I spent six months reading RFCs to build a global RSVP-TE backbone only I could safely operate. The engineers who replaced me ripped it out in a week. And they were right. We usually blame technical debt on rushing, budget pressure, poor documentation or laziness. The most dangerous debt I
The Motivation Julian Lucek and Nitin Vig from HPE/Juniper recently showed Claude Opus passing the JNCIP certification. Impressive but multiple-choice tests just prove a model memorized the BGP state machine not that it can actually build a network. I wanted to see if an agent could design and configure
In Part 1 we structurally isolated the Route Reflector onto its own compute. The brain was protected. But protecting the brain does not protect the body. That is exactly what this part is about. The natural next step is optimization: tuning Optimal Route Reflection (ORR) and maximizing RIB Sharding to
A DDoS attack almost ruined my 40th birthday. Not the party, but the infrastructure I was responsible for. Friends texted "happy birthday." Colleagues texted... differently. Even though they were kind enough to shield me that day, I couldn't stay on the sidelines. I watched our scrubbing
We have a massive problem in network engineering. I call it the "Safety Plateau." We reach a point where the network works. The configs are ugly. The route-maps are 3,000 lines long. The logic is spaghetti. But packets are flowing. So we stop. We don't
Last month I shared a screenshot of a single switch validation: 12 tests, 1.46 seconds. It was cool, but it was a toy example. Scaling that to a nearly 300-device fabric requires more than just a loop. It requires architecture. The obvious question is: "Why not just use
The Challenge: When Granularity Is Your Only Option We were dealing with a legacy "beast" of a platform: a critical and systemic service running on traditional infrastructure, glued behind a single IP address. This IP hosted hundreds of distinct TCP ports, each representing different customers, protocols, and hard-wired
We love to lie to ourselves about redundancy. We configure BFD. We enable TI-LFA. We type commit. Then we sleep, assuming the network will heal itself in milliseconds. I recently spent days trying to prove myself wrong. Two years ago, I wrote about our migration to Segment Routing and our
When I think about our move from MPLS/LDP to MPLS/SR, I often compare it to switching from corned beef to wagyu - technically it's the same protein, but the experience is completely different. The Pain That Drove Us to Change I've spent years managing
The Excavator Doesn't Care About Your Diversity We'd done everything right. Diverse and multiple fiber paths to our remote site. Different physical routes. Different carriers. Different entry points. Textbook diversity - real diversity, not just on paper. Then an improbable confluence of circumstances hit. Multiple failures,
A Note on Context: Network engineering is rarely black and white. The following blueprint represents a methodology honed over 15+ years of working in the trenches of Internet Edge architecture. Treat this as a field report on what has worked for me rather than a universal standard. The Sovereign Edge:
At 2 AM on a Tuesday, my phone buzzed with a WhatsApp message: "You awake? Do you mind if I call you? I'm in the weeds..." A friend's Route Reflector (RR) on a transit Provider Edge (PE) router had just starved to death. Keepalives