The Elematron blog

Network engineering, explained and fixed.

Short, correct explainers on the problems engineers actually hit — each paired with a free tool and a daily drill so you can practise what you just read.

Voice VLAN Bandwidth Sizing: Codec, Frame Size, and Overhead Calculation

Calculate exact bandwidth per VoIP call by codec type, frame size, and protocol overhead. G.729, G.711, and more with real formulas for network engineers.

Routing4 min read

CCNA Design Lab: EIGRP vs OSPF for Branch Networks

Compare EIGRP and OSPF for branch network design. Learn convergence, scalability, and deployment trade-offs for CCNA labs.

Security4 min read

FortiGate NSE4: Rotating Admin Credentials Without Downtime

Learn how to rotate FortiGate admin passwords and credentials safely without service interruption. Step-by-step NSE4 guide for production environments.

Security4 min read

FortiGate NSE4: NAT Rule Order When Addresses Overlap

Learn how FortiGate processes NAT rules when source or destination addresses overlap. Essential for NSE4 exam prep and production troubleshooting.

Troubleshooting4 min read

EIGRP Query Storm: How to Escape the ACTIVE State

Learn why EIGRP routes get stuck in ACTIVE state and how query storms form. Practical fixes to restore convergence and prevent topology failures.

Routing4 min read

BGP Route Flap Dampening: When Your Network Oscillates

Learn how BGP route flap dampening suppresses penalty and stabilizes unstable routes. Technical guide for CCNA and NSE candidates.

Troubleshooting4 min read

FortiGate IGMP Snooping: Multicast Not Forwarding Across VLAN

Learn why multicast traffic fails across VLANs on FortiGate and how IGMP snooping configuration affects forwarding behavior.

Security4 min read

FortiGate: Web Filter + SSL Inspection = Bypass

Learn how FortiGate web filtering and SSL inspection interact, why misconfigurations create bypasses, and how to secure both layers for NSE4.

Security4 min read

Juniper VLAN Range in Filter: Expansion and Matching Order

Learn how Juniper expands VLAN ranges in firewall filters, matching order, and practical configuration examples for JNCIA candidates.

Troubleshooting4 min read

Palo Alto User-ID Agent Out of Sync: Policy Mismatch Fix

Troubleshoot Palo Alto User-ID Agent sync issues causing policy mismatches. Learn root causes, diagnostic steps, and resolution techniques for NSE certification.

Routing4 min read

FortiGate SD-WAN: Path Loss Detection Threshold & Failover Timing

Learn how FortiGate SD-WAN detects link failure, configures path loss thresholds, and triggers failover. Technical guide for NSE and network engineers.

Security4 min read

FortiGate NSE4 Lab: Application Control Bypass – Policy Trap

Learn why FortiGate application control policies fail to block traffic. Hands-on NSE4 lab covering policy logic, inspection modes, and common misconfigurations.

Routing4 min read

EIGRP unequal cost load balancing and feasible successor trap

Learn how EIGRP unequal cost load balancing works, why feasible successors matter, and how to avoid common configuration traps.

Security4 min read

Palo Alto SSL inspection certificate chain fix

Fix certificate chain breaks during Palo Alto SSL inspection. Learn why HTTPS fails and how to resolve decryption issues.

Security4 min read

FortiGate NSE4: Central NAT vs Policy NAT – Lab Scenario Showdown

Learn the critical differences between FortiGate Central NAT and Policy NAT, with real lab scenarios and configuration examples for NSE4 exam prep.

Troubleshooting4 min read

FortiGate Hairpin NAT Fails: Asymmetric Return Path Detection

Why FortiGate hairpin NAT breaks when return traffic takes a different path. Diagnose asymmetric routing and fix NAT loopback issues.

Troubleshooting4 min read

NSE4 Lab: Troubleshooting Policy Logs for Blocked Traffic

Learn to diagnose and resolve blocked traffic in FortiGate using policy logs. Essential NSE4 lab covering log interpretation, policy rules, and traffic flow analysis.

Routing4 min read

CCNA EIGRP Metric: K-Values and Bandwidth Calculation

Learn how EIGRP calculates routing metrics using K-values and bandwidth. Master the formula, default settings, and practical configuration for CCNA.

Security4 min read

Palo Alto NAT Rule Order and Overlapping Addresses

Master NAT rule sequencing and address overlap handling on Palo Alto Networks firewalls for the PCNSA exam and production deployments.

