IPv6
·
IPv6 Transition Mechanisms: Which One, and When
There is no single "IPv6 migration button." Instead there are three transition mechanisms, and the skill is knowing
CCIE
CCIE-level material for engineers past the CCNP line. Articles tagged CCIE cover expert-track routing, overlays, security and automation, with full configs and real device output from CML.
Latest
IPv6
·
NAT64 Explained: Stateful, Stateless, and the DNS64 Half of the Story
Dual-stack and tunnels both assume IPv6 exists on both ends of a conversation. NAT64 solves the harder case: an
IPv6
·
IPv6 over IPv4 Tunnels: Manual, GRE, and 6to4 Compared
Sometimes you have IPv6 islands that need to talk to each other, but the network in between is IPv4-only
IPv6
·
IS-IS for IPv6: Multi-Topology and the Single-Topology Trap
IS-IS is the quietest way to break IPv6 in your network. It will happily form an adjacency, show every
IPv6
·
EIGRP for IPv6: Classic and Named Mode on IOS XE
EIGRP did not just bolt IPv6 support onto the existing process. On Cisco IOS XE, EIGRP for IPv6 is a
VLAN
·
The Layer 2 Attack Surface: A Hardening Checklist That Actually Holds
The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
VLAN
·
Private VLANs: Isolating Hosts That Share a Subnet
Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.
VLAN
·
VLAN ACLs (VACLs): Filtering Traffic Inside a VLAN
A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
VLAN
·
Static ARP ACLs: Inspecting ARP Without DHCP Snooping
DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.
Router Service Hardening: Turning Off What You Never Needed
Harden a Cisco router by disabling unused services, proven with a real before-and-after Nmap scan taking Telnet from open to closed, plus syslog design.
NTP Authentication: Trusting the Clock Your Logs Depend On
Configure authenticated NTP on Cisco IOS XE, why IOS flags MD5 as weak, and how ntp authenticate and trusted-key stop a rogue server moving your clock.
Anti-Spoofing on the Edge: ACLs, uRPF, and RFC 2827 in Practice
Build RFC 2827 (BCP 38) anti-spoofing with an ingress ACL and uRPF strict mode, tested with real spoofed packets and live Cisco ACL log evidence.