Tagged: Networking
122 posts · browse all tags
-
FortiGate BGP Cookbook Part 1: Dual-ISP Edge Recipes
Six FortiGate BGP recipes for a dual-homed internet edge: stop being a transit AS, accept only a default route, steer traffic in both directions, advertise a prefix with no connected route, originate a default, and authenticate the session with TCP-AO.
-
Metasploit Deep Dive Part 4: Meterpreter's TLV Wire Protocol, From Real Protocol Source
What actually goes over the wire once a meterpreter session is established: the packet header, the TLV encoding scheme, and how AES got layered on top of a protocol that started out XOR-obfuscated.
-
Metasploit Deep Dive Part 5: Transports Compared
reverse_tcp, reverse_https, bind_tcp, and the less obvious handlers the real framework ships, including two built specifically for pivoting through AWS rather than a raw socket.
-
No CVE Required: The Ted Backdoor Hiding Inside Your Own HAProxy Build
Rapid7 found a Linux implant compiled into HAProxy's own binary. No CVE, no patch, a recompiled build reports the same version string as a clean one. The mechanism, and why file integrity monitoring, not network visibility, is what would catch it.
-
Same Day, Two Advisories: Cisco's Nexus 9000 Root RCE and the IOS XR Hardening Bundle
Cisco's September 2 disclosures: an unauthenticated root RCE on ten Nexus 9000 models via two unrestricted TCP ports, and a seven-CVE IOS XR hardening bundle with no workaround anywhere in the product line. Plus why that second detail matters more than any CVSS score.
-
Same Job, Different Shell Part 1: Reachability and Continuous Monitoring
ping and Test-Connection do the same job, but which PowerShell version you're on changes both the syntax and, in one tested case, what the tool actually reports. Part 1 of a series pairing Windows and Linux networking commands, with a real PS 5.1 vs 7.6 discrepancy found along the way.
-
Same Job, Different Shell Part 10: Packet Capture
tcpdump against pktmon: when rule tables and connection state stop answering the question, packet capture does. A real captured TCP handshake and a real captured DNS query/response pair, on both platforms.
-
Same Job, Different Shell Part 11: The Complete Cheat Sheet
Every command pair from this series, reachability through packet capture, in one table, plus which PowerShell cmdlets actually change behavior between versions and which don't. The closing part of the Windows/Linux networking command comparison series.
-
Same Job, Different Shell Part 2: Path Tracing
traceroute and tracert answer "which hops did this take", but the protocol each one probes with matters more than people realize. A real sandbox test where the same destination gave two different route pictures depending on whether the probe was UDP or TCP.
-
Same Job, Different Shell Part 3: Interface and IP Configuration
ip addr, ifconfig, ipconfig, Get-NetIPAddress, Get-NetAdapter: five commands that all answer "what's my address", none of which return quite the same shape of answer. Part 3 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 4: Routing Tables
ip route, route -n, route print, Get-NetRoute: reading a routing table is the same question on both platforms, why is this packet going that way, but Windows answers it with a metric that Linux's route table doesn't expose the same way at all.
-
Same Job, Different Shell Part 5: DNS Lookups and Resolution
dig, nslookup, and resolvectl against Resolve-DnsName and ipconfig /displaydns, with real query output captured live against both authoritative-adjacent and recursive resolvers, plus the caching layer most people forget to check first.
-
Same Job, Different Shell Part 6: Active Connections and Sockets
ss, netstat, and Get-NetTCPConnection all answer "what's connected to what right now", but only one platform ties a connection straight back to a process name without a second lookup. Part 6 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 7: ARP and Neighbor Tables
ip neigh, arp -a, and Get-NetNeighbor read the same table: which MAC address answers for which IP on your local subnet. Windows names the entry states more precisely than Linux does, and Part 7 maps them directly against each other.
-
Same Job, Different Shell Part 8: Port and Service Testing
nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.
-
Same Job, Different Shell Part 9: Firewall Status, Read-Only
iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.
-
Five Minutes and an Empty Port Part 10: The Closing Checklist and a Vendor Comparison
Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.
-
Five Minutes and an Empty Port Part 7: Port Security and the Layer 2 Hygiene Most Networks Already Own
The defensive turn starts at the layer that would have stopped Part 6's persistent dropbox outright: port security, DHCP snooping, Dynamic ARP Inspection, and the rest of the Layer 2 hygiene most switches can already do without buying anything new.
