# Ping Labz
> Ping Labz helps you master IT certifications with hands-on Cisco networking labs, cybersecurity tutorials, and practical guides for CCNA, CCNP, and Security+.
Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).

## Pages
- [802.1X Complete Guide: Port-Based Network Access Control](https://www.pinglabz.com/802-1x.md) - 802.1X decides whether a device gets on your network before a single user frame passes. This cluster overview covers the three protocol roles, EAP methods, switch configuration, host modes, dynamic VLANs, dACLs, and rollout strategy.
- [About PingLabz](https://www.pinglabz.com/about.md) - PingLabz is networking education for engineers who want production-realistic Cisco content: cluster pillar guides, hands-on labs with downloadable CML topologies, and printable field-reference PDFs, all verified on real Cisco IOS XE 17.x devices.
- [BGP (Border Gateway Protocol)](https://www.pinglabz.com/bgp.md) - Cluster overview for the PingLabz BGP series: fundamentals, configuration, traffic engineering, troubleshooting, security, and design, all built on a consistent Cisco IOS XE 17.x lab. BGP runs over TCP 179 and holds the internet together.
- [Blog](https://www.pinglabz.com/blog.md) - The full PingLabz blog feed. Browse every published article and lab writeup in one place, from protocol deep dives with real Cisco IOS XE output to hands-on CML labs.
- [Contact](https://www.pinglabz.com/contact.md) - How to reach PingLabz at contact@pinglabz.com for billing, content access, lab errors, corrections, or collaboration. Responses within 2 business days; billing issues usually get a same-day answer.
- [Disclaimer](https://www.pinglabz.com/disclaimer.md) - PingLabz content is provided for general informational and educational purposes: IT learning, career development, and certification prep. It is not legal, financial, or other professional advice. Use it at your own discretion.
- [EIGRP (Enhanced Interior Gateway Routing Protocol): The Complete Guide](https://www.pinglabz.com/eigrp.md) - The cluster overview for the PingLabz EIGRP series: the DUAL algorithm behind its convergence, K values and the composite metric, configuration on Cisco IOS XE, stub routing, and how EIGRP compares to OSPF and BGP.
- [FHRP (First Hop Redundancy Protocol): The Complete Guide](https://www.pinglabz.com/fhrp.md) - HSRP, VRRP, and GLBP all solve the same problem: a virtual gateway that survives router failure. This cluster overview covers the protocol family, how each one works, and the design patterns that tie FHRP to STP and the rest of the LAN.
- [GRE Tunnels: The Complete Guide for Network Engineers](https://www.pinglabz.com/gre.md) - Cluster overview for the PingLabz GRE series: how RFC 2784 encapsulation works, the packet format, configuration, and why GRE still underpins more enterprise overlays than any other tunnel technology three decades on.
- [IPv6: The Complete Guide for Network Engineers](https://www.pinglabz.com/ipv6.md) - The cluster overview for the PingLabz IPv6 series: the 128-bit address format, address types, the simplified header, ICMPv6 and Neighbor Discovery, and SLAAC. IPv6 is no longer optional knowledge, and this is the map.
- [MPLS (Multiprotocol Label Switching): The Complete Guide](https://www.pinglabz.com/mpls.md) - MPLS forwards on labels instead of IP lookups and underpins L3VPN, traffic engineering, and segment routing. This cluster hub covers the label stack, LDP, MP-BGP VPNv4, and how MPLS coexists with SD-WAN.
- [OSPF Complete Guide: From Fundamentals to Enterprise Design](https://www.pinglabz.com/ospf.md) - OSPF from fundamentals to enterprise design: LSA types, area types, DR/BDR election, configuration, and troubleshooting, all built on Cisco IOS XE 17.x. The hub for the full PingLabz OSPF series.
- [Privacy Policy](https://www.pinglabz.com/privacy-policy.md) - What data PingLabz collects, how it is used, and your rights: account details, Stripe-handled payment processing, and the site's analytics. Updated 11 May 2026.
- [QoS (Quality of Service): The Complete Guide for Cisco Engineers](https://www.pinglabz.com/qos.md) - QoS decides which packets win when bandwidth runs out. This is the hub for the PingLabz QoS series: classification and marking, MQC, DSCP, queueing, policing, shaping, voice and video, and QoS in SD-WAN and wireless.
- [SD-WAN: The Complete Guide for Network Engineers](https://www.pinglabz.com/sd-wan.md) - The cluster overview for the PingLabz SD-WAN series: architecture, Cisco Catalyst SD-WAN, vendor comparisons, security and the SASE convergence, and deployment models for the WAN that replaced dedicated MPLS circuits.
- [Spanning Tree Protocol (STP) Complete Guide: From Fundamentals to Enterprise Hardening](https://www.pinglabz.com/spanning-tree-protocol.md) - The complete Spanning Tree guide: how STP keeps Layer 2 loop-free, the PVST+, Rapid PVST+, and MST variants, configuration, hardening features, troubleshooting, and enterprise design on Cisco Catalyst switches.
- [Topics](https://www.pinglabz.com/tags.md) - Every topic on PingLabz, from routing protocols to hands-on labs captured on real Cisco gear.
- [Terms of Service](https://www.pinglabz.com/terms-of-service.md) - The terms governing your use of pinglabz.com: free accounts and PingLabz Pro subscriptions, your responsibilities as a member, and how PingLabz content and services may be used.
- [VLANs & Layer 2 Switching](https://www.pinglabz.com/vlans-layer-2-switching.md) - The complete VLANs and Layer 2 switching series — 22 articles covering VLAN fundamentals, trunking, inter-VLAN routing, EtherChannel, troubleshooting, and campus design on Cisco Catalyst switches.
- [Cisco Wireless: The Complete Guide](https://www.pinglabz.com/wireless.md) - The cluster overview for Cisco wireless on the Catalyst 9800: platform architecture, the AP join process, tags and profiles, WLAN configuration, FlexConnect, RRM, mobility, and troubleshooting clients that will not roam cleanly.

