u/Qvosniak

Hey guys,

I've run into a weird issue and I'm not sure whether this is expected behavior, user error, or a possible FortiManager bug.

One of my colleagues recently added an LDAP configuration change on one of our FortiGate's VDOMs. When creating the object in FortiManager, the per-device mapping was specifically set to:

fg01 [VDOM1]

For context, the FortiGate has multiple VDOMs:

• root
• VDOM1
• VDOM2
• VDOM3

The strange part is that when I later try to install an unrelated change to the root VDOM, the LDAP configuration that was created for VDOM1 appears in the install preview for root as well. I wouldn't expect that to happen.

My first thought was that there might be a stale database entry under the root VDOM, so I checked:

Device Manager > Device & Groups > fg01 [root] > CLI Configurations > user > ldap

However, there are no records found.

To me, that indicates FortiManager should not be pushing any LDAP configuration to the root VDOM, yet the LDAP config from VDOM1 keeps appearing every time I perform an install.

I've also tried various CLI/database resync commands, but the behavior remains the same. The LDAP configuration continues to show up in the install preview despite not existing in the root VDOM's device database. This is also the same for VDOM2. For some reason VDOM3 is not affected.

Has anyone seen this before?

A few questions:

1. Is this expected behavior with per-device mappings and VDOMs?
2. Could this be a database synchronization issue within FortiManager?
3. Is there another location where FortiManager could be storing this LDAP configuration that I'm overlooking?
4. Any recommendations for troubleshooting this further?

Thanks!

Hey guys so I'm currently working on recreating an entire customer's network from

scratch using fortinet gear.

They have workstations, phones, cameras(nvr) and other peripherals

Now, given how massive the customer warehouse is, it's been quite complex to trace each cable and determine what connects to what.

So, what we've decided to do is daisy chain the phones to the workstations and use LLDP-MED profile so it assigns a data and voice vlan.

We have a lots of 148F-POE switches scarred across the site and fortigate too

Given the phones are POE, they need to be on a POE ports (let's say port 1-24)

This is all good and fine, but the client wants to connect cameras there too (on the POE ports) and given we have no idea which cables are for what cameras, I was thinking.. Can we use MAC NAC on the same ports as where the Voice/Data LLDP profile is configured?

This would allow us to connect cameras to those ports too and, as it matches the MAC, that port will become Camera Vlan. If a phone connects there, then based on the LLDP-MED, it will assign the voice vlan, and lastly if a workstation connects to the phone (daisy chain), then it will get the correct workstation vlan.

Is this even doable?

Unfortunately the client isn't willing to pay more for a switch we can use solely for cameras, plus it will be extremely complicated to find out what cables connects to what cameras, etc..

Thanks Guys!

Hey guys

I need some advice, I went to purchase something from amazon few days ago and they immediately cancelled my order and they claim is due to 'allegedly requesting multiple refunds'

lol, they make it seem all the orders i've asked for I've asked for refunds.

One of them was a fkn sticky tape that they courier said they delivered it but never provided proof and couldn't find the delivery (it was like 2 bucks lmao) so requested it they could send another one..

And another one was a monitor screen I bought which came faulty and asked to get it replaced.

I cannot think of any other refunds or replacements and now they say I'm abusing the return policy? lol

If tried to appeal it but they keep getting back to me saying the reason why the cancel the oder but not steps to be taken.

I have gift card balance and credits in there.. wtf can i do now...

I absolutely love networking. Been in networking for 4 to 5+ years already. Genuinely. I learn something new every single day and I still get excited when I figure something out or get to work on something I've never touched before.

I don't consider myself a senior engineer at all, but I don't really feel like a junior either. I'm somewhere in the middle.

I recently landed my first (yes.. first) proper full-time Network Engineer role at an MSP. Before this, I had a few networking-related positions, but networking wasn't my full-time job. Even so, those roles gave me a ton of experience, especially with Fortinet and Juniper.

At my previous company, I basically became "the networking guy" despite it not being my actual full-time role. The company decided to move heavily into Fortinet, and I had never touched their gear before. I pretty much had no choice but to learn it.

