The Motivation Julian Lucek and Nitin Vig from HPE/Juniper recently showed Claude Opus passing the JNCIP certification. Impressive but multiple-choice tests just prove a model memorized the BGP state machine not that it can actually build a network. I wanted to see if an agent could design and configure
In Part 1 we structurally isolated the Route Reflector onto its own compute. The brain was protected. But protecting the brain does not protect the body. That is exactly what this part is about. The natural next step is optimization: tuning Optimal Route Reflection (ORR) and maximizing RIB Sharding to
A DDoS attack almost ruined my 40th birthday. Not the party, but the infrastructure I was responsible for. Friends texted "happy birthday." Colleagues texted... differently. Even though they were kind enough to shield me that day, I couldn't stay on the sidelines. I watched our scrubbing
We have a massive problem in network engineering. I call it the "Safety Plateau." We reach a point where the network works. The configs are ugly. The route-maps are 3,000 lines long. The logic is spaghetti. But packets are flowing. So we stop. We don't
Last month I shared a screenshot of a single switch validation: 12 tests, 1.46 seconds. It was cool, but it was a toy example. Scaling that to a nearly 300-device fabric requires more than just a loop. It requires architecture. The obvious question is: "Why not just use
The Challenge: When Granularity Is Your Only Option We were dealing with a legacy "beast" of a platform: a critical and systemic service running on traditional infrastructure, glued behind a single IP address. This IP hosted hundreds of distinct TCP ports, each representing different customers, protocols, and hard-wired
When I think about our move from MPLS/LDP to MPLS/SR, I often compare it to switching from corned beef to wagyu - technically it's the same protein, but the experience is completely different. The Pain That Drove Us to Change I've spent years managing
We love to lie to ourselves about redundancy. We configure BFD. We enable TI-LFA. We type commit. Then we sleep, assuming the network will heal itself in milliseconds. I recently spent days trying to prove myself wrong. Two years ago, I wrote about our migration to Segment Routing and our
A Note on Context: Network engineering is rarely black and white. The following blueprint represents a methodology honed over 15+ years of working in the trenches of Internet Edge architecture. Treat this as a field report on what has worked for me rather than a universal standard. The Sovereign Edge:
The Excavator Doesn't Care About Your Diversity We'd done everything right. Diverse and multiple fiber paths to our remote site. Different physical routes. Different carriers. Different entry points. Textbook diversity - real diversity, not just on paper. Then an improbable confluence of circumstances hit. Multiple failures,
At 2 AM on a Tuesday, my phone buzzed with a WhatsApp message: "You awake? Do you mind if I call you? I'm in the weeds..." A friend's Route Reflector (RR) on a transit Provider Edge (PE) router had just starved to death. Keepalives
Every network engineer wants sub-second convergence. But it's a common trap to assume BGP handles this automatically. Because BGP manages the vast majority of overlay routing, many assume the underlying IGP speed is of secondary importance. This is a massive vulnerability. BGP is not an independent entity. Its