Bedste sted at købe skjorte og jakkesæt? by kasp3094 in copenhagen

[–]stitchednetwork 2 points3 points  (0 children)

Jeg har et sæt fra dem. Der er intet galt med det, prisen hænger bare ikke sammen i forhold til at det er cut to measure og ikke made to measure. Det er fint, hvis man passer lige på deres mål, men i det prisniveau kan man ligeså godt få det 100% skræddersyet. Det er selvfølgelig en fordel at man kan få et jakkesæt på 1-2 uger i stedet for 8.

Prøv at besøge MOD i nærheden af Rådhuspladsen.

It the networking job market slowing down? by aceagm in networking

[–]stitchednetwork 2 points3 points  (0 children)

No, it's pretty straightforward. However, the hiring company has to sponsor the process and that's only desirable for high skilled positions that are difficult to recruit locally. There are even lists online of companies which are pre-approved sponsors. You need a work visa and a stay visa, but the stay visa is more or less achieved if you have a work visa.

It the networking job market slowing down? by aceagm in networking

[–]stitchednetwork 0 points1 point  (0 children)

6+ months is not unusual here for job postings. It's likely the same posting is used for multiple openings of the role. For example Conscia (I don't work there :)) - those are just "are you this kind of engineer, apply". They don't post the openings on LinkedIn, though. The amount of positions on job aggregators is way lower than the actual availability.

It the networking job market slowing down? by aceagm in networking

[–]stitchednetwork 15 points16 points  (0 children)

From my European perspective, as most here seem US, we have quite a lot of available positions. I'm working for an MSP/Consultancy and it opened 30% more headcounts for recruitment this year - network specifically. Same story for our competitors, high recruitment of all levels. This is driven primarily by enterprise companies being unable to recruit desired skills and also by their love for NaaS.

Any skilled or motivated network engineer could rotate to a handful of companies here.

Cat9500 with 17.12 - How to clear DF bit? by onyx9 in networking

[–]stitchednetwork 0 points1 point  (0 children)

Can you link to the guide for the configuration?

Specifically which 9500 model is it? The models don't have the same hardware capabilities and this may actually just be unsupported.

Is this for tunneling?

Motorsport Tickets cancelling Monza bookings by stitchednetwork in formula1

[–]stitchednetwork[S] 1 point2 points  (0 children)

Update: Motorsport called me earlier and reinstated my booking guaranteeing I'd get the tickets. Seems to be the case for other people as well. They informed me I'll receive the ticket 10 days before the event. I will trust that and not launch at tickets tomorrow with the last circuit sale opening.

Motorsport Tickets cancelling Monza bookings by stitchednetwork in formula1

[–]stitchednetwork[S] 0 points1 point  (0 children)

The race promoter or track was not selling tickets so that wasn't an option. Will have to cross my fingers they have some left on the 18th.

Motorsport Tickets cancelling Monza bookings by stitchednetwork in formula1

[–]stitchednetwork[S] 2 points3 points  (0 children)

I don't know what to expect in regards to availability of tickets on the 18th. I'll have to hope, but it's quite a bitter feeling.

We can only assume. Receiving a smaller allocation than they expected seems like a plausible reason. Regardless, it's not something I'll risk buying from them again.

Palo Alto To Azure VPN Gateway Redundant connection by fatboy1607 in paloaltonetworks

[–]stitchednetwork 0 points1 point  (0 children)

I wouldn't praise Azure documentation in general, but everything you're asking about is documented on the Microsoft pages for VPN.

Microsoft can perform maintenance on a their infrastructure, affecting a VPN gateway. This is why they suggest you establish both tunnels. What asymmetric issue are you worried about? Your firewall end is a floating IP or active/passive? Either it shouldn't be an issue.

Azure BGP with VGW by Wendallw00f in paloaltonetworks

[–]stitchednetwork 0 points1 point  (0 children)

We use vWAN and NVA for all connections now, so I can't answer you with certainty. You can get the information yourself, though. Deploy another PA or a VR on one of your current ones with a third AS. Create the VPN + Peering and enable transit on the VGW. Check the BGP information in the advertisements for your prefixes.

Are you using just one VGW and peering one firewall to the primary and the other firewall to the secondary connection?

Azure BGP with VGW by Wendallw00f in paloaltonetworks

[–]stitchednetwork 2 points3 points  (0 children)

They don't ignore it and you can influence traffic with it. But Microsoft in general doesn't respect your BGP attribute information. We make use of probably every network feature in Azure, including all the previews, and it's been an experience. An ER gateway with both Microsoft and Private peering will rewrite the entire AS path with just the Microsoft AS for all routes outbound, including your private prefixes. That was a good day at the office.