So I spent months teaching myself, doing labs, lots of trial and error, and yes... occasionally learning in production because resources were pretty limited. Somehow, it all clicked. I became really comfortable with Fortinet, earned a few certifications, and the Fortinet Regional Manager watched my progress the whole way through. He even started advocating for me and talking about my skillset to other people in the industry. I ended up getting recognition from a few Fortinet FCXs for some of the work and changes I implemented.

The weird thing is, even though I feel genuinely confident with Fortinet, I still have this voice in my head saying, "Am I really that good though?"

Today, that same Regional Manager called me and said he's been recommending me to several high-end Fortinet partners who are looking for engineers. I've started getting few conversations here and there about prospect opportunities with some pretty incredible salaries.

And honestly... it's freaking me out.

Part of me is excited, but another part of me feels like I don't deserve it. I still have so much to learn. I don't even have a CCNP. Sure, I've worked with a lot of the technologies that CCNP covers, and every day I come across new things and keep learning, but I definitely don't feel like I'm at that level yet. I'm slowly trying to grasp more knowledge for the CCNP, but I've been procrastinating for sure.

Yet people are seeking me because of my experience and skillset anyway.

Does this feeling ever go away? Do you ever stop feeling like someone is overestimating your abilities?

I really want to keep learning and growing. One of my long-term goals has always been getting my CCNP, but that's beside the point.

I guess I'm just wondering if anyone else has been in this position and whether the impostor syndrome ever gets any quieter.

I work at an MSP with a pretty solid change management process, and I’m a huge advocate for documenting everything properly. My change requests are thorough, step-by-step, include the implementation plan, rollback plan, risks, and all the technical details.

Yet almost every single time, I get pulled into a CAB call and asked to explain… exactly what’s already in the change request.

And these aren’t non-technical people either. The CAB members are technical and understand the jargon from the CR..

I’m more than happy to answer questions, fill in gaps, or clarify something that’s unclear. That’s the whole point of the process imho. But if the meeting is literally just me explaining (again) my CR, then what's the point?

Ive got so fed up I’ve literally just started reading the change request word-for-word during these calls because apparently nobody else has, or can't be bother to do so.

Btw.. my change request aren't even that long either. I'd understand if my CH are pages long, they aren't.

Mind you, I could be 100% wrong too, and this could be normal in IT.. I'd love to know what you think :)

Hey guys,

Working in an MSP I was tasked to migrate on of our clients old firewall (Sophia) to a FortiGate firewall? this means recreating the entire rule sets, address objects, ip addressing, vlans.. etc..

Now, as part of the migration, they want to move from a flat network to a segregated one, which is fine tbh, but in terms of firewall policies.

I see there are maaaaany policies they have that are maybe relevant or not, plus they are not properly configured, or unnecessary (based on my initial review).

Given they want to segregated the network, i'd need to also create some policies to allow inter vlan routing. But for the other policies, my mind is saying, fix them, fix them.. but I feel it's not my problem at all, and that I should just copy 1:1 each firewall policy, even if it's enable, disable or doesn't do anything at all.

It's my first time working at an MSP so not sure what's the best method to tackle this.

Hope anyone can shed a light about how you guys do it? :)

Thank you so much!

Hey guys,

Sorry if this a long read, I just wanted to bring some context to the story :) - Just don't know how to tackle this client requests..

Over the last few weeks I've been involved in a project for one of our MSP clients, which operates a large metro network.

I was brought into the project primarily because of my experience with Juniper. While I have worked with Juniper gear before, I wouldn't consider myself a Juniper expert by any means. Apparently, though, nobody else at my MSP is comfortable taking this on, so I've ended up being the main engineer involved.

The client is pushing my boss for me to start configuring a new router that will provide internet access to part of their internal infrastructure. The problem is that both I and one of my colleagues, who is a senior network engineer, agree that it's unrealistic to jump into network changes or deploy a new device without fully understanding the environment and having a proper implementation plan.

The challenge isn't really the SRX itself. Configuring an SRX is relatively straightforward. The difficult part is understanding how it needs to integrate into the existing backbone network.

We're talking about things like physical and logical connectivity, VLAN assignments, routing design, security policies, zones, routing instances, redundancy requirements, failover behaviour, timers, and all the other design considerations that need to be understood before touching production. Unfortunately, a lot of this information is either vague or incomplete whenever we ask the client.