-
Five Minutes and an Empty Port Part 8: 802.1X, MAB, and the NAC Platforms Behind the Curtain
Port security answers whether a device is the one already learned on a port. 802.1X and the NAC platforms behind it answer the harder question: whether this specific identity, on this specific device, should be on the network at all.
-
Five Minutes and an Empty Port Part 9: MAC Filtering, USB Device Control, and Wireless IDS
Closing the defensive arc: MAC OUI and vendor filtering with an honest look at how easily it's defeated, OS-level USB device control for the HID vector Part 3 was built around, and wireless IDS for the one attack in this series MAC randomization never touched.
-
BGP Deep Dive Part 1: The Application That Runs Between Autonomous Systems
The first post in a deep dive into BGP. Why EGP failed, the two napkins that became RFC 1105, and the distinction that took a bad Halabi read and a good Doyle read to finally land: an IGP finds the best path inside a network you own, BGP negotiates policy between networks you don't.
-
BGP Deep Dive Part 10: Multiprotocol BGP, or How One Session Learned to Carry Everything
RFC 4760 turned BGP from an IPv4-unicast-only protocol into a generic reachability-advertisement transport. Here's how AFI/SAFI, MP_REACH_NLRI, and one session carrying multiple address families actually works.
-
BGP Deep Dive Part 11: Convergence, Stability, and Scale
Route flap dampening, graceful restart, BFD, and ADD-PATH: four mechanisms that shape how fast, how stable, and how scalable a BGP deployment actually is.
-
BGP Deep Dive Part 12: Security, or Why BGP Trusts You Until Proven Otherwise
BGP was built on trust between operators, not cryptographic proof. Real hijack incidents, RPKI/ROV, BGPsec, and MANRS: what actually protects the internet's routing today.
-
BGP Deep Dive Part 2: The Session, From TCP SYN to Established
Part 2 of the BGP Deep Dive: TCP port 179 and why BGP needed a transport layer at all, the full six-state finite state machine from Idle to Established, what the OPEN message actually negotiates, and the hold timer, keepalive, and session-security mechanics underneath it.
-
BGP Deep Dive Part 3: The UPDATE Message and the Attribute Catalog That Is BGP's Actual Policy Engine
Part 3 of the BGP Deep Dive: the UPDATE message's real structure, RFC 4271's four categories of path attribute, and a walk through ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, and AGGREGATOR, including the classic unreachable-next-hop gotcha.
-
BGP Deep Dive Part 4: The Best Path Algorithm, Step by Step
Part 4 of the BGP Deep Dive: the full best path selection algorithm that consumes every attribute from Part 3, walked step by step from Cisco-proprietary Weight down to the final router-ID tiebreak, including why hot-potato routing is baked into step 8, not a separate design choice.
-
BGP Deep Dive Part 5: eBGP and iBGP Are Not the Same Protocol Wearing One Name
Part 5 of the BGP Deep Dive: why AS_PATH loop prevention does nothing inside an AS, the iBGP split-horizon rule that actually prevents internal loops, and why that one rule is the direct, mechanical reason full-mesh iBGP exists at all.
-
BGP Deep Dive Part 6: Route Reflectors and Confederations, Two Ways to Break the Full Mesh
Part 6 of the BGP Deep Dive: RFC 4456 route reflection and RFC 5065 confederations, the two sanctioned ways to relax iBGP's full-mesh requirement from Part 5 without giving up its loop safety, plus the path-hiding tradeoff route reflection quietly introduces.
-
BGP Deep Dive Part 7: Communities, BGP's General-Purpose Signaling Channel
Part 7 of the BGP Deep Dive: standard communities from RFC 1997, extended and large communities that fixed their real limitations, the three well-known values every implementation understands, and why the whole mechanism only works because two networks agree on what a number means.
-
BGP Deep Dive Part 8: Policy in Practice, Prefix Filters, AS-Path Filters, and RFC 7454
Part 8 of the BGP Deep Dive: the actual tools operators use to apply policy, prefix filtering, AS-path filtering, the route-map pattern every vendor implements some version of, and RFC 7454's real operational recommendations for filtering, max-prefix limits, and session hardening.