## Posts
- [TCP Three-Way Handshake and Teardown, Captured](https://www.pinglabz.com/tcp-handshake-teardown-capture.md) - The three-way handshake is the first thing anyone learns about TCP and the last thing most people actually look at. SYN, SYN-ACK, ACK is easy to draw. What is harder, and far more useful, is reading a real capture and knowing at a glance whether the connection was refused, reset mid-stream, closed…
- [DHCP DORA Explained with a Real Packet Capture](https://www.pinglabz.com/dhcp-dora-packet-capture.md) - Discover, Offer, Request, Ack. You can recite DORA in your sleep, and it still will not help you the day a client comes up with a 169.254 address and the server insists the pool is fine. What helps is knowing which of the four packets actually appeared, which fields they carried, and where in the p…
- [OSPF Hello Packets Explained with a Real Capture](https://www.pinglabz.com/ospf-hello-packet-capture.md) - Every OSPF adjacency you have ever built started with a Hello packet, and almost every adjacency that refuses to build is a Hello packet being quietly thrown away. The trouble is that show ip ospf neighbor only tells you the outcome. It will not tell you that the other router is advertising a 5 sec…
- [Install Zabbix 7.0 LTS in Docker Alongside Grafana](https://www.pinglabz.com/install-zabbix-7-0-lts-in-docker-alongside-grafana.md) - Two monitoring platforms, one Ubuntu box, zero port collisions. Plus the built-in host that cannot reach its own agent, and why apt was not an option.
- [How to Install Grafana Enterprise on Ubuntu Server](https://www.pinglabz.com/how-to-install-grafana-enterprise-on-ubuntu-server.md) - From an empty Ubuntu box to a Grafana login screen: APT repo, systemd, and the 20-second gotcha that makes people think the install failed.
- [Linux Networking Field Reference (10-Page Printable Cheat-Sheet)](https://www.pinglabz.com/linux-networking-cheatsheet.md) - Ten printable pages of Linux networking commands, flags and real lab output, including a ten-symptom troubleshooting decision tree. Free for members.
- [Top Linux Networking Commands: The 2026 Field Reference](https://www.pinglabz.com/top-linux-networking-commands.md) - Every Linux networking command that matters, grouped by the question it answers, with real captures from a four-hop lab and the triage order to run them in.
- [ufw: Simple Firewalling on Debian and Ubuntu](https://www.pinglabz.com/ufw-linux.md) - Enable ufw without losing your SSH session, learn the rule grammar, and see exactly which iptables chains it builds underneath.
- [nftables: The Modern Linux Firewall](https://www.pinglabz.com/nftables-linux.md) - Your iptables rules already run on nftables. Handles, named sets, inet tables and atomic ruleset loads, all proven with real output from a live lab.
- [iptables Fundamentals: Tables, Chains, Real Rules](https://www.pinglabz.com/iptables-linux.md) - Tables, chains and rule order, demonstrated with real captures from a Debian host in a live lab: DROP against REJECT timing, conntrack, logging and NAT.
- [/proc/net and Networking sysctls: Where the Numbers Come From](https://www.pinglabz.com/proc-net-linux.md) - Every Linux networking tool is a formatter over a handful of kernel files. Here is what is in them, how to read the hex, and what happens when you change the sysctls that matter.
- [iftop, nload, bmon, vnstat, nethogs Compared](https://www.pinglabz.com/linux-bandwidth-monitoring.md) - Five live bandwidth monitors pointed at the same flow at the same time, with real terminal frames and a reconciliation of why they all report different numbers.
- [ngrep: grep for Network Traffic](https://www.pinglabz.com/ngrep-linux.md) - Pattern matching against live packet payloads. The syntax, the hex mode, the file interop, and a real capture showing the server name leaking out of an encrypted session.
- [tshark: Wireshark in the Terminal](https://www.pinglabz.com/tshark-linux.md) - Wireshark’s full dissector library driven from an SSH session: capture filters against display filters, custom field output, ring buffers and the statistics taps that make triage fast.
- [SSH Beyond Login: Tunnels, Jump Hosts, scp/sftp](https://www.pinglabz.com/ssh-tunneling-scp.md) - Local, remote and dynamic forwards, ProxyJump instead of agent forwarding, scp -O against IOS XE, and why telnet is still a fine port tester.
- [socat: Port Forwarding and Bidirectional Relays](https://www.pinglabz.com/socat-linux.md) - One command joins any two endpoints: TCP, UDP, TLS, UNIX sockets, serial ports or a program. Port forwards, TLS wrappers and protocol bridges from real captures.
- [netcat: Port Checks, File Transfers, Listeners](https://www.pinglabz.com/netcat-nc-linux.md) - Open, refused, timed out and no route to host are four different tickets. Plus banner grabs, file transfer with no server, and why UDP tests lie.
- [wget: Downloads, Mirrors, Connectivity Tests](https://www.pinglabz.com/wget-linux.md) - The retry and resume behavior that makes wget worth keeping, spider mode as a health check, rate limiting, and the robots.txt rule that empties your mirror.
- [curl for Network Engineers: Ports, HTTP, APIs](https://www.pinglabz.com/curl-network-engineers.md) - Prove a port is open, split DNS from TCP from server think time, test a device API and read a TLS failure, all with real output from a routed lab.
- [How Linux Resolves Names: resolv.conf, systemd-resolved, nsswitch](https://www.pinglabz.com/linux-dns-resolution.md) - dig tests a nameserver. getent tests name resolution. The full path from nsswitch.conf to the wire, with the resolver deliberately broken and fixed.
- [host: The Fastest DNS Lookup Tool](https://www.pinglabz.com/host-command-linux.md) - One name in, one line out, and the only exit status of the three you can trust. Plus the timing test that complicates the fastest claim.
- [nslookup: Quick DNS Queries That Still Matter](https://www.pinglabz.com/nslookup-linux.md) - Declared deprecated for twenty years and still on every machine. What it does well, where it will mislead you, and the debug flag nobody uses.
- [dig: The Complete DNS Query Guide](https://www.pinglabz.com/dig-command.md) - Read the status line first. Flags, sections, TTLs, delegation traces and DNSSEC, all against a real authoritative server in the lab.
