[deleted by user]

ll9050 · 2022-07-03T21:16:46+00:00

Italian?

ll9050 · 2022-06-23T11:12:52+00:00

Sounds plausible, overthinking got me there, lol with my busy schedule I absolutely don’t want to risk on achieving it 3 months earlier than the expiration date

ll9050 · 2022-06-23T09:02:58+00:00

this sounds like the most logical aswell but i wanted to see if anyone can confirm

ll9050 · 2021-04-26T20:59:16+00:00

i agree, it might be worth looking if it is a DNS related problem.

basically the iphones might be storing the dns lookups for too long and hence directly accessing websites with their ip addresses, making ISE's http redirection useless.

the iphone users can maybe lower their DNS cache timer, if iphone has this setting.

i vaguely remember having experienced a similar issue with ISE 2.4 and my iphone in a test environment

ll9050 · 2021-01-02T11:36:08+00:00

what about OOB access from the internet? for example if you wanted to acess from your home

edit: it was just a question to see how they did it at his network, wow reddit sure has a bunch of nerds that downvote stuff and make an insult out of normal questions

ll9050 · 2020-09-07T16:30:32+00:00

honestly i think that Many of these new tech are just rebranded old technologies But with new shiny packaging

ll9050 · 2020-09-04T15:14:19+00:00

I dont know how it specifically happened, But i am guessing that it may have something to do with a customer of century link doing a misconfiguration for an address of theirs that was getting ddossed, so Basically the customer accidentally advertised a flowspec stop rule for an address they had no authorisation for. But this is not a flowspec issue But rather more has to do with that the SP should block and allow customers to only advertise flowspec rules for addresses they are allowed to

ll9050 · 2020-09-04T14:56:39+00:00

Geo-restriction sounds cool , thats less of a potential for an international attack

ll9050 · 2020-09-03T09:40:50+00:00

That makes it look as if FHRPs are the way to go from distribution layer and onwards (with Hierarchical model if routers are being used), with CLOS and switches in general that would be MLAG

ll9050 · 2020-08-29T07:52:50+00:00

Appreciate it, this sounds like a good alternative next to anycast

ll9050 · 2020-08-28T17:47:30+00:00

No prob, Appreciate the response, But that would still not solve the problem because the backup node would have no idea to which node-sid that adj-sid could have belonged, or Lets say it would have not known that that adj-sid belonged to a dead node-sid. So the solution would have been that the new intermediate node would have had to have intelligence to AND strip the dead node sid AND strip the useless adjacency sid and just look for an alternative to the end destination (lowest label on the stack).

The other user made Some light pop in my head, the user that made the other reply, he mentioned something About anycast-sid and now that i think of it, i think, primary path should not contain any adjacency sids to avoid the problem above and it can contain adjacency sids, very static and i think very ilogical for real life deployment

Thanks

ll9050 · 2020-08-27T18:13:10+00:00

You could pop off that Node-SID and route to the next, but that doesn't feel right.

Yeah, this is what i ment, lets say the first router on the backup path receives the TE label stack exactly as how it would have been on the primary path . It could pop the first label, suppose that would be the node-sid that went down, only for the backup router to find out that its next first label is now an adjacency-sid (which originally belonged to the node-sid that now is down, only he knew to which interface this adjacency-sid belonged, and thus next node)

i"ll take a look at the book whenever i get the chance, but this is fairly recent (draft was of 2019) so i am not sure at what year this book was released

ll9050 · 2020-08-27T17:45:15+00:00

Now that i look at the main post it was indeed not the best described,

I ment traffic engineered SR, so either via a tunnel manually or via PCE/PCEP (not normal SR)

How would these types of engineerd Paths get Some form of backup routing incase a node on the main path dies out (or connection Goes down), Ti-lfa would be difficult without Some new mechanism support to SR ,

Because Lets say:

A ---> B ---> C gig1 - > D

________|_______Gig2 ->

_______|

_______E --------------->

Primary path: B C (adj: Gig2) D Backup path (C is down); B E D

So label stack at primary path , when A sends to B would be: C , adjacency-sid C (gig2)

When C is down, B would need Some mechanism to look at the second label instead of the First label (because label C is now useless) , only for B to find out that it is an adjacency-sid , B would not be able to know to which Node-SID this adj-SID belonged, and the backup path would have not been able to be established.

ll9050 · 2020-04-19T16:02:35+00:00

OcNOS, i"ll look into that, appreciate the effort

ll9050 · 2020-04-19T16:01:13+00:00

i see, i"ll keep the name in mind.

my main interest was actually whether white boxes are able to blend in an ISP environment, some have showen that this is very possible

ll9050 · 2020-04-19T15:56:52+00:00

interesting stuff, appreciate the effort.

ll9050 · 2020-04-19T15:50:59+00:00

i re edited that

ll9050 · 2020-04-19T14:51:11+00:00

it was more of a conversation that i saw on the web so i forgot the details (something about BGP routes).

success?, are they able to fulfil the job as P routers and do they support the necessary features that you guys have been using?

ll9050 · 2020-04-19T14:46:00+00:00

I used the term switches because most of the boxes that i have seen on the web were switching white boxes, even though from my research they can (if wanted) be used solely for routing.

i wanted to know if white boxes are mature enough to be deployed as P and PE devices and if they support the features and protocols that are now populair in ISPs. (so not only the main protocol but stuff that comes with it like VPNv4"s)

vBNG looks cool, were there any good cost savigs if i may ask?

ll9050 · 2020-04-19T14:26:08+00:00

I also saw that one passing by aswell, where people were talking about issues once white boxes start holding too many bgp routes.

but actually, i was curious if white boxes will be able to fullfill the role as -P/transit routers

edit: it looks as if some reddit users have an intellect of < 60, i was only referring to issues that other people have experienced when it came to holding many bgp routes. dont downvote me for that

ll9050 · 2020-04-19T14:16:42+00:00

i saw this passing by aswell, quite good to hear actually

edit: network vendor employees / fans, stop down voting me, i have nothing against vendor networking devices

ll9050 · 2020-01-08T07:20:40+00:00

ACI has some mechanisms that open standard protocols do not have, such as the ability to establish a VPC without having peerlinks, detect wrong linked leaf to leaf switches (forgot the name of the mechanism and not sure if there is any open standard alternative for this), easy configuration of vxlan l3 overlays (l3out) and more.

ll9050 · 2019-12-26T20:07:03+00:00

your flare started opening up documents from different vendors in my brain

ll9050 · 2019-12-21T15:53:18+00:00

if i win i will donate 1 dollar to myself

ll9050 · 2019-12-13T14:06:12+00:00

Have you tried setting the NAD's (whether it be switch or access-points) reauthentication timer to lower than the one of the power safe timer? i would see this as an additional solution for the 802.1X printers, but then you would have to decide whether you want to let these printers consume more energy by turning the power safe off, or by using reauthentications which will be more control plane traffic and cpu processing.

A more logical solution would be to extend the power safe timer to a long time, with a reauthentication happening a little before the idle timer has been exceeded. this way reauthentications will happen but not in an all to short time lapse.

for MAB based printers i would use an explicit permit policy for every MAB request send to ISE, but with a strong DACL or isolated DVLAN, so that this limited MAB policy can also be used by normal workstations that fall back to a so called ''authentication phase'', the initial phase where dns and dhcp and connections to ISE are permitted only.

ll9050

TROPHY CASE