet where it's going. Firewall policy decides whether it's allowed, NAT rewrites it, and security profiles inspect it. Inside the iprope chain, central NAT vs policy NAT, VIPs, IP pools, and the flow-vs-proxy UTM pipeline.
-
A Day in the Life of a Packet on a 50G FortiGate, Part 5: Egress, NPU Offload, and the Full Troubleshooting Cookbook
The packet is decided. Now it has to actually leave. Egress shaping, NPU offload re-evaluation, IPsec encap, ARP, transmit. Then a single-page reference of every diagnose, get, and show command from across this series.
-
Comparing Route Tables Between Two Sources: A Small Python Tool for Audits and Migrations
A self-contained Python utility that takes two Excel route lists, normalises every prefix through ipaddress, finds exact matches and overlaps, preserves invalid entries for audit, and writes a colour-coded Excel report plus CSVs. Includes install guide and full source.
-
Configuring RADIUS Admin Auth on FortiGate SDWAN: RBAC and Three User Profiles (Part 2 of 2)
Part 2 of 2 on RADIUS for FortiGate SDWAN. Walks through the FortiOS config end-to-end — RADIUS server entry, group-to-profile mapping via VSA, three worked RBAC examples (senior engineer, NOC operator, compliance auditor), and the verification commands you'll need.
-
NSE5 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a 10-part study series for the Fortinet NSE 5 / FCP FortiManager Administrator certification. Covers the exam logistics, the official curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE5 Part 10: Advanced Features and Integrations
Part 10 — the final post in the NSE5 study series. Covers the advanced features that make FortiManager more than a config pusher: FortiGuard distribution, scripting, the JSON-RPC API, SSO, and FortiAnalyzer integration.
-
NSE5 Part 2: Initial Configuration and System Settings
Part 2 of the NSE5 study series — covers the day-one FortiManager configuration: network, admin access, system time, DNS, FortiGuard, OFTP, the on-disk file structure, and the diagnostic commands worth memorising before anything else.
-
NSE5 Part 3: High Availability
Part 3 of the NSE5 study series — covers the FortiManager HA cluster: primary and secondary roles, the sync mechanics, monitor IPs, manual vs automatic failover, and what to do when the cluster splits.
-
NSE5 Part 4: Administrative Domains (ADOMs)
Part 4 of the NSE5 study series — covers Administrative Domains: normal vs advanced ADOMs, version locking, ADOM modes, RBAC scope, and the per-ADOM revision history that underpins the rest of the FortiManager workflow.
-
NSE5 Part 5: Device Registration and Provisioning
Part 5 of the NSE5 study series — covers device registration: the FGFM tunnel, manual vs automatic registration, model devices, zero-touch provisioning, and the install operations that turn a registered device into a managed device.
-
NSE5 Part 6: Device-Level Configuration and Templates
Part 6 of the NSE5 study series — covers the FortiManager template engine: provisioning templates, CLI templates, SDWAN, IPsec, and certificate templates, and how they compose into a single per-device install.
-
NSE5 Part 7: Policy and Objects
Part 7 of the NSE5 study series — covers ADOM-level policy management: policy packages, the object database, dynamic objects, install previews, install logs, and the cleanup workflows that keep the database lean.
-
NSE5 Part 8: Workflow, Workspace Mode and Revision Control
Part 8 of the NSE5 study series — covers workspace mode and the workflow approval engine: ADOM locking, read/write sessions, the workflow state machine, and how to recover an ADOM that two admins are fighting over.
-
NSE5 Part 9: Diagnostics and Troubleshooting
Part 9 of the NSE5 study series — covers the FortiManager diagnostic toolbox: device-manager diagnostics, the FGFM tunnel, install-failure forensics, oftpd, packet capture, and the debug commands worth knowing under exam pressure.
-
RADIUS vs TACACS+ on FortiGate SDWAN: Choosing the Right AAA Backend (Part 1 of 2)
Part 1 of 2 on RADIUS for FortiGate SDWAN. Covers the protocol differences vs TACACS+, the RADIUS server options worth knowing (NPS, FortiAuthenticator, FreeRADIUS, ISE, Okta, Duo, Entra), and when each protocol is the right call for FortiOS.
-
Resilient DNS at Home: Building an HA Pi-hole Pair on Raspberry Pi
A complete walkthrough for installing Pi-hole on a Raspberry Pi running current Raspbian, then turning a single box into a highly available pair using keepalived and Orbital Sync — with the config examples and show commands you'll actually use.
-
Building a FortiManager Lab on Proxmox — Part 1: Lab Goals, Compute Sizing and Proxmox Host Preparation
Part 1 of a five-part series on building a FortiManager lab on Proxmox. Covers lab goals, compute sizing for FMG and FGT VMs, host prerequisites, and a clean Proxmox 8.x baseline before the qcow2 build in Part 2.
