Tagged: Fundamentals
19 posts · browse all tags
-
BGP Deep Dive Part 1: The Application That Runs Between Autonomous Systems
The first post in a deep dive into BGP. Why EGP failed, the two napkins that became RFC 1105, and the distinction that took a bad Halabi read and a good Doyle read to finally land: an IGP finds the best path inside a network you own, BGP negotiates policy between networks you don't.
-
BGP Deep Dive Part 10: Multiprotocol BGP, or How One Session Learned to Carry Everything
RFC 4760 turned BGP from an IPv4-unicast-only protocol into a generic reachability-advertisement transport. Here's how AFI/SAFI, MP_REACH_NLRI, and one session carrying multiple address families actually works.
-
BGP Deep Dive Part 11: Convergence, Stability, and Scale
Route flap dampening, graceful restart, BFD, and ADD-PATH: four mechanisms that shape how fast, how stable, and how scalable a BGP deployment actually is.
-
BGP Deep Dive Part 12: Security, or Why BGP Trusts You Until Proven Otherwise
BGP was built on trust between operators, not cryptographic proof. Real hijack incidents, RPKI/ROV, BGPsec, and MANRS: what actually protects the internet's routing today.
-
BGP Deep Dive Part 2: The Session, From TCP SYN to Established
Part 2 of the BGP Deep Dive: TCP port 179 and why BGP needed a transport layer at all, the full six-state finite state machine from Idle to Established, what the OPEN message actually negotiates, and the hold timer, keepalive, and session-security mechanics underneath it.
-
BGP Deep Dive Part 3: The UPDATE Message and the Attribute Catalog That Is BGP's Actual Policy Engine
Part 3 of the BGP Deep Dive: the UPDATE message's real structure, RFC 4271's four categories of path attribute, and a walk through ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, and AGGREGATOR, including the classic unreachable-next-hop gotcha.
-
BGP Deep Dive Part 4: The Best Path Algorithm, Step by Step
Part 4 of the BGP Deep Dive: the full best path selection algorithm that consumes every attribute from Part 3, walked step by step from Cisco-proprietary Weight down to the final router-ID tiebreak, including why hot-potato routing is baked into step 8, not a separate design choice.
-
BGP Deep Dive Part 5: eBGP and iBGP Are Not the Same Protocol Wearing One Name
Part 5 of the BGP Deep Dive: why AS_PATH loop prevention does nothing inside an AS, the iBGP split-horizon rule that actually prevents internal loops, and why that one rule is the direct, mechanical reason full-mesh iBGP exists at all.
-
BGP Deep Dive Part 6: Route Reflectors and Confederations, Two Ways to Break the Full Mesh
Part 6 of the BGP Deep Dive: RFC 4456 route reflection and RFC 5065 confederations, the two sanctioned ways to relax iBGP's full-mesh requirement from Part 5 without giving up its loop safety, plus the path-hiding tradeoff route reflection quietly introduces.
-
BGP Deep Dive Part 7: Communities, BGP's General-Purpose Signaling Channel
Part 7 of the BGP Deep Dive: standard communities from RFC 1997, extended and large communities that fixed their real limitations, the three well-known values every implementation understands, and why the whole mechanism only works because two networks agree on what a number means.
-
BGP Deep Dive Part 8: Policy in Practice, Prefix Filters, AS-Path Filters, and RFC 7454
Part 8 of the BGP Deep Dive: the actual tools operators use to apply policy, prefix filtering, AS-path filtering, the route-map pattern every vendor implements some version of, and RFC 7454's real operational recommendations for filtering, max-prefix limits, and session hardening.
-
BGP Deep Dive Part 9: Traffic Engineering, or Why Outbound Is Easy and Inbound Never Fully Is
Part 9 of the BGP Deep Dive: multihoming and traffic engineering using nothing but attributes this series has already covered. Outbound TE is a solved problem with LOCAL_PREF. Inbound TE never fully is, and this post explains why prepending, MED, and communities are all, honestly, best-effort.
-
OSPF Deep Dive Part 1: Neighbor States, DR/BDR Election, and Network Types
The first post in a full OSPF series covering Cisco, FortiOS, and Junos: the hello protocol, the neighbor state machine, why DR/BDR election exists, and the network types that decide whether an election happens at all.
-
OSPF Deep Dive Part 2: LSA Types and the Area Type Hierarchy
What actually travels in the LSDB: the seven LSA types that matter in practice, and how stub, totally stubby, NSSA, and totally NSSA areas each filter a different subset of them.
-
OSPF Deep Dive Part 3: The SPF Algorithm, Cost, and Route Selection
How a full LSDB actually becomes a routing table: Dijkstra's algorithm, the reference-bandwidth cost trap every vendor shares, and why intra-area, inter-area, and external routes are preferred in that exact order regardless of cost.
-
OSPF Deep Dive Part 4: Virtual Links, Summarization, and Redistribution
Fixing the lab's missing backbone connection with a virtual link, then summarizing at the ABR and redistributing a static route at the NSSA's ASBR, with working syntax on Cisco, FortiOS, and Junos for each.
-
OSPF Deep Dive Part 5: OSPFv3 and Running OSPF Over IPv6
OSPFv3 isn't OSPFv2 with bigger addresses. It separates topology from addressing, drops built-in authentication in favor of IPsec, and runs over link-local addresses by default, plus the per-vendor syntax to bring it up on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 6: Authentication and Security Hardening
What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.
-
The Three Planes: Management, Control, and Data — and Why Every SDWAN Argument Comes Back to Them
A vendor-neutral primer on the management, control, and data planes — what each actually does, why management-vs-control is the distinction everyone blurs, and a three-question test you can run against any SDWAN platform regardless of vendor.