I just want to see how something is physically wired. Previously, you had to drive to the datacenter and spend most of your visit stuck at the security desk, waiting for someone to find you on their screen and badge you into the room. I built net3d so I don&
I spent six months reading RFCs to build a global RSVP-TE backbone only I could safely operate. The engineers who replaced me ripped it out in a week. And they were right. We usually blame technical debt on rushing, budget pressure, poor documentation or laziness. The most dangerous debt I
The Motivation Julian Lucek and Nitin Vig from HPE/Juniper recently showed Claude Opus passing the JNCIP certification. Impressive but multiple-choice tests just prove a model memorized the BGP state machine not that it can actually build a network. I wanted to see if an agent could design and configure
In Part 1 we structurally isolated the Route Reflector onto its own compute. The brain was protected. But protecting the brain does not protect the body. That is exactly what this part is about. The natural next step is optimization: tuning Optimal Route Reflection (ORR) and maximizing RIB Sharding to
A DDoS attack almost ruined my 40th birthday. Not the party, but the infrastructure I was responsible for. Friends texted "happy birthday." Colleagues texted... differently. Even though they were kind enough to shield me that day, I couldn't stay on the sidelines. I watched our scrubbing
We have a massive problem in network engineering. I call it the "Safety Plateau." We reach a point where the network works. The configs are ugly. The route-maps are 3,000 lines long. The logic is spaghetti. But packets are flowing. So we stop. We don't
Last month I shared a screenshot of a single switch validation: 12 tests, 1.46 seconds. It was cool, but it was a toy example. Scaling that to a nearly 300-device fabric requires more than just a loop. It requires architecture. The obvious question is: "Why not just use
The Challenge: When Granularity Is Your Only Option We were dealing with a legacy "beast" of a platform: a critical and systemic service running on traditional infrastructure, glued behind a single IP address. This IP hosted hundreds of distinct TCP ports, each representing different customers, protocols, and hard-wired
We love to lie to ourselves about redundancy. We configure BFD. We enable TI-LFA. We type commit. Then we sleep, assuming the network will heal itself in milliseconds. I recently spent days trying to prove myself wrong. Two years ago, I wrote about our migration to Segment Routing and our
When I think about our move from MPLS/LDP to MPLS/SR, I often compare it to switching from corned beef to wagyu - technically it's the same protein, but the experience is completely different. The Pain That Drove Us to Change I've spent years managing
The Excavator Doesn't Care About Your Diversity We'd done everything right. Diverse and multiple fiber paths to our remote site. Different physical routes. Different carriers. Different entry points. Textbook diversity - real diversity, not just on paper. Then an improbable confluence of circumstances hit. Multiple failures,
A Note on Context: Network engineering is rarely black and white. The following blueprint represents a methodology honed over 15+ years of working in the trenches of Internet Edge architecture. Treat this as a field report on what has worked for me rather than a universal standard. The Sovereign Edge:
Backbone Architecture
At 2 AM on a Tuesday, my phone buzzed with a WhatsApp message: "You awake? Do you mind if I call you? I'm in the weeds..." A friend's Route Reflector (RR) on a transit Provider Edge (PE) router had just starved to death. Keepalives
Backbone Architecture
Every network engineer wants sub-second convergence. But it's a common trap to assume BGP handles this automatically. Because BGP manages the vast majority of overlay routing, many assume the underlying IGP speed is of secondary importance. This is a massive vulnerability. BGP is not an independent entity. Its
Physical Layer
We need to talk about the most dangerous comfort blanket in enterprise IT: Dual Homing. If you spend enough time in this industry, you will eventually file a Root Cause Analysis for a total blackout on a "fully redundant" backbone. We do not talk about these incidents publicly.
Physical Layer
Your contract says you have two separate paths. Your routing table shows two distinct IS-IS adjacencies formed over independent circuits, with the LSDB confirming unique paths to the remote site. Your logical diagrams look flawless, and your auditor just happily checked the box for high availability. Then a guy in
Leadership
Following my recent piece on the Cook vs. Chef Paradox, many of you asked: "Herve, if the career ladder is broken, how do you actually build a kitchen that scales? How do you turn a junior into a Chef?" Management isn't about presiding over a dashboard;
Leadership
We keep saying we can't find "real" Network Engineers. We look for those who have a genuine passion for the "why" behind the packets, yet finding them has become incredibly difficult. Is the passion gone? I don't think so. I think the
Network Fundamentals
(The "Set and Forget" Trap That is Killing Your Uptime) We need to talk about the "dirty little secret" in many production networks: the static route. In the early days of a network build, they are seductive. They are easy to understand, quick to configure, and
DDoS Defense
The following blueprint is not a theoretical lab exercise or a "cloud-native" wish list. It is a methodology honed over years of managing a sovereign enterprise backbone where we own our Autonomous System (AS), our IPs, and our compute rather than relying on public cloud abstraction. This approach
DDoS Defense
A note before we begin: What follows is my perspective forged from decades of operational scars. It's not gospel - it's one engineer's hard-won opinion. Take what's useful to you and feel free to challenge the rest. I stood in the war