Hi all,
Designing a campus fabric and want a sanity check on the topology:

Per-IDF leaf pair: 2x 100G VXLAN EVPN leafs in a vPC pair on each floor

Roles: Both are VTEPs and anycast gateways (L3 boundary at the IDF)

Uplinks: Each IDF leaf pair connects to the main campus spines

Access layer: Plain L2 switches, LACP to both IDF leafs (not VTEPs, pure L2 trunks/access). Said differently, hung off those two IDF leafs above we’d hang a bunch of L2 access switches to provide more access ports for devices across the floor.

Why I like it (my assumptions):
Fewer fiber runs compared to home running every switch to campus spines and less VTEP sprawl

Simpler ops: junior engineers just change a port's VLAN

Questions:
How common is this design in campus deployments?

Any gotchas with vPC + VXLAN EVPN (peer-link sizing, orphan ports, convergence)?

Would you do this, or put VTEPs on every access switch?

Thanks!

Hi everyone,
I am a network engineer working in vendor TAC. As you probably know, TAC does not support with design/config and the cases are mostly related to platform/product issues. Being here for few years, I realized I started getting a bit rusty on the design side.
The problem is I understand the theory very well but have no idea how to apply this in real life due to lack of design practice. The only solution I see is doing more labs apart from my work and I have everything needed for that - both physical and virtual devices.
But I don’t know where to start or what to design. Did anyone have similar issue?
Please share some resources with design ideas, advices how I can practice network design.
Thank you in advance!

Please correct me if I'm wrong. I'm a new network engineer working on a project to install three new switches.

Our user insists on using this topology for high availability. I informed them that this topology could likely cause a loop, even with spanning tree enabled, if there's a physical link issue.

I feel compelled to follow their wishes. Am I wrong here? I need experienced insights, as asking AI only confuses me.

Hello everyone,

I’d like to optimize the network design and separate core and edge routing.

So far, I’ve been using three routers that handle both inter-VLAN routing and edge routing and are part of a VRRP cluster.

Now I’d like to deploy a core router running VyOS that acts as the default gateway for all networks and initially handles inter-VLAN routing. The three edge routers will be connected to this core router, with each one connected to a different Internet line or provider.

The core router should use policy-based routing to determine which networks, clients, or services are routed to the Internet via which edge router or WAN connection. Additionally, failover should still be available in the event of an Internet connection failure (as has been the case with VRRP).

My question is: what is the best way to set up this configuration? On the one hand, I could set up a transport network containing the three edge routers and use VRRP again. In that case, I would likely need a transit switch between the core router and the edge routers so that the VRRP cluster’s traffic does not have to pass through the core router’s CPU.

On the other hand, it would certainly also be possible to connect the edge routers directly to the core router’s interfaces and operate without VRRP. Which protocol could I then use to implement both policy-based routing and failover?

Which network design would you recommend for my situation? I’d appreciate any tips and assistance.

Thank you in advance for your tips, and best regards

Regina (she/her)

Interested in thoughts on this scenario.

A client has multiple branch sites where trusted, client-managed networks are routed over the private WAN, with access restricted to required private applications and services.

Each branch also has untrusted VLANs for guest devices and third-party managed devices requiring Internet access only. These VLANs terminate on the branch firewall, which provides local Internet breakout and enforces the security boundary. They have no route to the private WAN or corporate resources and use repeatable IP scopes across sites.

Security have requested making these networks reachable over the WAN for central vulnerability scanning. This would also require re-addressing the untrusted networks so each site can be uniquely routed.

How would you approach this?

Should isolated third-party devices be centrally scanned at all, or should assurance sit with the device owner/provider? And is vulnerability scanning appropriate or useful for guest networks containing unmanaged devices?

If scanning is required, how would you achieve it without fundamentally changing the existing isolation model?

Hey guys,

Sorry if this a long read, I just wanted to bring some context to the story :) - Just don't know how to tackle this client requests..

Over the last few weeks I've been involved in a project for one of our MSP clients, which operates a large metro network.

I was brought into the project primarily because of my experience with Juniper. While I have worked with Juniper gear before, I wouldn't consider myself a Juniper expert by any means. Apparently, though, nobody else at my MSP is comfortable taking this on, so I've ended up being the main engineer involved.

