r/networking

So here I am, about 7 years in, Senior Engineer that still (very often) references white papers for a lot of configuration context. It’s not that I don’t know the tech and the logic, it’s more of a devils advocate tactic I do to myself for reassurance, even this far into my career. Do any of you mid-sr level do this as well, like a lot haha ?

For context, I’m not saying it’s looked down upon for referencing, it’s practically how I/You learn and very much the go-to way I tell junior engineers to take before escalation. There’s just times I feel heavy with Imposter Syndrome (aware this doesn’t go away haha). Surely I’m not alone 😆

Hi guys, recently in company we bought 2 refurnished AIR-CAP3702I-E-K9. I've been fighting this for a couple of weeks and could use a second pair of eyes.

Setup

• Mobility Express 8.10.196. 0 running on an AIR-AP1832I-E-K9
• 4x AIR-CAP3702I-E-K9 joined and working fine (primary 8.10.196.0, backup 8.10.185.0)
• APs on trunk ports, native VLAN 5 (management), DHCP for VLAN 5 on the core switch
• No Cisco support contract, so I can't just download images whenever I need them

Background: what happened before

I bought two refurbished 3702Is from a local supplier. Both failed:

• AP #1 started dropping off the controller (Echo Timer Expiry, DTLS closed, constant image download attempts). The WLC log was full of IMAGE_DOWNLOAD_ERR2: Refusing image download request ... max downloads (5) in progress. After a power cycle it wouldn't boot at all: "no bootable files". In ROMMON, ap3g2-k9w8-xx.153-3.JK11 (the actual IOS file) was 0 bytes, and it was the only image on flash. No RCV image.
• AP #2 (the spare) boot-looped with %DOT11-2-FAILURE_RADIO_RESET ... hostmem badmagic and "Radio FW image download failed" on both radios. It came up on maybe every 4th boot. Clearly hardware.

Before sending them back, I caught AP #2 in a good boot and used archive tar /create to pull its JK11 image to my TFTP server (Ubuntu + tftpd-hpa). The resulting tar has no folder prefix, so I repacked it so the paths start with ap3g2-k9w8-mx.153-3.JK11/. I also pulled an RCV image off another AP the same way. So now I at least have backups of both.

Where I am now

The supplier sent a replacement 3702I. It came with JD4/JF5 and an old RCV (15.3(3)JD). I cleaned up flash, loaded JK11 from ROMMON with tar -xtract, set BOOT to JK11 with RCV as fallback, and it boots fine:

Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JK11
LWAPP image version 8.10.196.0
AP image integrity check PASSED

So the version matches the controller exactly. The AP gets DHCP, finds the WLC, DTLS comes up, and it even shows in show ap summary and the ME dashboard. But it never actually comes up properly. On join, the WLC tells it to download an image that doesn't exist:

%CAPWAP-5-SENDJOIN: sending Join Request to 172.16.5.200
perform archive download capwap:/c3700 tar file
%CAPWAP-6-AP_IMG_DWNLD: Required image not found on AP. Downloading image from Controller.
%Error opening capwap:/c3700 (OK)
Download image failed, notify controller!!! From:8.10.196.0 to 0.0.0.0, FailureCode:4
capwap_image_proc: unable to open tar file

After that, Join Requests go unanswered and the WLC closes DTLS every ~60 seconds. Repeat forever.

WLC side

%CAPWAP-4-INVALID_STATE_EVENT: ... AP(4c:77:6d:5d:ea:f0) event (Capwap_join_request) and state (Capwap_image_data) combination
%LWAPP-3-IMAGE_DOWNLOAD_ERR6: AP did not complete Pre-Download Image 4c:77:6d:5d:ea:f0 - During scheduled autoreboot
%LWAPP-3-IMAGE_DOWNLOAD_ERR7: Waiting for 1 APs to complete their Pre-Download Image - For scheduled autoreboot.

Earlier, while the AP was still on its factory RCV (8.3.102.0):

%CAPWAP-3-DISC_MAX_DOWNLOAD: Ignoring discovery request from AP 4c:77:6d:43:dd:64 - maximum number of downloads (5) exceeded

show ap image all:

Initiated....... 1
Downloading..... 5

AP Name           Primary     Backup      Predownload Status
AP-SPRAT-01       8.10.196.0  8.10.185.0  None
AP-SPRAT-02       8.10.196.0  8.10.185.0  None
AP-PRIZ-02        8.10.196.0  8.10.185.0  None
AP-PRIZ-01        8.10.196.0  8.10.185.0  None
AP-HALA-01        8.10.196.0  8.10.185.0  None
AP4c77.6d43.dd64  8.10.196.0  0.0.0.0     Initiated

The counter says 5 downloading, but no AP is actually downloading. I suspect these slots have been stuck since a previous upgrade (8.10.185.0 → 8.10.196.0), and that this is also what killed AP #1 in the first place.