As a result, I've found myself trying to reverse engineer parts of their backbone, understand how everything currently fits together, and effectively put on a network architect hat so I can design an integration approach for the SRX deployment. All of this, of course wasn't part of my job tasks, but I did it anyway because I know building a skyscraper without plans, is just a disaster waiting to occur. Ironically, becoming a network architect is actually a career goal of mine, so it's been a valuable learning experience.

Of course, all this time has been billable back to the client, and I've spend numerous hours trying to understand their network (which I can tell you, it's not a simple 3 tier design, but an medium ISP-like network), and me and my colleague have slowly started to understand how everything comes together, which took us around a month, yet still figuring out new things every week.

Without drifting away, the issue is that I feel like I'm being blamed for the delays when the reality is that I don't have enough information to confidently proceed. The client keeps pushing for me to start configuring the SRXs immediately.

Sure, I can start building a configuration, but based on what exactly? I don't have a complete topology, I don't have a clear design, and I've learned from previous projects that building infrastructure without proper planning usually comes back to bite you later. Eventually you discover gaps, assumptions turn out to be wrong, and fixing the resulting issues often means redesigning large parts of the solution anyway.

I've been putting in a lot of effort trying to develop a proposal and a deployment approach. At the same time, I don't feel experienced enough to tackle something of this scale completely on my own. Thankfully I've got a senior colleague who's been willing to provide guidance and sanity-check my thinking.

Even with the right support, though, this doesn't feel like the kind of project that can be completed by simply snapping your fingers. Proper network design takes time, planning, validation, documentation, and stakeholder input. That seems to be the very thing the client is frustrated about, yet they're also expecting the solution to be designed and implemented within a week.

In my mind, if a building collapses, who's to blame? the handyman who build the tower without any architectural plans? or the higher ups who wanted it 'completed' without any design nor planning.

So I'm curious how more experienced engineers would handle a situation like this.

Have you ever been pushed to implement a solution before the design requirements were fully understood? How did you manage client expectations and timelines in those situations?

For context, I work for an MSP, so I also have other customers and projects competing for my time. I know some people will say "welcome to the MSP world," and that's fair enough, but setting the MSP aspect aside for a moment, how would you approach a project like this and deal with the pressure around unrealistic timelines?

Thank you Guys! and have a good start of the week!

Let's say we have a firewall and we create a firewall policy that allows traffic one way, from internal to outside.

Of course, the return traffic will be allowed as the firewall creates a session table and matches the source/destination IPs, ports and protocols use) and it will make sense of the session.. I get that part.

But let's say a MITM for some xyz reason knows all that information, who's the sender, what ports both source and destination ports are they using, what protocols...

If that's the case, what's stopping the spoofed packet from being accepted as a 'legitimate' packet as it genuinely matches the checks performed by the firewall?

I may be missing something or perhaps the firewalls have more checks that makes it difficult to spoof

If that's the case, regardless of its complexity, there is still a small chance a spoofed packet can be mixed up with a legitimate return traffic.

I hope I was able to explain myself lol!

Thanks guys!

A colleague of mine asked me today how I manage to switch between different vendor CLIs so quickly without getting constantly tripped up. Honestly, I didn't have a great answer other than "a lot of mistakes and four years of doing it."

It’s interesting how, over time, you stop thinking about the specific syntax and just "jump in" to the task..

Adding an interface in cisco? easy: en / conf t / int gi1/1 ip add x.x.x.x/24 - exit

Juniper? conf / edit system interfaces / set ge0/0/0 unit 0 family inet address x.x.x.x/24 - commit

Fortinet? config system interface / edit port1 / set mode static / set ip x.x.x.x/24 - end

Don’t get me wrong, I still have moments where I mix up commands between similar syntaxes when I’m bouncing between Aruba, Cisco or even Dell, but when the syntaxes are completely different, I find I can swap my mental context almost instantly, which is ironic given they are completely different syntax, yet still it's easier for me to swap between them.

It’s definitely been a process, but I’ve finally reached a point where it feels like muscle memory rather than active recall.

I’m curious, how long did it take you guys to reach that point where you just "knew" what to type without thinking? And generally, how many different CLI syntaxes are you juggling on a regular basis?

Also controversial take: Juniper will always be the best CLI syntax I’ve ever worked with. And the absolute worst? Comware. If you know, you know. Still have nightmares dealing with that syntax..

