Engineer Lab

A working IP phone does not necessarily reveal how it learned its voice VLAN. This article explains how LLDP-MED, CDP, manual settings, and DHCP discovery affect switch migration, and what engineers should verify to preserve VLAN tagging, PC connectivity, authentication, and working voice services.

Access points can work normally during installation yet fail to recover after a shared power outage. This article explains why measured PoE consumption, allocated power, and available budget are different values, and how to validate full service recovery before accepting a deployment.

An unused switch port can create unintended access when configuration is removed or devices fail authentication. This article explains VLAN 1 defaults, shutdown versus parking VLANs, Layer 2 isolation, quarantine DHCP, 802.1X fallback states and vendor VLAN-tagging requirements, with a practical acceptance-testing framework.

Replacing a firewall while rewriting policies and redesigning VLANs can make application failures difficult to diagnose. This guide explains functional equivalence, evidence-based cleanup, migration baselines, zero-hit rule limitations, positive and negative testing, and how to sequence security improvements without losing the ability to identify what changed.

Two physical WAN circuits do not automatically provide two independent paths. This article explains shared gateways, provider bridging, same-subnet firewall constraints, SD-WAN health checks, HA boundaries, and how to prove redundancy with failure-domain mapping and acceptance testing.

Automating a switch reload is easy. Deciding whether the next device is safe to upgrade is harder. This guide defines readiness gates, distribution checks, baseline-delta validation, stop conditions, blast-radius controls and recovery requirements for production upgrade automation.

Two to four access points do not automatically need a controller. This guide explains what centralized Wi-Fi management actually adds, how same-SSID roaming differs from fast roaming, what controller outages may affect, and why AP and management-platform compatibility should be checked before you centralize.

Why can iBGP peer over loopbacks if BGP is not running yet? This article explains the underlay dependency, why OSPF is optional, how loopback-based sessions can survive link failure, and why BGP Established does not prove application traffic is healthy.

A real office expansion raised a common network-refresh problem: the core is still limited to 1G, but new switches and fiber are being installed today. This article explains how to stage the move to 10G, when LAG can help, how to compare OM3 and single-mode, and which infrastructure is worth future-proofing now.

Moving from traditional AD to Entra ID and Intune raises a second question after SSO: what actually consumes a FortiClient EMS license? This guide separates users, endpoints, sessions and identity workflows using current FortiClient EMS 7.4.7 licensing rules.