- [netstat vs ss: Why It Was Replaced and How to Switch](https://www.pinglabz.com/netstat-vs-ss.md) - The full command map, wall clock timings on a host holding ten thousand sockets, and the surprise result when you add process lookup.
- [ss: The Modern Socket Statistics Tool](https://www.pinglabz.com/ss-command-linux.md) - Queue columns that tell you which end stopped working, filters that run in the kernel, and the TCP internals nothing else on the box will give you.
- [tracepath and Path MTU Discovery on Linux](https://www.pinglabz.com/tracepath-pmtu.md) - Small things work and big things hang. One unprivileged command finds the narrow link, and one iptables rule shows what a black hole looks like.
- [mtr: Continuous Path Monitoring on Linux](https://www.pinglabz.com/mtr-linux.md) - Loss and latency per hop against a link with 12 percent loss injected on purpose, and the one rule that separates real loss from cosmetic loss.
- [traceroute: UDP, ICMP, and TCP Modes Explained](https://www.pinglabz.com/traceroute-linux.md) - Three probe types down one four hop path, the packets on the wire for each, and the ICMP rate limit that makes a perfect path look broken.
- [nmcli and nmtui: Managing Connections from the CLI](https://www.pinglabz.com/nmcli-linux.md) - Devices against connection profiles, the activation step everybody forgets, and how to make a configuration survive a reboot.
- [ethtool: Link Speed, Duplex, Offloads, NIC Stats](https://www.pinglabz.com/ethtool-linux.md) - The driver layer below the kernel: link settings, offloads that make packet captures disagree with the wire, rings, and where host-side drops show up.
- [ARP on Linux: ip neigh, arp, and Neighbor States](https://www.pinglabz.com/ip-neigh-arp-linux.md) - The six-state neighbor machine walked live on a real lab, the tunables behind it, and why arp -n cannot show you any of it.
- [ifconfig, route, netstat: Legacy net-tools to iproute2](https://www.pinglabz.com/ifconfig-vs-ip.md) - The full command map, and the same host through both toolsets so you can see exactly what the legacy tools hide from you.
- [ip route: Managing the Linux Routing Table](https://www.pinglabz.com/ip-route-linux.md) - Every field in a route line, get against show, blackhole routes, the replace gotcha, and policy routing with multiple tables.
- [The Linux ip Command: The Complete Guide](https://www.pinglabz.com/linux-ip-command.md) - The grammar, the four objects you use every day, the output modifiers that make it readable, and how to create interfaces out of nothing.
- [VXLAN EVPN Troubleshooting: What Actually Breaks](https://www.pinglabz.com/vxlan-evpn-troubleshooting.md) - Four faults hit in a real Nexus fabric, the output that identified them, and an ordered method for the next one.
- [EVPN L3VNI and the Distributed Anycast Gateway](https://www.pinglabz.com/evpn-l3vni-anycast-gateway.md) - Symmetric IRB routes between VNIs on the leaf that receives the packet. Here is the L3VNI build and the real output that proves it worked.
- [A Real VXLAN Packet, Header by Header](https://www.pinglabz.com/vxlan-encapsulation-packet-walk.md) - A genuine VXLAN packet captured between a spine and a leaf, taken apart byte by byte from the outer MAC down to the ICMP echo request inside.
- [VXLAN L2VNI Configuration on Nexus, Proven](https://www.pinglabz.com/vxlan-l2vni-configuration.md) - An L2VNI build on a real Nexus fabric, including the vPC anycast VTEP mistake that produced an empty peer table and how it was fixed.
- [BGP EVPN Route Types Explained with Real Output](https://www.pinglabz.com/bgp-evpn-route-types.md) - EVPN route types stop being abstract the moment you read them off a real fabric. Here are Types 2, 3 and 5 from a working Nexus lab.
- [Ingress Replication vs PIM Anycast RP in VXLAN](https://www.pinglabz.com/ingress-replication-vs-pim-anycast-rp.md) - BUM traffic still has to get everywhere in a VXLAN fabric. Here is how ingress replication handles it, and what you give up by not running PIM.
- [Spine-Leaf Underlay with OSPF on Nexus](https://www.pinglabz.com/spine-leaf-underlay-ospf.md) - A spine-leaf underlay should be the least interesting part of your fabric. Here is the OSPF build that gets you there, with real Nexus output.
- [vPC Failure Modes: Peer-Link, Keepalive, Type-1](https://www.pinglabz.com/vpc-peer-link-keepalive-failure.md) - The vPC failure matrix, with the Type-1 mismatch demonstrated on real hardware and the peer-link and keepalive rows explained rather than faked.
- [vPC Explained: Build It and Read Its Health](https://www.pinglabz.com/vpc-explained.md) - A real NX-OS vPC build with the warnings it emits, the health output decoded field by field, and an honest look at orphan ports.
- [Nexus Port-Channels and LACP: Suspended Members](https://www.pinglabz.com/nexus-port-channel-lacp.md) - Why NX-OS rejects channel-group before feature lacp, how to read the port-channel flags legend, and what a suspended member actually means.
- [NX-OS Fundamentals: Your First Thirty Minutes on a Nexus](https://www.pinglabz.com/nx-os-fundamentals.md) - A practical orientation for your first console session on a Cisco Nexus: what the box is, what is turned on, which VRF you are in, and how to save it properly.
- [NX-OS vs IOS XE: What Changes on Your First Nexus](https://www.pinglabz.com/nx-os-vs-ios-xe.md) - If you know IOS XE cold, most of NX-OS will feel familiar until it suddenly does not. Here are the six differences that bite on day one, with real Nexus 9000v output.
- [Native VLAN Mismatch: Read the CDP Log, Fix the Trunk](https://www.pinglabz.com/native-vlan-mismatch-troubleshooting.md) - %CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.