-
BGP Deep Dive Part 9: Traffic Engineering, or Why Outbound Is Easy and Inbound Never Fully Is
Part 9 of the BGP Deep Dive: multihoming and traffic engineering using nothing but attributes this series has already covered. Outbound TE is a solved problem with LOCAL_PREF. Inbound TE never fully is, and this post explains why prepending, MED, and communities are all, honestly, best-effort.
-
BitBang CLI Part 1: A Terminal, File Browser, and Proxy Over WebRTC, No Port Forwarding
bitbang-cli is a single static Go binary that gets you a shell, file browser, and LAN proxy on a remote machine with no inbound port, no account, and no VPN client. Built from source and run for real, including a live P2P connection and a PIN-protected listener.
-
BitBang CLI Part 2: What a WebRTC Reverse Shell Looks Like From the Wire
bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.
-
SSH Deep Dive Part 3: Tunnels and Jump Hosts, -L, -R, -D, and -J
Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.
-
Route Leaking Between VRFs on FortiGate: What Happens When You Actually Build It
I set out to build the BGP leak-target VRF route-leaking mechanism from my own earlier post, on a real FortiGate 70G. It hit three undocumented platform quirks in a row. The real answer turned out to be a static route over a VDOM-link — no BGP required.
-
Lab Environments Part 1: Why Lab, and How to Choose
Opening a short series on the lab environment landscape with the question that actually decides which tool you want: what do you need the lab to be, not which GUI looks nicest.
-
Lab Environments Part 6: Cloud-Hosted Labs, and Picking One
Closing the overview: renting the compute layer instead of owning it, a comparison across all five categories, and a plain decision framework. Proxmox is next, with the deep dives to follow.
-
Proxmox Deep Dive Part 4: Networking - Bridges, VLANs, and SDN
From the single vmbr0 bridge the installer creates, through VLAN-aware bridges and bonding, to the newer SDN stack with EVPN and BGP over VXLAN, and where the extra complexity is actually worth it in a homelab.
-
Proxmox Deep Dive Part 5: The Built-In Firewall
Three separate levels, datacenter, node, and VM, each guarding a different kind of traffic, plus security groups and IP sets for keeping rule sets manageable as a homelab grows.
-
Container Networking Deep Dive Part 1: From Namespaces to a Container Network by Hand
Before Docker automates any of it, build a container network by hand: two network namespaces, a veth pair each, a Linux bridge, and one iptables NAT rule. Everything Docker does later is this, generated for you.
-
Container Networking Deep Dive Part 10: A Full Walkthrough, Chasing a Cross-Node Connectivity Bug
A checkout service scales out, starts failing calls to a payment gateway on a different node, and the failure turns out to be two separate problems stacked on top of each other. A start-to-finish walkthrough using every technique from this series.
-
Container Networking Deep Dive Part 2: Docker's Default Bridge Model, Unpacked
Install Docker and run the same two-container topology from Part 1 with docker run instead of ip netns. Then read the actual iptables rules and docker0 bridge Docker generated, line for line, against the ones written by hand.
-
Container Networking Deep Dive Part 3: Docker Network Drivers Compared
bridge, host, macvlan, ipvlan, and none are not five ways to do the same thing. Each one trades away a specific piece of isolation, performance, or addressing flexibility. A driver-by-driver comparison with the actual tradeoff each makes.
-
Container Networking Deep Dive Part 4: Multi-Host Overlay Networking and the VXLAN Underneath It
A Docker Swarm overlay network makes containers on different hosts look like they share a bridge. VXLAN encapsulation is how, and it costs 50 bytes of every packet's MTU budget, the same overhead this series already covered from the tunneling side.
-
Container Networking Deep Dive Part 5: What CNI Actually Is
Kubernetes doesn't use Docker's networking model. It defines a plugin interface instead, CNI, with a lifecycle of exactly two verbs. Why one-IP-per-pod forced that split, and what a CNI plugin actually does when a pod starts.
-
Container Networking Deep Dive Part 6: CNI Plugins Compared, Flannel, Calico, and Cilium
Three CNI plugins solve the same ADD-verb reachability problem three different ways: VXLAN encapsulation, BGP-distributed routes, and an eBPF datapath. The architecture and datapath differences, not a feature-checklist bake-off.
