Hey guys, long time since I had to build a stack wise pair. Have one access pair of 2 x 9300x stacks and one 4x pair.

The 4x pair has now twice lost its stack member provisioning with members losing sight of the active and standby and the active and standby losing sight of each other, though stack cables are correctly connected in the ring.

It leads to the active with highest priority keeping it's config but no others showing as joined in show switch stack...some members coming up the same and all but the active sometimes rebooting into the rommon after 5 reboots (or forced by mode button) and having to get the unset STACK_1_1 and wr erase and set the member I'd as unprovisioned to provisioned on the active/master. Or by setting switch clear stack-mode on the members... Or some combination of all of these.

They aren't live yet but I have had to move a power up a couple of times now and it's happened both times.

In rommon on all switches looping in rommon I can see the correct priorities and stack members using the set command... So I'm not sure why they go out of whack. Buggy IOS firmware?

Painful waiting for the reboots to get it sorted. What's the correct process here when this happens, I must be doing something wrong in sequence but my config looks good to me?

The other 2 x access pair is fine and have had no issue.

We have firepower 1010 running ASA image 9.18(4)68. We have a need for management access using ASDM to a unique IP that can't have on a physical or SVI interface (dont ask its a long story). We came up with using a loopback with a nameif interface.

Below is a snapshot of the configuration

interface Loopback1

nameif asdmmgmt

ip address 172.30.255.1 255.255.255.255

interface Vlan10

description LAN

nameif inside

security-level 100

ip address 10.10.10.1 255.255.255.240

management-access inside

http 0.0.0.0 0.0.0.0 inside

http server enable 4443

Couple of items to point out, we can ping the 172.30.255.1 IP no issue. However when launching ASDM to IP 172.30.255.1:4443 it times out and we see error messages below.

Sep 01 2026 15:28:13: %ASA-2-106001: Inbound TCP connection denied from 192.168.10.10/61373 to 172.30.255.1/4443 flags SYN on interface inside

Sep 01 2026 15:28:16: %ASA-2-106001: Inbound TCP connection denied from 192.168.10.10/61373 to 172.30.255.1/4443 flags SYN on interface inside

We also do not have the option of specifying HTTP access to the nameif interface asdmmgmt for some reason.

fpr-76257072(config)# http 0 0 ?

configure mode commands/options:

Current available interface(s):

inside Name of interface Vlan10

outside Name of interface Ethernet1/1

Anyone ever try this ?

I got offer from Cisco. It is in common hardware group. I am an fpga developer. During the interview, I didn’t get a clear idea about the group actually does.
Does Cisco actually ship products which has fpgas in them or does it just use them for prototyping?

If you know about this group, could you share info about how working in the group is. Are layoffs an ongoing thing?

Thank you

Hi - we are looking at a pair of Cisco 8711-48Z-M routers to replace some older gear. I am a little confused about what licensing I need here. We are looking at the advanced feature suite. I understand that I need either the full chassis license or I can license it per 100G of capacity (pay as you consume). Then I also see a chassis based SIA license. Is this also needed? It looks like this is a minimum of 3 years and includes the SW updates?

Hi everyone,

I’m troubleshooting an 802.1X issue with a Dell laptop connected through a Dell WD19/WD19S dock.

Topology:

Laptop → Dell Dock → Ethernet → Switch

When I connect the laptop directly to the switch, 802.1X works perfectly and the endpoint authenticates using dot1x.

However, when I connect the same laptop through the Dell dock:

- The switch learns the laptop's actual MAC address

- Forescout sees the laptop correctly

- But authentication is MAB instead of 802.1X

- It looks like the PC's EAPOL/802.1X frames aren't reaching the switch, causing the port to fall back to MAB

The PC's 802.1X configuration is working because it authenticates successfully when connected directly.

Has anyone experienced 802.1X/EAPOL not passing through a Dell WD19/WD19S dock?

Could this be related to MAC passthrough, dock firmware, Realtek Ethernet drivers, or EAPOL pass-through?