- [MAB with FreeRADIUS on Cisco: MAC Authentication Bypass Without ISE](https://www.pinglabz.com/mab-freeradius-cisco-lab.md) - MAB with no ISE node and no license: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
- [Errdisable Recovery on Cisco: Every Cause and How to Bring the Port Back](https://www.pinglabz.com/errdisable-recovery-cisco.md) - An err-disabled port stays down forever by default, because nothing auto-recovers until you arm it. The full cause list from IOS XE 17.18.2, how to identify which one fired in ten seconds, and the captured proof that auto-recovery is a retry loop rather than a fix.
- [802.1X with FreeRADIUS on Cisco: The Full Lab, No ISE Required](https://www.pinglabz.com/802-1x-freeradius-cisco-full-lab.md) - Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
- [NAT and PAT Troubleshooting on Cisco IOS XE: An Empty Translation Table](https://www.pinglabz.com/nat-pat-troubleshooting-cisco-ios-xe.md) - The NAT config looks correct and nothing is translating. One command splits the problem in two: no entry means the traffic never matched, an entry means the failure is downstream. Captured on IOS XE 17.18.2 in CML, where a single missing ip nat inside leaves the table empty at 0 hits.
- [HSRP Troubleshooting: Both Routers Active and Flapping States](https://www.pinglabz.com/hsrp-troubleshooting-flapping-dual-active.md) - Dual-active HSRP is invisible from one router: each end looks like a healthy Active gateway until you put both outputs side by side and see Standby=unknown on each. Captured live on IOS XE 17.18.2 in CML, plus the preempt behavior that silently inverts your design.
- [CEF Load Balancing and Polarization: Why One Link Gets All the Traffic](https://www.pinglabz.com/ecmp-cef-load-balancing-polarization.md) - Two equal links, one carrying everything. CEF picks a path per flow, not per packet, and when every router in a tier runs the same hash you get polarization. Proven on real route, CEF and exact-route output from a CML lab on IOS XE 17.18.2.
- [Routing Loop Troubleshooting: Detect, Break, and Prevent Them](https://www.pinglabz.com/routing-loops-detect-and-fix.md) - A traceroute whose hop addresses repeat until the TTL runs out is a routing loop, and nothing else. Captured on CML with IOS XE 17.18.2: the symptom signature, why TTL keeps a routing loop from behaving like a Layer 2 loop, the four causes ranked by real frequency, and the Null0 discard route...
- [Detecting Nmap Scans: The View From the Defender's Side](https://www.pinglabz.com/detecting-nmap-scans-cisco-blue-team.md) - The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
- [IPv6 Neighbor Discovery Troubleshooting: Stuck at Link-Local](https://www.pinglabz.com/ipv6-neighbor-discovery-troubleshooting.md) - An IPv6 host with only an FE80:: address is waiting on a Router Advertisement that never came. Captured on CML with IOS XE 17.18.2: the five NDP messages, the neighbor cache states, the A/M/O flags in a real RA, and why filtering ICMPv6 unplugs a segment.
- [tcpdump for Network Engineers: A Practical Reference](https://www.pinglabz.com/tcpdump-for-network-engineers.md) - Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.
- [Scapy vs Cisco Layer 2 Defenses: Crafting and Spoofing Packets](https://www.pinglabz.com/scapy-packet-crafting-spoofing-cisco.md) - Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
- [BGP Route Not in the Routing Table: Why It Is Not Installed](https://www.pinglabz.com/bgp-route-not-in-routing-table.md) - The prefix is in the BGP table and show ip route says % Network not in table. The leading status characters are the whole diagnosis. Captured live on IOS XE 17.18.2 in CML, where a missing next-hop-self leaves an iBGP path valid, inaccessible and never installed.
- [OSPF Stuck in INIT: Diagnosing the One-Way Hello](https://www.pinglabz.com/ospf-stuck-in-init-one-way-hello.md) - INIT means "I hear you, you do not hear me". One router shows a neighbor in INIT, the other shows an empty table, and that asymmetry is the entire diagnosis. Captured live on IOS XE 17.18.2 in CML with an inbound ACL eating OSPF in one direction.
- [BGP Neighbor Stuck in Active, Idle or Connect: Decode the State](https://www.pinglabz.com/bgp-neighbor-stuck-idle-active-connect.md) - Active is a failure state and Idle is where the FSM gives up. Organized by the state you are looking at right now, with a lab finding that matters: on IOS XE 17.18.2 both "no route to peer" and "TCP 179 blocked" showed up as Idle.
- [pyATS and Genie: Diff Cisco Operational State, Not Config](https://www.pinglabz.com/pyats-genie-network-testing.md) - Config diffs tell you your text landed. They do not tell you the interface came up. Here is how pyATS and Genie snapshot live operational state, diff it across a change, and prove a rollback was clean, captured against IOS-XE 17.18.2 in CML.
- [Netmiko vs NAPALM vs pyATS: Three Ways to Diff a Cisco Change](https://www.pinglabz.com/netmiko-vs-napalm-vs-pyats.md) - Netmiko, NAPALM and pyATS answer "did my change do anything?" at three different layers. Same three IOS-XE 17.18.2 routers, same lab, real captured diffs.
- [Nornir and NAPALM: Cisco Config Management That Is Actually Idempotent](https://www.pinglabz.com/nornir-napalm-cisco-config-management.md) - Nornir gives you the inventory and the concurrency netmiko never had. NAPALM asks the router for the diff instead of guessing in Python. Captured on three IOS-XE 17.18.2 nodes, including the dest_file_system fix nobody documents.
- [Netmiko Tutorial for Cisco: SSH Automation That Proves It Worked](https://www.pinglabz.com/netmiko-ssh-automation-cisco.md) - A netmiko walkthrough built from a live capture against IOS-XE 17.18.2: connect, read, parse with TextFSM, push with send_config_set, then prove whether anything actually changed. Includes the ntc-templates key names that fail silently.
- [IPsec over GRE vs GRE over IPsec](https://www.pinglabz.com/ipsec-over-gre-tunnel.md) - IPsec over GRE and GRE over IPsec stack the same two protocols in opposite order, and the order decides what gets encrypted on the wire. This post explains both designs, contrasts them cleanly, and shows when each one belongs.
