Torbjorn.dev

Moving to Forgejo on Hetzner

Wed, 01 Apr 2026 10:00:00 +0000

I recently moved my git repositories off GitHub and onto a self-hosted Forgejo instance running on a Hetzner VPS. The whole thing costs €4.49/month and took an afternoon to set up.

In this post I’ll walk through the deployment, the reasoning behind it and migration steps. This is meant as inspiration, not a batteries-included guide. Adapt it to your own needs.

Gleaning DNS resolver behavior

Sun, 01 Mar 2026 10:00:00 +0000

You probably trigger your first query to a DNS resolver before putting socks on in the morning (and so do I).

What happens when you open “lkml.org” in your browser is fairly predictable, but what happens when said request hits the resolver varies widely. This is usually opaque to both you, the user, and the DNS client. RFC 9606 with its RESINFO record is intended to solve this, but it is about as widely implemented as RFC 2549.

Tuning Vibe CLI for Network Engineering

Tue, 16 Dec 2025 10:00:00 +0000

Vibe CLI is Mistral’s answer to Claude Code and OpenAI Codex. Out of the box it’s optimised for software development, not network engineering. But with the some configuration tweaking it’s surprisingly capable for network tasks.

TL;DR

Model selection

Vibe defaults to Devstral. It does quite a good job for most things but certain complex tasks do better with reasoning. My general “strategy” is to use Devstral until it seems to get stumped or otherwise performs poorly, then switch to Magistral.

Building your own Containerlab node kinds

Wed, 29 Oct 2025 12:07:52 +0000

Over the last few weeks I’ve added several new node types to containerlab to cover my own lab needs. The process has been surprisingly straightforward after I got familiar with the codebase, and I figure others probably have devices they’d like to add too. This post will guide you through the basics of creating vrnetlab-based node kinds for containerlab - it’s easier than you might think.

The node kinds I have contributed thus far are the following:

Containerlab Cisco images simplified

Sun, 26 Oct 2025 22:21:47 +0000

Running Cisco VMs in containerlab can feel surprisingly unintuitive if you’re coming from tools like EVE-NG or CML. This post will walk you through the first crucial step: building the images.

TL;DR

vrnetlab

Vrnetlab is the glue that allows us to join VMs to _container_lab. It does quite a few useful things:

Configures & runs VMs inside containers
Enables “container native” networking
Exposes serial to telnet on port 5000
Loads configuration on startup
Checks node state & health

In sum this enables us to deploy containerlab nodes in a declarative and predictable manner.

EEM in Catalyst Center templates

Sat, 05 Oct 2024 17:23:26 +0000

Introducing Catalyst Center templating to brownfield environments often require dynamic configuration outside of what jinja can offer. I will cover a few scenarios below that demonstrates when and how EEM applets can assist you in overcoming some limitations in CC templating.

TL;DR

Why EEM?

Jinja templates on the Catalyst Center are flexible enough to cover most scenarios where dynamic configuration is required, but it has a few notable limitations. The main ones I face regularly are the lack of access to inventory variables & interactive commands in onboarding templates, and when your desired configuration requires referencing operational data.

PNP Licence level change

Fri, 20 Sep 2024 13:05:22 +0000

IOS-XE routers are currently not being shipped with the ordered license level applied. This becomes an issue whenever you need non-default licensing level features during PNP onboarding(DMVPN spokes for example). In this post I will cover the simplest way I have found to remediate this.

Note: This method does not work for changing license level from essentials to advantage on Catalyst 9000 series switches.

TL;DR

The problem

Onboarding templates are quite limited in functionality. They don’t allow for any interactive commands such as reload and only permits you to push the full config in one go. It is hence not possible to simply set the license level directly in the onboarding template. Solving this will hence require some form of on-box or off-box automation. I will cover doing this on-box with EEM in this post.

EVE-NG Netplan configuration

Thu, 27 Jun 2024 17:18:34 +0000

If you’re like me you found the introduction of Netplan to Ubuntu a fresh of breath air. YAML is ubiquitous these days and is very convenient wherever manual modification is expected/required. Why EVE-NG decides to stick with legacy configuration 7 years after the introduction is hence beyond me.

NOTE: You will likely not get the same level of support from EVE-NG (if any) by converting to Netplan configuration

Deploying Hugo site to Bunny.net

Wed, 20 Mar 2024 17:04:51 +0000

As part of simplifying my personal tech-stack I found Bunny.net to best fit the hosting needs for my static websites. It’s good, it’s fast & is’s cheap - a rare contradiction to RFC 1925!

In this post I will cover automated site deployments with the following stack:

Bunny Storage & CDN
Github Actions
Terraform

TL;DR

Bunny.net infrastructure

To serve our website with Bunny we need two things:

CML Autoshutdown nodes

Sun, 25 Feb 2024 09:22:12 +0000

If you manage a shared CML instance you probably have to remind your coworkers regularly to shut their labs down regularly to free up the node count. This is unfortunately not something that can be automatically handled out of the box, so we’ll have to make our own fix for this.

