Run any Skill in Manus with one click

network-architect

Stars7

Forks0

UpdatedApril 13, 2026 at 19:22

Network architecture and engineering — routing (BGP, OSPF, EIGRP), switching (STP, VLANs, 802.1Q, EtherChannel), WAN (MPLS, SD-WAN, DMVPN, IPsec), QoS, redundancy (HSRP/VRRP/GLBP), IPv4/IPv6 addressing and subnetting, and network troubleshooting. Use when designing topology, reviewing routing policy, troubleshooting L2/L3, or producing network architecture documentation.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

rloisell

rloisell/rl-agents-n-skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Computer Network ArchitectsComputer and Mathematical Occupations·SOC 15-1241

SKILL.md

readonly

name	network-architect
description	Network architecture and engineering — routing (BGP, OSPF, EIGRP), switching (STP, VLANs, 802.1Q, EtherChannel), WAN (MPLS, SD-WAN, DMVPN, IPsec), QoS, redundancy (HSRP/VRRP/GLBP), IPv4/IPv6 addressing and subnetting, and network troubleshooting. Use when designing topology, reviewing routing policy, troubleshooting L2/L3, or producing network architecture documentation.

Network Architect Skill

Covers network design, routing/switching, WAN, and troubleshooting at CCNP depth.

Ryan's context: CCNA (2003–2006), CCNP R&S (BSCI/BCMSN/ISCW/ONT), Applied Computer Science. Currently designing enterprise SASE solutions.

Shared skills referenced:

Zero Trust / SASE → ../zero-trust-architect/SKILL.md
Network security controls → ../network-security/SKILL.md
DNS tools → ../dns-tools/SKILL.md

IP Addressing & Subnetting

VLSM Quick Reference

Prefix	Hosts	Typical use
/30	2	Point-to-point links
/29	6	Small DMZ / loopbacks
/28	14	Small office
/27	30	Medium VLAN
/26	62	Large VLAN
/25	126	Large campus segment
/24	254	Standard site VLAN
/22	1022	Supernet / summary

RFC 1918 Private Address Space

10.0.0.0/8        — Class A (large enterprise, data centres)
172.16.0.0/12     — Class B (medium enterprise)
192.168.0.0/16    — Class C (branch, home office)

IPv6 Address Types

Type	Prefix	Use
Global Unicast	2000::/3	Routable internet
Link-Local	fe80::/10	On-link only; auto-assigned
Unique Local	fc00::/7	Private (analogous to RFC 1918)
Multicast	ff00::/8	Replaces broadcast
Loopback	::1/128	Local loopback

Routing Protocols

OSPF

Key design rules:
- Area 0 (backbone) required; all other areas connect to it
- Use stub/totally stub for areas with single ABR
- Summarise at ABR boundaries (area range) and ASBR (summary-address)
- BFD for sub-second convergence on high-value links
- OSPF authentication: MD5 minimum; SHA-256 preferred (OSPFv3)

Troubleshooting checklist:
1. Are MTU values matching on both sides? (ip mtu mismatch → EXSTART/EXCHANGE stuck)
2. Are hello/dead timers matching?
3. Is the subnet mask identical?
4. Are area IDs matching?
5. Stub area flag mismatch?

BGP

Key design rules:
- eBGP: always set next-hop-self on iBGP reflectors
- Use prefix-lists (not distribute-lists) for filtering — faster, cleaner
- Null-route aggregates before advertising summaries (ip route x.x.x.x 255... null0)
- AS-path prepending for inbound traffic engineering (not overused)
- Set MED for outbound preference signal to upstream
- BGP communities for policy tagging across eBGP peers

Path selection order (remember: N WLLA OMDI):
  Next hop reachable → Weight (Cisco-local) → Local-Pref → Locally originated
  → AS-path length → Origin (IGP < EGP < ?) → MED → eBGP > iBGP
  → IGP metric to next-hop → Router-ID (lowest)

Security hardening:
- TTL Security (GTSM): neighbor x ttl-security hops 1
- MD5 authentication on all eBGP sessions
- max-prefix with threshold + warning

EIGRP

Feasibility condition: FD of successor > RD of feasible successor
Stuck-In-Active (SIA): query propagation too wide → use stub or summarisation
Named mode EIGRP preferred for configuration clarity

Switching

STP Variants

Variant	Standard	Notes
STP	802.1D	Legacy; slow (30–50s convergence)
RSTP	802.1w	Fast convergence (~1s); backward-compatible
PVST+	Cisco	Per-VLAN STP; load balancing via root placement
Rapid PVST+	Cisco	RSTP per VLAN; current default on Cisco
MST	802.1s	Maps multiple VLANs to instances; scale

