IPv6 Transition Mechanisms: Which One, and When
Dual-stack, tunneling, and translation each solve a different IPv6 migration problem. This decision guide shows you which mechanism fits which situation and how the three fit together on real networks.
CCIE
CCIE-level material for engineers past the CCNP line. Articles tagged CCIE cover expert-track routing, overlays, security and automation, with full configs and real device output from CML.
Latest posts
NAT64 Explained: Stateful, Stateless, and the DNS64 Half of the Story
How NAT64 lets an IPv6-only client reach an IPv4-only server: the full stateful configuration on Cisco IOS XE 17.18, the address synthesis math done by hand, the DNS64 half that makes it usable, and an honest platform finding from the lab.
IPv6 over IPv4 Tunnels: Manual, GRE, and 6to4 Compared
Configure a manual IPv6-over-IPv4 tunnel on Cisco IOS XE 17.18, prove it with a real ping across an IPv4-only core, and compare the three tunnel types you need to know: manual, GRE, and 6to4.
IS-IS for IPv6: Multi-Topology and the Single-Topology Trap
IS-IS runs a single topology by default, forcing IPv6 down the IPv4 shortest path even where IPv6 is broken. See how multi-topology IS-IS fixes the black hole, with real adjacency output on Cisco IOS XE 17.18.
EIGRP for IPv6: Classic and Named Mode on IOS XE
EIGRP for IPv6 is a separate protocol instance with no network statement and link-local next hops. You walk the classic interface-based config on IOS XE 17.18, see real adjacencies and routes, and clear up the shutdown gotcha.
The Layer 2 Attack Surface: A Hardening Checklist That Actually Holds
The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
Private VLANs: Isolating Hosts That Share a Subnet
Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.
VLAN ACLs (VACLs): Filtering Traffic Inside a VLAN
A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
Static ARP ACLs: Inspecting ARP Without DHCP Snooping
DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.
Router Service Hardening: Turning Off What You Never Needed
Harden a Cisco router by disabling unused services, proven with a real before-and-after Nmap scan taking Telnet from open to closed, plus syslog design.
NTP Authentication: Trusting the Clock Your Logs Depend On
Configure authenticated NTP on Cisco IOS XE, why IOS flags MD5 as weak, and how ntp authenticate and trusted-key stop a rogue server moving your clock.
Anti-Spoofing on the Edge: ACLs, uRPF, and RFC 2827 in Practice
Build RFC 2827 (BCP 38) anti-spoofing with an ingress ACL and uRPF strict mode, tested with real spoofed packets and live Cisco ACL log evidence.