Theoretical foundations and architecture
Capstone project: designing a Tier-2 service provider network (HLD and LLD) along the chain "requirement - decision - acceptance criterion". 1. Topology: eight nodes in AS 65000 - three PEs (PE1, PE2, PE3), two P routers (P1, P2), two RRs (RR1 and RR2 sharing cluster-id 100) and ASBR1 toward the partner AS 65001; PE3 doubles as the BNG. The single point of failure is ASBR1 and it is recorded in the risks. 2. Underlay: Loopback0 /32 from 10.255.0.<id>, /30 links with MTU 1600, IS-IS Level-2 (wide metrics, point-to-point) and BFD 100 ms x 3 on the core links. 3. Transport: SR-MPLS from the start (SRGB 16000-23999, label = 16000 + index) and TI-LFA; LDP and RSVP-TE are not used in normal operation; the switchover target is at most 50 ms, verified by test T03. 4. Overlay: MP-BGP through two RRs with the vpnv4 and EVPN families (vpnv6 is provided for by the plan). 5. Customer services: customer A - L3VPN with overlapping addresses; customer B - Inter-AS Option B L3VPN with the partner AS; customer C - EVPN-MPLS E-LAN (EVI 300); BNG subscribers - VRF SUBS with CGNAT and RADIUS. 6. Operations: deployment with Ansible, monitoring by syslog, SNMP, IPFIX and gRPC telemetry. MikroTik is not part of the core and acts as a CE/CPE.
From requirements to design decisions
A service provider design is built as a chain of "requirement - decision - measurable acceptance criterion". A decision without a criterion cannot be defended, and a decision without a requirement cannot be justified. The project has eight nodes in AS 65000: three PEs (PE1, PE2, PE3), two P routers (P1, P2), two RRs (RR1, RR2) and ASBR1 towards the partner AS 65001. The nodes are chosen to cover every module of the course without bloating the lab.
| Requirement | Decision | Criterion (test from sp-acceptance) |
|---|---|---|
| Loss of at most 50 ms when a core link fails | IS-IS L2 + SR-MPLS + TI-LFA, carrier-delay 0 on optics | T03: at most 500 packets lost at a 10 000 pps flow |
| Isolation of customers A, B, C and subscribers | VRF/RT plan, EVI for C, separate VRF SUBS | T06: 100% blocking of inter-customer traffic |
| Voice with controlled delay | SR policy color 100 + EF queue (TC 5) | T09, T10: 0 voice loss at 148% load |
| Loss of an RR does not affect services | two RRs, same cluster-id 100, clients peer with both | T05: 0 loss, both sessions on the clients |
| 5000 BNG subscribers | PE3 as BNG, RADIUS .50, CGNAT pool | T11: 5000 logins in 60 s, AAA answers in under 1 s |
| Rollback of any change | commit confirmed / configure replace / backup | T12: recovery in at most 5 minutes |
Transport: why IS-IS + SR rather than OSPF + LDP
The first row of the trade-off table defines everything else: the core is built on IS-IS Level-2 with SR-MPLS, and LDP and RSVP-TE are not used in steady state. The reasons: TI-LFA builds a repair path by construction (as long as the graph has an alternate path) and needs no RSVP state on transit nodes; an SR policy replaces RSVP-TE for critical traffic without signalling on the P routers; IS-IS carries the SIDs in TLVs together with the metrics, which means one database instead of an LDP session on every link. The price: Cisco, Huawei and Juniper support this scheme, while RouterOS v7 has neither IS-IS nor SR (by the course convention), so MikroTik stays out of the core and plays the CE/CPE role at the customer A handoff. If the operator needs an LDP node at the edge, an SR/LDP border with a mapping server is built (see sr-migration-lab), but the project does not require it.
IS-IS was chosen over OSPF for three practical reasons: node addressing through the NET independent of IP subnets, a single process for IPv4 and IPv6 (needed for vpnv6/6VPE), and a protocol that does not depend on the IP configuration of the interface. IS-IS uses wide metrics (24 bits per link), point-to-point network type on every link, and level-2-only mode so that only one LSDB is kept.
Topology and failure domains
PE1, PE2 and PE3 are connected to both P1 and P2 (two planes), and P1 and P2 are connected to each other. ASBR1 is connected to both planes, RR1 only to P1 and RR2 only to P2: the RRs are out of the transit path and cannot become transit because of the topology itself. The failure domains are: one link (TI-LFA), one plane (P1 or P2 as a whole - the other plane carries all the load), one RR (the second RR reflects the same routes). The project has exactly one single point of failure and it is recorded in the risks: ASBR1; a second ASBR is added in the next phase, and until then the handoff to AS 65001 has no redundancy.
Metrics are assigned so that the primary path is deterministic: PE-P1 = 20, PE-P2 = 25, P1-P2 = 10, ASBR-P = 20 or 25, RR-P = 50. The primary PE1 - PE2 path goes through P1 (40), the backup through P2 (50). If the planes were made equal, traffic would use ECMP, TI-LFA would not be needed for half of the flows when a link fails, and you would not test exactly what the protection was built for.
Addressing, SIDs and MTU
The Loopback0 of each node is 10.255.0.<id>/32; the same id gives the NET (49.0001.0100.2550.<id4>.00) and the Prefix-SID index: label = 16000 + index. Links are /30 from 10.0.0.0/24 (the /31 format of RFC 3021 saves addresses but is not supported equally on all four platforms and breaks the common templates). A single SRGB 16000-23999 on all nodes is needed because SR policies in the project are written with absolute labels (16012, 16002): with different SRGBs these lists stop working. The range 15000-15999 is reserved for local labels and does not overlap the SRGB. The core MTU is 1600: 1500 IP + 4 for the service label + up to 6 transport labels (a TI-LFA or SR policy stack) 24 = 1528 for L3VPN, while for EVPN an Ethernet frame 1514 + 4 + 24 + control word 4 = 1546.
RR, RD/RT and services
RR1 and RR2 share cluster-id 100: a client receives the same route from two RRs, and loops are excluded by the cluster list. The RR works without VRFs, so the RT filter is disabled on it (on Cisco no bgp default route-target filter, on Huawei undo policy vpn-target). The RD is unique per VRF per PE so that routes of different PEs are not merged when a PE is added or multipath is used; the RT defines the service topology. For customer B (Inter-AS Option B) RT 65000:200 is kept on ASBR1 without a VRF - the ASBR must keep VPN routes without a local import (retain route-target); EVPN-MPLS is chosen for C, and VPLS stays only for legacy PEs.
QoS, BNG, monitoring and security
Classes: EF/DSCP 46 -> TC 5 (priority 10%), AF41 -> TC 4 (20%), AF31 -> TC 3 (30%), CS6 -> TC 6 (control protocols, 5% guarantee), everything else TC 0. Tunnel model Short-Pipe: on the egress to the CE the queue is selected by the customer DSCP. The BNG is PE3: subscribers in VRF SUBS (RT 65000:500), pool 100.64.1.0/24, NAT444 into 198.51.100.0/28, RADIUS 10.255.0.50. Monitoring: syslog, SNMP traps, IPFIX and gRPC telemetry to 10.255.0.60, automation from 10.255.0.200. Security: CoPP on all nodes, maximum-prefix on the handoffs, filters on the ASBR, IS-IS and BGP authentication.