STP hardening:
- PortFast on all access ports
- BPDU Guard on PortFast ports
- Root Guard on uplinks where root must not appear
- Loop Guard on non-designated ports (replaces UniDirectional Link Detection)
- BPDU Filter: use only on ports where STP BPDUs are explicitly unwanted

VLANs and Trunking

802.1Q trunk: native VLAN must match on both sides (or use vlan dot1q tag native)
DTP: always disable on access ports (switchport nonegotiate)
VTP: use transparent mode or VTPv3 with password; avoid VTP v1/v2 in large environments

VLAN design conventions:
  VLAN 1   — never use for data; isolate or shut unused ports
  VLAN 99  — management VLAN (or any non-1 native)
  VLAN 10  — data
  VLAN 20  — voice (with QoS trust dscp on IP phones)
  VLAN 30  — management devices
  VLAN 100+ — service VLANs

EtherChannel

LACP (802.3ad): preferred; interoperable
PAgP: Cisco-only
Static (on/on): use only when LACP unavailable

Load balancing hash options (balance on most variable field):
  src-mac / dst-mac / src-dst-mac
  src-ip  / dst-ip  / src-dst-ip   ← recommended for routed traffic
  src-port / dst-port / src-dst-port ← recommended for server farms

WAN Technologies

MPLS L3VPN

PE–CE routing: eBGP, OSPF, or static
Route distinguisher (RD): makes VPN routes unique in MP-BGP (not security)
Route target (RT): controls VPN import/export (the actual policy)
VRF: per-customer routing table on PE

Troubleshooting:
  show bgp vpnv4 unicast all summary
  show ip route vrf <name>
  show mpls ldp neighbor
  show mpls forwarding-table

IPsec VPN

IKEv2 preferred (vs IKEv1 — less round-trips, better re-keying)
Encryption: AES-256-GCM
Integrity: SHA-256 or SHA-384
DH group: 14 minimum; 19/20 (ECDH) preferred
PFS: always enable (new DH exchange per SA)
Dead Peer Detection (DPD): always enable

Transform sets to avoid: DES, 3DES, MD5, DH group 1/2/5

DMVPN

Phase 1: hub-to-spoke only (spoke cannot talk directly to spoke)
Phase 2: spoke-to-spoke (NHRP redirect; one NHRP resolution per pair required)
Phase 3: spoke-to-spoke with NHRP shortcut (summarise at hub; more scalable)

SD-WAN (Cisco Viptela / Catalyst SD-WAN)

Control plane: vManage (GUI/API), vSmart (policy), vBond (orchestration)
Data plane: vEdge / cEdge with OMP (Overlay Management Protocol)
Policy types: centralized (control/data) vs local (access/device)
Application-aware routing: based on BFD SLA metrics (jitter, loss, latency)

QoS

DSCP Marking Reference

Class	DSCP Decimal	Binary	Use
EF	46	101110	VoIP RTP (voice bearer)
CS3	24	011000	Call signalling
AF41	34	100010	Video conferencing
AF31	26	011010	Mission-critical data
AF11	10	001010	Bulk data
CS1	8	001000	Scavenger (low priority)
BE	0	000000	Best effort (default)

Trust boundary: always at the IP phone or first managed switch port
Mark at edge; never remark in the core
VoIP sizing rule: BW = (Codec_bps + 160b_overhead) × calls
CBWFQ + LLQ: queue voice in LLQ (priority); everything else in CBWFQ classes

Gateway Redundancy

Protocol	Standard	VIP ownership	Load balance
HSRP v2	Cisco	Active router	No (one active)
VRRP	RFC 5798	Master router	No
GLBP	Cisco	AVG + multiple AVF	Yes (per-host round-robin)

Best practice: HSRP or VRRP for simplicity; GLBP when upstream bandwidth balance matters
Object tracking: track interface/IP SLA; decrement priority on failure to trigger failover

Troubleshooting Methodology (OSI Bottom-Up)

L1  Physical   — cabling, SFP, interface status (show int, show cdp neigh)
L2  Data Link  — MAC table, ARP, STP state, trunk config (show mac address-table, show spanning-tree)
L3  Network    — routing table, ARP, ping, traceroute (show ip route, debug ip routing)
L4  Transport  — port reachability (telnet <ip> <port>), access-list hits
L7  App        — DNS resolution, TLS handshake, application logs

NETWORK_KNOWLEDGE

Append discoveries here. Format: YYYY-MM-DD: <note>

Network Architect Skill

Covers network design, routing/switching, WAN, and troubleshooting at CCNP depth.

