blog
Field notes on networks, automation, AI infrastructure, and the answer-engine era.
-
Configuring and Monitoring 6 GHz Standard Power on a Catalyst 9800, Programmatically
The whole Standard Power configuration on a 9800 is one boolean with three names across the CLI, YANG, and Catalyst Center. Two operational models carry grants, expiry, and cloud health over NETCONF, a pyATS Blitz precheck reports controller-side readiness as pass or fail, and an undocumented RPC input is the only per-radio write path in the modeled surface. Measured on a live 17.17.1 bench, packaged in a public repo. Last of four posts on 6 GHz power modes.
-
Why 40 MHz Is the Right Default Channel Width in 6 GHz
The clients arriving on enterprise 6 GHz are phones and tablets needing a few megabits each, and they already prefer 6 GHz at the operating system level. 40 MHz serves them, survives AFC exclusion masks under almost any grant, and carries to international sites. Wide channels stay a deliberate choice: LPI keeps SNR by rule, and Standard Power needs a clean grant at every site. Third of four posts.
-
What AFC Requires From a Standard Power Access Point
AFC protects fixed point-to-point microwave links. A Standard Power AP reports latitude, longitude, and height with a stated uncertainty, re-authorizes every 24 hours, and lives with an upside-down V of excluded spectrum. The hard part indoors is location: GNSS anchors near windows, derivation hops, and uncertainty the AFC treats as risk. With bench notes from a 9800-CL that reports exactly why it is blocked. Second of four posts.
-
Choosing a 6 GHz Power Mode: Low Power Indoor or Standard Power
Every enterprise 6 GHz AP runs as Low Power Indoor or Standard Power. LPI gets the full 1,200 MHz and holds client power ceilings 6 dB under the AP's, which shrinks the usable cell. Standard Power raises the ceilings on both sides in exchange for AFC registration, a 24-hour re-authorization, and exclusion masks. The trade framed as a purchase, and a table for which way to lean. First of four posts.
-
Patching This Site's MCP Endpoint and Limiting What It Can Do
An MCP server bolted onto your site is a public, unauthenticated API with a friendlier name. Bringing this one to the current protocol revision without breaking older clients, and the seven limits I put on it: read-only tools, 60 requests a minute per hashed IP, a 64 KB body cap, an https-only Origin check, arguments clipped instead of rejected, and logs that store no addresses. The version bump was the reason I opened the file, and rereading it is what found the problems.
-
No Lab, No Problem: Record CML2 Devices into pyATS Mocks for CI
Develop against the live CML2 lab, but a CI runner cannot reach it and should not wait on a boot. Record the fabric once with unicon playback, commit the recording, and replay the exact same pyATS suite in GitHub Actions with no lab attached. Point the testbed at an unreachable address and it still passes, because replay never opens a socket. Includes a real repo with a green Actions run.
-
The Snapshot Machine: genie learn and diff as a Change-Validation Safety Net on CML2
Make a change in a maintenance window, run a few show commands, and they look fine. Then genie learn and genie diff the CML2 fabric before and after, and watch one fat-fingered OSPF cost quietly reroute three destinations while every adjacency stays FULL. Structured before-and-after diffs catch the side effects show commands miss.
-
From Intent to Reality: Driving pyATS Tests from NetBox Against a CML2 Fabric
NetBox holds the intent (declared OSPF router-IDs), a CML2 spine-leaf is the network under test, and pyATS is the judge. Close the loop and prove the live network matches what you said it should be, with real pass and fail output.
-
Build the Lab Once, Test It Forever: A CML2 Spine-Leaf Wired for pyATS
Stop hand-maintaining your pyATS testbed. Build a four-node spine-leaf in CML2 as code, then generate the testbed straight from the CML API so it never drifts from the lab, with live Genie-parsed proof over a System Bridge management network.
-
Agents Are the World's New First-Class Citizens
Cisco Live 2026 made AI agents their own kind of identity, with permissions and an accountable human owner. Why issuing the identity is the easy 20 percent, what real accountability takes, and how the same agents quietly became the audience we now write for.
-
Your robots.txt Says Yes. Your Firewall Says 403.
A client's robots.txt welcomed AI search and blocked training crawlers. The firewall 403'd everyone anyway. Finding Cloudflare's blunt AI-bot toggle, the AI Crawl Control fix, and why you audit enforcement, not intent.
-
Why Your Next Network Lab Might Be Built by an AI Agent
CML 2.10 ships a first-party MCP server, and Claude can now build the lab for you. What Joe Clarke's demo gets right, plus the failures my own lab hit that the agent never saw: dataplane readiness gates, the cat9000v interface trap, and guardrails that live in docstrings.
-
Prompts Are Guidelines. Code Is the Config.
Where the model's judgment ends and your code has to take over: branching on stop_reason, forcing tool use, hooks, stateless history, and why a valid JSON schema still isn't a true answer. First in a Today I Learned series.
-
Beyond the Click: 5 Counter-Intuitive Truths About the New Era of AI Search
The shift from SEO to AEO, the Mirror Effect, social signals, productivity arbitrage, the authenticity paradox, and agentic AI — what brand visibility looks like in a zero-click world.
Subscribe via RSS.