Advanced Networking
19 parts · read in order
- 1 NX-OS VXLAN/EVPN Fabric: Underlay and Overlay End to End Build a VXLAN BGP EVPN fabric on Nexus from scratch. Covers the OSPF underlay, BGP EVPN overlay, NVE configuration, distributed anycast gateway, and the verification commands that prove it actually forwards.
- 2 EVPN Multihoming with ESI-LAG: Active-Active Without MLAG Standards-based all-active multihoming in EVPN-VXLAN fabrics. How ESI, Type-1 and Type-4 routes, aliasing, and split-horizon work on Junos QFX, and what to check when a link fails.
- 3 EVPN IRB: Symmetric vs Asymmetric Routing Models Inter-subnet routing in EVPN-VXLAN fabrics comes in two flavors that behave very differently at scale. How asymmetric and symmetric IRB forward, why VNI sprawl matters, and which one to standardize on.
- 4 BGP Route Servers with BIRD: Running an IXP Peering Fabric How an internet exchange route server actually works, and how to build one with BIRD 2. Transparent AS_PATH, per-client filtering, RPKI validation, and the BGP communities members use to control who they peer with.
- 5 Running an RPKI Validator: Routinator and RTR to Your Routers Origin validation only works if your routers have fresh, trusted ROA data. How to run Routinator, feed it to BIRD, FRR, and IOS-XR over RTR, and roll out invalid-dropping without blackholing yourself.
- 6 MANRS in Practice: Filtering, Anti-Spoofing, and Good Peering The four MANRS actions turned into real config. Building prefix filters with bgpq4, enforcing AS-path sanity, deploying BCP38 anti-spoofing with uRPF, and keeping your PeeringDB and IRR records honest.
- 7 Dual-Transit Multihoming: Inbound and Outbound Traffic Engineering Two upstreams, real control over traffic. Outbound steering with local-preference, inbound steering with AS-path prepend, MED, and provider communities, and why inbound is always the harder half.
- 8 Nornir and NAPALM: Vendor-Neutral Network Automation in Python When Ansible YAML stops scaling, Python automation takes over. How Nornir handles inventory and concurrency, NAPALM abstracts vendor CLIs, and the two combine into config push with diffs and rollback.
- 9 NetBox as Source of Truth: Driving Config from Inventory A source of truth only earns the name when config is generated from it, not typed beside it. Modeling your network in NetBox, pulling it with pynetbox, and using it as a dynamic inventory so the database and the devices cannot drift.
- 10 gNMI Streaming Telemetry: Beyond SNMP Polling SNMP polls; gNMI streams. How model-driven telemetry with gNMI subscriptions, gnmic, and OpenConfig paths replaces the poll-and-pray loop, and how to land the data in Prometheus without writing a collector.
- 11 802.1X Wired NAC with RADIUS: Authenticating the Edge Network access control on the wired enterprise edge. 802.1X with MAB fallback, dynamic VLAN assignment from RADIUS, and the fail-open design that keeps the office working when the RADIUS server is unreachable.
- 12 CI/CD for Network Configs: Test and Rollback with GitLab Treat network config like code: review in merge requests, validate offline with Batfish, push with a diff gate, and roll back on failure. A GitLab pipeline that turns "SSH in and paste" into a reviewable, reversible process.
- 13 Linux nftables Deep Dive: Modern Stateful Firewalls iptables is legacy; nftables is the replacement that has shipped for years. Tables, chains, hooks and priorities, stateful matching, and the sets and maps that make nftables both faster and far more readable.
- 14 Traffic Control with tc: Shaping, Policing, and HTB The Linux tc subsystem is powerful and famously cryptic. Qdiscs, classes, and filters demystified, an HTB hierarchy that actually shares bandwidth, fq_codel to kill bufferbloat, and ingress policing with IFB.
- 15 eBPF and XDP for Fast Packet Processing: A Practical Intro XDP runs your code in the driver, before the kernel builds an sk_buff — the fastest place to touch a packet in Linux. What XDP is, a working drop program, how to load it and inspect maps, and where it fits versus iptables and DPDK.
- 16 Kubernetes Networking with Cilium: From CNI to Service Mesh Cilium replaces the kube-proxy iptables mess with an eBPF dataplane, adds identity-based network policy up to L7, and gives you Hubble for flow visibility. How it works and how to reason about policy that follows pods, not IPs.
- 17 MetalLB and BGP: LoadBalancer Services on Bare Metal Cloud gives you LoadBalancer Services for free; bare metal does not. MetalLB in BGP mode advertises Service IPs to your routers for real ECMP load balancing — how to configure the pools, peers, and advertisements, and why BGP mode beats L2.
- 18 WireGuard Mesh at Scale: Routing, NAT Traversal, and Failover A two-peer WireGuard tunnel is trivial; a full mesh of dozens of nodes is a different problem. The n-squared key challenge, AllowedIPs as a routing table, keepalives for NAT, and running a dynamic routing protocol over the mesh instead of static routes.
- 19 Suricata IDS/IPS Inline: Tuning Without Killing Throughput Running Suricata as more than a noisy alert firehose. IDS versus inline IPS modes, AF_PACKET and NFQUEUE deployment, ruleset management with suricata-update, and the threading and tuning that keep it from becoming the bottleneck.