What was the fix in your case? Did updating the dock firmware/driver resolve it, or did you have to change a switch/dock/BIOS setting?

Any advice would be appreciated. Thanks

Looking at this from the transport side rather than the security side.

AI traffic has a different profile than the web traffic our current design was built around: long-lived connections, streamed responses, bursty token throughput, and a small number of destination endpoints concentrated in a handful of US and EU regions. Add inline inspection on top and you are doing decrypt, inspect, and re-encrypt on sessions that stay open for minutes.

What that surfaces: PoP density matters less than PoP placement relative to model endpoints; inspection adds compute at the edge, which not every PoP footprint is provisioned for; our sites in South America and Southeast Asia are already the outliers on RTT, so adding an inspection hop there is the thing I am worried about; and peering to the major cloud and AI providers varies a lot by vendor and nobody publishes it clearly.

Questions for anyone who has measured rather than trusted the marketing map: what is your real added latency for an inspected AI session from a secondary-market site; does the vendor do inspection at every PoP or only at a subset of "full-stack" locations, since several are quietly the latter; and has anyone hit throughput ceilings on inspection during peak?

I am in a tier 3 clg pursuing bca at my 5 sem and I am fed up by all ts coding n shit and wanna get into cybersecurity plz tell me cisco Junior Cybersecurity Analyst good or not and how much of my time it may consume

Is there any update regarding the Cisco’s Software Engineer role (2018541) for freshers ??

Same as the title

Hi, so I have shortlisted for the Code with Cisco interviews and I have the first round on Tuesday.

Actually I gave the OA with the mindset that they would offer me the CTC of atleast 35 or the 53 one but they are offering the lowest slab of 25, which is well below my expectations.

I was planning to sit for the placements, however since this was sort of on campus I won't be able to if I get selected in this, and I can't refuse the interview.

Do they allow for negotiation of the slab for the offers? Like is there any way? My placement cell tried contacting the HR but they have been unresponsive. I have a strong profile for college placements with a faang internship strong gpa and cf profile, I was planning to keep cisco as a backup in case I don't get the ppo for my internship, but with 25ctc I would rather sit for placements.

Curious if anyone has tried using both Gemini API to connect to CML MCP and use Gemini with CML and Claude Desktop both and what your opinion was with both.

https://www.cisco.com/web/software/286325254/176135/Public_Release_Notes_9800_APSP_17_18_4a.pdf

Hello folks, I applied for the Cisco Technical Graduate Apprentice (TGA) position and recently cleared the Online Assessment (OA).

However, there has been a long gap after the OA, and I received the next update/form only after quite some time.

Has anyone else experienced a similar delay after clearing the OA for the Cisco Technical Graduate Apprentice role?

If yes, how long did you have to wait between the OA and the next update/interview process?

I would really appreciate it if anyone could share their experience or timeline. I just want to know whether such a long gap is normal in the TGA hiring process

I am a 4rth year student. Recently I was selected for interview for SRE role Bangalore office. I was selected till 3rd round i.e. etr connect. The HR told she will declare the result and tell it to college. I did not received any rejection or selection. The interview was on 4rth Aug. Can some one guide me. I was told by the HR not to contact her directly go through the college. But HR is not replying to college mail as well. Everything was online on webex.

Hi guys, Does anyone here have their joing date on September 23 for the software engineer trainee role

We have a Cisco NCS-5501-SE that is password protected. Our technician advised that we may need a USB boot disk to reset the password.

Has anyone dealt with this before and knows where we can obtain the required USB boot image, or is there someone here who can help us with the password recovery?

Any guidance would be greatly appreciated. Thanks!

Trying to get a rough idea of what to budget for a few Cisco C220 M7 or M8 servers. I’m flexible on the processor selection, but I’ll need 1 TB of RAM per server, which I expect will be one of the larger cost components.

Has anyone purchased or received recent quotes for similarly configured UCS servers that they’d be willing to share as a ballpark?

