Dear Junos, Tunnels Are Not Virtual Links

In late June, we added GRE tunnels to netlab, including a Junos implementation. It looked great (as in “everything worked”) until I changed the integration tests to have GRE tunnels between a tested device and a pair of FRR containers. All other implementations worked as before, but Junos failed to establish an OSPFv3 adjacency over the GRE tunnel with FRR.

Stefano Sasso quickly identified the culprit: Junos OSPFv3 process thinks it should send the DBD packets over GRE tunnels with MTU set to zero (the behavior reserved for virtual links)¹.

Multivendor SR-MPLS

Summer is almost over, and it’s time to resume regular programming with the next example from the Segment Routing workshop I had at ITNOG10: multi-vendor SR-MPLS. I used the same lab topology as in the previous examples but deployed Arista EOS on PE1, FRRouting on P, and SR Linux on PE2¹

Arista cEOS Does Not Apply ACLs to Control-Plane Traffic

When someone starts singing the Use Digital Twins to Test Your Network hymn (or, more recently, tells you how AI agents can do that to validate their ideas), ask them about these minor details. If they persist, point them (not that it would help) to this long list of gotchas.

That list just got longer: Arista cEOS container does not apply inbound ACLs to control-plane traffic (Arista vEOS VM does).

Worth Reading: Reading the Git Crime Scene

Tony Mattke continues publishing excellent “Git for Networking Engineers” content. In his latest article, he described how to find who made what changes (and why) in a Git repository.

Absolutely worth reading if you’re new to Git, but even oldtimers might find a few useful tidbits (Git is one of those things one never truly masters).

Worth Reading: On AI Coding and Its Discontents

A lot of AI-coding enthusiasts are making claims along the lines of “AI coding tools are like compilers; you supply intent, they translate it into code, and who ever looked at the machine-code output?” Unfortunately, there is a bit of a gap between hope and reality; traditional compilers were always deterministic, and are (after decades of development and bug-fixing) pretty much bug-free. AI coding tools are neither, and no amount of “agentic loops” will solve that.

Exploring the BGP Neighbor CONNECT State

Sakar left an interesting comment on my The Curious Case of the BGP Connect State blog post, claiming that Cisco IOS/XE goes through a CONNECT state when opening an incoming BGP session.

I wanted to double-check this behavior, so I needed a scenario where one router would keep sending TCP SYN requests, the other would not (or we wouldn’t learn anything), and the two routers could not communicate (or they’d quickly go into the OPEN state).

Here’s my first attempt at meeting those requirements:

The Never-Ending IPv6 Loopback Prefix Saga

Remember the sage advice to simplify your life and use the IPv6 /64 prefixes everywhere? Not only does it make your life simpler (and wastes immesuarably less address space than the crazy “let’s assign /64 to every device” stupidity), it also reduces the hardware requirements in your high-speed routers layer-3 switches. You see, doing lookups on 64 bits uses half the silicon it takes to do lookups on 128 bits.

Alas, some people never got the memo. OSPFv3 standard clearly states in one of the bullets in section 4.4.3.9 that the loopback prefixes should always be advertised as /128s regardless of what’s configured on the interface.

Worth Reading: LLM Prompts for Network Engineers

Tony Mattke put together a long list of recommendations that might help you get more out of your LLM tokens.

Definitely worth reading instead of yelling at the stupid AI.

Compress netlab Lab Topologies with Dot Notation

netlab is using the Python Box library to make the code easier to read¹. When I started the project, I hated the way you fetch values from Python dictionaries with stuff like node['ospf']['area']; Python Box lets you write node.ospf.area. Even better², you can tell Python Box to create intermediate dictionaries as needed. node.ospf.area = 1 will automatically create the node.ospf dictionary.

But wait, there’s more (yes, we’re getting to the topic of today’s blog post): Box lets you use the same dotted notation in YAML files.

On ACLs and AI-Generated Device Configurations

Last Friday, I had a lovely chat with Steinn Bjarnarson and Urs Baumann, resulting in the NetworkAutoMagic episode 11. We couldn’t avoid mentioning netlab, the seven layers of ACL hell (which is still balmy compared to the QoS hell), and the gotchas of AI-generated device configurations.