-
Building a FortiManager Lab on Proxmox — Part 2: Obtaining the Image, qcow2 Conversion and First Boot
Part 2 of the FortiManager-on-Proxmox series. Walks through obtaining the KVM image from the Fortinet portal, validating the qcow2 files, building the VM shell with the right machine type and SCSI controller, importing both disks, and first-boot verification.
-
Building a FortiManager Lab on Proxmox — Part 3: Proxmox Networking, Linux Bridges, VLAN-Aware Bridges and SDN for the Lab
Part 3 of the FortiManager-on-Proxmox series. Designs the four-segment lab network, compares Linux bridges, VLAN-aware bridges and Proxmox SDN, walks through the /etc/network/interfaces shape, and explains why the lab bridges should never have an IP on the host.
-
Building a FortiManager Lab on Proxmox — Part 4: A Lab Edge FortiGate VM in Front of FortiManager
Part 4 of the FortiManager-on-Proxmox series. Builds a FortiGate-VM as the lab edge in front of FortiManager, with four NICs mapped to the lab bridges, a scoped policy set, FortiGuard pinhole, local-in policy hardening, and the deny-with-log rule that proves the boundary works.
-
Building a FortiManager Lab on Proxmox — Part 5: Registering Managed FortiGates, ADOMs and Policy Package Installs
Part 5 of the FortiManager-on-Proxmox series. Builds two managed FortiGate VMs, registers them via FGFM through the lab edge, splits them across two ADOMs, deploys a shared policy package with FMG, exercises revision history and rollback, and turns the lab into a snapshotted training platform.
-
FortiOS 7.6.6 SDWAN: VRF1 Transport and Loopback Design
A refined VRF reference design for FortiOS 7.6.6 — transport in VRF 1, separate transport and management loopbacks, complete management-plane pinning, and NPU-VLINK guidance for inter-VRF acceleration.
-
MP-BGP and VRFs on FortiGate SDWAN
A practical reference design using MP-BGP (VPNv4) and VRFs on FortiOS to keep management (VRF20), customer SDWAN (VRF30), and Guest Wi-Fi DIA (VRF99) isolated end-to-end. Includes config, traffic flows, and the gotchas that bite people in production.
-
AI Part 1: Why I Gave Claude Write Access to My Site
A year ago I would have called this irresponsible. Today an MCP server lets Claude write to my site. The trust model isn't "I trust the model" — it's "I trust the blast radius".
-
AI Part 2: The Minimum Viable MCP Server
A personal MCP server is a tiny HTTP service. The spec accommodates a lot of complexity that, if you're the only user, you can stop building. Here's the inventory of what I have running, and what I deliberately left out.
-
AI Part 3: Designing Tools for an LLM, Not for Yourself
The verb in the tool name is the most important part. Descriptions answer the questions a chooser asks, not the questions a maintainer asks. Allowlists fail closed; blocklists fail open. Error messages are also instructions.
-
AI Part 4: Safety Rails — Allowlists, Atomic Writes, Audit Logs, Rollback
About two hundred lines of code, none of them clever, all of them the reason I sleep fine with the service running. Allowlists, atomic writes, an audit log, and a manual rollback path.
-
AI Part 5: Prompt-Driven Authoring in Practice
What's it actually like to use? The honest answer, including where the loop is tight, where it's still clumsy, and the three things I'd warn anyone trying this.
-
AI Part 6: Connector Quirks, Cache Traps, and What I'd Do Differently
Six months in. The cache layer you don't see, OAuth refresh edge cases, and the short list of decisions I'd make differently if I were doing this again from scratch.
-
Building a Polished CLI Tool with Click and Rich: Packaging Network Automation for Other Humans
Turn a working network-automation script into a tool your colleagues will use — moving from argparse to Click, formatted output with Rich, environment-loaded secrets, and pip-installable packaging.
-
iptables to nftables: Migrating Production Firewalls Without Downtime
A working engineer's guide to moving from iptables to nftables on production Linux firewalls — the mental model shift, where iptables-translate misleads you, atomic ruleset swaps, and a clean rollback strategy that means a bad migration costs you seconds, not your weekend.
-
Linux Networking from the Ground Up: Network Namespaces, veth Pairs, and Building a Multi-Router Lab on One Host
Build a real multi-router BGP and OSPF lab on a single Linux box using network namespaces, veth pairs, and FRRouting — no VMs, no containers, no GNS3. A practical walk-through of the primitives that GNS3, Docker, and Kubernetes are quietly using under the hood.
-
NAPALM vs Netmiko: Vendor-Agnostic Config vs Raw CLI, and When You Want Both
A practical comparison of NAPALM and Netmiko for network automation — where Netmiko's raw CLI access is the right answer, where NAPALM's compare/replace/rollback abstraction earns its keep, and the hybrid pattern that most production tooling actually settles on.
-
Netmiko in Practice: From a Show-Command Script to a Repeatable Audit Tool
A working network engineer's guide to Netmiko — starting from a small repo of mine that runs show commands across a JSON inventory, and extending it into something you can use as a real audit tool with structured output, concurrency, secure credentials, and a sane dry-run for config changes.
