Network freak Weekly Roundup: 2026-W40

This is the weekly Network freak roundup for 2026-W40. It collects the latest practical networking articles published this week, so the X feed can stay quiet while readers still get all links in one place.

IPsec Phase 1 vs Phase 2 Explained: SAs, Crypto Maps and IKEv2

Short answer: In IKEv1, Phase 1 authenticates the VPN peers and establishes the IKE/ISAKMP security association that protects their negotiation; Phase 2 uses that protected channel to negotiate IPsec security associations for data traffic.[1] An established Phase 1 is therefore not proof that your application traffic has a working IPsec SA.

This is the distinction behind the interview question, “What is the difference between IPsec Phase 1 and Phase 2?” The terminology belongs to IKEv1: IKEv2 uses IKE_SA_INIT, IKE_AUTH and CREATE_CHILD_SA exchanges rather than the same two-phase process.[2] IKEv1 is deprecated; learn its terminology for interviews and legacy troubleshooting, not as a recommendation for a new deployment.[3]

X Follow @ipexptobe

F5 BIG-IP Client IP Missing: X-Forwarded-For Troubleshooting Checklist

An application behind F5 BIG-IP works, but every access-log entry shows the load balancer instead of the visitor. Before disabling SNAT, separate two requirements: preserving the packet source address and conveying a client address in an HTTP header. BIG-IP SNAT changes the source address of a connection; an HTTP profile can insert client-address information into a request without undoing that translation.[1][2]

This troubleshooting guide provides a reusable decision table, a narrowly scoped NGINX configuration example, and an acceptance matrix for detecting spoofed or incorrectly trusted X-Forwarded-For headers. The examples are hypothetical and unexecuted on BIG-IP or NGINX; the workflow is an original operational recommendation, not a vendor-certified deployment recipe.

X Follow @ipexptobe

NAT vs PAT vs Static NAT vs DNAT Explained with Packet Flow

What is the difference between NAT, PAT, static NAT and DNAT? They describe different aspects of translation, not four mutually exclusive features: NAT is the umbrella, PAT includes transport-port mapping, static NAT fixes an address mapping, and DNAT changes a packet's destination.[1][2][3]

Short answer: Basic NAT translates IP addresses; PAT (called NAPT in RFC 3022) lets multiple internal endpoints share an external address using transport identifiers.[1] Static one-to-one NAT describes how the address mapping is assigned, while SNAT and DNAT describe whether the source or destination is rewritten.[2][3]

X Follow @ipexptobe

Palo Alto User-ID Wrong User: IP Mapping Troubleshooting Matrix

An application is blocked for the right employee, but the Palo Alto firewall log shows a different username. Before changing the Security policy, answer a narrower question: which identity source associated this connection with that user, and was an IP address alone enough to identify them?

This guide provides a User-ID troubleshooting matrix, a read-only evidence workflow and a change-acceptance checklist. It focuses on incorrect or missing IP-to-user mappings, including the shared-IP case on terminal servers. All examples are hypothetical; commands are templates, not results from a production firewall.

X Follow @ipexptobe

Slurm Job Pending with Idle GPUs: A 256-GPU Sizing and Troubleshooting Checklist

A Slurm job can remain pending while a dashboard shows dozens of idle GPUs. Before buying more accelerators or changing the fabric, ask a narrower question: can the scheduler assemble the exact node, GPU, CPU, memory, policy and locality shape requested by this job? A cluster-wide free-GPU total is not enough to answer it.

This guide provides a 256-GPU capacity worksheet, a pending-job troubleshooting matrix, two original diagrams and a deployment checklist. The design and queue snapshots are hypothetical; the arithmetic was executed in Python. Configuration and diagnostic commands are unexecuted examples, not results from a production cluster. They require adaptation to your installed Slurm release and site policy.

X Follow @ipexptobe

Monthly BGP Table Watch: Prefix and ASN Trends — September 2026

This monthly BGP Table Watch report summarizes how the public routing table changed over roughly the last 30 days, using the latest public Potaroo/CIDR Report samples available on 2026-10-01.

The goal is to provide a slower, more useful view than the daily snapshots: month-over-month prefix growth, IPv6 movement, visible ASN changes, and the route-churn areas worth watching.

X Follow @ipexptobe

Administrative Distance vs Metric vs Longest Prefix Match Explained

Does a router choose the lowest administrative distance, the lowest metric, or the longest prefix? The answer depends on whether you mean building the routing table or forwarding a packet.[1]

Short answer: A routing protocol selects its candidates using its own path-selection rules; administrative distance (AD) selects between competing route sources for the same prefix and prefix length; longest prefix match selects the most specific installed route when forwarding a packet.[1] Do not treat these as three numbers compared together for every packet.[1]

X Follow @ipexptobe

Panorama Out of Sync: Commit and Push Troubleshooting Checklist

Panorama commit succeeded, but the firewall still shows an old setting—or the managed-device view says out of sync. Do not start by selecting Force Template Values. First identify which boundary failed: commit to Panorama, push selection, the firewall job, or the effective configuration on the target.

