Cabletron and Enterasys

Over four and a half years, the role moved through the full arc of vendor engineering: field engineering and post-sales support, systems engineering and pre-sales, and, from 1997, certified instruction. The daily work was hands-on and physical: installing, configuring, troubleshooting, upgrading, migrating, and sometimes physically relocating the secure, redundant, resilient, managed networks that ran São Paulo's enterprises, LAN, campus LAN, and WAN alike. The WAN side was built on Frame Relay and fractional-E1 leased lines, the LP circuits of the Brazilian carriers, reaching up to ATM and Packet over SONET on the faster links, and leaned mostly on Cisco routers - in that era sold as Cabletron-branded OEM (original equipment manufacturer) modules built on licensed Cisco IOS: the CRBRIM and its Cisco-technology WAN routing siblings that slotted into the MMAC hub family, carrying Cisco 2500-, 4000-, and 4500-series routing inside Cabletron sheet metal. Installing, configuring, optimizing, and troubleshooting those routers was daily work, done in the age when the config examples that mattered were printed out and carried in the notebook bag. In the latter years they gave way to the SmartSwitch Router, the switch-router line born of Cabletron's 1998 YAGO Systems acquisition - the same technology thread that later became Riverstone. This was where the discipline of solution design, implementation, auditing, troubleshooting, and escalation management was first practised, and where teaching first entered the work.

The enterprise network of the late 1990s was not the Ethernet-and-IP monoculture it would later become. The wire itself was as likely to be Token Ring, or an FDDI or CDDI fibre-and-copper ring backbone, as it was to be Ethernet. And IP was only one protocol among many, sharing the same segments with IBM's SNA, DEC's DECnet, Xerox's XNS, AppleTalk, and Novell's IPX. IPX, a descendant of XNS, was a notorious source of broadcast storms: it ran in any of four different Ethernet frame types, 802.3 “raw”, 802.2, SNAP, and Ethernet II, and a segment where those were mismatched, or where its SAP service broadcasts went unchecked, could drown itself in overhead while stations on the wrong frame type sat unable to talk at all. Making these protocols coexist on one infrastructure, and keeping it stable, was the daily reality.

None of this happened at a desk. It meant pulling cable under the petrol-ship pier at São Sebastião for Petrobras, alongside the country manager and nearly the entire local team, because the deadline and the late-fee clause left no other option. It meant climbing metal structures to mount antennas at the top, and crawling through tight, dusty spaces, always in full business attire, designer tie included. It meant constant travel by car, plane, and taxi, and waking up more than once not sure which city it was. It also meant meeting a great many people and making friends and acquaintances along the way. The work was physical, relentless, and, in its own way, a privilege.

Where the work went is its own kind of résumé. The customer list ran across the Brazilian economy of the era: the datacentres of national and international banks and credit-card processors, the BM&F futures exchange, and investment and stock-trading brokers; Rede Globo across many sites in Rio de Janeiro and São Paulo, Editora Abril, and print and cable-TV media; Petrobras throughout both states, Votorantim and VCP, and chemical and pharmaceutical industry; airlines, national bus-line operators, insurers, call centres, retail and fast-food chains, construction and development firms; mobile-phone and cable operators; federal, state, and municipal government; and large, geographically distributed university campuses. Few weeks looked alike.

The connectivity of the era deserves recording, because the numbers sound implausible now. The São Paulo office reached corporate headquarters in Rochester, New Hampshire over a 256 kbps private line. That single link carried an entire country operation: mail, file access, internal systems, and whatever else needed the other end. Brazil held 134.141.239.0/24 out of Cabletron's own registered space, and it was possible to reach the internet through the United States over that private line - though in practice the local Brazilian connection carried most of it, at either 2 or 10 Mbps depending on which year is being remembered, and that uncertainty is left standing rather than resolved into a false precision. Dial-up did the rest. The modems were USRobotics Sportsters, replaced as the speeds stepped up through 14.4, 28.8, 33.6 and finally 56k, with a pair of the more expensive Couriers arriving as a gift from a client - which is roughly how anyone outside a corporate purchasing department came to own one.

Returning to the lineage as a services and support manager, the focus was the Secure Routing product line, with Enterasys as the regional focal point for Brazil. The work combined high-level customer support, complex troubleshooting, and escalation management, including the demanding escalations that came in from a key account, Petrobras in São Paulo, with localized product management alongside. The technical surface had grown to include network management, NAC and UAC, intrusion detection and prevention, and SIEM, across enterprise switching and routing. Enterasys was later acquired by Extreme Networks in 2013, closing a circle that connects this early work to a platform still taught today.

One thread from the Enterasys years deserves recording precisely, because it is easy to overstate. This was the height of policy-based networking, Enterasys built its Secure Networks architecture around role-based access and 802.1X, and the work sat in close, constant contact with the demanding world of contact-center networks and the Avaya and Cisco IP-telephony systems running on top of them. The familiarity ran deep, but it was familiarity from the network side. The role was never unified-communications engineering; it carried no telephony certification and no hands-on UC work. What it delivered instead was the layer all of that depends on: a secure, redundant, resilient, monitored, guaranteed always-on superhighway for voice and mission-critical traffic. Being clear about where that line sits is part of describing the work honestly.

One deployment of those years connects two chapters of this record. Enterasys's LAN user access control, reviewed as Sentinel 1.0 in October 2006 and sold as Enterasys NAC after it, admitted an end system only after assessing it, and the assessment engine it called was Nessus, the scanner created by Renaud Deraison and by then Tenable Network Security's product: a Nessus server scanned the endpoint when the Trusted Access Gateway asked, a failed scan put the port into a quarantine policy that allowed nothing but the remediation web page, and a passing one released it. On the other side of the loop sat Enterasys's Dragon intrusion detection and prevention and the NetSight Automated Security Manager, which turned a detected event into a located source and an applied response. Deploying that solution for customers in Brazil, with Nessus doing the assessment, was this record's first contact with Tenable's product, fourteen years before the pre-sales chapter of 2020. The author recalls the Nessus part clearly and the Dragon part less so; the product descriptions here come from Enterasys's own 2008 NAC whitepaper and from the 2006 review of Sentinel 1.0, not from memory.