The solution

The easiest way to do this is to shut down all running labs each night. This isn’t perfect, but people quickly learn to save their configs after losing progress once or twice. We will accomplish this with a python script and a cronjob

Ubuntu, SecureCRT & Telnet links

Thu, 15 Feb 2024 19:13:07 +0100

SecureCRT will not open any SSH/Telnet links by default in Ubuntu 22.04. If you’ve found this writeup you have probably discovered this already. This article will hopefully save you some time and effort.

TL;DR

Explaination

The problem can be split into two parts:

Enabling SecureCRT to open links
Ensuring SecureCRT is used for opening said links

Desktop entry

Ubuntu uses desktop entries to specify how a program should be launched. These are configuration files which among other things define which icon to use, description and which arguments the program accepts.

My CCIE - EI v1.1 Lab setup

Sat, 13 Jan 2024 00:01:59 +0200

One of the first hurdles one has to overcome in achieving the CCIE - EI is getting access to a proper lab environment. This post covers how I have solved this for the CCIE EI v1.1.

Hardware & Software

The new equipment and software list has some major changes. The most important changes are as follows:

The DNAC is bumped to a much improved v2.3
The DNAC is now a lot easier to run virtualized!
The vEdges are fully replaced by cEdges
The CSR 1000v is replaced by the C8Kv

Virtual machines

These images are included in Cisco Modeling Labs:

Catlyst 8000v cEdge support in EVE-ng

Thu, 28 Sep 2023 01:43:02 +0200

When you spend copious amounts of time labbing it quickly becomes tedious to reset lab devices manually. Especially so when you have multiple config-sets for labbing different technologies and scenarios. This is enough reason alone to make EVE-ng the superior network labbing platform with its startup-configs feature.

EVE-ng does however not support config import/export for all nodes out of the box. After resetting the cEdges in my lab to my base config N times i thought to myself “This is just a c8000v in a different mode, adding config export/import should be a quick fix.”. I was wrong.

CCIE - EI: 1.3 EIGRP 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

1.3 - EIGRP

AD 90(internal), 170(external)

Transport: IP/88 -> 224.0.0.10/FF02::A

Timers: 5/15, 60/180(sub 1544kbps nbma)

ip hello-time eigrp {asn} {seconds}
ip hold-time eigrp {asn} {seconds}
eigrp> timers active-time {minutes}

Authentication: MD5 and SHA

Only MD5 is supported in classic configuration. Usually configured with a key-ring, though SHA allows for configuration directly under af-interface. Only configurable per-interface(including default interface)

CCIE - EI: 1.4 OSPF 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

The reference bandwidth can be different between adjacent routers, but it doesn’t make much sense to do so.

1.4 - OSPF

Link state protocol using djikstra

Timers

Hello, 10s/30s
Dead, 40s/120s
Wait, equal to dead
LSRefresh, 30m
MaxAge, 30m

Messages

Hello
- Discovery
- Agreement on parameters
- Bidirectionality check
- Health check
DBD
LSR
LSU
LSAck

RID selection:

CCIE - EI: 1.5 BGP 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

1.5 - BGP

1.5a IBGP and EBGP peer relationships

iBGP and eBGP

Defined by the remote-as specified for a neighbor.

Differences between iBGP and eBGP:

eBGP defaults to next-hop-self
eBGP uses an advertisement interval of 30, while iBGP uses 0 by default.
eBGP packets are sent with a TTL of 1, while iBGP uses 255 by default.
Some differences default behaviour for tie-breakers, see 1.5b Path selection
Some differences in default convergence optimzations, see 1.5e Convergence and Scalability

Peering

Transport: TCP/179
Router with the lowest RID initiates peering.
Initiating router can be identified with show tcp brief
Initiating router can be manually configured with neighbor {} transport active

CCIE - EI: 1.6 Multicast 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

1.6 - multicast

The documentation for multicast in IOS-XE 16.12 is not very good IMO. Configuration guides like MLD is nowhere to be found in detail

Address ranges:

Permanent groups 224.0.0.0/23
- Local groups 224.0.0.0/24, not to be routed
- Routed groups 224.0.1.0/24, will be routed
SSM groups 232.0.0.0/8
GLOP addresses 233.0.0.0/8, globally unique experimental groups
- GLOP address = 233.{first 8b of ASN}.{last 8b of ASN}.X
Private groups 239.0.0.0/8 The remaining address space under 224.0.0.0/4 are “transient groups”, shared global address space for globally routed multicast groups.

IPv6 addresses:
ff00::/8 is reserved for IPv6 multicast Format: FF{flags}{scope}::{64b prefix}{32b group ID}

CCIE - EI: 3.1 MPLS 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

3.1 - MPLS

Lower latency and higher throughput are two major benefits to MPLS/Label switching over IP routing.

MPLS Header(4B):

20b - Label
3b - Exp
1b - S-bit
8b - TTL

LIB - Similar to the RIB, containing all local and remote labels + neighbor RID per associated prefix.
LFIB - Similar to the FIB, containing label, outgoing interface and label/action for the best LSP Segment.

