Project: a branch with no single point of failure
Lesson 4 of 4
4Project: a branch with no single point of failure
The big pictureThis is the mid-level stage project, and it is what you will show in a job interview. It is not enough for the network to "work". It must keep going when any piece fails, and be monitored, tidy and generated from data. You will build it in Packet Tracer or containerlab, document it, and break it on purpose.
What the picture shows: Six phases in order, each building on the one before, and you do not move on until its condition holds.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
You will build a small company branch: staff, phones and guests, and two internet links. The goal is to be able to tell your manager: "pull any cable or turn off any device, and everything is back within seconds". You walk six phases, each with a clear condition that tells you it is done. Take your time: two to three weeks at an hour a day.
The parts: CORE1 and CORE2 on a two-link LACP channel, three access switches with two uplinks each, RSTP with CORE1 root for VLANs 10 and 30 and CORE2 root for VLAN 20, HSRPv2 matching the root with preempt and uplink tracking, central DHCP via helper-address with DHCP snooping, IPv6 from a /48 plan with RA Guard, two edge routers on eBGP to two providers (private ASes in the lab) with Local Preference, prepending and prefix-lists, SNMPv3 and syslog to one server on NTP time, a QoS policy with a capped EF queue inside a shaper, and a script that generates the access configs from JSON and shows the diff.
Before You Start
🔁Every lesson in this stage
STP, HSRP, IPv6, BGP, monitoring, QoS and automation.
🏢The junior office project
You built a simple office network before.
The Core Idea
1The whole picture
Before any command, draw the design: every device doubled, every link with an alternative. Ask of every box in the drawing: "what if this fails?". If the answer is "something stops", you have found a single point of failure.
2The six phases and their conditions
Press each phase to see its goal, what you do and its done-when condition. Do not skip: each phase assumes the one before works.
The project plan: six phases
About an hour a day. The "done when" condition is always practical: something you see in the lab or a command you run.
1 · Design and data
- Goal
- A drawing, an address table and one data file as the source of truth.
- What you do
- Draw the network, write the IPv4, IPv6 and VLAN plan in one JSON file, and give each device its role.
- Done when
- Every address in the drawing is in the file, and no box in the drawing lacks an alternative.
2 · Core and layer 2
- Goal
- Loops with no storm, and a root you choose.
- What you do
- An LACP channel between the cores, RSTP with priorities, PortFast and BPDU Guard on device ports.
- Done when
show spanning-treeshows your chosen root per VLAN, andshow etherchannel summaryshows (SU) and (P).
3 · Gateway and addresses
- Goal
- A gateway that never dies, and addresses reaching every device.
- What you do
- HSRPv2 matching the root with preempt and tracking, helper-address on both cores, DHCP snooping, IPv6 with SLAAC and RA Guard.
- Done when
- A new PC gets IPv4 and IPv6 in every VLAN, and turning CORE1 off keeps a ping to the gateway alive with under 10 seconds of loss.
4 · The edge and BGP
- Goal
- Internet from two providers with a clear policy.
- What you do
- eBGP to ISP-A and ISP-B, Local Preference to prefer A outbound, prepending towards B inbound, and a prefix-list announcing only your prefix.
- Done when
show ip bgpshows A preferred, and cutting A's link moves the exit to B in under a minute.
5 · Operations
- Goal
- A network that talks and protects voice.
- What you do
- SNMPv3 and syslog to one server and NTP on every device, a QoS policy with a capped EF queue inside a shaper, and a script that generates access configs from JSON and shows the diff.
- Done when
- A port going down shows in the central log with the right time, and running the script twice says "no change" the second time.
6 · Failure tests and write-up
- Goal
- Proof the design works, and a portfolio piece.
- What you do
- Unplug every device and every link one by one, record the outage time in a table, then write a README with the drawing, the data and the results and put it on GitHub.
- Done when
- No outage beats 10 seconds for internal traffic or a minute for the internet, and the table is published with the configs.
3Check your design with code
Before you build, let code hunt for single points of failure in your data file: which device, if removed, cuts part of the network off from the internet?
ACC3 has only one uplink. Add ("CORE2", "ACC3") and run again to watch the weak spot vanish.
links = [("ISP-A", "EDGE1"), ("ISP-B", "EDGE2"), ("EDGE1", "CORE1"), ("EDGE1", "CORE2"),
("EDGE2", "CORE1"), ("EDGE2", "CORE2"), ("CORE1", "CORE2"),
("CORE1", "ACC1"), ("CORE2", "ACC1"), ("CORE1", "ACC2"), ("CORE2", "ACC2"), ("CORE1", "ACC3")]
internet = {"ISP-A", "ISP-B"}
access = ["ACC1", "ACC2", "ACC3"]
def reaches_internet(start, removed):
seen, todo = {start}, [start]
while todo:
here = todo.pop()
for a, b in links:
for x, y in ((a, b), (b, a)):
if x == here and y not in seen and y != removed:
seen.add(y)
todo.append(y)
return bool(seen & internet)
nodes = {n for link in links for n in link} - internet - set(access)
for node in sorted(nodes):
cut = [acc for acc in access if not reaches_internet(acc, node)]
print(f"remove {node:<6} ->", f"CUT OFF: {cut}" if cut else "still fine")Worked example
The task: in a failure test you turned CORE1 off and a ping from a PC in VLAN 10 to the internet broke for 35 seconds. The target is under 10. Where do you look?
The answer: 35 seconds looks like classic STP or default HSRP timers plus delay. Check: (1) is the mode rapid-pvst on every switch? One old-mode switch drags convergence back down. (2) HSRP timers: lower them to hello 1 and hold 3, or sub-second with millisecond timers. (3) Is CORE2 the backup root at priority 8192? (4) The BGP and OSPF sessions between edge and core: turn on BFD to detect failure in under a second. Rerun the test and log the new number in the table.
Myth vs Reality
| Myth | Reality |
|---|---|
| A nice diagram is enough to convince an interviewer. | The interviewer asks "what happens if...?". Your failure-test table with real numbers is the answer that convinces. |
| Two of everything means no point of failure. | A single link, one DHCP server or one power feed may remain. Hunt them with questions and with code. |
| A lab is nothing like reality, so it is useless. | The protocols and behaviour are the same. A lab is the only place you can break everything with no consequences. |
Where you meet it at work
🏦A bank or hospital branch
The same design on real gear, with the same requirement: no stopping.
🧑💼The job interview
Show the drawing, the failure table and the script in ten minutes.
📚CCNP certificate
Most ENCOR topics passed through your hands in this project.
Test your understanding
What is the strongest proof your design has no single point of failure?
What you do not test you do not know works.
Why match the STP root with the active HSRP router in each VLAN?
If they differ, traffic crosses the inter-core link for no reason.
Which tool detects a BGP neighbour failure in under a second?
BFD sends light messages every few tens of milliseconds and tells the protocol at once.
An access switch has only one uplink to the core. What is the problem?
Every access switch needs two uplinks to two different cores.
What is the done-when for the operations phase in this project?
The condition is practical and visible, not the passing of days.
Quick review cards
Check Your Understanding
What is the first question you ask of every box in the design drawing?
"What if this fails?" If the answer is "something stops", it is a single point of failure.
Why build the data in JSON before any command?
Because it becomes the source of truth you generate configs from and check with code.
What makes this project convincing to an employer?
The failure-test table with real numbers, configs generated from data, and the published write-up.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.