Hey guys, I am looking for some architectural advice on connecting a geo-cluster of Juniper SRXs to a FortiGate HA pair.

For context, I am working with a pair of SRX380s in a Chassis Cluster that are geographically separated, where the fabric link is extended via fibre across WAN switches.

On the inside, there is a pair of FortiGates in HA mode acting as the Layer 3 inter-VLAN routing boundary for internal infrastructure.

The goal is to connect the FortiGate HA pair directly to the SRX cluster to act as the next-hop boundary for limited internet access. I am planning a full-mesh physical topology where FortiGate 1 connects to both SRX1 and SRX2, and FortiGate 2 connects to both SRX1 and SRX2.

Because both environments are clustered, I am stuck on the cleanest way to provision the reth interfaces on the Juniper side to handle these downlinks. I have three options in mind.

1. The first option is to combine all downlink interfaces from both physical SRX nodes into a single reth interface.
   2.The second option is to create two separate reth interfaces, meaning one per physical SRX node mapping down to the FortiGates.
2. The third option is to create a unique reth interface for every individual physical link, resulting in four total reth interfaces for the downlinks.

I would love to know which approach makes the most sense natively in Junos to ensure predictable failover behavior without creating asymmetric routing headaches. Any insight on would be greatly appreciated guys 😄

Hey everyone,

I’m currently setting up a Cisco XRv 9000 image inside GNS3, but I've run into an annoying roadblock. Right now, I can only get the IOS CLI to load if the node's console type is set to VNC (Which is the normal behavior as far as I know).

I want to switch the console type over to Telnet so I can just use my normal terminal via PuTTy but whenever I blindly change the GNS3 node settings to Telnet, the XRv boots up into the kernel mode not the ios CLI, and can''t seem to overwrite this.

I've tried many Additional Settings within the QEMU Additional Options like -vga std.. but nothing..

I stumbled across this GNS3 guide for ASAv devices which handles a similar issue:https://www.gns3.com/how-to-configure-any-asav-qcow2-

However, the steps and QEMU settings there are specific to the ASA platform and don't seem to translate directly to the XRv9k architecture.

Does anyone know the proper workflow or specific QEMU/advanced settings needed to successfully force the XRv 9000 to pipe the cisco ios via Telnet instead of VNC?

Appreciate any help or pointers you can give!

Hey guys,

Left my old company 1 month ago, really nice place tbh, just decided to keep progressing in my career.

Yesterday former colleague of mine, really nice dude, has reached out to me initially asking about how I was doing.. personal stuff, and then he dropped the bombshell asking me about where to find specific information for work, it was a quick back and forth sms, I provided the answer and stoops replying.

However he kept sending me screenshots after screenshots about the same issue and I simply ignored them. Today he reached out again asking if we can have a quick call to discuss some networking stuff I left behind.

Now, I am more than happy to provide a quick consult but I'd be charging for that. The thing is is my colleague who's reaching out, not my former employer.

If that's the case, how should I handle this? How should I reply back?

I like the company, they are nice dudes, and I don't wanna burn any bridges, but I also want to put a foot down and demand for time/money for my consults

Mind you I don't have a 'company' under my name :(

Hey guys,

I know some people may ask why I am running GNS3 on Proxmox.. I've gone through this and I decided to do it this way.

Anyway..

I've seen few tutorials on YT, I followed this one: https://www.youtube.com/watch?v=UfqjqigS-OM

and so far I managed to boot it up, and even ping the GNS3VM on Port 80

I am using Windows 11 GNS3 Client on the same network and the VM gets recognized, however it remains stuck in 'Discovering or connecting to Main Server'.

I have allocated 96Gb ram to the VM
48 vCPUS

But I cannot get passed this point.

I've seen people having issues however they are running the VM on VMware Workstation instead of Proxmox.

I am hoping someone could guide be through how to fix this up.

https://preview.redd.it/os5nqxcc9p0h1.png?width=744&format=png&auto=webp&s=507e5b0cca5e433160c5ca9b1a4a99f27d967893

I've checked the NIC as well and ever changed it to the physical NIC or VirtIO.. Pings works, Web works.. but yet cannot connect to the VM from the GNS3 client.

https://preview.redd.it/a5imonff9p0h1.png?width=465&format=png&auto=webp&s=de83c3c7b649b403b6f3f48a7869607e6cbc09cb

https://preview.redd.it/tef4nkwa9p0h1.png?width=289&format=png&auto=webp&s=af814e52a9e89cf37335e57a43f1f35b926d25c9

Heh guys,

New here, so when I installed proxmox for the first time it came with a local and local-lvm storage.