CCIE - EI: 3.2 DMVPN 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

3.2 - DMVPN

Docs: Support > Products & Downloads > Networking Software (IOS and NX-OS) > IOS-XE 16 > Configuration Guides > 16.12.1 > Dynamic Multipoint VPN

Phase 1
- No spoke-spoke communication
- Summarization/filtering on hub
Phase 2
- Spoke-spoke communitcation through NHRP requests only
- Next-hop addresses must be intact for spoke-spoke communication
- No filtering/summarization
- Hub briefly used in spoke-spoke data-plane until NHRP request has been received
Phase 3
- Spoke-spoke communication, through NHRP requests/redirection.
- Filtering/summarization allowed
- NHRP redirect to packet-source when ingress and egress interface is equal.
- Hub briefly used in spoke-spoke data-plane until NHRP request/redirect has been received.
- Hierarchical DMVPN is supported without hub daisy-chaining.

DMVPN Basics

Basic configuration

Hub configuration

CCIE - EI: 4.0 Security and Services Pt. 1 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

4.0 - Infrastructure Security and Services Pt. 1

4.1 Device Security on Cisco IOS XE

Control plane policing and protection

CoPP - Control-plane Policing
Used to protect routers from DoS attacks through applying policing to control-plane traffic/punted traffic.

class-map {}
 match {}

policy-map {}
 class {}
 drop
! or
 police {}

control-plane
 service-policy input {}

This is a foot-gun if I’ve ever seen one…

CCIE - EI: 4.0 Security and Services Pt. 2 📝

Fri, 29 Apr 2022 22:00:00 +0000

My CCIE Enterprise Infrastructure study notes, what I wrote down while preparing for the lab, not a complete resource.

4.0 - Infrastructure Security and Services Pt. 2

4.5 Network Services

4.5.a First-Hop Redundancy Protocols

HSRP, GLBP, VRRP

GLBP

Gateway Load Balancing Protocol. Achieving HA load-balancing through ARP trickery and multiple mac addresses.

Active Virtual Gateways(AVG) assign MAC addresses to Active Virtual Forwarders(AVF) and responds to ARP for the shared virtual IP address. The AVG allocates up to 4 MAC addresses per group to AVFs. GLBP routers can either be in Speak, Standby or Active state for a given group.

CCIE - EI: IPv6 📝

Fri, 29 Apr 2022 22:00:00 +0000

This is a summary of the notes I’ve made in preparation for the IPv6 parts of the exam. In other words, this only contains the stuff I felt the need to take note of. Please see study resources for the resources I’ve used.

IPv6

Fixed header size of 40B, compared to the minimum of 20B and maximum of 60B for IPv4.
- IPv6 can use extension headers instead of the IPv4 IHS.
- IPv4 packet lengths must adhere to a 32b divisible length and IPv6 must adhere to a 64b divisible length.
TOS field is identical to IPv4
Flow labels are included in IPv6 to label all packets in a sequence to ensure equal treatment.
- Very few applications actually uses this though…
The total length field includes the header in IPv4, while it excludes the header in IPv6
- Jumbograms are packets with payloads larger than the 16b length field allows, only possible in IPv6 where the MTU is insane.
- v6 requires an MTU of 1280b, while IPv4 only requires an MTU of 68b.
The “protocol” field is replaced with the “next-header” field in IPv6.
- The protocol numbers used in IPv4 is reused in the IPv6 next-header field.
- The next-header field will either point to a type of payload or extension header(which again contains a next-header field)
The TTL field has been renamed to hop-limit in IPv6
The checksum field is removed from IPv6 headers as they’re not needed.
- UDP checksum is hence mandatory in IPv6

Extension headers There are currently six extension headers for IPv6:

My CCIE - EI Lab setup

Thu, 23 Sep 2021 00:01:59 +0200

One of the first hurdles one has to overcome in achieving the CCIE - EI has been getting access to a proper lab environment. At the time of writing I have not found any reputable “rack rental” provider for the CCIE - EI. Hence I found it neccessary to build my own.

Click here if you want to go straight to the inventory list.

Hardware & Software

Cisco has released the equipment and software list for the CCIE - EI Pods for the exam. This is the logical starting point for any lab build. I will break down my choices of lab software choices by the points on this list.

Hello world!

Sun, 22 Aug 2021 01:51:26 +0200

After being over a year in the making, this website is finally live. 🎉

A lot has happened since the first commit for this site: A pandemic hit, I moved, and I became a father of two. I should have settled for a simple Wordpress site…

Goals

This site was made with a few goals in mind:

Having a single place to refer to when sharing information.
Assist me in learning through writing longer-form articles about technology.
Being able to publish to a platform that I own and control.
Functioning as an extension of my CV/Resume

Whether I am able to fulfill my wishes through this site is yet to be seen. I am hoping to be able to publish a post on this site on a bi-weekly basis.