-
Container Networking Deep Dive Part 7: eBPF-Native Networking and the End of kube-proxy
kube-proxy's default iptables mode chain-walks a rule per backend, per packet. Cilium's kube-proxy replacement skips that entirely, at the socket layer, before a packet is even built. What kube-proxy actually does, and what changes when eBPF replaces it.
-
Container Networking Deep Dive Part 8: Network Policy Enforcement Compared, iptables vs eBPF
The same Kubernetes NetworkPolicy resource gets enforced completely differently depending on the CNI plugin underneath it. Calico's default path turns it into iptables rule chains; Cilium turns it into eBPF map lookups keyed on pod identity. Same intent, different mechanism, different failure modes.
-
Container Networking Deep Dive Part 9: Troubleshooting Container Networking
A vendor-neutral methodology for the five failure modes that account for most container networking outages: conntrack exhaustion, VXLAN MTU fragmentation, DNS-in-pod failures, cross-node connectivity breaks, and tcpdump inside a network namespace.
-
OSPF on Linux Part 1: A Brief History of Routing on Linux
The first post in a companion series to OSPF Deep Dive: how Linux went from a kernel that could route packets but not speak a routing protocol, through GNU Zebra and Quagga, to FRRouting. History first, because the config in Part 3 makes more sense once you know why it looks the way it does.
-
OSPF on Linux Part 2: Why FRRouting Is the Defacto Choice
The zebra/protocol-daemon/vtysh architecture from the inside, FRR against its one real remaining competitor, BIRD, and why FRR's Cisco-shaped CLI is a genuine advantage for this specific series rather than a cosmetic one.
-
OSPF on Linux Part 3: Installing and Configuring OSPF with FRR
Getting FRR onto a Linux box for real: the package, the users it creates without asking, the daemon on/off switch in /etc/frr/daemons, and the first router ospf block in vtysh. Verified against a real install, not written from memory.
-
OSPF on Linux Part 4: Wiring LAB-LNX into the OSPF Deep Dive Lab
Adding a fourth router to CORE-CSR, BRANCH-FGT, and EDGE-MX: a Linux box running the FRR config from Part 3, walked from Down to Full against the neighbor state machine from OSPF Deep Dive Part 1, with an LSDB parity check across all four platforms.
-
OSPF on Linux Part 5: Troubleshooting OSPF on Linux
The closing post: OSPF Deep Dive Part 11's three-vendor show-command table extended to four with FRR's vtysh, then the failure modes that only exist on Linux, ip_forward, a firewall dropping protocol 89, multicast group membership, the wrong network namespace, veth MTU, and tcpdump on the wire.
-
OSPF Deep Dive Part 1: Neighbor States, DR/BDR Election, and Network Types
The first post in a full OSPF series covering Cisco, FortiOS, and Junos: the hello protocol, the neighbor state machine, why DR/BDR election exists, and the network types that decide whether an election happens at all.
-
OSPF Deep Dive Part 10: A Vendor-Neutral Troubleshooting Methodology
A structured way to diagnose OSPF problems that works on any vendor, because it's built on the neighbor state machine from Part 1, not on any platform's specific commands: what state is it stuck at, and what does that state rule in or out.
-
OSPF Deep Dive Part 11: Show Commands and the LSDB, Side by Side
The same neighbor table, interface state, and LSDB, read through three different command sets: Cisco IOS/IOS-XE, FortiOS, and Junos, mapped side by side against the CORE-CSR/BRANCH-FGT/EDGE-MX lab from this series.
-
OSPF Deep Dive Part 12: A Multi-Vendor Outage, Start to Finish
A closing walkthrough on the CORE-CSR/BRANCH-FGT/EDGE-MX lab: a complaint with no down interfaces and no failed adjacencies anywhere, a red herring that turns out to be real but irrelevant, and a root cause that traces straight back to Part 3's reference-bandwidth warning.
-
OSPF Deep Dive Part 2: LSA Types and the Area Type Hierarchy
What actually travels in the LSDB: the seven LSA types that matter in practice, and how stub, totally stubby, NSSA, and totally NSSA areas each filter a different subset of them.