Of course, out of 500GB total, only 100 were allocated to LVM and the rest to LVM-thin (local-lvm)

So people said, hey you can simply remove it and leave only LVM.. after all, you can then create a ZFS storage using HDD.

Mind you my proxmox is installed on the SSD.

Now, I went to resize the local storage (LVM) and removed the local-lvm (lvm-thin), and turns out that I cannot resize LVM back as it fails with an unable to resize on-line something...

So this got me questioning, what's exactly the purpose of LVM? which is now showing the entire 500gb, but I cannot do anything, as I currently don't have any storage, and I'm not allowed to create a LVM-Thin anymore either.

If I want to reuse the SSD for VMs, then I'm technically screwed?

I'm so confused, sorry guys, I hope I made sense.

Hey guys!

New here, so I could have my terminology mixed up.

Anyway, I have a proxmox server with the following:

128gb RAM

x2 4TB Drives (Looking for Mirrored ZFS)

500GB NVME SSD.

Here is my goal:

I've never worked with ZFS, and as a small project of mine is to create ZFS pools (I'm not sure if you call it like that) to share folders across the network to keep backups and also Network images for my GNS3 instance.

Also, I'd like to have another pool to use for the proxmox VMs storage, not sure how crazy this idea sounds (I know proxmox does ZFS natively, but i wanted to ask if doing it 'my' way, is doable)?

Of course this adds an extra layer and I'd have to start the TrueNAS VM first and wait for it to boot up before the other VMs turns on.

I could also work with proxmox directly but I really don't wanna deep dive on cli and stuff, I prefer a 'set and forget' and I feel TrueNAS GUI is what I really need.

I'm not sure how to get started, or how to approach this.

any suggestions or feedback is always welcomed 😁!

Hey guys!

This is my first time I've worked and an MSP as L3 network engineer, and lowkey it's fun, but we got this important customer who wants us (alternate between my colleague and I) to go on-site every single day in case something isn't working- Like oh they unplugged something up, or.. oh an ethernet plug got unplugged..

I understand this is part of the 'job' but I don't feel quite comfortable going on-site every day as a network engineer to perform level 1 troubleshooting, that's not what I signed off on my mind.

I'd love to raise my concern but I'm not sure either if it's doable, or maybe negotiating, although due to it being a massive client, I don't think I can advocate for both me and my colleague. Perhaps suggesting a L1 to be onsite?

I really like my job in general, but I feel it's excessive for us to be on-site every single weekday, especially as we have more clients with us.

Is this normal as network engineers?

It's my first time guys so please be kind 🙏🙏

I'm open to any feedback/advice :)

Hey everyone, I need to share a wild experience with my failing 1TB NVMe Samsung 970. This morning, my laptop suddenly marked it as read-only.. It had failed with error "Could not send DTS Short". I was about to do a backup.. literally about to with my new workstation and then this happened, so I was really on edge.

After my earlier post, and helps of othered I urgently got a dual NVMe/SATA enclosure, placed the faulty SSD drive, and then connected it to my workstation. The drive, still BitLocker encrypted, kept saying access denied even though I had the key, attempt after attempt, third party and other third party.. nothing.. But, by some miracle, after countless attempts, it finally unlocked, just once. I rush into copying the important files directly to my workstation. I verified the files and most of my personal data was intact. A few image folders were corrupted, but nothing critical.

After that, I installed Windows on a separate 480GB SATA drive I had laying around, and thought, since it worked on the workstation, I could just do the direct backup on the laptop too. But after disconnecting it from the workstation and plugging it back into my laptop, even with the correct BitLocker key, the drive kept disappearing, no more access denied error, simply no recognition at all. I took it back to the workstation hoping for another miracle, but now it shows the same symptoms as the laptop, disappearing completely even with the correct key.

I feel like SSD gods gave me one final chance to safe my files, and I took it!,

RIP SSD (and f* you)