Simple, not simplistic
"Simple" and "simplistic" aren't the same thing. A simple network does what its job needs with nothing extra; a simplistic one leaves out things its job needs and hopes. These principles are how the lessons on this site try to stay on the right side of that line.
- Start with the simplest design that survives the failures you care about. Name the failures first, then choose the design.
- Every component must earn its place. If you can't say which failure, scale problem or outside network it handles, remove it.
- Redundancy you haven't tested is a hope. Fail things on purpose, in a lab and in maintenance windows, and time the recovery.
- Detect failures automatically, at both ends, quickly. Interface state isn't enough; protocols, keepalives and BFD are how routers find out.
- Make the common case boring. One way of doing each thing, the same on every router: templates, naming, numbering. Surprises are where outages hide.
- Know your normal. Prefix counts, session states, traffic levels. You can't spot "wrong" without knowing "right".
- Write down why. The next person (often you, a year later) needs the reason a piece exists before they can safely remove it.
Why each piece exists
Every technique on this site answers one of the three forces: failure, growth, or other networks.
| We do this | Because | Learn it in |
|---|---|---|
| Routing protocols instead of static routes | Failures are detected at both ends, and the work doesn't grow with every subnet | OSPF Fundamentals |
| BGP at the edge | Other networks only tell you what they reach through it, and you need policy, not shortest paths | BGP Fundamentals |
| BGP between loopbacks | A session survives the failure of any one link | BGP on loopbacks vs interface addresses |
| BFD | Failures detected in under a second instead of minutes | BGP on loopbacks vs interface addresses |
| Two gateways with VRRP | Hosts keep working when a router fails | Office gateway: DHCP, DNS and VRRP on VyOS |
| Edge and core routers | Outside-facing risk and internal routing change separately | Edge and core |
| Route reflectors | iBGP sessions don't multiply as routers are added | Route reflectors on VyOS |
| Communities | Intent travels with a route, instead of in someone's head | BGP communities, prepending and RTBH |
| Filters, IRR and RPKI | Mistakes and attacks from other networks stop at your edge | RPKI and Route Origin Validation |
| A firewall in zones | Policy stays understandable as interfaces are added | Zone-based firewall on VyOS |
| Monitoring, backups, rollback | You find out first, and can undo | Operating VyOS |