LevelUp your I.T skills for the ever evolving job market

Gain practical real-world and in-demand experience with LevelUp I.T.'s articles, examples, labs, public and private repos!

Featured posts

Hand-drawn spine-leaf fabric with a firewall, a BIG-IP and an app: part 4, SNAT in depth

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 4): SNAT in depth, AutoMap, SNAT pools and X-Forwarded-For

Part 4. SNAT in depth: how AutoMap chooses its address, its limits at scale, SNAT pools and standalone SNATs, and X-Forwarded-For to give applications the real client address, safely.

8 min read

Hand-drawn RAG stack: your documents, retrieve, augment, generate, with the title 'RAG from first principles, behind a BIG-IP'

RAG from first principles: embeddings, vector databases, chunking, and a lab copilot behind BIG-IP

Hand-drawn: two requests on one connection each, one finishing in 0.21 s and one streaming for 15.6 s

Inference-Aware Load Balancing for LLMs (part 1): from connections to tokens, what changes when the backend is an LLM

Hand-drawn transformer stack: embeddings, attention, feed-forward, next token, with the title 'transformers from first principles'

Transformers from first principles: build a tiny GPT, from counting letters to mixture of experts

Hand-drawn spine-leaf fabric with a firewall, a BIG-IP and an app: part 3, SNAT explained

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 3): the first virtual server, and why it fails behind a firewall

Join now

Courses

Fabric lab: build a small cloud, end to end

Build a Cloud-Style Fabric Lab

An 11-part, copy-paste-reproducible build of a small cloud: leaf-spine VXLAN/EVPN fabric, Kubernetes with Cilium BGP, and Active/Active firewalls, all virtual, all on one box.

Members only

Mastering BGP

Mastering BGP delves into its architectural strengths: reliability (TCP foundation, keepalives), stability (MAI, dampening, route refresh), scalability (reflection, confederations, selective propagation), and flexibility (policy-driven, path attributes, communities).

Mastering IS-IS

IS-IS, a robust link-state routing protocol, is key for scalable networks. This series demystifies IS-IS from its Layer 2 operations, NSAP addressing, and hierarchical design to advanced traffic engineering with practical Juniper configurations. Master IS-IS for high-performance network designs.

Network Automation with GO

Hello and welcome to "Network Automation with Go," a blog series designed for network engineers and developers. We'll explore how Go's speed, concurrency, and simplicity can help you build powerful, efficient, and scalable network automation solutions. Get ready to level up your skills!

View all

Join now

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 4): SNAT in depth, AutoMap, SNAT pools and X-Forwarded-For

Part 4. SNAT in depth: how AutoMap chooses its address, its limits at scale, SNAT pools and standalone SNATs, and X-Forwarded-For to give applications the real client address, safely.

8 min read

RAG from first principles: embeddings, vector databases, chunking, and a lab copilot behind BIG-IP

RAG built from first principles and run for real: keyword search, embeddings and cosine similarity by hand, vector databases, chunking, a grounded prompt, and a RAG app behind a BIG-IP with monitors, least connections, caching and failure handling.

13 min read

Inference-Aware Load Balancing for LLMs (part 1): from connections to tokens, what changes when the backend is an LLM

Why connection-based load balancing breaks for language models: tokens, streamed answers, prefill and decode, TTFT and TPOT, a reasoning model thinking before it answers, batching and Little's law, all measured on a real 24B model behind an F5 lab.

15 min read

Transformers from first principles: build a tiny GPT, from counting letters to mixture of experts

How a language model turns next-token guessing into full answers, built up from a model that only counts letters: embeddings and gradient descent, attention worked by hand, the transformer block, tokenization, the KV cache, quantization, long context and mixture of experts.

20 min read

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 3): the first virtual server, and why it fails behind a firewall

Part 3. Nodes, pools and virtual servers, the full-proxy model, and why a load balancer behind a stateful firewall needs a symmetric return path: asymmetric routing, and the SNAT AutoMap fix.

