Close IPv6 RA-Guard evasion paths before calling the access edge protected
Validate that access switches inspect IPv6 extension-header chains and fragments before relying on Router Advertisement Guard.
Read the checklistDSE security knowledge hubNetworks & Infrastructure
Networks & Infrastructure
Knowledge
Page 150 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Networks & Infrastructure knowledge center
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
DSE post stream
1,594 articlesNetworks & Infrastructure
Use BGP Roles and OTC only after both sides agree on the relationship
Introduce BGP Roles and the Only-to-Customer attribute with explicit relationship mapping, interoperability tests, and a rollback path.
Read the guide
Make eBGP default-reject a tested policy, not a surprise outage
Confirm explicit import and export policy coverage before changing an eBGP platform to default-reject behavior.
Read the playbook
Prove VRRP failover from the client path, not the master-state display
Test virtual-router failover with real client traffic and upstream dependencies instead of relying on VRRP state alone.
Read the checklist
Tune BFD for the failure you need to detect—not the smallest timer
Set Bidirectional Forwarding Detection timers from a tested convergence objective and platform capacity, not a minimum-number contest.
Read the guide
Publish CAA only after mapping every legitimate certificate issuer
Use DNS Certification Authority Authorization records to express issuance policy without disrupting approved certificate workflows.
Read the playbook
Monitor DNSSEC trust-anchor rollover as a resolver lifecycle
Verify that validating resolvers can maintain DNSSEC trust anchors through updates, restarts, and extended offline periods.
Read the checklist
Enable QNAME minimisation as one DNS privacy layer
Reduce unnecessary query-name disclosure from recursive resolvers while preserving a tested compatibility and fallback path.
Read the explainer
Protect syslog in transit without mistaking TLS for log durability
Authenticate and encrypt syslog transport while separately engineering buffering, retention, integrity, and collector availability.
Read the guide
Build an IPsec profile before negotiating each tunnel by exception
Standardize IPsec and IKE choices, lifecycles, monitoring, and exceptions before adding more site-to-site VPNs.
Read the playbook