I inherited a VXLAN EVPN network and it has been pretty stable until recently. From time to time, the layer3 or at least the inter-vlan drops for a few seconds. It happened last week, yesterday and today.

For what I can tell, the layer2 is fine. The VLANs gateway is on the service leafs (vPC pair). We are using ePBR to force the inter-vlan to the firewall, which is connected to the service leafs, the firewall will route the traffic back to the service leafs.

This has been stable for several months and no network changes. At this point, I'm not sure if the Nexus pair (where the SVI with ePBR) is causing the network downtime or the firewall.

We recently migrated to OpenShift for virtualization and containers. This was a month or two ago.

The firewall has a static route to the 172.16.0.0/16 with the next-hop of the HSRP VIP of the vPC pair. The service leafs are learning the 172.16/16 from a Catalyst leaf. All the VLANs are stretched to the service leafs via L2VNI.

```

[Fw]---/29---[service leafs pair]---[spines]---[cat9k leaf]

```

I know the layer2 (or L2VNI) didn't fail because Zabbix is not reporting any ICMPloss between it and the hosts in the same VLAN. However, any subnets within the same VRF drops for a few seconds.

The leafs CPU utilization history is basically idle 1% - 3%. The firewall is the same thing. Network utilization wise, we are using less than 800Mbps of traffic and the network is 40Gbps links.

I'm trying to get some ideas what I should look for to identity the issue and what is causing it.

My nexus version is 10.5.4 and the Catalyst is 17.15.4b. The Palo Alto firewalls (active/passive) are version 11.14.0.

Thanks.

I am a new hire systems engineer for Arista Networks. I have been on the customer side for my entire career thus far, and recently got hired in this new role working on the vendor side of things. I am wondering from anyone at the major network vendors who went from customer to the vendor side, How long did it take you to feel comfortable enough and be a "contributor" where you work? I want to feel like I am adding something but I am having trouble getting past the initial shock of it all. I am loving things so far, but getting past the initial learning curves and being able to start adding value is a real struggle for me currently. For those who made the switch, how long did it take to start feeling like a contributing member of the team?

Hi guys,

I have a career in sales working for a VAR for about five years now. We provided new and preowned networking hardware globally- stocking mainly the major OEMs like Cisco, Dell, HPE, Juniper & Arista.

I talk to network engineers, managers & directors on a daily basis. I really want to become better at my job and truly understand how I can be helpful towards network engineers like yourselves.

My questions for you all - what do you value in your relationships with your hardware reps? How do they (if at all) truly make your day to day work easier?

What are examples of your hardware reps going above and beyond for you? And what are the things that you hate to deal with?

Any feedback is much appreciated. Working with you guys and building relationships enable me to feed my family at the end of the day, so thank you for dealing with us!!

Hi all,

I passed my Comptia Net+ in Jan of this year, but have yet to really use much of my skills and so my knowledge has dulled a bit. I want to change that and start to shift towards networking focused, in case I want to change jobs down the line and to be more of a help to the team.

I've just moved offices and have been shown around our server room, given a brief overview of equipment and the environment, shown the (little and outdated) diagrams and documents. I'd like to come up with a plan/steps of things to do to get my head around everything whilst also still doing work etc.

Currently, I am working on labelling cables and tracing the physical paths of everything, noting them down and I plan to try and redo the diagrams. I want to also do this logically, however any tips/advice on doing this would be appreciated as I've done generic help desk for months and need to read back up on everything.

Cheers :)

A lot of my ISPs in my country have switched over / are switching over to CGNat IPs which makes dyndns and noip register the wrong ip address rendering it useless . Is the solution to fix this . We have 300 clients using either dyndns or noip to access our servers but now I servers won’t whitelist them as they getting misreported IPs

I’m potentially replacing an older ESXi host with a Dell R570 and running into a networking design question.

The current host has a lot of physically separated networks, with many of them using their own dedicated 1Gb copper NIC. iSCSI also uses multiple physical links.

The problem is the R570 can’t be configured with enough 1Gb copper ports to recreate the existing layout one-for-one.

My options seem to be:

1. Keep the existing copper switching and use a managed switch to aggregate the separate copper networks into VLANs, then hand them off to the R570 over SFP+ trunks. Keep dedicated high-speed ports for iSCSI.

2. Configure the R570 with 8x 10Gb BASE-T and move to 10Gb copper switching. Use two ports as redundant VLAN trunks for normal VM/management traffic, two dedicated ports for iSCSI, and use the remaining ports for vMotion/FT, additional redundancy, or spares.

3. Go with a different server platform that can still be configured with enough 1Gb copper ports to more closely replicate the current physical layout and avoid redesigning the networking right now.

The environment is already very copper-heavy, including the storage side, so I’m leaning toward the 10Gb BASE-T option.

For those running VMware in production today, how would you handle this? Is consolidating the normal networks onto redundant 10Gb trunks the standard approach now, or would you try to preserve more physical separation somehow?

I’m mostly trying to avoid forcing a new server into an old 1Gb-era design when the hardware doesn’t really support that layout anymore, but I also don’t want to redesign the network just for the sake of redesigning it.

Thanks in advance for any advice or real-world experience.

Hello,

I need to strenghten security via access-lists under (SVIs (interface vlans)) using automation tools for Nexus 9k switches.

I was always using Git, Ansible nxos_config module for that with no ip access-lists / ip access-list way. It was somehow working for non important SVIs. Nxos_acls is not good approach, because it does not support statistic enable command. Now i need to make it to use atomic fashion.

Cisco 9k supports that using configure session / commit method, but ansible doesnt provide models for that atomic fashion, i think i will need to remake it via nxos_config / nxos_command as i was using before. Also Ansible has AWX / Tower which is nice addition. Maybe i'm missing something ? Any other ways u would do it ?

Thanks

Hi all,

I'm managing a small stack of HPE 5130-series switches (JG963A) running Comware software version 7.1.070, Release 3507P09. On most of these switches, the hidden xtd-cli-mode command (used to unlock the full/extended Comware CLI from the default simplified/restricted CLI) works fine — it prompts:

All commands can be displayed and executed in extended CLI mode. Switch to extended CLI mode? [Y/N]:y

Password:

Warning: Extended CLI mode is intended for developers to test the system. Before using commands in extended CLI mode, contact the Technical Support and make sure you know the potential impact on the device and the network.

and after entering the password, it drops me into the full CLI (system-view, display interface, etc.) as expected.

On one specific switch in the stack, though, xtd-cli-mode now just returns:

<SWITCH>xtd-cli-mode

Permission denied.

with no Y/N prompt at all — straight rejection.

What I've tried:

- Reconnecting fresh via SSH (telnet is disabled on this unit) — same result.

- Rebooting the switch entirely — same result, persists across reboot.

- The account I'm using is the local admin user with network-admin + network-operator roles assigned, service-type ssh enabled, and it authenticates fine for a normal SSH login — it's specifically the xtd-cli-mode command that's rejected.

- Restricted CLI at login only exposes display, exit, quit, no, show — no way to run display users, free user-interface, or check security-enhanced/lockout state from there.

Since this is a firmware "developer mode" feature with anti-abuse messaging built in ("contact Technical Support"), I suspect this might be some kind of persistent lockout counter stored in flash rather than a normal AAA/role permission issue — but I have no visibility into it and no way to reset it from the restricted CLI.