Security4 min read

SPF, DKIM and DMARC as DNS records: what each one is doing

Learn how SPF, DKIM, and DMARC DNS records work together to authenticate email, prevent spoofing, and protect your domain reputation.

Troubleshooting4 min read

Choosing DNS TTLs before a migration cutover

Learn how to set DNS TTL values strategically before a network migration to minimize downtime and avoid DNS cache issues during cutover.

Security4 min read

Split-Horizon DNS: Same Name, Different Answer Inside and Out

Learn how split-horizon DNS returns different records for internal and external queries, with practical configuration examples for enterprise networks.

Switching4 min read

Voice VLAN design: separating phones without a second cable

Learn how to design and configure voice VLANs to separate phone traffic from data on a single access port using 802.1Q tagging.

Addressing4 min read

Mapping VLANs to subnets with a scheme you can still read in two years

Learn how to design a VLAN-to-subnet numbering scheme that stays readable and maintainable. Practical strategies for enterprise networks.

Switching4 min read

Native VLAN mismatch: the trunk that half works

Learn why native VLAN mismatches break trunk links silently. Understand the mechanics, spot the symptoms, and fix configuration errors fast.

Tail drop vs WRED: what happens when a queue fills

Learn how tail drop and WRED handle congestion differently. Understand queue management, packet loss, and TCP behavior for better QoS design.

Sizing a voice queue: bandwidth per call and what to reserve

Calculate VoIP bandwidth per call, codec selection, and QoS reservation strategy for voice queues and contact centers.

The QoS trust boundary: where markings should be set and where rewritten

Learn where to set DSCP and CoS markings at the QoS trust boundary, and when to rewrite them. Essential for CCNA and NSE candidates.

Dual stack: which address a host actually prefers

Learn how dual-stack hosts choose between IPv4 and IPv6. Understand address selection rules, Happy Eyeballs, and what actually happens on the wire.

IPv6 subnetting: why /64 is the answer almost every time

Learn why /64 is the standard IPv6 subnet prefix for most networks. Technical breakdown of address space, EUI-64, and practical subnetting strategy.

Why every IPv6 interface has a link-local address you never configured

Learn why IPv6 link-local addresses (fe80::/10) are automatically assigned to every interface and how they work in modern networks.

SLAAC vs DHCPv6: choosing how hosts get an IPv6 address

Compare SLAAC and DHCPv6 for IPv6 address assignment. Learn when to use each method, how they work, and best practices for enterprise networks.

Troubleshooting4 min read

Reading IP addresses in hex from packet captures and logs

Learn to convert hexadecimal IP addresses found in packet captures, memory dumps, and network logs into readable dotted-decimal notation.

Troubleshooting4 min read

Ephemeral port exhaustion behind NAT: the failure that looks like DNS

Why NAT port exhaustion mimics DNS failures and how to diagnose the real problem before it cascades across your network.

Troubleshooting4 min read

Reading a TCP handshake to tell a firewall drop from a dead service

Learn to distinguish firewall blocks from dead services using TCP handshake analysis. Decode RST, SYN-ACK, and timeout patterns.

Reference4 min read

Reading HSRP and VRRP virtual MAC addresses at a glance

Learn how to decode HSRP and VRRP virtual MAC addresses to identify protocol, group ID, and priority. Quick reference for network engineers.

Troubleshooting4 min read

HSRP flapping: reading the state changes before users notice

Learn to detect and troubleshoot HSRP flapping by reading state transitions, syslog patterns, and debug output before network outages occur.

Troubleshooting4 min read

Latency vs Bandwidth: Why Your Link Isn't Slow

Understand why a 1 Gbps link can feel slow. Learn the difference between latency and bandwidth, and how each affects real-world network performance.

Troubleshooting4 min read

OSPF neighbors will not form: the checklist that finds it

Step-by-step troubleshooting checklist for OSPF neighbor adjacency failures. Covers interface config, timers, MTU, and authentication.

Routing4 min read

Floating static routes: cheap failover that actually fails over

Learn how floating static routes provide sub-second failover without dynamic routing protocols. Configuration, pitfalls, and admin distance explained.

Troubleshooting4 min read

MAC address flapping between ports: causes and the fix

Learn what causes MAC address flapping on network switches, how to detect it, and proven troubleshooting steps to restore stability.

Troubleshooting4 min read

ARP incomplete: what an unresolved entry is really telling you

Learn what ARP incomplete means, why entries fail to resolve, and how to troubleshoot unresolved ARP entries in your network.

