4 ms·

I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a ne

I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...

hyperpl 5y ago
I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.
- imiric 5y ago
  Could you share your config files or suggest a starting point for migrating from pfSense?
neatze 5y ago
> "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.
kjs3 5y ago
Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".

hyperpl 5y ago

I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.

imiric 5y ago
Could you share your config files or suggest a starting point for migrating from pfSense?

neatze 5y ago

> "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.

kjs3 5y ago

Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".