Hi everyone,

I'm currently building a NAC lab with PacketFence 15.1.0 OVA + PNETLab + Cisco IOS L2 switch.

The Cisco switch has RADIUS configured:

radius server PACKETFENCE

address ipv4 192.168.200.88 auth-port 1812 acct-port 1813

key PF-RADIUS-2026-LAB

And Gi0/1 is currently:

interface GigabitEthernet0/1

description WINDOWS-SERVER-CLIENT

switchport access vlan 200

switchport mode access

authentication port-control auto

mab

dot1x pae authenticator

spanning-tree portfast edge

The switch confirms:

show interfaces gi0/1 status

Gi0/1 connected 200

802.1X:

PAE = AUTHENTICATOR

MAB:

Mac-Auth-Bypass = Enabled

However, when I connect a VPCS to Gi0/1 and generate traffic, I get:

show mac address-table interface gi0/1

Vlan Mac Address Type Ports

-------------------------------------------

No MAC is learned.

And:

show authentication sessions interface gi0/1 detail

No sessions match supplied criteria.

So MAB never seems to start.

I previously tested with Windows Server 2012 on the same port. I eventually got basic connectivity/ping working, but I still didn't get an authentication session.

Interestingly, PacketFence's internal RADIUS/REST side seems to be responding. A local RADIUS test reached PacketFence and the REST response contained:

{"control:PacketFence-Authorization-Status":"allow"}

So I'm currently trying to determine whether the problem is actually before RADIUS, specifically the endpoint → Cisco switch path.

My main question is:

Why would Gi0/1 show connected but learn no MAC address, while MAB and dot1x are enabled?

Could this be related to the PNETLab interface mapping, VPCS configuration, or the Cisco IOS image I'm using?

I'd appreciate any advice on what I should check next. I don't want to start changing PacketFence/RADIUS configuration unnecessarily if the switch isn't even seeing the endpoint MAC.

How long is the usual timeframe to receive an offer from Cisco after interviews are completed?

Hello,

We're a single site of ~50 users been quoted on retiring our ASA-5516 and moving to a Maraki MX95 (Dual failover) and were kind of shocked to see $6,000 in labor on top of the cost of hardware and licensing. About half of that is 12 hours for the setup and deployment and another 8 to program VPN on the device (2 hours) and update the workstations at 15 minutes apiece (6 hours). I understand there's no migration tool and it all has to be done manually, but I'm curious if 20 hours of labor sounds reasonable? That doesn't include the 16 hours of planning design, meetings, documentation update, project management, etc.

So... 36 hours total labor for what I had assumed might be an 8-10 hour project. Am I off base?

I just want to know what is the full time conversion rate in cisco. And it's better to join cisco at this role. What tasks they offer is it support or anything else

Anyone using config groups that has done the upgrade of 20.15.x to 20.18.x on the control side? I’m being pushed to do it in the next 90 days so we can add a G2 router that needs 20.18.x to our router choice list.

Did anything in your config groups/policy groups break? Any major changes in UI with config groups? I don’t have a lab I can put in to check myself.

I am an engineer and working closely with the guys from networking and security, nobody understands why i cant connect iot sensors to the wifi,

ACCESS POINT IS : Cisco Catalyst CW9166I.

I have some smart valves with 2.4 ghz and some HVAC controls and heat sensors and a couple TAPO smart plugs, we've been trying to connect them for 2 weeks with every single thing and still cannot connect them, for some weird reason the TAPO smart plugs work with no issue, but anything else fails completely, we have no more ideas..any help would be much appreciated

Error is always failing to connect to cloud, so we cant connect the toys with the ipad.

We got on board cisco SDwan post viptela right as the cEdges were being added....so all of our stuff was done in the classic template system. But now i see that configuration groups are a thing.

is it worth converting my old templates to config groups? i have 5 new routers coming on board in the next few months, should i do them as conf groups? or stay the course with the template system?

thanks!