-
OSPF Deep Dive Part 3: The SPF Algorithm, Cost, and Route Selection
How a full LSDB actually becomes a routing table: Dijkstra's algorithm, the reference-bandwidth cost trap every vendor shares, and why intra-area, inter-area, and external routes are preferred in that exact order regardless of cost.
-
OSPF Deep Dive Part 4: Virtual Links, Summarization, and Redistribution
Fixing the lab's missing backbone connection with a virtual link, then summarizing at the ABR and redistributing a static route at the NSSA's ASBR, with working syntax on Cisco, FortiOS, and Junos for each.
-
OSPF Deep Dive Part 5: OSPFv3 and Running OSPF Over IPv6
OSPFv3 isn't OSPFv2 with bigger addresses. It separates topology from addressing, drops built-in authentication in favor of IPsec, and runs over link-local addresses by default, plus the per-vendor syntax to bring it up on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 6: Authentication and Security Hardening
What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 7: Cisco IOS/IOS-XE Implementation and Gotchas
CORE-CSR's actual configuration: process ID scope, the network-statement vs interface-based config split, the passive-interface-default trap, and why raising reference-bandwidth only ever warns once, locally, at configuration time.
-
OSPF Deep Dive Part 8: FortiOS Implementation and Gotchas
BRANCH-FGT's configuration: why FortiOS has no passive-interface-default equivalent, how OSPF scopes to a VDOM, the router-id selection rule that actually differs from Cisco's, and how OSPF interacts with SD-WAN policy routes.
-
OSPF Deep Dive Part 9: Junos Implementation and Gotchas
EDGE-MX's configuration: why Junos never adds an interface to OSPF by accident, the policy-based redistribution model, and the one default that catches Cisco and FortiOS engineers off guard, OSPF outranking eBGP by default.
-
DNS Tunneling and Covert C2: iodine, dnscat2, and Catching It on the Wire
DNS is the one protocol almost every egress policy leaves wide open. iodine's real --help output and dnscat2's documented client/server model show why — plus the query-entropy and NXDOMAIN signals that actually catch it, tied back into the CONTOSO.LOCAL pivoting lab.
-
Pivoting and Tunneling Part 1: Why Pivoting Is Just Routing With Extra Steps
Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.
-
Pivoting and Tunneling Part 2: Chisel and the HTTP Tunnel That Looks Like Nothing
Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.
-
Pivoting and Tunneling Part 3: ligolo-ng and Tunneling Without Proxychains
ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.
-
Pivoting and Tunneling Part 4: What Tunneling Does to Your Packets — MTU, Fragmentation, and PMTUD Inside a Tunnel
Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.
-
Pivoting and Tunneling Part 5: Double Pivots, Multi-Hop Chains, and Catching Them From the Wire
Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.
-
Netcat: The Swiss Army Knife of TCP/IP, A Deep Dive
Netcat's origins and the OpenBSD/GNU fork split, core socket mechanics, file transfer and port scanning, bind vs reverse shells (with the mkfifo workaround for -e-less builds), and HTTP banner grabbers, mock servers, and relays — with firewall-testing use cases throughout.
-
Ansible Deep Dive Part 1: What Ansible Is, and Why Agentless Still Wins
Kicking off a thirteen-part Ansible series. Part 1 covers what Ansible actually is, the push-based agentless model and why it still matters against Chef/Puppet/Salt, the control node/managed node mental model, installing Ansible, and your first ad-hoc command against a real inventory.
-
Ansible Deep Dive Part 2: Inventory — Static, Dynamic, and Everything In Between
Part 2 of the Ansible series: INI vs YAML inventory, groups and nested groups, host_vars/group_vars, patterns and limits, and moving to dynamic inventory plugins (AWS, and a network-specific example) once static files stop scaling.
-
The Three Planes: Management, Control, and Data — and Why Every SDWAN Argument Comes Back to Them
A vendor-neutral primer on the management, control, and data planes — what each actually does, why management-vs-control is the distinction everyone blurs, and a three-question test you can run against any SDWAN platform regardless of vendor.
-
Cilium: Kubernetes Networking and Security Built on eBPF
Cilium replaces iptables-based kube-proxy and overlay CNIs with eBPF programs on the kernel datapath. Connects back to namespaces, veth pairs, nftables, and eBPF/XDP, then covers identity-based network policy and Hubble observability.