Troubleshooting4 min read

Tracking down a duplicate IP address on a live VLAN

Find and resolve duplicate IP addresses on your network. Step-by-step troubleshooting methods for live VLANs using ARP, DHCP logs, and CLI tools.

Troubleshooting4 min read

Asymmetric routing: why the firewall drops the return packet

Learn why firewalls drop return traffic in asymmetric routing scenarios and how to diagnose and fix the problem.

Security4 min read

Which ICMP types to allow through a firewall

Learn which ICMP message types are safe to permit through firewalls and why blocking all ICMP breaks PMTUD and network performance.

Security4 min read

Rotating router and firewall credentials without an outage

Learn how to safely rotate network device passwords on routers and firewalls with zero downtime. Step-by-step procedures for Cisco, Juniper, Palo Alto, and Fortinet.

Security4 min read

Hardening the management plane: the ports to close first

Close the highest-risk management ports first. Learn which services to disable, disable methods, and verification steps for network device hardening.

Security4 min read

Writing least-privilege firewall rules without breaking the app

Learn how to build restrictive firewall rules that enforce least privilege while keeping applications running. Practical techniques for network engineers.

Subnetting4 min read

Subnetting on the Fortinet NSE4 exam: what to expect

Master NSE4 subnetting questions: VLSM, binary math, route summarization, and practical FortiGate scenarios.

Security4 min read

Auditing an ACL for the permit any that should not be there

Learn how to identify overly permissive ACL rules, audit permit any statements, and tighten access control lists for better network security.

Security4 min read

FortiGate policy order: why your rule never matches

Learn why FortiGate firewall policies fail to match and how policy order determines which rule applies first. Essential for NSE and network engineers.

Security4 min read

Turning messy IP ranges into clean firewall object groups

Convert irregular IP ranges to CIDR notation for firewall ACLs, object groups, and security policies. Simplify network config.

Routing4 min read

When routes will not summarize: discontiguous networks explained

Learn why discontiguous networks prevent route summarization, how they break CIDR aggregation, and how to identify them in your topology.

Addressing4 min read

Supernetting vs subnetting: two directions, one mask

Learn how subnetting divides networks and supernetting combines them. Understand CIDR, route summarization, and when to use each technique.

Addressing4 min read

Why the first and last address in a subnet are off limits

Learn why network and broadcast addresses are unusable in subnetting, how they work, and why this matters for your design.

Addressing4 min read

100.64.0.0/10: the carrier NAT range explained

What is 100.64.0.0/10 CGNAT? Learn why this address range is neither private nor public, and how it affects your network.

Addressing4 min read

Designing an IP addressing plan for multi-site branch networks

Learn how to design scalable IP addressing plans for branch offices, including subnetting strategies, address allocation, and routing considerations.

Addressing4 min read

Choosing an RFC 1918 range that will not collide with your VPN peers

Plan private IP ranges across VPN peers without collision. Learn RFC 1918 subnetting strategy for site-to-site and remote access networks.

Addressing4 min read

/30 or /31 for point-to-point links: which to use

Compare /30 and /31 subnets for point-to-point links. Learn when to use each, RFC 3021 rules, and practical deployment guidance.

Subnetting4 min read

Answering a CCNA subnetting question in under 60 seconds

Learn the fastest method to solve CCNA subnetting practice questions. Master the binary method and shortcut techniques used by exam passers.

Security4 min read

Generating strong credentials for routers, switches and firewalls

Learn why default and weak passwords fail network devices, and how to generate strong, compliant credentials for Cisco, Juniper, Arista and Palo Alto.

Troubleshooting4 min read

Jumbo frames: when a 9000-byte MTU helps and when it hurts

Learn when jumbo frames (9000-byte MTU) improve throughput and when they cause fragmentation, latency, and packet loss in enterprise networks.

Subnetting4 min read

CIDR subnetting for CCNA: /26, /27, /28 explained

Master /26, /27, /28 CIDR subnets for CCNA. Learn host counts, usable IPs, and practical subnetting with real examples.

Subnetting4 min read

The subnet cheat sheet: prefix, mask and host counts

Quick reference for subnet masks, CIDR notation, and usable host counts. Essential lookup for network engineers and CCNA candidates.

Addressing4 min read

Reading IP addresses in binary, hex and decimal

Learn to convert IP addresses between decimal, binary, and hexadecimal. Essential for subnetting, ACLs, and network troubleshooting.