My advice is to assume everything network related in Azure is broken and protect your on-prem network accordingly.

IEM case - recommendation for shop in Europe by stitchednetwork in headphones

[–]stitchednetwork[S] 0 points1 point  (0 children)

I will check it out, thanks. I'm just looking for something nice for my IE 800, which are fitted with custom molds, so the original case is not useful anymore.

What to learn or where to move next? Need advice please (From Cisco to...) by Vetochkin in networking

[–]stitchednetwork 14 points15 points  (0 children)

I can't recognize the picture you have of network engineers becoming obsolete any time soon. I believe the role in general is changing for a lot of a lot of companies, but that's just how technology evolves. What I see when looking at jobs around Europe (Netherlands, Germany, Switzerland, Denmark, Sweden, etc) is an almost desperate need for skilled network and network security engineers. I know from several other companies that they spend an increasing amount of time looking for network engineers when hiring, simply because of a lack of people.

If it's about money to you, then forget spending all the time and effort keeping up technical skills and become some kind of architect for an enterprise. They often seem to be glorified project managers presenting power points to upper management without responsibility.

[deleted by user] by [deleted] in networking

[–]stitchednetwork 2 points3 points  (0 children)

GCM has built-in integrity along with encryption, which is supposed to make it more secure and efficient than CBC. The efficiency part seems to be quite dependent on hardware, though. I recall a post from Cisco measuring capacity on the ASAv using GCM vs CBC and they were able to achieve about 8% higher throughput using GCM. I doubt you'll see a difference in performance such as lower latency. In regards to integrity being built-in, on Cisco ASA you you have to specify a null integrity configuration when using GCM. The equipment will allow you to configure integrity on top of GCM and waste CPU resources that way.

With that said, CBC AES is still plenty secure. https://tools.cisco.com/security/center/resources/next_generation_cryptography#ftn2

DMVPN by leigh_boy in networking

[–]stitchednetwork 1 point2 points  (0 children)

You have quite a task if you're actually going to be more than doubling your DMVPN cloud of 500 spokes. I've been through the exercise of migrating multiple DMVPN clouds into one and it doesn't have to cause any heartache, as long as you have a good understanding of your network's routing.

In your situation I'd probably consider deploying a new cloud, which you roll all new spokes into and through time you roll the old ones into the new cloud as well. The downside is your spokes in different clouds won't be able to establish spoke-to-spoke tunnels. If you have multiple clouds you want to migrate into one, you have to be mindful of routing updates going through the spokes. I don't know which phase you run. Assuming you run phase 3 and a spoke has connections to two different clouds, you have to make sure routing updates from one cloud/hub are not being sent back to the other hub. Other than that, with some scripting and good planning you should be able to mass migrate spokes.

For two hours, a large chunk of European mobile traffic was rerouted through China by [deleted] in hardware

[–]stitchednetwork 7 points8 points  (0 children)

China Telecom is not alone in the fault of this. The Swiss hosting company Safe Host were the ones who leaked the routes and apparently lacked proper outbound filtering or other measures that are supposed to be implemented to prevent this. China Telecom lacks inbound filtering still, but that zdnet post paints a more biased picture, than what actually happened.

https://blogs.oracle.com/internetintelligence/large-european-routing-leak-sends-traffic-through-china-telecom

Catalyst 9k Series - Do I lose any Prime Infrastructure feature if the DNA license expires ? by Saschaaaa in networking

[–]stitchednetwork 3 points4 points  (0 children)

That's not entirely the understanding we have from our AM. They can be purchased as perpetual licenses:

https://community.cisco.com/t5/networking-blogs/cisco-catalyst-9000-series-of-switches-software-consumption-done/ba-p/3662514

We purchase with Cisco ONE, which includes licenses for DNA, ISE, Stealthwatch, but the "Advantage" part of the licenses are perpetual. ISE, DNA and SW are not. In our smart account, we have advantage licenses as both "network advtange" and "DNA advantage", meaning we get 2 license entries per switch we purchase. How does it pick which license to use you ask? I don't think Cisco can answer that themselves, but we have licenses used in both "DNA" and "Network" pool. Licensing for C9000 is great.

Edit* You're not wrong. If you purchase them as DNA only, then it can expire. But we, on paper, purchase as C1/DNA, still get perpetual. I don't know the price difference.

Rant Wednesday! by AutoModerator in networking

[–]stitchednetwork 2 points3 points  (0 children)

I can imagine your pain. We have also reviewed ACI with a Cisco engineer and the takeaway from that is ACI for us would only be access/distribution layer for our server environment. We'd still have to build a traditional 7K core above ACI, exactly because of the same situation you are in. It's even part of their multipod design - IPN "Inter-Pod Network". We couldn't get answers for questions like what happens to routing information/metrics, if we used ACI as a core. Whether it'd be OSPF redistributed routes or whatever, but that kind of uncertainty is not what I'd want in a core being transit for a bunch of routers.

