Blog

One golden image, one netplan file per node: LACP bonds into the vPC pairs, out-of-band management, the virtio link-speed trap that silently breaks 802.3ad, and the switch side of every bond.

Wiring Active/Active firewalls into the fabric: four eBGP sessions, thirteen prefixes up and one default down, device-bound NAT, two DNAT pinholes for all inbound traffic, and the vPC SVI timer lesson.

VXLAN tunnels between loopbacks, EVPN as the directory, anycast gateways everywhere, and the route-target auto trap that silently empties eBGP fabrics. With the complete overlay configs for all twelve switches.

Twelve switches become a fabric: loopbacks, /31s, jumbo MTU, and eBGP as the only routing protocol. Plus the promised look inside a vPC leaf pair, and the three-command verification that proves the underlay.

How my bare-metal k8s cluster gets cloud-style LoadBalancer IPs: Cilium allocates a VIP, every node advertises it over eBGP to the NX-OS leaves, and the fabric ECMPs traffic into the cluster. Full walk from IPAM pool to leaf routing table.

One Linux box, a pile of QEMU VMs, and a bridge per cable. Sizing the host, the overcommit that makes it affordable, image conventions, and driving it all from the API.

A build series: from an empty hypervisor to a real app on a routed VXLAN/EVPN fabric with Kubernetes and Cilium BGP, every config shown. Part 1 is the map: the whole architecture, the addressing plan, and why BGP runs at literally every layer.

IPoIB gives your IB fabric an IP address so ordinary sockets code just works. On a 10G link it even matches verbs on bandwidth. The CPU counter and the latency numbers tell the real story of what that convenience costs.

PAN-OS config-sync makes an Active/Active pair feel like one firewall, until NAT teaches you otherwise. Two commit failures, the per-device rule pattern that survives sync, and the exact boundary between what the pair shares and what each box must own.