Why anycast inside the fabric is harder than it looks An anycast service is advertised from multiple hosts into the data center fabric — the same prefix, the same service IP, originated from several places at once. The promise is appealing: multiple next hops for one service prefix gives you load balancing, fast failover, and horizontal scalability without any state in the network. The catch is that for every leaf to actually use all of those origins, the fabric has to carry and install multiple equal-cost paths for a single prefix end to end. That is not BGP’s default behavior, and the moment you combine it with two things modern fabrics love — an IPv6 unnumbered underlay and IPv4-in-IPv6 next hops (RFC 5549) — one of the most common EVPN disambiguation tricks stops working. This post walks through why, and what the realistic options are. ...

Companion posts. This is the hands-on lab — real NX-OSv configs, the tests I ran, and where they broke. For the high-level summary see Anycast Inside the Data Center; for the deeper protocol write-up (overlay index, recursive resolution, why pure-IP fabrics lose per-host ECMP) see Anycast in EVPN/VXLAN Fabrics: The IPv6 Unnumbered and RFC 5549 Problem. Why Anycast is used for horizontal scaling and for better failure response. With modern orchestration and virtualization, a new instance of a service can be spawned on demand — by an engineer or by the system itself. ...

Part of an anycast series. This is the high-level summary. For the hands-on NX-OS lab (configs, the RFC 5549 failure, the working EVPN solution) see Anycast Inside an EVPN/VXLAN Fabric with BGP Unnumbered (RFC 5549), and for the deeper protocol treatment see Anycast in EVPN/VXLAN Fabrics: The IPv6 Unnumbered and RFC 5549 Problem. Why Anycast services are advertised from multiple hosts into the data center. The same service prefix is originated from several places at once, which gives you multiple next hops for that service — and with it, load balancing, better failover, and scalability. ...

In an EVPN/VXLAN fabric, the MAC address table is part of the control plane: when a MAC is learned or removed, the switch generates a BGP EVPN update so the rest of the fabric stays in sync. That tight coupling is exactly what makes EVPN work — but it also means that ordinary MAC aging on a quiet host can turn into a stream of BGP churn. This post is about a problem we chased down to the interaction between ARP timeout and MAC address-table timeout, and why the common assumption about “any packet refreshes the timer” is wrong. ...

⚠️ Modernization Notice These notes were written in 2018–2019. IPv6 CPE and OS support, DHCPv6 implementations, and ISP best practices have evolved significantly since then. Treat this as a record of real testing and the architectural decisions behind it, and validate against current RFCs, CPE datasheets, and OS release notes before deploying in production. Overview This post brings together two pieces of work I did on IPv6 for PPP broadband. The first is a set of notes and lab tests on running a single dual-stack PPP session per subscriber and assigning IPv6 prefixes to the CPE from a Cisco IOS XE BNG. The second is a design sketch for assigning static IPv6 prefixes per customer from a RADIUS/AAA backend. They belong together: the lab work shows how Cisco ISG/IOS XE actually behaves when prefixes arrive over RADIUS, and the design sketch is the natural next step once you decide that static, per-customer prefixes are what you want. ...

L2VPN pseudowire (PW) behavior differs between vendor platforms and device models, particularly around how VLAN tags are handled. Understanding the differences between VC type 4 (VLAN-based) and VC type 5 (Ethernet port-based) pseudowires, and the interoperability gotchas between EVC-based and non-EVC platforms, is critical when building multi-vendor L2VPN networks. L2VPN Packet Structure The basic structure of a packet traversing an L2VPN pseudowire is: Tunnel header + VC label + Control Word + L2 PDU Control Word The control word is a 4-byte field inserted between the VC label and the L2 payload. In Cisco IOS/IOS XR, the control word is enabled by default. ...

When troubleshooting MTU and ICMP reachability across vendor platforms, understanding how each calculates the ping packet size is critical. Cisco, Juniper, and PC operating systems all interpret the ping size parameter differently, leading to different on-wire packet lengths. Cisco In Cisco, the ping size parameter specifies the total packet size including the IP header (20 bytes) and ICMP header (8 bytes). The data payload is what remains. The encapsulation headers added by the egress interface will be included on top of this size. Importantly, the MTU command under an interface specifies the L2 payload size — the maximum data + IP + ICMP that the interface will forward. So if you set MTU 1500 on an Ethernet interface, the on-wire frame size will be 1500 + 14 bytes (Ethernet header) = 1514 bytes. For VLAN-tagged frames, add another 4 bytes (802.1Q tag). ...

We have been using a Perl based BGP script to announce some prefixes — for black hole routing, or to ban IP addresses as a result of law enforcement requests — from a database to the network. This project was the result of searching for a new BGP daemon that can be hooked into any need and that supports the L3 MPLS VPN Unicast address family. We have used osrg/gobgp (GoBGP) as a native library for the iBGP connection into our network. GoBGP can be embedded directly as a Go library, so instead of talking to a separate daemon over gRPC we drive the BGP server in-process and feed it routes straight from our database. ...

⚠️ Modernization Notice This post was written in 2018 against Cisco IOS XE / ISG on the ASR 1000. Behavior around parameterized QoS, CoA, and policy-map chaining has changed across releases. Treat the configs and outputs here as a record of what I tested at the time, and validate against the current IOS XE configuration guides before deploying. Overview On the ASR 1000 (and IOS XE in general) there are broadly two ways to apply QoS to subscriber sessions: per-session and per-flow. They cannot be applied at the same time on the same session, so the first decision is which model fits your service. ...

⚠️ Güncelleme Notu Bu yazı 2018’de aldığım notlara dayanıyor. Erişim engelleme yöntemleri ve özellikle HTTPS’in yaygınlaşmasıyla içerik tabanlı filtrelemenin sınırları o günden bu yana belirgin şekilde değişti. Buradaki yaklaşımları o dönemin bir kaydı olarak değerlendirin. İnternet erişimini kısıtlamak, engellemek veya limitlemek; çoğunlukla yasal kurumların talepleri ya da servis sağlayıcıların kendi politikaları gereği gündeme gelen, oldukça güncel bir konu. Engelleme dışında bu yöntemler, ağ içi ve ağ dışı P2P kullanımını kısıtlamak veya düzenlemek için de kullanılabiliyor. ...