Architecture: scalable service-provider design and control-plane security
What this domain tests
Architecture on SPCOR is about service-provider design choices rather than single-box commands: hierarchical core, aggregation, and access layers; scalable BGP design; control-plane hardening; and the virtualized and SDN components that sit alongside routers. Questions often ask why a design scales, not just which command enables a feature.
Core rules
- Build a routed core with one IGP, OSPF or IS-IS, carrying loopbacks and core links. Carry customer and Internet routes in BGP and keep the IGP small and stable.
- iBGP full mesh grows as n(n-1)/2. Route reflectors reduce sessions; a cluster is identified by cluster ID, and redundant RRs in one cluster should share it.
- An RR reflects best routes, preserves next hop by default for iBGP, and uses originator ID and cluster list for loop prevention.
- Harden the control plane with iACL/CoPP, BGP maximum-prefix, TTL security on eBGP, prefix filters, and uRPF where traffic symmetry allows.
- NFV separates network functions from hardware; VNFs run on server platforms. SDN controllers program forwarding or service chaining through APIs such as NETCONF/YANG.
Worked example
A design has 14 PE routers in one AS. Full-mesh iBGP needs 14 x 13 / 2 = 91 sessions. Two route reflectors reduce each PE to two iBGP sessions, 28 total. The RRs need not sit on the forwarding path: they reflect routes, while MPLS forwarding follows the IGP path to the egress PE. Put both RRs in the same cluster ID so a route reflected by one is recognized as a duplicate by the other; different cluster IDs can create duplicate paths and churn. Give the RRs redundant IGP reachability and verify that BGP next-hop recursion does not point into a failed link.
Traps that cost marks
- Treating the RR as a forwarding hop; it is control plane unless separately in-path.
- Using different cluster IDs on redundant RRs and causing duplicate reflected routes.
- Applying strict uRPF on asymmetric uplinks and dropping valid return traffic.
- Forgetting that nonclient-to-nonclient routes still need a full mesh or another RR.