-
Nmap and the Scripting Engine: A Network Engineer's Field Guide to NSE
Nmap's scan engine and NSE scripting framework are as useful for firewall change validation and inventory work as for security assessments. Covers scan types, timing, NSE categories, writing a custom script, and practical recipes for network engineers.
-
Local Internet Breakout in Practice: SDWAN Zones, Rules, and a Multi-VRF Guest Wi-Fi Walkthrough
How SDWAN zones, members, and performance-SLA rules actually decide where a session breaks out — and a full walkthrough of giving Guest Wi-Fi its own VRF, its own zone, and a local internet path that never touches the corporate tunnel.
-
Fortinet SDWAN Hub Placement Part 1: The Traditional Model — Hubs in the DC
Why hubs traditionally sit in the DC, the job they actually do there, how they protect FMG/FAZ, and how BGP on loopback ties it together. Part 1 of a series that goes on to challenge the assumption that the hub belongs in the DC at all.
-
Fortinet SDWAN Hub Placement Part 2: The MSSP Shift — When the Hub Becomes Customer-Centric
What changes when one FMG/FAZ pair manages many customers through ADOMs: the hub stops being "the DC's hub" and becomes a per-customer design decision, with its own routing domain, AS plan, and placement logic.
-
Fortinet SDWAN Hub Placement Part 3: Cloud, SASE, and the Death of "The DC" as the Default
Closing out the hub-placement series: what changes about hub design when the destination is Azure, AWS, or GCP rather than a DC, and what changes again for customers migrating from a DC-centric WAN to a SASE-centric one.
-
From DSCP to Deep Packet Inspection: Why SDWAN Application-Aware Routing Killed Traditional QoS
A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.
-
Advanced tcpdump Recipes for the Enterprise Engineer: The Packet Never Lies
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 1: System Health & Routing
Part 1 of a 3-part deep-dive CLI reference for the NSE 4 exam. Covers get system status, get system performance status, interface and NIC diagnostics, the routing table RIB vs FIB, ARP, and ping-options — with live output breakdowns and exam-pressure indicators for every command.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 2: Session Table & Packet Flow
Part 2 of 3 in the NSE 4 CLI reference series. Deep-dives into FortiOS session table internals — filtering, reading, and clearing sessions — then covers the packet sniffer verbosity levels 1–6 and the full debug flow chain with line-by-line breakdown of successful vs. dropped traces.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 3: VPN & HA
Part 3 of 3 in the NSE 4 CLI reference series. Covers IPsec VPN diagnostics (IKE gateway state, tunnel SAs, SPI counter discrepancies), SSL-VPN authentication traces, and HA cluster mechanics — election criteria, heartbeat state, and configuration synchronisation verification via checksum hashes.
-
BGP Route Dampening Part 1: The Flapping Problem, Exponential Decay, and Cisco Configuration
A deep dive into how BGP route dampening works: the 1990s internet instability that created it, the exponential decay algorithm behind it, every Cisco parameter explained, and a full configuration and verification reference.
-
BGP Route Dampening Part 2: RFC 7454, BFD, and Where Dampening Still Belongs
Why the IETF now discourages global BGP route dampening, how Bidirectional Forwarding Detection interacts with it, what RFC 7454 actually says, and the specific modern scenarios where dampening remains the right answer.
-
SDWAN Resilience Part 1: Design and Assumptions
A multi-part deep dive into building a resilient Fortinet SDWAN on a real, slightly unfashionable topology — HA FortiManager, dual hubs in active/standby, no DCI, and an independent DCE. Part 1 lays out the topology, the AS plan, and challenges the design choices up front.
-
SDWAN Resilience Part 2: BGP on Loopback
Why we peer BGP on loopbacks instead of tunnel-interface IPs, the FortiOS dynamic-IPsec config that makes it work, the spoke-side reciprocal config, and why hub-to-hub iBGP is the wrong answer in a no-DCI active/standby topology.
-
SDWAN Resilience Part 3: DC to DCE Routing — Static, OSPF, and BGP
The hub FortiGate has to glue the spoke overlay to the data-centre environment that hosts the services. Static, OSPF, and eBGP each work — but only two of them fail correctly when the DCE peering goes down on one DC and not the other.