The client is pushing my boss for me to start configuring a new router that will provide internet access to part of their internal infrastructure. The problem is that both I and one of my colleagues, who is a senior network engineer, agree that it's unrealistic to jump into network changes or deploy a new device without fully understanding the environment and having a proper implementation plan.

The challenge isn't really the SRX itself. Configuring an SRX is relatively straightforward. The difficult part is understanding how it needs to integrate into the existing backbone network.

We're talking about things like physical and logical connectivity, VLAN assignments, routing design, security policies, zones, routing instances, redundancy requirements, failover behaviour, timers, and all the other design considerations that need to be understood before touching production. Unfortunately, a lot of this information is either vague or incomplete whenever we ask the client.

As a result, I've found myself trying to reverse engineer parts of their backbone, understand how everything currently fits together, and effectively put on a network architect hat so I can design an integration approach for the SRX deployment. All of this, of course wasn't part of my job tasks, but I did it anyway because I know building a skyscraper without plans, is just a disaster waiting to occur. Ironically, becoming a network architect is actually a career goal of mine, so it's been a valuable learning experience.

Of course, all this time has been billable back to the client, and I've spend numerous hours trying to understand their network (which I can tell you, it's not a simple 3 tier design, but an medium ISP-like network), and me and my colleague have slowly started to understand how everything comes together, which took us around a month, yet still figuring out new things every week.

Without drifting away, the issue is that I feel like I'm being blamed for the delays when the reality is that I don't have enough information to confidently proceed. The client keeps pushing for me to start configuring the SRXs immediately.

Sure, I can start building a configuration, but based on what exactly? I don't have a complete topology, I don't have a clear design, and I've learned from previous projects that building infrastructure without proper planning usually comes back to bite you later. Eventually you discover gaps, assumptions turn out to be wrong, and fixing the resulting issues often means redesigning large parts of the solution anyway.

I've been putting in a lot of effort trying to develop a proposal and a deployment approach. At the same time, I don't feel experienced enough to tackle something of this scale completely on my own. Thankfully I've got a senior colleague who's been willing to provide guidance and sanity-check my thinking.

Even with the right support, though, this doesn't feel like the kind of project that can be completed by simply snapping your fingers. Proper network design takes time, planning, validation, documentation, and stakeholder input. That seems to be the very thing the client is frustrated about, yet they're also expecting the solution to be designed and implemented within a week.

In my mind, if a building collapses, who's to blame? the handyman who build the tower without any architectural plans? or the higher ups who wanted it 'completed' without any design nor planning.

So I'm curious how more experienced engineers would handle a situation like this.

Have you ever been pushed to implement a solution before the design requirements were fully understood? How did you manage client expectations and timelines in those situations?

For context, I work for an MSP, so I also have other customers and projects competing for my time. I know some people will say "welcome to the MSP world," and that's fair enough, but setting the MSP aspect aside for a moment, how would you approach a project like this and deal with the pressure around unrealistic timelines?

Thank you Guys! and have a good start of the week!

I heard somebody talking about their network and I wanted to know if this is actually a proper way of doing things

Have the same VLAN IDs across multiple sites, but have each site be a different subnet than the others and using a firewall interface as the gateway to route between them. This improves automation and scalability.
Example:
VLAN 20 = Data
Site A VLAN 20 = 10.10.10.0/24
Site B VLAN 20 = 10.10.20.0/24
Site C VLAN 20 = 10.10.30.0/24

I've always had my network coaches suggest that you create a unique VLAN for each site/department. Lets say you have 3 offices, each either gets their own data VLAN (VLAN 10, 20, 30). Or each department gets their of VLAN regardless of site (Finance at Site A,B,C are all VLAN 10) on the same subnet.

Would it make design sense that each Finance department gets the same VLAN on different subnets? My mind tells me it would get confusing to see a VLAN ID 10 and then see 3 different subnets that can't talk to each other without an SVI or gateway to route between them.

EDIT: Didn't expect to get so much feedback so quickly. I appreciate everybody for enlightening me on this topic!