- [Catalyst 9800-CL in CML: What You Can and Can't Actually Lab](https://www.pinglabz.com/catalyst-9800-cl-cml-limitations.md) - The 9800-CL in CML will never show a joined AP, and it is not your config. Real IOS XE 17.18.2 output shows exactly what a virtual wireless controller can and cannot do, so you spend study time on the parts that actually work.
- [dnswalk: Audit a DNS Zone for Consistency](https://www.pinglabz.com/dnswalk.md) - dnswalk transfers a DNS zone and audits it for internal consistency: missing PTR records, mismatched addresses, and bad delegations. Real Kali output shows you how to read what it flags.
- [dnstracer: Follow the DNS Delegation Chain](https://www.pinglabz.com/dnstracer.md) - dnstracer follows the DNS delegation chain from the root servers down to the authoritative source instead of just dumping records. You see where a nameserver's answer actually comes from, with real output captured from Kali in the lab.
- [dnsmap: DNS Subdomain Brute Forcing on Kali](https://www.pinglabz.com/dnsmap.md) - When zone transfers are refused, brute force is how you enumerate a domain. dnsmap grinds a wordlist of common hostnames against a target and keeps every name that resolves. Real output captured from Kali against a BIND9 server in the lab.
- [massdns: High-Performance DNS Enumeration at Scale](https://www.pinglabz.com/massdns.md) - massdns is a high-performance stub resolver that pushes over 350,000 DNS queries per second by spreading load across public resolvers. See how internet-scale subdomain enumeration works, with real output from Kali in our lab.
- [dnsenum: Enumerate a Domain's DNS End to End](https://www.pinglabz.com/dnsenum.md) - Point dnsenum at a domain and get nameservers, MX records, zone transfer attempts, subdomain brute forcing, and reverse sweeps in one report. Every capture is real output from a Kali box against a BIND9 server in the lab.
- [dnsrecon: The Complete DNS Enumeration Tool Guide](https://www.pinglabz.com/dnsrecon.md) - dnsrecon rolls zone transfers, SRV enumeration, subdomain brute forcing, and reverse lookups into one Python tool. Every command here was run from Kali against a real BIND9 server, with XML, CSV, and JSON export covered.
- [IPv6 Address Examples: Every Type, Worked Through](https://www.pinglabz.com/ipv6-address-examples.md) - A worked example of every IPv6 address type you will actually meet, broken down field by field. Learn to read the first hextet and instantly know if you are looking at link-local, global unicast, multicast, or unique-local.
- [HSRP Configuration on Cisco IOS XE](https://www.pinglabz.com/hsrp-configuration.md) - A working HSRP config is two lines per router, but priority, preemption, tracking, and timers decide how it behaves in production. Walk the full setup on Cisco IOS XE, from the virtual IP to the four settings people skip.
- [IPv6 Transition Mechanisms: Which One, and When](https://www.pinglabz.com/ipv6-transition-mechanisms.md) - Dual-stack, tunneling, and translation each solve a different IPv6 migration problem. This decision guide shows you which mechanism fits which situation and how the three fit together on real networks.
- [NAT64 Explained: Stateful, Stateless, and the DNS64 Half of the Story](https://www.pinglabz.com/nat64-explained.md) - How NAT64 lets an IPv6-only client reach an IPv4-only server: the full stateful configuration on Cisco IOS XE 17.18, the address synthesis math done by hand, the DNS64 half that makes it usable, and an honest platform finding from the lab.
- [IPv6 over IPv4 Tunnels: Manual, GRE, and 6to4 Compared](https://www.pinglabz.com/ipv6-over-ipv4-tunnels.md) - Configure a manual IPv6-over-IPv4 tunnel on Cisco IOS XE 17.18, prove it with a real ping across an IPv4-only core, and compare the three tunnel types you need to know: manual, GRE, and 6to4.
- [IS-IS for IPv6: Multi-Topology and the Single-Topology Trap](https://www.pinglabz.com/is-is-for-ipv6.md) - IS-IS runs a single topology by default, forcing IPv6 down the IPv4 shortest path even where IPv6 is broken. See how multi-topology IS-IS fixes the black hole, with real adjacency output on Cisco IOS XE 17.18.
- [EIGRP for IPv6: Classic and Named Mode on IOS XE](https://www.pinglabz.com/eigrp-for-ipv6.md) - EIGRP for IPv6 is a separate protocol instance with no network statement and link-local next hops. You walk the classic interface-based config on IOS XE 17.18, see real adjacencies and routes, and clear up the shutdown gotcha.
- [The Layer 2 Attack Surface: A Hardening Checklist That Actually Holds](https://www.pinglabz.com/layer-2-attack-surface-hardening.md) - The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
- [Private VLANs: Isolating Hosts That Share a Subnet](https://www.pinglabz.com/private-vlans-explained.md) - Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.
- [VLAN ACLs (VACLs): Filtering Traffic Inside a VLAN](https://www.pinglabz.com/vlan-acls-vacl-configuration.md) - A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
- [Static ARP ACLs: Inspecting ARP Without DHCP Snooping](https://www.pinglabz.com/static-arp-acl-inspection.md) - DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.
- [Router Service Hardening: Turning Off What You Never Needed](https://www.pinglabz.com/cisco-router-service-hardening.md) - Harden a Cisco router by disabling unused services, proven with a real before-and-after Nmap scan taking Telnet from open to closed, plus syslog design.
- [NTP Authentication: Trusting the Clock Your Logs Depend On](https://www.pinglabz.com/ntp-authentication-cisco.md) - Configure authenticated NTP on Cisco IOS XE, why IOS flags MD5 as weak, and how ntp authenticate and trusted-key stop a rogue server moving your clock.
- [Anti-Spoofing on the Edge: ACLs, uRPF, and RFC 2827 in Practice](https://www.pinglabz.com/anti-spoofing-acls-urpf.md) - Build RFC 2827 (BCP 38) anti-spoofing with an ingress ACL and uRPF strict mode, tested with real spoofed packets and live Cisco ACL log evidence.
