Job role: network engineer, a multi-site enterprise network
You build a three-site organisation’s network from scratch — OSPF and BGP, redundant gateways, VPN, monitoring and automation — then defend it in planned outage drills.
Level 501 · 18 lessons · 15 practice labs
Lessons
Design
- Requirements and constraints
- High- and low-level design documents
- A multi-site address plan: IPv4 and IPv6
- Short task: prepare your design for peer review
Build
- The underlay: OSPF and redundant links
- BGP at the edge with two providers
- Encrypted links between sites
- Shared services: DNS, DHCP, NTP
- Short task: verify the build with acceptance tests
Operations
- Monitoring and alerting
- Putting configuration under automation
- A network security baseline
- Short task: write the operations runbook
Drills
- Drill: main link failure
- Drill: a wrong route announcement
- Drill: a distributed denial-of-service attack
- Short task: report the drill findings
Wrap-up
- Capstone: deliver and defend the multi-site enterprise network
Practice labs
- An address plan for three sites: Prepare a summarisable IPv4 and IPv6 address plan for three sites and tabulate each site’s loopback, management and user ranges.
- Review a design as a peer: Find the clashing ranges, missing redundancy and inconsistent naming in the given low-level design and write a review note with suggested fixes.
- Verify the build with acceptance tests: Write an automated acceptance-test script for Silverwater Municipality’s three-site lab network covering reachability, redundancy and shared services, run it and fix the failing tests.
- One site has lost its OSPF neighbour: Find why the OSPF adjacency between sites will not form (area, timers, MTU), fix it and show the routes being learned.
- Inter-site traffic is in clear text: Move the link between two sites onto an encrypted tunnel, run OSPF over the tunnel and prove that the capture shows only encrypted traffic.
- Shared services depend on one site: Show that DNS and NTP depend on a single site, set up backups at a second site and prove the other sites keep resolving names and syncing time when the first site is cut off.
- The BGP session with the second provider will not come up: Find the AS number or neighbour address mistake on the BGP session to the second provider, fix it and show the session reaching Established.
- Traffic leaves through the wrong provider: Implement the primary and backup provider policy with local preference and AS-path prepending and show outbound and inbound traffic using the expected link.
- A site is announcing someone else’s prefix: Detect the prefix a site announced by mistake in the lab, contain its impact, prevent it recurring with prefix filters and report the drill findings with a timeline.
- Security baseline check: Audit the three sites’ routers against the given security baseline (SSH, management access, logging, NTP), fix the deviations and audit again.
- What to do when the alert fires: Set up monitoring and an alert for an inter-site link, write a runbook page with the steps to follow when it fires and test it by cutting the link.
- Move a hand-managed router into a template: Move one site’s hand-managed router configuration into a template and Git, bring the difference between template output and the live state to zero and roll out one change from the template.
- Drill: the main link is cut: Cut the main inter-site link, measure that traffic moves to the backup path and how long it takes, and compare with the expected time.
- Drill: overload on the web server: Identify the affected service and traffic sources from flow data during the heavy request traffic generated in the lab, apply rate limits and filters at the edge and show the service recovering.
- Drill: two incidents at once: Resolve a simultaneous link failure and a misconfigured route on Pinecrest Bank’s three-site lab network, justify your prioritisation and report the findings and improvements.
About this course
You build a three-site organisation’s network from scratch — OSPF and BGP, redundant gateways, VPN, monitoring and automation — then defend it in planned outage drills.
What you will learn
- Design
- Build
- Operations
- Drills
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.