Fortunately, I don’t have to go into more details; Steinn published extensive notes, and if you don’t feel like listening to us while driving, you can waste time watching us on YouTube.

netlab 26.08: ArcOS, VPP (FD.io), ACLs, and DNS

netlab release 26.08 brings a few humongous additions:

• ArcOS support by @roc-ops
• VPP (FD.io) with FRR or BIRD control plane by @jbemmel
• SONiC containers (also by @roc-ops)
• IPv4/IPv6 access control lists in the routing module by @DanPartelly

But wait, there’s more:

On the Futility of Opening Ansible Issues

Remember the anonymous troll who chided me for writing a rant instead of opening a GitHub issue in the relevant Ansible repository? Well, I decided to be an open-source poster boy when I stumbled upon the next Ansible bug, and ended up feeling like a sweet summer child :(

Content: New Parameter in Multiple something_config Ansible Modules

Last December, I wrote a pretty ranty post explaining how Ansible release 12 broke (some?) network device configuration playbooks. The inevitable anonymous troll (why are they always anonymous?) couldn’t resist asking whether I opened an issue on GitHub. I didn’t (more about that later), but when the solution to that rant was “we’re deprecating using templates in src” parameter, I opened an issue arguing why that’s not a good idea.

Worth Reading: Git Oh-Shit Toolkit

Tony Mattke published a blog post I wish I’d read 10 years ago. His Oh-Shit Toolkit includes several tools one can use after messing up Git branches or commit history.

Definitely worth reading, even if you’ve been working with Git for ages.

netlab 26.07: GRE, Wireguard, Graceful Restart, and Scale-Out Labs

The highlights of netlab release 26.07 include:

• The multiserver plugin by @muddyblack distributes containerlab devices across multiple servers.
• The GRE tunnel plugin supports GRE tunnels on Cisco IOS, FRR, VyOS, and Junos (vSRX and vJunos-router) (most device implementations done by @ssasso and @jbemmel).
• The WireGuard tunnel plugin by @jbemmel supports WireGuard tunnels on FRR.
• The bgp.session plugin and the OSPF module support graceful restart on Arista EOS, BIRD, FortiOS, and FRR (by @jbemmel and @a-v-popov)
• The bgp.policy plugin supports the bgp.role attribute on FRR and BIRD (by @jbemmel).

But wait, there’s more ;)

netlab: 2000 Pull Requests Later ;))

Jeroen van Bemmel noticed an interesting fact yesterday evening: the netlab GitHub repository has 2000 merged/closed pull requests. I never expected the tiny “let’s learn Python while working around the complexities of Vagrantfile” project to get this far ;))

Thanks a million to everyone who contributed, reported a bug, asked a question, or helped us spread the word. You rock 🤗

Worth Reading: Scripting Good Practices in Python

Just in case you decide to build a simple Python project over the summer: read scripting good practices in Python by Brett Cannon and tell your AI friend to adhere to them ;)

Worth Reading: More VXLAN and EVPN Labs

Ali Bahadır Coşkun continued his EVPN/VXLAN journey. Using the free netlab-powered EVPN/VXLAN labs, he finished the basic EVPN/VXLAN lab (adding EVPN control plane to VXLAN underlay), and then completed the whole VXLAN/IRB/anycast saga.

Want to do something similar? The free EVPN/VXLAN lab exercises include six VXLAN labs, almost a dozen EVPN labs, and a few EVPN designs. I might add a lab or two during the summer break.

Worth Checking: EVPN Centralized Anycast Gateway

Daniel Blažek couldn’t resist testing Arista EOS centralized anycast gateway functionality (on top of IPv6 underlay to make it even more fun) and published working device configurations in a GitHub repo.

His repository includes a containerlab topology definition, so you can start the lab directly from the repository.

Getting Started with netlab @ Cisco DevNet

Cisco DevNet channel has published an hour-long Getting Started with netlab interview with Suresh Vina, resulting in netlab.tools documentation having more weekly visits than ipspace.net blog for the first time. Thanks a million ;))

If you’re new to netlab, I hope you’ll enjoy the video. If you have any follow-up questions, don’t hesitate to start a discussion.