-
SDWAN Resilience Part 4: BFD and Convergence Tuning
Default BGP timers detect failure in three minutes. That's unacceptable for active/standby SDWAN. This post is the timer-math: DPD vs BFD on tunnels, BFD-for-BGP, holdtime ratios, the Graceful Restart trade-off, and what convergence numbers each combination actually delivers.
-
SDWAN Resilience Part 5: Performance SLAs and Service Steering
BGP and BFD catch every failure that takes a tunnel or session with it. They don't catch the failure where everything looks healthy at the network layer but the application is gone. That's the gap SDWAN Performance SLAs fill — and the place where careful health-check design earns its keep.
-
SDWAN Resilience Part 6: Building It Right — Full DCI and Dual-Active ADVPN
The first five parts defended a topology with real constraints. This final post is the version without those constraints — Fortinet's reference design: full DCI, dual-active ADVPN, iBGP between hubs, symmetric routing, ECMP across both paths. The full shebang.
-
Designing an Arista SDWAN Spoke with Enhanced HA, Dual DIA, and OSPF
Building a resilient Arista (formerly VeloCloud) SDWAN spoke: two Edges in Enhanced HA, two DIA circuits wired the optimal way, a multi-VLAN LAN, OSPF for route exchange, and the caveats that bite in practice.
-
Adding Vendor Route-Table Parsers to route-compare, and Why the Work Lives on a Branch
A follow-up on the route-compare tool: I taught it to read raw show ip route, get router info routing-table all, show route, and show routing route output directly — no Excel cleanup step. The work lives on a branch rather than on main, and this is why.
-
Comparing Route Tables Between Two Sources: A Small Python Tool for Audits and Migrations
A self-contained Python utility that takes two Excel route lists, normalises every prefix through ipaddress, finds exact matches and overlaps, preserves invalid entries for audit, and writes a colour-coded Excel report plus CSVs. Includes install guide and full source.
-
NSE5 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a 10-part study series for the Fortinet NSE 5 / FCP FortiManager Administrator certification. Covers the exam logistics, the official curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
Resilient DNS at Home: Building an HA Pi-hole Pair on Raspberry Pi
A complete walkthrough for installing Pi-hole on a Raspberry Pi running current Raspbian, then turning a single box into a highly available pair using keepalived and Orbital Sync — with the config examples and show commands you'll actually use.
-
Building a FortiManager Lab on Proxmox — Part 3: Proxmox Networking, Linux Bridges, VLAN-Aware Bridges and SDN for the Lab
Part 3 of the FortiManager-on-Proxmox series. Designs the four-segment lab network, compares Linux bridges, VLAN-aware bridges and Proxmox SDN, walks through the /etc/network/interfaces shape, and explains why the lab bridges should never have an IP on the host.
-
FortiOS 7.6.6 SDWAN: VRF1 Transport and Loopback Design
A refined VRF reference design for FortiOS 7.6.6 — transport in VRF 1, separate transport and management loopbacks, complete management-plane pinning, and NPU-VLINK guidance for inter-VRF acceleration.
-
MP-BGP and VRFs on FortiGate SDWAN
A practical reference design using MP-BGP (VPNv4) and VRFs on FortiOS to keep management (VRF20), customer SDWAN (VRF30), and Guest Wi-Fi DIA (VRF99) isolated end-to-end. Includes config, traffic flows, and the gotchas that bite people in production.
-
Building a Polished CLI Tool with Click and Rich: Packaging Network Automation for Other Humans
Turn a working network-automation script into a tool your colleagues will use — moving from argparse to Click, formatted output with Rich, environment-loaded secrets, and pip-installable packaging.
-
iptables to nftables: Migrating Production Firewalls Without Downtime
A working engineer's guide to moving from iptables to nftables on production Linux firewalls — the mental model shift, where iptables-translate misleads you, atomic ruleset swaps, and a clean rollback strategy that means a bad migration costs you seconds, not your weekend.
-
Linux Networking from the Ground Up: Network Namespaces, veth Pairs, and Building a Multi-Router Lab on One Host
Build a real multi-router BGP and OSPF lab on a single Linux box using network namespaces, veth pairs, and FRRouting — no VMs, no containers, no GNS3. A practical walk-through of the primitives that GNS3, Docker, and Kubernetes are quietly using under the hood.