- [CoPP vs CPPr: Which Control-Plane Defense to Deploy](https://www.pinglabz.com/copp-vs-cppr.md) - CoPP is one aggregate policer; CPPr subdivides the control plane and adds port-filtering. A decision guide backed by a real CoPP police capture.
- [Control Plane Protection (CPPr): Beyond CoPP with Port-Filtering](https://www.pinglabz.com/control-plane-protection-cppr.md) - CPPr subdivides the control plane into host, transit and cef-exception subinterfaces and adds port-filtering, next to real CoPP police captures from CML.
- [ZBF vs ASA vs FTD: Which Firewall Belongs Where](https://www.pinglabz.com/zbf-vs-asa-vs-ftd.md) - Zone-Based Firewall, ASA, and FTD solve different jobs. This comparison uses real command output captured from all three platforms to show you which Cisco firewall belongs where, not which one is best.
- [Nested Class-Maps in ZBF: Building Layered Policy](https://www.pinglabz.com/zbf-nested-class-maps.md) - Flat ZBF policies do not scale. This post shows how nested class-maps let you reuse protocol groups across policies and combine match-all conditions with match-any protocols to build layered, maintainable firewall policy.
- [ZBF Port-Maps: Inspecting Applications on Non-Standard Ports](https://www.pinglabz.com/zbf-port-maps.md) - Your ZBF matches protocol http, but the app on TCP 8080 will not pass because the inspector cannot see it. Port-maps teach the IOS XE protocol inspector about non-standard ports. Real cat8000v output shows the failure and the fix.
- [Zone-Based Firewall on Cisco IOS XE: Zones, Zone-Pairs, and the Policy Model](https://www.pinglabz.com/zone-based-firewall-ios-xe.md) - The Zone-Based Firewall is the stateful firewall inside Cisco IOS XE. This anchor guide covers zones, zone-pairs, the class-map and policy-map model, and the default-drop trap that locks engineers out of their own routers.
- [MPLS Traffic Engineering Explained](https://www.pinglabz.com/mpls-traffic-engineering.md) - OSPF and IS-IS send every flow down the shortest path while parallel links sit idle. MPLS-TE is how you steer traffic onto the paths you choose. This post covers the problem, the components, and why segment routing is changing how it is done.
- [Clientless SSL VPN Is Gone: What Replaced WebVPN on Modern ASA](https://www.pinglabz.com/asa-clientless-webvpn-removed.md) - Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
- [ASDM Access on the ASA: Setup, TLS, and Whether You Should Use It](https://www.pinglabz.com/asa-asdm-setup.md) - Enable ASDM on a Cisco ASA 9.24, hit the image-not-set gotcha, and get the honest 2026 verdict on the Java GUI versus the CLI.
- [IPsec Through an ASA: NAT-T, ESP Pass-Through, and Why the Tunnel Won't Come Up](https://www.pinglabz.com/ipsec-through-asa-nat-t.md) - Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.
- [IKEv1 vs IKEv2 on the ASA: Migrating a Site-to-Site Tunnel](https://www.pinglabz.com/asa-ikev1-to-ikev2-migration.md) - Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.
- [LAN-to-LAN IPsec VPN on the ASA with IKEv2](https://www.pinglabz.com/asa-lan-to-lan-ikev2.md) - A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.
- [Transparent Mode ACLs: EtherType Rules and What Bridges Through](https://www.pinglabz.com/asa-transparent-etherype-acls.md) - EtherType ACLs let a transparent-mode Cisco ASA filter non-IP frames a routed firewall never sees. Learn what bridges through a Layer 2 firewall by default and how to control it.
- [Configuring a Transparent Firewall on the ASA](https://www.pinglabz.com/asa-transparent-firewall-configuration.md) - Typing firewall transparent wipes the ASA's entire running configuration instantly. This walkthrough covers switching modes safely from the console with a saved config, then building a working transparent-mode firewall on the ASAv.
- [TCP Normalization on the ASA: The Silent Connection Killer](https://www.pinglabz.com/asa-tcp-normalization.md) - Connections that die crossing the ASA with no ACL deny are usually TCP normalization. You see the real tcp-map and accelerated-security-path drop counters from an ASAv 9.24 that turn this silent killer into something visible.
- [Custom L7 Inspection on the ASA: Regex, Match Conditions, and Blocking What You Choose](https://www.pinglabz.com/asa-custom-l7-inspection.md) - Build a custom Layer 7 HTTP inspection policy on the ASA that blocks a specific URL by regex, then prove it with a real before-and-after test: one URL loads instantly, the other hangs until timeout. Captured on an ASAv 9.24 in CML.
- [Deep Packet Inspection on the ASA: Application Inspection Engines in Practice](https://www.pinglabz.com/asa-deep-packet-inspection.md) - L3 and L4 filtering is half a firewall. This post shows the ASA's application inspection engines in action on a real ASAv 9.24 in CML, including the default inspection policy and live per-interface counters.
- [The ASA Modular Policy Framework (MPF): class-map, policy-map, service-policy](https://www.pinglabz.com/asa-modular-policy-framework.md) - MPF is the engine under nearly every advanced ASA feature. Build class-maps, policy-maps, and service-policies from scratch on a real ASAv 9.24 in CML, with live counters climbing as a Linux client hits a published web server.
- [Choosing ASA High Availability: Failover vs Clustering vs Contexts](https://www.pinglabz.com/asa-ha-design-comparison.md) - Failover, clustering, contexts, redundant interfaces: the ASA HA menu is long. We tested every option live on asav 9.24, so each supported or rejected cell in this comparison is a tested fact, not a datasheet claim.
- [ASA Clustering Explained: Spanned vs Individual Interface Mode](https://www.pinglabz.com/asa-clustering-spanned-vs-individual.md) - Cisco ASA clustering pools up to sixteen units into one logical firewall that shares load and state. This article explains spanned vs individual interface mode, plus a real capture of ASAv 9.24 rejecting the cluster commands and what that tells you.
- [ASA Resource Classes: Stopping One Context From Eating the Firewall](https://www.pinglabz.com/asa-context-resource-classes.md) - Multiple ASA contexts draw from the same connection, translation, and inspection pools. Resource classes cap and guarantee slices of firewall capacity so one busy context cannot starve the rest.
