A few weeks ago, we got nearly 95% of our VMs clean from known vulnerabilities after putting a lot of effort into patching. Now we’re back down to around 10%, and it honestly feels like all that progress disappeared overnight.

Every week there seems to be another critical vulnerability, and the workload is getting hard to keep up with.

At this point, our time is almost split in two: nights for patching during maintenance windows, and mornings for regular operational work, support requests, and issues from other teams.

It’s starting to feel like this is becoming the new normal for security and infrastructure teams.

I understand that keeping systems secure is part of the job, but the constant cycle of emergency patching, coordinating with application owners, testing fixes, and making sure production stays stable is becoming exhausting.

So I’m curious how other teams are handling this:

• Do you have a weekly maintenance window dedicated to vulnerability remediation?
• Are your teams also spending more and more nights patching, or have you found a more sustainable way to manage it?

I know having a 100% vulnerability-free environment is unrealistic, especially with how fast new CVEs keep coming out, but it’s frustrating to see weeks of hard work erased so quickly.

Is everyone else dealing with the same thing, or are we approaching this the wrong way?

This is a hypothetical I'm just looking for what you guys consider to be good documentation.

For example, let's say you are a JR network admin and you are new to the environment and the SR tells you that documentation exists for the 'routers' and 'core switches' and you can review it by typing the device hostname in the knowledge base server.

Ok, great, you do that and you see the documentation for the HA routers.

Now what, what do you expect to see?

I'm not looking for someone to copy paste their documentation, as stated, this is a hypothetical.

I see a lot about documentation on here but what does that mean? I'm sure it could mean different things to different people.

Yes, you should have login credentials for the devices documented and config backups should be automated, but lets say your backups are not good and you need to start over, are you expecting to see the full config of the routers in the documentation?

Any time I document something, I try to make it as dummy proof as I can. Maybe an accountant couldn't do anything with my documentation because they don't know what a console cable is or they don't know what SSH is, but I try to make my documentation detailed enough for a help desk tech to be able to follow the documentation step by step to resolve the issue or get it to a point where it is at least 'online' for myself or another network eng/tech/etc to be able to login and take over.

I say that because I often read documentation that was put together by someone else and aside from it being outdated, the steps are not very detailed. For example, it will say something like this.

1. Log in to the server
2. Get the logs
3. Send the logs to support

My documentation would say something like this:

1. Log into the server, the hostname is xxxxxx the ip address is xxxxx
2. The name of the application on this server is xxxxxx, the logs are located in C:\Program Files\xxxxxxx\logs\filename.txt copy filename.txt that is the file that is needed for support.
3. Send filename.txt to support@application-domain-name-here.com and include your case number if there is an active ticket.

Edit- My example included an 'application' and I wanted to post this in networking specifically because this is mainly a question for the networking device documentation. I wanted to make it clear that this was not incorrectly posted here instead of sysadmin, for example.

Wondering what cert(s) or education to go for from my position.

I was on the Service Desk for 3 years and have been a Network Engineer for the past 4 years. My work does neither encourage nor rewards certifications, so I have never pursued one. I have experience with Palo, Juniper, Fortinet, VMWare, and other basic Network Admin tools/concepts.

Where should I go from here to be valuable in the job market? My family will likely need to move in the next 1-3 years and I want to be able to find a job easily. Even though we have no access to Cisco equipment, is a CCNA best? Should I go with a Palo or Fortinet cert even though I do not plan to go into security? Juniper cert? Any input is appreciated, and thank you in advance.

I'm currently working on a project focused on automating network configuration in an existing network environment. I'm completely new to network automation, so I'm looking for advice, recommendations, and experiences from people who have worked with network automation.

The goal is to automate repetitive configuration tasks while keeping the existing infrastructure in place. A complete migration to Infrastructure as Code (IaC) as I see it isn't realistic for now, so I'm particularly interested in solutions that can be introduced incrementally into an existing environment.

Our environment includes equipment from multiple vendors:

• MikroTik (BRAS)
• HPE / Aruba
• Edgecore
• Ruckus ICX
• Extreme Networks (VDX / MLX)
• Fortinet (FortiGate)

The main tasks we wouldd like to automate for now are:

• VLAN provisioning along the required network path: The tool should determine which switches are on the network path between the relevant access router or BRAS and the customer connection, and configure the VLAN only on the devices that need it. The VLAN does not need to exist on every switch in the network, only on the relevant switches along that path.
• BRAS and RADIUS configuration: Automate the configuration required to provision a customer connection.
• Resource allocation and documentation: Automatically select an available VLAN ID, IPv4 address, and IPv6 prefix/address while ensuring that resources are not already in use or reserved. Currently, our network documentation is spread across multiple systems and only some of these systems provide API access. Any recommendations for centralizing network documentation, tracking resource allocation, and integrating/replacing existing documentation sources would therefore also be appreciated.

I've already looked into some tools and products, such as Ansible with AWX, Nornir, Cisco NSO, NetBox for documentation, and Oxidized for configuration backups (we currently use RANCID). However, there are many options and design decisions to consider, and it's difficult to know which approach would work best for our environment.

Ideally, we would like a solution that supports the vendors mentioned above. A interface or GUI to make configuration changes would also be a nice thing to have. Support for reviewing and approving (certern) changes before they are applied would be particularly useful for audit trails that record who requested, approved, and executed each change.

Recommendations for suitable tools, example architectures, or ways to implement this into our environment would be greatly appreciated. I'm also particularly interested in approaches to determining the required network path and resource assignments, and integrating automation into documentation.

Thanks in advance!