-
“A VRF is a separate routing table inside a router” is a correct definition, but it taught my team nothing. They had spent years building four separate networks, and I was asking them to merge those into one. This post…
-
Held the Line, Owned the Miss
An SE evaluating me for a role told me something about my own resume I’d never noticed. It carries more “held a technical position against management pressure, then was proven right” stories than any resume he’d reviewed, he said, and…
-
Are These Actually the Same Rules? A CheckPoint-to-Palo-Alto Migration Audit
Two firewalls that both call something “the address at 10.4.x.x” are not saying the same thing, if one of them stores that address as an object called dns-primary and the other stores it as a signed 32-bit integer with no…
-
A Hit Counter Doesn’t Know When It Started Counting
A rule that has matched nothing in nine minutes and a rule that has matched nothing in eighty days look exactly the same in the output. I wrote about that moment on LinkedIn; this post goes deeper into the toolchain…
-
How Retiring One System Retired Another
The Wireless Gateway’s End Also Killed CheckPoint’s Cleartext Login One component retired. It killed an entire system on its way out. I only built one of them. Before wifi, Baylor’s residential network ran authentication through CheckPoint using a cleartext, telnet-emulated…
-
The Server That Never Talked: ARP TTL, FDB Aging, and a Broadcast Storm
An ARP TTL FDB aging mismatch turned a data center into a light show. Around 2005, every top-of-rack switch in the data center was blinking like a light show at a disco rave. I traced the cause back to a…
-
The Firewall Was the Wrong Layer: Automating Threat Response with BGP
The Firewall Was the Wrong Layer: Automating Threat Response with BGP A LinkedIn post I wrote about this covers the story: a daily infosec email, a firewall policy cycle, and the decision to stop doing the same fix by hand.…
-
When the Interior Doesn’t Speak PIM: SPBM Multicast Root Cause
SPBM Multicast and a Replacement Plan That Assumed the Wrong Protocol A hospital system spanning several states runs its live IPTV distribution out of a single metro region’s headend: DirecTV and BlonderTongue encoder headends feeding 60+ active multicast streams. When…
-
When the Spec Is the Only Source of Truth
This post began as a LinkedIn reflection on RFC reading and first-principles thinking. The story went deeper into RFC 2865 RADIUS authentication than a LinkedIn post could hold. RFC 2865 RADIUS Authentication The authentication failures were intermittent. Not every packet.…
-
460 Devices, No Documentation, and the Pipeline That Changed That
The engagement had 460 managed devices and no current topology documentation. Network topology automation was the only viable path — manual spreadsheet work would have taken weeks and produced a point-in-time artifact no one could re-run. The Cisco design team…