Five dead SSH sessions filled every VTY line on IOS XE 17.18.2 and new SSH was refused. clear line from the console, then service tcp-keepalives-in, exec-timeout 5 0 and a reserved admin line, with real show users timings for each fix.
An inherited IOS XE config had Type 7 passwords, an old Type 5 secret and a Type 7 OSPF key. Every Type 7 decoded in seconds. The migration to Type 8 and Type 6, then two Type 6 failures: a copied string and a deleted master key that broke OSPF after reload.
login block-for on IOS XE 17.18.2 stopped an SSH password loop after three tries, then the default sl_def_acl locked out the admin too. The quiet-mode access-class fix, the login local line AAA removed, and syslog proof of both sides.
A sniffed SNMPv2c RW community and one snmpset shut a router interface and dropped OSPF on IOS XE 17.18.2. The fix: remove the communities, add SNMPv3 authPriv with an ACL, and solve the AES-256 Blumenthal vs Reeder mismatch with SHA-256.
An incident-style CoPP policy left OSPF in class-default with an 8 kbps drop policer. A ping flood took the neighbor down about 38 seconds in, and a lighter flood stalled it in EXCHANGE. Real counters, the diagnosis, and the class order that fixed it.
A VTY access-class with a subnet mask instead of a wildcard locked the NOC out of SSH on IOS XE 17.18.2. After the fix, moving management into a VRF locked it out again with zero ACL hits. Both recoveries from the console, and the access-class vrfname fix.
Save show output from an IOL console and a pcap from the client namespace in one Containerlab run: 10 ICMP frames, 0 kernel drops, management addresses redacted, and the node named host that put the veth in the wrong namespace.
FMCv used 32.21 GiB of a 63 GiB lab host. IOL, IOSv-L2, ASAv and single-FTDv labs each ran beside it with 21 to 29 GiB available. Two FTDv nodes left about 13 GiB and FMC went unhealthy for 183 seconds.
Twelve feature labs on IOL, IOL-L2 and IOSv-L2 in Containerlab. IOSv-L2 learned DHCP snooping bindings, ran DAI and wired EAP-TLS; IOL-L2 passed IPSG with a static binding and RA Guard. Neither switch image passed every test.
With the ASA clock on UTC-8, its legacy syslog timestamp carried no timezone, so a collector that assumed UTC put an ASA deny almost eight hours before the IOS XE permit for the same ping. UTC plus logging timestamp rfc5424 fixed the order.
A short Zeek script flagged 6 rogue DHCP replies and 3 false gateway ARP replies on an IOL-L2 switch, but only with SPAN on the client port. Without SPAN the sensor still saw broadcasts and none of the attack frames.
Suricata 8.0.3 as an inline IPS on NFQUEUE between two Cisco IOL routers: one drop rule stopped one UDP payload, proven by pcaps on both sensor interfaces, fast.log, EVE and the NFQ count. --runmode single failed; workers worked.