Ryan's context: CCNA (2003–2006), CCNP R&S (BSCI/BCMSN/ISCW/ONT), Applied Computer Science. Currently designing enterprise SASE solutions.

Shared skills referenced:

Zero Trust / SASE → ../zero-trust-architect/SKILL.md
Network security controls → ../network-security/SKILL.md
DNS tools → ../dns-tools/SKILL.md

IP Addressing & Subnetting

VLSM Quick Reference

Prefix	Hosts	Typical use
/30	2	Point-to-point links
/29	6	Small DMZ / loopbacks
/28	14	Small office
/27	30	Medium VLAN
/26	62	Large VLAN
/25	126	Large campus segment
/24	254	Standard site VLAN
/22	1022	Supernet / summary

RFC 1918 Private Address Space

10.0.0.0/8        — Class A (large enterprise, data centres)
172.16.0.0/12     — Class B (medium enterprise)
192.168.0.0/16    — Class C (branch, home office)

IPv6 Address Types

Type	Prefix	Use
Global Unicast	2000::/3	Routable internet
Link-Local	fe80::/10	On-link only; auto-assigned
Unique Local	fc00::/7	Private (analogous to RFC 1918)
Multicast	ff00::/8	Replaces broadcast
Loopback	::1/128	Local loopback

Routing Protocols

OSPF

Key design rules:
- Area 0 (backbone) required; all other areas connect to it
- Use stub/totally stub for areas with single ABR
- Summarise at ABR boundaries (area range) and ASBR (summary-address)
- BFD for sub-second convergence on high-value links
- OSPF authentication: MD5 minimum; SHA-256 preferred (OSPFv3)

Troubleshooting checklist:
1. Are MTU values matching on both sides? (ip mtu mismatch → EXSTART/EXCHANGE stuck)
2. Are hello/dead timers matching?
3. Is the subnet mask identical?
4. Are area IDs matching?
5. Stub area flag mismatch?

BGP

Key design rules:
- eBGP: always set next-hop-self on iBGP reflectors
- Use prefix-lists (not distribute-lists) for filtering — faster, cleaner
- Null-route aggregates before advertising summaries (ip route x.x.x.x 255... null0)
- AS-path prepending for inbound traffic engineering (not overused)
- Set MED for outbound preference signal to upstream
- BGP communities for policy tagging across eBGP peers

Path selection order (remember: N WLLA OMDI):
  Next hop reachable → Weight (Cisco-local) → Local-Pref → Locally originated
  → AS-path length → Origin (IGP < EGP < ?) → MED → eBGP > iBGP
  → IGP metric to next-hop → Router-ID (lowest)

Security hardening:
- TTL Security (GTSM): neighbor x ttl-security hops 1
- MD5 authentication on all eBGP sessions
- max-prefix with threshold + warning

EIGRP

Feasibility condition: FD of successor > RD of feasible successor
Stuck-In-Active (SIA): query propagation too wide → use stub or summarisation
Named mode EIGRP preferred for configuration clarity

Switching

STP Variants

Variant	Standard	Notes
STP	802.1D	Legacy; slow (30–50s convergence)
RSTP	802.1w	Fast convergence (~1s); backward-compatible
PVST+	Cisco	Per-VLAN STP; load balancing via root placement
Rapid PVST+	Cisco	RSTP per VLAN; current default on Cisco
MST	802.1s	Maps multiple VLANs to instances; scale

STP hardening:
- PortFast on all access ports
- BPDU Guard on PortFast ports
- Root Guard on uplinks where root must not appear
- Loop Guard on non-designated ports (replaces UniDirectional Link Detection)
- BPDU Filter: use only on ports where STP BPDUs are explicitly unwanted

VLANs and Trunking

802.1Q trunk: native VLAN must match on both sides (or use vlan dot1q tag native)
DTP: always disable on access ports (switchport nonegotiate)
VTP: use transparent mode or VTPv3 with password; avoid VTP v1/v2 in large environments

VLAN design conventions:
  VLAN 1   — never use for data; isolate or shut unused ports
  VLAN 99  — management VLAN (or any non-1 native)
  VLAN 10  — data
  VLAN 20  — voice (with QoS trust dscp on IP phones)
  VLAN 30  — management devices
  VLAN 100+ — service VLANs

EtherChannel

LACP (802.3ad): preferred; interoperable
PAgP: Cisco-only
Static (on/on): use only when LACP unavailable