7 min read

Hand-drawn diagram: clients, a firewall, an F5 BIG-IP as tier one, a Cilium Gateway as tier two, then the pods

Kubernetes Gateway API behind an F5 BIG-IP: Cilium, BGP to the fabric, and a measured migration from Ingress

Where an F5 BIG-IP fits when Kubernetes moves from Ingress to Gateway API: two tiers joined by BGP on an EVPN fabric, Cilium as CNI and gateway, SNAT automap pitfalls, one request traced hop by hop, and a migration from Ingress with no failed request.

16 min read

Hand-drawn spine-leaf fabric with a firewall, a BIG-IP and an app: part 2, plugging in the BIG-IPs

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 2): licensing and plugging the BIG-IPs into the fabric

Part 2. Licensing two BIG-IPs from the web UI and the CLI, then VLANs, self IPs, floating self IPs and port lockdown, and how the EVPN fabric learns where the BIG-IPs live.

10 min read

Hand-drawn GPU: compute on top, high-bandwidth memory below, the bandwidth arrow between them

LLM inference infrastructure, explained: GPUs, the KV cache, batching, the network and load balancing

The whole stack behind a language model's answer, from one model file to a fleet: why decode is memory-bound, how the KV cache sets capacity, what batching really buys, how models are split across GPUs, the RDMA fabric behind them, and why round-robin load balancing fails for inference.

13 min read

Hand-drawn spine-leaf fabric with a firewall, a BIG-IP and an app: learning f5 on a real fabric

Learning F5 BIG-IP on a real data-centre fabric running on SONiC switches (part 1): the lab, layer by layer

Part 1. The data centre the BIG-IPs live in: a SONiC spine-leaf fabric with BGP EVPN and VXLAN, VRFs for users and applications, a Palo Alto firewall between them, and two BIG-IPs on service leaves.

8 min read

Two-site failover for an inference API with F5 BIG-IP DNS (part 3 of 3)

Part 3 of 3. Two-site failover for an inference API with F5 BIG-IP DNS: the switch timed sample by sample, the resolver's TTL tail, and the pool fallback default that kept handing out the failed site's address.

6 min read

An F5 BIG-IP edge for a Kubernetes inference API: BGP, Advanced WAF and CIS (part 2 of 3)

Part 2 of 3. An F5 BIG-IP in front of a Kubernetes inference API: BGP route health timed under failure, an Advanced WAF built from the OpenAPI contract with a narrow fix for a prompt that quotes SQL, and three settings that looked correct and weren't.

10 min read

A second pod network with Multus on an EVPN VXLAN fabric (part 1 of 3)

Part 1 of 3. A second pod network with Multus on an EVPN VXLAN fabric, measured: what Services, NetworkPolicy and probes miss, where Cilium drops an asymmetric reply, how rp_filter combines, and how host-local gives two pods one address.

8 min read

Anatomy of an AI serving fabric

A GPU cluster that serves models has three kinds of user and one hard question: which layer owns which decision? Two complete builds walked layer by layer, down to the configuration, with the one choice that changes everything: rails as plain VLANs, or a routed rail Clos.

12 min read

Hand-drawn banner: brownfield vxlan evpn to cisco ndfc, nexus dashboard migration, what recalculate rejects

Migrating a brownfield VXLAN EVPN fabric to Cisco NDFC: what Recalculate rejects

You have a VXLAN EVPN fabric that already works, and now it needs to be managed by Cisco NDFC. This post walks through bringing ten Nexus 9300v switches under Nexus Dashboard as a brownfield migration, without rebuilding anything.

12 min read

FabricSRE part 2: triage, change assurance and the timeline

A DCI link goes down at 18:00. Nexus Dashboard's syslog export lands seven seconds later, the triage turns it into one incident, the investigation names the link, and the fix goes through NDFC with an approval bound to the exact lines a human read. Part 2 of FabricSRE.

10 min read

Subscribe to LevelUp I.T. newsletter and stay updated.

Don't miss anything. Get all the latest posts delivered straight to your inbox. It's free!