What I've tried

• show reset: no reset scheduled
• config ap image predownload abort all: accepted, no change
• config ap image predownload abort <AP name>: accepted, no change

What would you do next? I would really appreciate your help. I can post the logs of AP and WLC if it would be helpful.

Hello everyone,

I’d like to optimize the network design and separate core and edge routing.

So far, I’ve been using three routers that handle both inter-VLAN routing and edge routing and are part of a VRRP cluster.

Now I’d like to deploy a core router running VyOS that acts as the default gateway for all networks and initially handles inter-VLAN routing. The three edge routers will be connected to this core router, with each one connected to a different Internet line or provider.

The core router should use policy-based routing to determine which networks, clients, or services are routed to the Internet via which edge router or WAN connection. Additionally, failover should still be available in the event of an Internet connection failure (as has been the case with VRRP).

My question is: what is the best way to set up this configuration? On the one hand, I could set up a transport network containing the three edge routers and use VRRP again. In that case, I would likely need a transit switch between the core router and the edge routers so that the VRRP cluster’s traffic does not have to pass through the core router’s CPU.

On the other hand, it would certainly also be possible to connect the edge routers directly to the core router’s interfaces and operate without VRRP. Which protocol could I then use to implement both policy-based routing and failover?

Which network design would you recommend for my situation? I’d appreciate any tips and assistance.

Thank you in advance for your tips, and best regards

Regina (she/her)

I've been in this field about 8 years now and am at the point where I need to get my certs up. I have a Juniper account through my work and a cisco learning account. This is a two part question.

1. I see no options to access amy form of a lab on juniper HPE, everything that includes a lab is $2k-$4k for a 3 day online course, which Im sure will be led by someone with a heavy accent.. Always helpful when trying to learn. So are there any options of virtual juniper labs out there? Something similar to packet tracer where I can actually practice and not just listen to some guy.

2. For those who are self-taught, whats your method? I'm primarily a hands-on learner and pick things up quick so long as I can practice. Packet tracer is fine for cisco, but I really need juniper routing practice. Any advice?

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Please correct me or enlighten me on my understanding of SASE framework:

SA - Secure Access --> basically allowing users to access the resources, cloud or on prem, in the most secured way
SE - Secure Edge - Making sure all traffic between any sites edge router/firewall is reaching its destination, whether another site or internet, in a secured manner.

sub components: ZTNA, CASB, SWG, FWaaS, SD - Wan

ZTNA - Continuously verifying user & device identity. Unlike old methods like enforcing NAC via AAA server like ISE, here client/device was authenticated only once initially.

Palo-alto global protect, Zscalar client, forti-client, cisco anyconnect/secure access can be used to implement it. Basically, all laptop traffic will be tunneled to DC OR all laptop traffic will be analyze be a firewall. FW can be cloud or on prem.

CASB - Cloud access secure broker - as name suggests, allowing users to access cloud applications, like share-point in a typical office environment, in a secured manner.

No idea how to implement it but i guess same products as above would help. OR may be some firewall in between.

SWG - Again, as name suggests, allowing users to access internet in a secured manner.

same products as above can be used to implement it. Or in work from office environment, tunnelling all traffic from branch to HQ/DC and breaking to internet from DC/HQ where we have high end firewalls with strict policies and maybe ssl inspection enabled.

FWaaS - a subscription based firewall services offered by some other company. This firewall services maybe on prem BUT its mostly cloud based.

SD - WAN - dynamic traffic steering, in a secured way, based on policies/rules set by the admin.

Numerous sd-wan vendors, like catalyst sd wan, versa sd wan, silver peak, fortigate etc. Some companies have firewall integrated with SD-WAN so we have more security features in a same box OR managed by central manager.

Question:

1. is this correct?
   SA components are - ZTNA, CASB and SE components are - SWG, FWaas, SD-WAN

2. If i need to implement SASE framework in a enterprise, lets say a retail store network like Walmart or fast food chain like McDonalds, where sites can be categorized as: Stores, warehouses, Corporate office, DC, HQ etc.

So what would be my approach to implement SASE framework?

And what solutions are offered by different vendors? and how to integrate different vendors to achieve the goal? Because many companies would use cisco entirely in their lan, other vendor in wlan, then another for firewall, vpn, and sd-wan..so on.

TLDR: Please guide me on SASE framework, its implementation, solutions offered by different vendors and how to integrate them.