This guide provides a reusable troubleshooting matrix and push approval worksheet for that investigation. It is a proposed operational workflow, not a report of a production incident or an executed firewall test. Product behavior is grounded in the PAN-OS 11.2 Commit Operations reference and the vendor's Templates and Template Stacks page; check the matching documentation for your deployed release.[1][3]

X Follow @ipexptobe

Route Redistribution Risks Between OSPF, EIGRP and BGP: Loops, Tags and Metrics

Route redistribution can make two routing domains reachable while quietly creating a path for routes to return to their origin. The interview question is: what can go wrong when redistributing OSPF, EIGRP and BGP, and how do you prevent it?

Short answer: the main risks are route feedback, unexpected path selection, incompatible metrics and unwanted prefix propagation; Cisco documents filtering and route-tag policies as ways to control these risks.[2] My recommended starting point is a narrow prefix allowlist, explicit target-protocol metrics, origin tagging with return-path rejection, and failure testing at every redistribution boundary.

X Follow @ipexptobe

F5 BIG-IP Server SSL Handshake Failed: SNI and Certificate Troubleshooting Matrix

A browser reaches the F5 virtual server, the pool looks healthy, yet the application fails after a backend certificate renewal. Before changing ciphers or disabling certificate checks, identify which TLS conversation fails. This guide provides a Server SSL troubleshooting matrix, a profile-review worksheet and a controlled acceptance test plan.

Scope: conventional BIG-IP LTM reverse-proxy TLS termination with re-encryption to HTTPS pool members—not TLS passthrough, SSL Orchestrator or forward proxy. Recommendations below are an original operational workflow, not results from a production incident or a completed lab. F5's BIG-IP 17.5.1 SSL administration guide is the main configuration reference; the older v14 TMSH reference is used only for explicitly identified command and field semantics.[4][3]

X Follow @ipexptobe

EIGRP Metric and K-Values Explained: Formula, Examples and Troubleshooting

EIGRP metric questions usually test three things: which inputs matter by default, how bandwidth and delay combine, and why mismatched K-values prevent neighbors from forming.

Short answer: with default K-values, EIGRP uses minimum path bandwidth and cumulative delay; for classic metrics, the calculation is 256 × (10^7 / minimum bandwidth in kbps + total delay in tens of microseconds).[1] K1 and K3 default to 1; K2, K4 and K5 default to 0, so load and reliability do not contribute to the default calculation.[1]

X Follow @ipexptobe

RoCE PFC Buffer Sizing Guide: 400G Headroom Worksheet and ECN Checklist

A GPU cluster can pass a quiet link test and still collapse under synchronized traffic. Before buying switches with a bigger advertised buffer, ask a more precise question: how much traffic can arrive after a congested port requests a pause, and where can that traffic be stored? This guide provides a headroom worksheet, an incast calculation and a deployment test matrix for that decision.

The worked design is hypothetical: 32 servers, eight GPUs per server, and a selected 400 Gb/s Ethernet fabric. Calculations are executed arithmetic, not benchmark measurements or validated switch settings. The configuration examples are explicitly pinned to NVIDIA Cumulus Linux 5.9 documentation; they are not claims about the newest release or every Spectrum generation. Use your actual ASIC, network operating system and NIC support matrix before making changes.

X Follow @ipexptobe

EIGRP Stuck in Active Explained: SIA Troubleshooting and Prevention

EIGRP Stuck in Active (SIA) means that a route's distributed computation has not received a required Reply within the permitted time; Cisco implementations can reset the unresponsive neighbor and remove routes learned through it.[1] For an interview, distinguish normal Active route computation from Stuck in Active, then explain how you would trace the missing reply and reduce query scope.[1][2]

X Follow @ipexptobe

Weekly BGP Table Watch: IPv4, IPv6 and ASN Changes — 2026-09-28

The global BGP table keeps moving every day. This weekly BGP Table Watch snapshot tracks IPv4 prefixes, IPv6 prefixes, visible ASNs and the largest routing-table changes reported during the last week.

The goal is not to alarm on every change. BGP is noisy by design. The goal is to build a simple operational habit: watch the size of the routing table, notice large origin-AS changes, and keep an eye on where new ASNs and route withdrawals appear.

X Follow @ipexptobe