-
Network Emulation with NETEM: Simulating Latency, Loss, Jitter, and Bandwidth Constraints for Realistic Lab Testing
A practical guide to using Linux's NETEM qdisc to bend networks to your will — adding latency, loss, jitter, duplication, reordering, and bandwidth caps so you can test how applications and protocols actually behave when the network is anything other than perfect.
-
Nornir for Network Engineers: Running Automation Across an Inventory at Scale
A practical introduction to Nornir for engineers whose Netmiko script has grown too big — inventory plugins, structured tasks, parallelism, filtering by site or role, and integrating Netmiko, NAPALM, and pyATS as connection plugins. The framework you reach for once one box has become a hundred.
-
Parsing show Command Output: TextFSM, Genie, and TTP for Structured Data
A practical comparison of the three main ways to turn Cisco show output into structured Python data — TextFSM with NTC Templates, Genie/pyATS, and TTP — with worked examples and rules of thumb for picking the right one.
-
Route Leaking Between VRFs on Cisco IOS: From BGP First Principles to Advanced Manipulation
A practical end-to-end walkthrough of route leaking between VRFs on Cisco IOS — starting with the BGP and VRF fundamentals you need to actually understand what's happening, the static and MP-BGP options for the leak itself, and the route-map machinery that lets you control exactly what crosses.
-
SSH Hardening Beyond the Basics: Certificate Authorities, Bastion Patterns, and Session Auditing
A production-grade SSH setup that goes beyond disabling password auth — running your own SSH CA with short-lived user and host certificates, ProxyJump bastions, ForceCommand restrictions, and recording sessions with tlog and auditd.
-
tcpdump Deep Dive: BPF Filters, Capture Rotation, and Cross-Mapping to FortiGate's diagnose sniffer packet
A practical, command-heavy guide to getting real value out of tcpdump — precise BPF filters, production-grade ring-buffer captures, and a side-by-side mapping to FortiGate's diagnose sniffer packet so you can switch between the two without losing your place.
-
NSE4 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a study series for the Fortinet NSE 4 / FCP FortiGate Administrator certification. Covers exam logistics, the official 16-lesson curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE4 Part 10: High Availability
Part 10 — the final post in the NSE4 study series. Covers FGCP, active-passive vs active-active, heartbeat and monitor interfaces, session synchronisation, failover behaviour, and the diagnostic output you'll be asked to interpret.
-
NSE4 Part 2: Initial Configuration & the Security Fabric
Part 2 of the NSE4 study series — covers the day-one FortiGate configuration (interfaces, operation modes, admin access, DHCP, FortiGuard) and how the Security Fabric stitches multiple FortiGates and Fortinet products together.
-
NSE4 Part 3: Firewall Policies & NAT
Part 3 of the NSE4 study series — firewall policy structure, lookup order, NGFW modes, central vs policy NAT, source NAT pools, virtual IPs, and the session helpers behind protocol fixups.
-
NSE4 Part 4: Authentication, FSSO & Certificates
Part 4 of the NSE4 study series — local and remote authentication (LDAP, RADIUS), captive portal, Fortinet Single Sign-On (FSSO) modes, and certificate operations including SSL deep inspection.
-
NSE4 Part 5: Logging, Monitoring & Diagnostics
Part 5 of the NSE4 study series — log categories and severity, local vs remote storage, FortiAnalyzer and syslog forwarding, threat weight scoring, and the diagnostic commands you actually reach for under pressure.
-
NSE4 Part 6: Security Profiles — Web, App Control, AV, IPS, DoS
Part 6 of the NSE4 study series — the five security profiles you attach to firewall policies: web filter, application control, antivirus, intrusion prevention, and denial-of-service.
-
NSE4 Part 7: SSL VPN
Part 7 of the NSE4 study series — SSL VPN modes (web, tunnel, full), portals, realms, MFA, split tunnelling and the diagnostic commands for tracking down a stuck client.
-
NSE4 Part 8: IPsec VPN
Part 8 of the NSE4 study series — IKEv1 vs IKEv2, route-based vs policy-based, site-to-site and dial-up, NAT traversal, dead peer detection, and the two diagnostic commands that separate a Phase 1 problem from a Phase 2 problem.
-
NSE4 Part 9: Routing & SDWAN
Part 9 of the NSE4 study series — static and policy routing, distance vs priority, RPF, OSPF and BGP basics, and how SDWAN turns a pile of WAN links into a single steered zone with performance SLAs.
-
Route Leaking Between VRFs on FortiGate: Why It's Trickier Than You Think
VRF route leaking is a daily reality in any multi-tenant or shared-services network design. On FortiGate it's harder to find — and harder to get right — than the equivalent on Cisco or Juniper. Here's how to do it, why it's easy to miss, and the practical pitfalls.