Welcome to my haven!

Sometimes depending on the network architecture you find your traffic inside a tunnel encapsulated inside another and maybe also inside another tunnel. So double to tripple encryption without that much of a security benefit. When the clients already establishing a VPN connection there is no need for the S2S encryption tunneling. We only getting smaller and smaller packets through the pipe because of the overhead of each IPsec tunnel reducing the MTU further.

This is my 2026 overview of my homelab. Here I go over everything I use almost on a daily basis. Feel free to surf around.

Network

The heart of my network is my Mikrotik hEX router. It has multiple VLANs, doing DNS forwarding and distributing IP addresses over DHCP.

Additionally it has some Wireguard tunnels towards my Hetzner Cloud servers that I don’t have to expose the management access towards the wild wild internet. Overall I have three different VLAN segments terminating on the router:

Today I encountered a scenario in which an HPE Aruba ProCurve switch (AOS-S), used as an access switch in a classic three-tier network topology, declares certain VLANs (in this case, VLAN 16) as root bridges. However, on the core switch, all VLANs are configured with a spanning tree priority of 4096 — see VLANs 12 and 53.

  VLAN  Root Mac        Root       Root       Root                 Hello
  ID    Address         Priority   Path-Cost  Port                 Time(sec)
  ----- --------------- ---------- ---------- -------------------- ---------
  1     f8f8f8-c3c3c3   32,768     0          This switch is root  2
  998   f8f8f8-c3c3c3   32,768     0          This switch is root  2
  999   f8f8f8-c3c3c3   32,768     0          This switch is root  2
  53    1bfdec-1bfdec   4096       2250       Trk1                 2
  12    1bfdec-1bfdec   4096       2250       Trk1                 2
  16    f8f8f8-c3c3c3   32,768     0          This switch is root  2

If you think about it, the reason is relatively clear. All VLANs that have been created on the switch participate in Rapid Per-VLAN Spanning Tree formation and also send different BPDUs per VLAN over a trunk link. If the VLAN is not permitted on the trunk, the BPDUs for that VLAN will never be sent over the trunk and therefore cannot negotiate with the neighboring switch to determine who will be the root bridge.

The Cisco C8300 and C8200 routers doesn’t have an Out-of-Band-Management Port. Nevertheless you can create a dedicated management interface over an in-band port.

When using an in-band port for management access it is still going through the normal data plane. When you follow this post, creating an dedicated management port over an in-band port doesn’t make it magically an out-of-band port.

In order to accomplish this we would need to create a dedicated management VRF, assign it to the interface and limit the SSH access with an ACL. The management port can then be connected to the regular out-of-band management network over that port. In the following examples we are using the Gi0/0/0 port as a dedicated management interface.

This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below.

Security considerations

In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).

Microsoft deactivated the offline telephone activation back in december last year. But now in my current project we need to activate Windows Pro and the Office Suite in an offline enviroment. Microsoft established a new process which I think is working pretty good.

At first I read that the offline activation is not possible anymore for OEM licenses, but in the documentation page for the new activation process states that it is possible to activate Retail, OEM and Volume / CSP licenses in this portal.

I was busy the last few days creating a task sequence inside the Microsoft Configuration Manager (Config Mgr) or also known as SCCM in the past, where we remove the config mgr agent after the task sequence is finished. Sounds easy right? Well I thought so too, but it wasnt as easy as run ccmsetup.exe /uninstall as a command line argument.

What did not work

1. I tried to run ccmsetup.exe /uninstall as a command line argument. In WinPE and full OS mode.
2. All other forms of running the ccmsetup.exe /uninstall command inside powershell scripts.
3. I found this script which kind of worked but it left a lot of remnant files in C:\Windows. Additionally the task sequence breaks directly after execution.

What did work

The cleanest way to remove the agent from the computer at the end of the task sequence is to use the build-in Prepare ConfigMgr Client for Capture method.