-
NAPALM vs Netmiko: Vendor-Agnostic Config vs Raw CLI, and When You Want Both
A practical comparison of NAPALM and Netmiko for network automation — where Netmiko's raw CLI access is the right answer, where NAPALM's compare/replace/rollback abstraction earns its keep, and the hybrid pattern that most production tooling actually settles on.
-
Netmiko in Practice: From a Show-Command Script to a Repeatable Audit Tool
A working network engineer's guide to Netmiko — starting from a small repo of mine that runs show commands across a JSON inventory, and extending it into something you can use as a real audit tool with structured output, concurrency, secure credentials, and a sane dry-run for config changes.
-
Network Emulation with NETEM: Simulating Latency, Loss, Jitter, and Bandwidth Constraints for Realistic Lab Testing
A practical guide to using Linux's NETEM qdisc to bend networks to your will — adding latency, loss, jitter, duplication, reordering, and bandwidth caps so you can test how applications and protocols actually behave when the network is anything other than perfect.
-
Nornir for Network Engineers: Running Automation Across an Inventory at Scale
A practical introduction to Nornir for engineers whose Netmiko script has grown too big — inventory plugins, structured tasks, parallelism, filtering by site or role, and integrating Netmiko, NAPALM, and pyATS as connection plugins. The framework you reach for once one box has become a hundred.
-
Parsing show Command Output: TextFSM, Genie, and TTP for Structured Data
A practical comparison of the three main ways to turn Cisco show output into structured Python data — TextFSM with NTC Templates, Genie/pyATS, and TTP — with worked examples and rules of thumb for picking the right one.
-
Route Leaking Between VRFs on Cisco IOS: From BGP First Principles to Advanced Manipulation
A practical end-to-end walkthrough of route leaking between VRFs on Cisco IOS — starting with the BGP and VRF fundamentals you need to actually understand what's happening, the static and MP-BGP options for the leak itself, and the route-map machinery that lets you control exactly what crosses.
-
tcpdump Deep Dive: BPF Filters, Capture Rotation, and Cross-Mapping to FortiGate's diagnose sniffer packet
A practical, command-heavy guide to getting real value out of tcpdump — precise BPF filters, production-grade ring-buffer captures, and a side-by-side mapping to FortiGate's diagnose sniffer packet so you can switch between the two without losing your place.
-
NSE4 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a study series for the Fortinet NSE 4 / FCP FortiGate Administrator certification. Covers exam logistics, the official 16-lesson curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE4 Part 10: High Availability
Part 10 — the final post in the NSE4 study series. Covers FGCP, active-passive vs active-active, heartbeat and monitor interfaces, session synchronisation, failover behaviour, and the diagnostic output you'll be asked to interpret.
-
NSE4 Part 2: Initial Configuration & the Security Fabric
Part 2 of the NSE4 study series — covers the day-one FortiGate configuration (interfaces, operation modes, admin access, DHCP, FortiGuard) and how the Security Fabric stitches multiple FortiGates and Fortinet products together.
-
NSE4 Part 3: Firewall Policies & NAT
Part 3 of the NSE4 study series — firewall policy structure, lookup order, NGFW modes, central vs policy NAT, source NAT pools, virtual IPs, and the session helpers behind protocol fixups.
-
NSE4 Part 8: IPsec VPN
Part 8 of the NSE4 study series — IKEv1 vs IKEv2, route-based vs policy-based, site-to-site and dial-up, NAT traversal, dead peer detection, and the two diagnostic commands that separate a Phase 1 problem from a Phase 2 problem.
-
NSE4 Part 9: Routing & SDWAN
Part 9 of the NSE4 study series — static and policy routing, distance vs priority, RPF, OSPF and BGP basics, and how SDWAN turns a pile of WAN links into a single steered zone with performance SLAs.
-
Route Leaking Between VRFs on FortiGate: Why It's Trickier Than You Think
VRF route leaking is a daily reality in any multi-tenant or shared-services network design. On FortiGate it's harder to find — and harder to get right — than the equivalent on Cisco or Juniper. Here's how to do it, why it's easy to miss, and the practical pitfalls.