Time-based ACLs, object groups, and IPv6 ACLs on Cisco IOS XE, with real output including a schedule that shows inactive because of when the lab ran. Make policy readable, reusable, and time-aware instead of a flat wall of lines.
ND Inspection, IPv6 Snooping, and IPv6 Source Guard stop address spoofing that RA Guard cannot see. This covers how the device-tracking binding table learns which IPv6 address belongs on which port and how the switch enforces it.
Any device on an IPv6 segment can send a Router Advertisement and reconfigure every host's default gateway. This post configures RA Guard and DHCPv6 Guard, then floods rogue RAs to prove the switch blocks them.
uRPF asks one question of every arriving packet: do I have a route back to this source? Configure strict mode on IOS XE, fire spoofed packets at the router, and count the drops, then see where loose mode fits instead.
A traffic flood aimed at the router's own CPU can drop OSPF and BGP adjacencies without a single link failing. CoPP is the seatbelt: a QoS policy on the control plane that rate-limits each traffic class.
Who logged in, what they could run, and who typed the command that broke the network. This article configures real AAA on Cisco IOS XE, authenticates a live login against RADIUS, shows the exchange on the wire, and compares TACACS+ vs RADIUS.
Conditional debug lets you ask a Cisco IOS XE router a narrow question instead of melting it with unfiltered output. Proven in the lab: two pings run, and only the matching one appears in the debug.
NTP keeps most networks within a second; trading floors, 5G fronthaul, and substations need microseconds. This article explains the structural limit that makes NTP incapable of that job and how PTP (IEEE 1588) solves it.
SLAAC, stateless DHCPv6, and stateful DHCPv6 can all run at once, arbitrated by the M and O flags. This article untangles all three, then builds a stateful server with a relay on Cisco IOS XE and a real Linux client taking a lease.
SPAN, RSPAN, and ERSPAN configured on real Cisco gear, with the ERSPAN packets captured arriving at a real Linux host. Three ways to mirror traffic to Wireshark, separated by how far the analyzer sits from the traffic.
A static route stays in the table as long as the interface is up, even when the path is dead. This post pairs object tracking with an IP SLA probe to build a static route that tests the path, then kills the path to prove it works.
IP SLA answers "is this path usable," which is not the same question as "is this link up." Captured on CML with IOS XE 17.18.2: ICMP and jitter probes against a deliberately degraded link, then a full tracked failover with the SLA timing out, %TRACK-6-STATE logging the object down, and the...