Subnetting4 min read

Is this IP in that subnet? The fast check every engineer needs

Learn how to quickly verify if an IP address belongs to a subnet using binary math, CIDR notation, and practical CLI methods.

Addressing4 min read

Convert IP range to CIDR: why it takes multiple blocks

Learn why converting an arbitrary IP range to CIDR notation usually requires multiple prefixes, not one. Essential for subnetting and route aggregation.

Subnetting4 min read

Splitting a subnet into equal blocks without the guesswork

Learn the systematic method to divide subnets into equal blocks. Master the math and avoid common mistakes in subnet planning.

Switching4 min read

VLAN ID ranges and reserved IDs you cannot use

Learn the full VLAN ID range (0-4094), which IDs are reserved, and how to plan your VLAN numbering scheme correctly.

Reference4 min read

TCP and UDP ports every network engineer should memorize

Master the essential TCP and UDP ports for networking: DNS, HTTP, SMTP, SSH, and more. A practical reference for engineers and certification candidates.

Addressing4 min read

MAC address formats: colons, dashes, Cisco dotted and the OUI

Learn MAC address notation formats: colon-separated, dash-separated, Cisco dotted-decimal, and how to identify the OUI manufacturer prefix.

IPv6 address compression: the :: shortcut done right

Master IPv6 address compression rules. Learn when and how to use :: correctly, avoid common mistakes, and compress addresses like a pro.

Reference4 min read

How long should that transfer take? Bandwidth math for real links

Learn to calculate data transfer time using bandwidth math. Practical formulas, real-world examples, and tools for network engineers.

Reference4 min read

The DNS records every network engineer should know

Master A, AAAA, MX, CNAME, NS, SOA, TXT, and SRV records. Essential DNS record types explained for network engineers and CCNA candidates.

Routing4 min read

Route summarization: shrinking your routing table the right way

Learn route summarization and CIDR aggregation to reduce routing table size, lower memory use, and improve convergence time across enterprise networks.

Subnetting4 min read

VLSM subnetting without the headache: a repeatable method

Learn a systematic VLSM subnetting method that eliminates guesswork. Step-by-step process for variable-length subnet masks with real examples.

DSCP marking explained: EF, AF classes and QoS

Learn how DSCP marking classifies traffic for QoS. Understand EF, AF classes, CS values, and practical marking strategies for enterprise networks.

Routing4 min read

Administrative distance: how a router picks between OSPF, EIGRP and static

Learn how administrative distance works and why routers prefer one routing protocol over another. Complete AD reference table included.

Security4 min read

GRE, ESP, and OSPF: Why they have no port numbers

Learn why GRE, ESP, and OSPF use protocol numbers instead of ports, and how to write ACLs for these Layer 3 protocols.

Troubleshooting4 min read

MTU, MSS, and why your VPN tunnels drop large packets

Learn why VPN tunnels fragment packets, how MTU and MSS interact, and how to diagnose and fix packet loss on encrypted connections.

Addressing4 min read

169.254.x.x address on your interface: what APIPA really means

Learn what APIPA (169.254.x.x) means, when it appears on your network interface, and how to troubleshoot it.

Routing4 min read

OSPF cost reference bandwidth: why 100 Mbps links get cost 1

By default OSPF gives every link above 100 Mbps a cost of 1, so it cannot tell 1G from 100G apart. Why it happens and how to fix it with reference bandwidth.

IPv6 address types (and how to compress them)

Global unicast, link-local, unique local, multicast - IPv6 scopes trip up engineers used to IPv4. A quick map of the ranges, plus the two rules for compressing any address.

Least privilege3 min read

Do these two subnets overlap? A 30-second check

Overlapping subnets quietly break routing, ACLs and firewall rules. The fast way to tell whether two CIDR blocks overlap, are disjoint, or one contains the other.

Least privilege3 min read

Subnet mask vs wildcard mask: stop mixing them up

A subnet mask and a Cisco wildcard mask are bitwise inverses. Confusing them writes ACLs and OSPF network statements that match the wrong hosts. The simple rule, plus the /12 trap.

Troubleshooting4 min read

OSPF stuck in EXSTART/EXCHANGE? It is almost always MTU

When an OSPF adjacency hangs in EXSTART or EXCHANGE and never reaches FULL, the cause is nearly always an interface MTU mismatch. Why it happens, how to confirm it, and how to fix it.