5 ms·
One of my past employers had a crazy simple networking philosophy. It killed me. He once had his provider shut the port facing his core switch down, due to STP
by protocolture 1y ago
One of my past employers had a crazy simple networking philosophy. It killed me. He once had his provider shut the port facing his core switch down, due to STP BPDUs being transmitted. To remedy this, instead of disabling the feature on the switch, he replaced it with an unmanaged switch that doesnt speak STP.
- ThePowerOfFuet 1y agoHe had no business managing a network.
- protocolture 1y agoHe had a particular niche that had few requirements on complex networking, and a business plan that was so brain dead simple it could be achieved easily. But yeah, really nice guy but unable to expand beyond that paradigm. I once helped him deal with a fibre ring, where there were 5 sites in the ring, but only 2 internet services. So sites 3, 4 and 5 had to communicate via sites 1 and 2. His team had put a sophos firewall, with NAT, and no routing, on every fibre connection and called me when it didnt work.
- api 1y agoThat's not great, but it's better than the opposite. I've been in networking for ages and have observed that most networking people will, as a rule, make networks as complicated as possible. Why have one layer of NAT when you can have four or five? Why not invent a bespoke addressing scheme? Why not cargo cult the documentation and/or scripts and config files from Stack Overflow or ChatGPT? Under-engineering is an easier problem to solve than over-engineering.
- bombcar 1y agoSeriously, the number of setups where "they gave us 255 VLANs, use them all!" I've seen is amazing.
- mleonhard 1y agoI took an "Architecting on AWS" class and half of the content was how to replicate complicated physical networking architectures on AWS's software-defined network: layers of VPCs, VPC peering, gateways, NATs, and impossible-to-debug firewall rules. AWS knows their customers tho. Without this, a lot of network engineers would block migrations from on-prem to AWS.
- protocolture 1y agoAges ago I deployed a sophos virtual appliance in AWS, so I could centrally enforce some basic firewall rules, in a way that my management could understand. There was only 1 server behind it, the same thing could have been achieved simply using the standard built in security rules. I think about it often. I do find Azures implementation of this stuff pretty baffling. Just in, networking concepts being digested by software engineers, and then regurgitated into a hierarchy that makes sense to them. Not impermeable, just weird.
- p_l 1y agoMain source of issues leading to overcomplex networking that I ever seen was "every VPC gets a 10./8" like approach replicated, so suddenly you have complex time trying to interconnect the networks later.
- api 1y agoIPv6 solves this but people are still afraid of it for stupid reasons. It's not hard, but it is a little bit different and there is a small learning curve to deploying it in non-trivial environments.
- protocolture 1y agoI have one customer, who runs a large wireless network, who when trying to design it has obviously taken lessons from US WISP operators on facebook managing trailer parks, and implemented a really low rent high complexity customer hand off circuit from that paradigm for one of his most valuable business customers. It worked, but was actually way more complex than he needed.
- kjs3 1y agomost networking people will, as a rule, make networks as complicated as possible Yeah, we are kinda like that. So many toys...why can't I use them all. Seriously, tho...the worst is when you go in and you can tell immediately "oh, the guy running this is trying to get his CCIE cert", because there's all sorts of weirdness you'd never/rarely do in a prod network, but it's on the cert test so lets try it out. YOLO!
- kc3 1y agoIt has been a while, but I have seen some switches that don't "speak" STP but still forward the BPDU messages (so other switches receive them and still detect loops through the "non-STP switch") and other switches that drop the BPDUs (so other switches/bridges cannot see them, possibly leading to a Layer 2 forwarding loop through the "non-STP switch").
- protocolture 1y agoYeah I had a TP Link in my homelab that I broke in half that did stuff like this.