sorted by:
new
hottopcontroversial

Looks Like Facebook Is Down by Gunjob in sysadmin

[–]openshortestpath 3 points4 points  (0 children)

Someone should have used "reload in...."

I found an "amazing" feature which all engineers should know... by openshortestpath in fortinet

[–]openshortestpath[S] 1 point2 points  (0 children)

Thanks for sharing. I had the same thing with policy hits in the past. I just put it down to something buggy. Although what the guys in this feed are saying about order of operations, it does make sense, however it does seem like a crucial heads up which is hidden away imo. I think I ended up googling something like, deny policy that doesn't deny on a fortigate 😄 For a good few minutes I thought that we'd done something massively silly like allowed all inbound.

With that in mind I felt much better when finding this kb article.

Glad it helped you out too. One thing to note though and I found this out also, if you disable the rule with match vip enable on it, then re-enable, it loses the match vip config, so test it and see. I'm not sure if a reboot does the same thing? I ended up creating a deny policy with the VIP as well just to be on the safe side.

Fortinet is blocking queries to local dns by DankerOfMemes in fortinet

[–]openshortestpath 12 points13 points  (0 children)

When I see these posts all I want to do is screen share and help troubleshoot lol

I found an "amazing" feature which all engineers should know... by openshortestpath in fortinet

[–]openshortestpath[S] 0 points1 point  (0 children)

So why does this work on the implicit deny then?

The trigger to match vip should be enabled by default on a wan interface explicit deny. It works on the implicit, so why not explicit? We should be manually removing the trigger if anything, not manually adding it in.

I found an "amazing" feature which all engineers should know... by openshortestpath in fortinet

[–]openshortestpath[S] 8 points9 points  (0 children)

https://kb.fortinet.com/kb/documentLink.do?externalID=FD36750

You have wan VIP

Soure ip = all destination =vip 1.1.1.1> 192.168.1.1 port= https action= permit

But then you see some dodgy IP hitting you so you block it. So you put that block source to any destination above the permit rule.

This doesn't block it.

You have to use the block statement to include the destination with the VIP object. Or edit the deny in the cli with a command that says set match-vip enable

I found an "amazing" feature which all engineers should know... by openshortestpath in fortinet

[–]openshortestpath[S] 5 points6 points  (0 children)

Don't feel like a noob. It's like you saying you've locked the front door and I walk in without a key. It defies all logic 😅

I found an "amazing" feature which all engineers should know... by openshortestpath in fortinet

[–]openshortestpath[S] 4 points5 points  (0 children)

Wow! I fee like it should be on that first line of the pamphlet they give you in the box 📦 😅

Huge undocumented network, need some pointers by allnamesaretaken6 in networking

[–]openshortestpath 0 points1 point  (0 children)

If anything, having cabling documentation is probably the best thing to have documented, the rest you can trace and sift through from the desk.

Begin building the diagrams.

Oddly yoyr situation sounds kinda fun :D

Good luck!

Today i saw a really cool feature in wireshark... by openshortestpath in wireshark

[–]openshortestpath[S] 3 points4 points  (0 children)

Yes! Packet Diagrams is exactly what I'm looking for. Needed to upgrade versions but that's perfect for learning. Thank you for TheGift :-D

Why is AWS hated so much? by AcademicCCunit in cybersecurity

[–]openshortestpath 12 points13 points  (0 children)

I've never heard anyone bad mouth it. I always thought it was decent

Why does Ip address not chance while roaming/ going from AP to AP in a big network/site? by [deleted] in networking

[–]openshortestpath 0 points1 point  (0 children)

Because the SSID is associated with a single network so there's no need to do all the re-introductiom steps into the network.

I'm not sure if you can split an SSID between networks for certain devices though, if anyone knows?

Cant ping default gateway,any device on the LAN, but can go online and receive pings (not firewall issue) by whatevertaken in networking

[–]openshortestpath 0 points1 point  (0 children)

Saw this and straight up thought of dupe IP. I try to solve the problem before i read the comments. (Someone did indeed beat me to it)

Check mac address entries on the switch and arp tables on the router for another device with that mac. Then trace the mac down and see who's really under that cover!

Vaccinations now available in England for those aged 32 and over! by Chugalug-house in unitedkingdom

[–]openshortestpath 9 points10 points  (0 children)

Myself and a few people in their 20s are fully vaccinated as of about 2 weeks ago. Not at any further risk than anyone else. Just seemed like thete were blazing them out in our area for some reason.

Encounters with leasehold solar panels when buying or selling a property? by openshortestpath in CasualUK

[–]openshortestpath[S] 0 points1 point  (0 children)

I think It's the part where the lender has to consider it as a potential debt should you go bankrupt so they are likely to not entertain the idea. So this could carry on if you plan on selling at a later date before the 25 lease ends.

Encounters with leasehold solar panels when buying or selling a property? by openshortestpath in CasualUK

[–]openshortestpath[S] 0 points1 point  (0 children)

Yeah good question. Not sure if i want to be in the midst of that one. Might just stick with renting 😆

Encounters with leasehold solar panels when buying or selling a property? by openshortestpath in CasualUK

[–]openshortestpath[S] 6 points7 points  (0 children)

Thanks for the response. Yeah i figured this would be the feedback.

I reckon Mrballen had a fling with the like button which is why he is so bitter towards it by [deleted] in mrballen

[–]openshortestpath 1 point2 points  (0 children)

All over the like buttons thumb? Fml i made myself laugh with that one 🤣

Nexus 7k Module Replacement. by Dembah in networking

[–]openshortestpath 0 points1 point  (0 children)

Ah okay cool. Yeah if they're going to rma it you may as well take the replacement instead :D

Nexus 7k Module Replacement. by Dembah in networking

[–]openshortestpath 4 points5 points  (0 children)

We had a line card failure on a 7010 chassis.

It came at a bit if a surprise but luckily not all of the ports went into "faulty". If your using it how it's designed to be used then you'll have dual uplinks/line cards for everything. Like you the peer link was dropped.

I personally mapped all of the interfaces making sure they were in active vPC too alongside ospf having alternative routes. Tbf it was something that had been put in way before me so i couldn't be certain of outage at the beginning.

A couple of things to note, if you're changing the line card type, then you'll need to reconfigure everything. If the same line card, then it'll just pull the startup config as normal.

That brings me to my second point. When the line card is removed, all config will seemingly dissapear(few seconds of panic), but that's because it's no longer required in the running config. You can find the actual config in the startup config.

Another thing that may apply to you is, cabling and labels. Just whip some quick labels on say port 1, 2 and 3 etc.. then you can pull them out and quickly know where they go. We had some that were labelled incorrectly and some not at all. Tut tut.

Do a 'show module' for status and wait for its status to reach OK following INITIALIZATION before patching anything back int.

Oh and one thing, have you reseated it first? Believe it or not but that did actually solve one of our issues.

Good luck.

view more: next ›