In-depth tutorials on OSPF, BGP, 802.1X, and more- for engineers who want to understand the why, not just the how.
Open Shortest Path First, the link-state IGP behind most enterprise networks. Articles tagged OSPF cover neighbor relationships, LSA types, areas, DR/BDR election, and Cisco IOS XE configuration.
60 posts
Border Gateway Protocol, the path-vector protocol that holds the internet together and increasingly runs inside enterprise data centers. Articles tagged BGP cover fundamentals, neighbor states, path attributes, best-path selection, traffic engineering, and Cisco IOS XE configuration.
59 posts
Port-based network access control, the standard for authenticating users and devices onto wired and wireless networks. Articles tagged 802.1X cover supplicant and authenticator behavior, RADIUS, EAP methods, Cisco ISE, dynamic VLANs, dACLs, host modes, and phased deployment.
38 posts
Virtual LANs and Layer 2 switching, the foundation of every campus network. Articles tagged VLAN cover fundamentals, trunking, inter-VLAN routing, EtherChannel, troubleshooting, and campus design on Cisco Catalyst switches.
47 posts
Enterprise Wi-Fi on Cisco Catalyst 9800, the WLC platform that replaced the AireOS generation. Articles tagged Wireless cover the configuration model, AP join, WPA3, FlexConnect, RRM, fast roaming, SSO HA, and IOS XE troubleshooting.
52 posts
Spanning Tree Protocol, the loop-prevention mechanism that keeps Layer 2 networks stable. Articles tagged STP cover port roles and states, RSTP and MST, root bridge configuration, BPDU Guard and Root Guard hardening, and Cisco Catalyst troubleshooting.
36 posts
%CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.
An err-disabled port stays down forever by default, because nothing auto-recovers until you arm it. The full cause list from IOS XE 17.18.2, how to identify which one fired in ten seconds, and the captured proof that auto-recovery is a retry loop rather than a fix.
MAB with no ISE node and no licence: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
The NAT config looks correct and nothing is translating. One command splits the problem in two: no entry means the traffic never matched, an entry means the failure is downstream. Captured on IOS XE 17.18.2 in CML, where a single missing ip nat inside leaves the table empty at 0 hits.
Dual-active HSRP is invisible from one router: each end looks like a healthy Active gateway until you put both outputs side by side and see Standby=unknown on each. Captured live on IOS XE 17.18.2 in CML, plus the preempt behaviour that silently inverts your design.
A traceroute whose hop addresses repeat until the TTL runs out is a routing loop, and nothing else. Captured on CML with IOS XE 17.18.2: the symptom signature, why TTL keeps a routing loop from behaving like a Layer 2 loop, the four causes ranked by real frequency, and the Null0 discard route...
Two equal links, one carrying everything. CEF picks a path per flow, not per packet, and when every router in a tier runs the same hash you get polarization. Proven on real route, CEF and exact-route output from a CML lab on IOS XE 17.18.2.
An IPv6 host with only an FE80:: address is waiting on a Router Advertisement that never came. Captured on CML with IOS XE 17.18.2: the five NDP messages, the neighbor cache states, the A/M/O flags in a real RA, and why filtering ICMPv6 unplugs a segment.
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.