- [ASA Security Contexts with Shared Interfaces: Classification Rules](https://www.pinglabz.com/asa-shared-interface-contexts.md) - When ASA security contexts share a physical interface, the classifier decides which context owns each incoming packet before any policy applies. Learn the classification rules that keep multi-tenant traffic out of the wrong tenant.
- [ASA Active/Active Failover: Failover Groups and Asymmetric Reality](https://www.pinglabz.com/asa-active-active-failover.md) - Active/Active failover needs multiple context mode and invites asymmetric routing. Watch a real ASAv 9.24 refuse the mode, then see the capture that proves what you should be running instead for most deployments.
- [EtherChannel on the Cisco ASA: Port-Channels, LACP, and Failover Interaction](https://www.pinglabz.com/asa-etherchannel-port-channel.md) - How EtherChannel bundles ASA links into one pipe with LACP, and how it interacts with failover. Includes a real-lab reality check: the ASAv 9.24 parser rejects every Port-channel command, and we show you exactly where.
- [ASA Redundant Interfaces: The Simplest Link HA You Can Configure](https://www.pinglabz.com/asa-redundant-interfaces.md) - ASA redundant interfaces bundle two physical ports into one logical interface for fast link-level HA without full unit failover. We tried it on a real ASAv 9.24, the parser refused, and that rejection is the most useful part of this post.
- [NAT and ACLs Together on ASA 8.3+: Real IPs, Not Mapped IPs](https://www.pinglabz.com/asa-nat-acl-real-ip.md) - Since ASA 8.3, interface ACLs reference the real, post-translation IP, never the mapped one. A before-and-after on one flow, allowed with a real-IP rule and dropped with a mapped-IP rule, settles the most misunderstood ASA behavior.
- [The ASA NAT Table Explained: Sections, Order, and Which Rule Wins](https://www.pinglabz.com/asa-nat-table-order.md) - ASA NAT stops being a guessing game once you can read the NAT table: three sections, top to bottom, first match wins. This guide shows you the table in one command and how to predict which rule translates a packet.
- [Static Identity NAT on the ASA: Translating Nothing, On Purpose](https://www.pinglabz.com/asa-static-identity-nat.md) - Identity NAT is the ASA rule whose whole job is to not translate. You build a static identity NAT between an inside network and a DMZ on a live ASAv, then prove it changes nothing with show nat detail and packet-tracer.
- [Destination NAT on the ASA: Policy NAT for Inbound Services](https://www.pinglabz.com/asa-destination-nat.md) - Publish a private server through a Cisco ASA with destination NAT: the static object NAT config that maps a public address inbound, plus the exact order the ASA processes the packet on the way in.
- [ASA Management Access Done Right: SSH, HTTPS, SNMPv3, NTP, and Logging](https://www.pinglabz.com/asa-management-access-configuration.md) - Configure SSH, HTTPS, SNMPv3, NTP, and syslog on the Cisco ASA the secure way. Every capture is real, taken over SSH from a Linux host to an ASAv 9.24(1) running in Cisco Modeling Labs.
- [RIPv2 on the Cisco ASA (and Why You'd Still See It)](https://www.pinglabz.com/asa-ripv2-configuration.md) - RIPv2 still shows up at interop boundaries, so here is how it behaves on a Cisco ASA. Two real captures from an ASAv 9.24 peering with IOS XE show it authenticating loudly and almost never winning a route.
- [EIGRP on the Cisco ASA: Configuration and Neighbor Gotchas](https://www.pinglabz.com/asa-eigrp-configuration.md) - Full EIGRP build on the Cisco ASA captured live from an ASAv 9.24, from working adjacency to the number-one neighbor failure that produces no error, no log, just an empty neighbor table.
- [OSPF on the Cisco ASA: Areas, Redistribution, and the ASA's Quirks](https://www.pinglabz.com/asa-ospf-configuration.md) - The full OSPF build on a Cisco ASA: configuration, a verified adjacency with MD5 authentication, the DR/BDR election the firewall loses, the link-state database, and redistribution, all captured from a live ASAv 9.24.
- [Dynamic Routing on the Cisco ASA: What the Firewall Will and Won't Do](https://www.pinglabz.com/asa-dynamic-routing-overview.md) - The ASA supports OSPF, EIGRP, RIP, and BGP, but with different defaults and its own opinions about which routes it installs. Get oriented with live captures from an ASAv 9.24 in CML before you configure any of them.
- [GETVPN Redundancy: COOP Key Servers and Rekey Survival](https://www.pinglabz.com/getvpn-coop-key-servers.md) - COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
- [VRF-Aware IPsec: Keeping VPNs in Their Lane](https://www.pinglabz.com/vrf-aware-ipsec.md) - FVRF routes the tunnel's outer ESP packets; IVRF holds the decrypted inner traffic. Separate those two in your head and VRF-aware IPsec becomes bookkeeping. This guide builds the config from that distinction.
- [GETVPN Configuration: Key Server, Group Members, and GDOI](https://www.pinglabz.com/getvpn-configuration-ios-xe.md) - The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
- [Certificate Authentication for IPsec: Trustpoints, Enrollment, and Revocation](https://www.pinglabz.com/ipsec-certificate-authentication.md) - Pre-shared keys sit in plain sight in configs and backups and do not scale past a few peers. This article moves IPsec authentication to certificates: trustpoints, CA enrollment, and revocation, so each device holds its own key and enrolls once.
- [GETVPN Explained: Group Encryption Without Tunnels](https://www.pinglabz.com/getvpn-explained.md) - GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
- [Running a Cisco Router as a CA Server: PKI You Can Lab](https://www.pinglabz.com/cisco-router-ca-server.md) - A Cisco IOS XE router can act as a full certificate authority: about six lines of config to issue real X.509 certificates and enroll other routers over HTTP. Build a PKI you can actually lab.