Load balancing hash options (balance on most variable field):
  src-mac / dst-mac / src-dst-mac
  src-ip  / dst-ip  / src-dst-ip   ← recommended for routed traffic
  src-port / dst-port / src-dst-port ← recommended for server farms

WAN Technologies

MPLS L3VPN

PE–CE routing: eBGP, OSPF, or static
Route distinguisher (RD): makes VPN routes unique in MP-BGP (not security)
Route target (RT): controls VPN import/export (the actual policy)
VRF: per-customer routing table on PE

Troubleshooting:
  show bgp vpnv4 unicast all summary
  show ip route vrf <name>
  show mpls ldp neighbor
  show mpls forwarding-table

IPsec VPN

IKEv2 preferred (vs IKEv1 — less round-trips, better re-keying)
Encryption: AES-256-GCM
Integrity: SHA-256 or SHA-384
DH group: 14 minimum; 19/20 (ECDH) preferred
PFS: always enable (new DH exchange per SA)
Dead Peer Detection (DPD): always enable

Transform sets to avoid: DES, 3DES, MD5, DH group 1/2/5

DMVPN

Phase 1: hub-to-spoke only (spoke cannot talk directly to spoke)
Phase 2: spoke-to-spoke (NHRP redirect; one NHRP resolution per pair required)
Phase 3: spoke-to-spoke with NHRP shortcut (summarise at hub; more scalable)

SD-WAN (Cisco Viptela / Catalyst SD-WAN)

Control plane: vManage (GUI/API), vSmart (policy), vBond (orchestration)
Data plane: vEdge / cEdge with OMP (Overlay Management Protocol)
Policy types: centralized (control/data) vs local (access/device)
Application-aware routing: based on BFD SLA metrics (jitter, loss, latency)

QoS

DSCP Marking Reference

Class	DSCP Decimal	Binary	Use
EF	46	101110	VoIP RTP (voice bearer)
CS3	24	011000	Call signalling
AF41	34	100010	Video conferencing
AF31	26	011010	Mission-critical data
AF11	10	001010	Bulk data
CS1	8	001000	Scavenger (low priority)
BE	0	000000	Best effort (default)

Trust boundary: always at the IP phone or first managed switch port
Mark at edge; never remark in the core
VoIP sizing rule: BW = (Codec_bps + 160b_overhead) × calls
CBWFQ + LLQ: queue voice in LLQ (priority); everything else in CBWFQ classes

Gateway Redundancy

Protocol	Standard	VIP ownership	Load balance
HSRP v2	Cisco	Active router	No (one active)
VRRP	RFC 5798	Master router	No
GLBP	Cisco	AVG + multiple AVF	Yes (per-host round-robin)

Best practice: HSRP or VRRP for simplicity; GLBP when upstream bandwidth balance matters
Object tracking: track interface/IP SLA; decrement priority on failure to trigger failover

Troubleshooting Methodology (OSI Bottom-Up)

L1  Physical   — cabling, SFP, interface status (show int, show cdp neigh)
L2  Data Link  — MAC table, ARP, STP state, trunk config (show mac address-table, show spanning-tree)
L3  Network    — routing table, ARP, ping, traceroute (show ip route, debug ip routing)
L4  Transport  — port reachability (telnet <ip> <port>), access-list hits
L7  App        — DNS resolution, TLS handshake, application logs

NETWORK_KNOWLEDGE

Append discoveries here. Format: YYYY-MM-DD: <note>

network-architect

Network Architect Skill

IP Addressing & Subnetting

VLSM Quick Reference

RFC 1918 Private Address Space

IPv6 Address Types

Routing Protocols

OSPF

BGP

EIGRP

Switching

STP Variants

VLANs and Trunking

EtherChannel

WAN Technologies

MPLS L3VPN

IPsec VPN

DMVPN

SD-WAN (Cisco Viptela / Catalyst SD-WAN)

QoS

DSCP Marking Reference

Gateway Redundancy

Troubleshooting Methodology (OSI Bottom-Up)

NETWORK_KNOWLEDGE

More from this repository

More from this repository

Network Architect Skill

IP Addressing & Subnetting

VLSM Quick Reference

RFC 1918 Private Address Space

IPv6 Address Types

Routing Protocols

OSPF

BGP

EIGRP

Switching

STP Variants

VLANs and Trunking

EtherChannel

WAN Technologies

MPLS L3VPN

IPsec VPN

DMVPN

SD-WAN (Cisco Viptela / Catalyst SD-WAN)

QoS

DSCP Marking Reference

Gateway Redundancy

Troubleshooting Methodology (OSI Bottom-Up)

NETWORK_KNOWLEDGE