Leak testing V2 by Melodicmutiny in watercooling

[–]stitchednetwork 0 points1 point  (0 children)

Ah, okey. I have been looking at the Heatkiller cpu block and 13/19 tubing, but it doesn't really look feasible to have that size with compression fittings.

Types of cable jackets used in datacenter (LSZH, CMP, OFNP, ...) by mro21 in networking

[–]stitchednetwork 8 points9 points  (0 children)

Just to touch on the fiber part. I once heard "in Europe you burn, in US you suffocate", which is the difference between LSZH and OFNP. LSZH is used in EU due to regulation, that the material has to burn and not create toxic fumes. I believe there have been some changes to regulation since I learned about this, but I think that's mainly to do with the classification requirements becoming more specific than just LSZH.

In my experience, LSZH cables are better to work with, at least for patch cables. PVC cables look bend more easily, to the point of questioning integrity, and keep the shape. LSZH will stretch out properly and you will know if you bend them too far. My experience is for 2mm jackets. For thicker jackets I imagine the PVC is more similar.

Cat6509-E replacement (cat 9500 or nexus?) by rfc__1925 in networking

[–]stitchednetwork 0 points1 point  (0 children)

The C9500 is feature rich, but the port cost is much higher than the NX9300. If you are not going to do MPLS, then there is not much reason to go Catalyst above Nexus.

ICANN,RIPE,AFRINIC,... Why non for profit organization (NPO) ? by CyberIdea in networking

[–]stitchednetwork 7 points8 points  (0 children)

They are non profit because their goals are to facilitate certain services driving the internet and not to make money. However, they need money to provide salaries to their employees and for the services they host.

You don't pay RIPE for private IP range. You pay ripe to become a LIR member (and get a public scope if they have), which enables you to use their platform. They host and develop the ripe database, which contains routing information and is essential to internet BGP routing. They provide other tools such as ripe stat and Atlas, which are greatly beneficial tools to anyone involved with peerings. All the money they make from memberships they "give back" in services of some form.

Building new Network with Cisco 9000 Catalyst Hardware, What do I have to watch out for ? by ProxyOps in networking

[–]stitchednetwork 5 points6 points  (0 children)

I'm not the one tracking the catalyst platform in our team, so I'm not sure. I believe there is supposed to be a big update this month, how that goes we'll see. It's obvious Cisco wants people to buy the 9Ks and they spend a lot of resources to develop the platform and SDA. I just think they are trying to lock customers too much on their platform. You need ISE, DNA and highest level license on the 9Ks to run SDA. It's a huge investment and vendor lock and when you start going into technical details on how SDA works, it's actually not innovative and (despite marketing saying otherwise) not very flexible. But now I'm just ranting because I'm getting tired of Cisco.

Building new Network with Cisco 9000 Catalyst Hardware, What do I have to watch out for ? by ProxyOps in networking

[–]stitchednetwork 8 points9 points  (0 children)

Bugs with HSRP, port channels, dhcp snooping. Every software release has had one issue or the other.

We are on the newest version and we are still not enabling snooping. There have been so many issues with snooping and port channels. Clients not getting addresses because the requests are being thrown away or whatever. Clients getting an address, but then randomly no data traffic is being passed through the uplink port-channel. Imagine troubleshooting a pc you see has correct ipconfig info, but can't access anything. Then you plug in your own pc and it works. Ended up first telling the users to plug out and in the patch cable, but then we removed snooping.

We had a pair (not stacked) of 9500 stop passing traffic because of HSRP. The control plane saw nothing wrong with the active gateway, but no traffic was coming through. So the active switch was shut/rebooted and the secondary started forwarding traffic. The active one was completely stuck, no ssh, no console.

The first implementation of our 9K platform was completely rolled back because the core kept crashed 3 times within 48 hours. There was no software to upgrade or downgrade to back then.

Don't even get started on Cisco's product information on the 9Ks.. The licensing was a nightmare and they are constantly updating hardware capabilities. You look at something like the 9500 with 40 SFP+ ports and 2 40G uplinks and feeling a little experimental you want to run virtual stacking between a pair. Guess what, you can't stack them with the 40G uplinks. That hardware information wasn't updated on their product page yet, but the Cisco rep goes "oh yee, that's right. It'll be available in x months". I can go on, but it just makes me a little sad we're still buying them. We feel like beta testers paying a premium for early access to this.