- [FlexVPN Explained: One Framework for Site-to-Site, Hub-Spoke, and Remote Access](https://www.pinglabz.com/flexvpn-explained.md) - FlexVPN collapses crypto maps, VTIs, DMVPN, and EzVPN into one IKEv2-based framework. See how a single configuration model covers site-to-site, hub-spoke, and remote access VPNs on Cisco IOS XE.
- [FlexVPN Spoke-to-Spoke: Dynamic Tunnels Without DMVPN](https://www.pinglabz.com/flexvpn-spoke-to-spoke.md) - The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
- [FlexVPN Site-to-Site Configuration on IOS XE](https://www.pinglabz.com/flexvpn-site-to-site-configuration.md) - Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.
- [IKEv2 Explained: Why It Replaced IKEv1 (and the Smart Defaults)](https://www.pinglabz.com/ikev2-explained.md) - What actually changed from IKEv1 to IKEv2: different RFC, exchange, state machine, and show commands. Real output from a cat8000v on IOS XE explains why show crypto isakmp sa returns nothing on a healthy IKEv2 tunnel.
- [IKEv2 Site-to-Site VPN with Crypto Maps on IOS XE](https://www.pinglabz.com/ikev2-site-to-site-crypto-maps.md) - You do not have to rebuild a legacy crypto map VPN as a tunnel interface to get IKEv2. On Cisco IOS XE you keep the crypto map, the ACL, and the transform set and swap only the key exchange. This post shows how.
- [IKEv2 Site-to-Site VPN with SVTI: The Config You Should Actually Deploy](https://www.pinglabz.com/ikev2-svti-configuration.md) - IKEv2, AES-GCM-256, and a static VTI: the site-to-site config you should deploy today. No crypto ACLs, no proxy-ID mismatches, just a routable encrypted tunnel interface, captured live on two cat8000v routers running IOS XE 17.18.
- [Crypto Maps vs VTI: Which Site-to-Site Design to Pick](https://www.pinglabz.com/crypto-maps-vs-vti.md) - Crypto map or VTI for your site-to-site IPsec tunnel? We built both designs on the same two IOS XE routers in CML, carried the same traffic, and captured the CLI differences so you can pick with evidence.
- [Static VTI (SVTI): The Modern Way to Build a Site-to-Site VPN](https://www.pinglabz.com/static-vti-svti-ipsec.md) - One command, tunnel mode ipsec ipv4, turns a tunnel interface into a routable IPsec-protected link. No crypto maps, no crypto ACLs, no GRE header. Built live on two cat8000v routers running IOS XE 17.18 across a simulated ISP in CML.
- [Troubleshooting IPsec: Phase 1 Up, Phase 2 Down, and Other Classics](https://www.pinglabz.com/troubleshooting-ipsec-vpn.md) - We built a live IPsec lab in CML, then broke the tunnel five different ways to capture exactly what IOS XE says for each failure. Phase 1 up, Phase 2 down, and the other classics, with real output.
- [NAT Traversal (NAT-T): How IPsec Survives a NAT Device](https://www.pinglabz.com/ipsec-nat-traversal-nat-t.md) - ESP has no port numbers, so PAT kills raw IPsec: Phase 1 comes up, Phase 2 passes nothing. This article shows why, what NAT-T actually changes on the wire, and the failure and the fix in real CLI output from a live CML lab.
- [GRE over IPsec: Why Tunnels and Encryption Belong Together](https://www.pinglabz.com/gre-over-ipsec.md) - Configure GRE over IPsec on Cisco IOS XE with IKEv2 and IPsec profiles. Modern and legacy configs, MTU planning, OSPF over the tunnel, and gotchas.
- [IPsec Explained: IKE Phase 1, Phase 2, and What Actually Gets Encrypted](https://www.pinglabz.com/ipsec-explained-ike-phases.md) - What an SA is, why IKE runs in two phases, and which bytes of your packet actually get encrypted. Grounded in real packet captures on the transit link between two Cisco IOS XE edge routers in a CML lab.
- [Site-to-Site IPsec VPN with Crypto Maps on Cisco IOS XE](https://www.pinglabz.com/site-to-site-ipsec-crypto-maps.md) - Complete site-to-site IPsec VPN build with crypto maps on IOS XE: ISAKMP policy, keys, transform set, interesting traffic, and the crypto map itself, with every line of CLI output captured from live cat8000v routers in CML.
- [Model-Driven Telemetry on IOS XE Routers: gRPC Dial-Out in Practice](https://www.pinglabz.com/model-driven-telemetry-ios-xe-routers.md) - Model-driven telemetry replaces SNMP polling with continuous streaming from the device. This article covers the MDT subscription model on IOS XE, dial-in vs dial-out over gRPC, and the honest platform picture.
- [JSON vs XML vs YAML for Network Engineers: One Payload, Three Ways](https://www.pinglabz.com/json-xml-yaml-network-engineers.md) - One interface configuration rendered as JSON, XML, and YAML from a single Python dictionary. See why RESTCONF, NETCONF, and Ansible each picked their format and how all three encode the same data model.
- [Advanced EEM: Tcl, Multi-Event Correlation, and EEM + Python](https://www.pinglabz.com/advanced-eem-tcl-python.md) - Go past one-line EEM applets: multi-event correlation, Tcl policies, and EEM as the trigger for on-box Python. Includes a real applet firing and capturing device state in a CML lab.
- [On-Box Python: Scripting IOS XE from the Inside](https://www.pinglabz.com/on-box-python-ios-xe.md) - On-box Python puts automation scripts on the IOS XE device itself, so they run even when the management network is down. Covers the cli module, where scripts run, and the honest platform picture, with a fully captured off-box pipeline as reference.
- [Jinja2 Templates for Network Configs: From Variables to Rendered CLI](https://www.pinglabz.com/jinja2-network-config-templates.md) - Stop hand-editing pasted router configs. This post builds the full templating pipeline: YAML variables, a Jinja2 template, rendered CLI, and a Netmiko push to a live router, all captured from a real CML lab.

## Optional
- [RSS Feed](https://www.pinglabz.com/rss/)
- [Sitemap](https://www.pinglabz.com/sitemap.xml)
- [Full content of pages and posts](https://www.pinglabz.com/llms-full.txt)