VyOS for Production Network Engineers

Part I

Networking Foundations for Routing Engineers

Ethernet, MAC, ARP, IPv4/IPv6, CIDR, subnets, gateways, MTU, TCP/UDP, ICMP — the prerequisites every routing engineer must already understand.

6 lessons

Part II

Routing Fundamentals

Routing tables, longest-prefix match, connected routes, static routes, default routes, next hops, recursive lookup, administrative distance, metric, ECMP.

6 lessons

Part III

VyOS Architecture

Linux base, FRRouting, configuration tree, commit engine, generated runtime configuration, services, web UI, API.

6 lessons

Part IV

Installation and Initial Deployment

ISO install, VM deployment, cloud image concepts, console, initial configuration, management connectivity.

6 lessons

Part V

Configuration Model

configure / set / delete / show / compare / commit / save / discard / exit; candidate vs active vs saved configuration.

6 lessons

Part VI

Commit and Rollback Safety

commit, commit-confirm, rollback, configuration history, save — production-critical safe-change mechanics.

6 lessons

Part VII

Interface Fundamentals

Ethernet interfaces, addressing, descriptions, MTU, administrative and operational state.

6 lessons

Part VIII

VLANs

IEEE 802.1Q, tagged traffic, trunks, sub-interfaces, parent interfaces, VLAN addressing, switch interaction.

6 lessons

Part IX

Bridges

Layer-2 bridging, bridge interfaces, when bridging is appropriate versus routing.

6 lessons

Part X

Bonding and Link Aggregation

LACP, active-backup, balance modes, switch dependencies, failure behaviour.

6 lessons

Part XI

IPv6

Addresses, prefixes, neighbour discovery, router advertisements, static and dynamic routing, firewall.

6 lessons

Part XII

Static Routing

Static routes, default routes, recursive next hops, floating static routes, blackhole routes.

6 lessons

Part XIII

Policy-Based Routing

When destination routing is insufficient; source-based routing, application routing, management routing.

6 lessons

Part XIV

Multiple Routing Tables

Linux/VyOS policy-routing, tables, rules, priorities, lookup sequence.

6 lessons

Part XV

VRFs

Route isolation, VRF interfaces, route-leaking considerations, operational troubleshooting.

6 lessons

Part XVI

Route Leaking Between VRFs

Controlled connectivity between VRFs, security implications, accidental leaks.

6 lessons

Part XVII

Routing Protocol Fundamentals

Adjacency, convergence, control plane vs data plane, IGP vs EGP, route preference.

6 lessons

Part XVIII

OSPF Fundamentals

Link-state routing, neighbours, LSAs, areas, DR/BDR, SPF, cost.

6 lessons

Part XIX

OSPF Configuration

VyOS/FRR OSPF configuration: router ID, networks, passive interfaces, areas, summarisation.

6 lessons

Part XX

OSPF Areas and Design

Area 0, non-backbone areas, ABRs, area design, summarisation, stub area concepts.

6 lessons

Part XXI

OSPFv3 / IPv6 Routing

OSPFv3 for IPv6, differences from OSPFv2, current VyOS support.

6 lessons

Part XXII

OSPF Troubleshooting

Neighbour states, MTU mismatch, area mismatch, authentication, timers, network type, duplicate router ID, missing routes.

6 lessons

Part XXIII

BGP Fundamentals

AS numbers, eBGP, iBGP, sessions, route advertisement, best path, path-vector model.

6 lessons

Part XXIV

BGP Session Establishment

Idle / Connect / Active / OpenSent / OpenConfirm / Established, TCP 179, source addresses, multihop, TTL, authentication.

6 lessons

Part XXV

BGP Route Advertisement

Network origination, redistribution, aggregates, default route advertisement, risks of advertising more than intended.

6 lessons

Part XXVI

BGP Attributes

Local preference, AS path, origin, MED, next hop, weight, communities.

6 lessons

Part XXVII

BGP Best Path

Best-path decision process, visual exercises, validation against FRR behaviour.

6 lessons

Part XXVIII

BGP Prefix Filtering

Prefix lists, route maps, inbound filters, outbound filters, default deny, route leaks.

6 lessons

Part XXIX

BGP Communities

Standard communities, operational tagging, upstream policy, blackholing concepts.

6 lessons

Part XXX

BGP Route Reflectors

iBGP scaling, full mesh, route reflectors, clients, cluster concepts.

6 lessons

Part XXXI

BGP Troubleshooting

Session down, route not received, route received but not selected, route selected but not installed, prefix filtered, next hop unreachable, AS path issue, route leak.

6 lessons

Part XXXII

BFD

Bidirectional Forwarding Detection, integration with BGP and OSPF, static-route tracking.

6 lessons

Part XXXIII

Route Policy

Prefix lists, route maps, community lists, policy evaluation order, named policies.

6 lessons

Part XXXIV

Route Redistribution

Redistributing static, OSPF, BGP, connected; loops, feedback, tagging, filtering, administrative distance.

6 lessons

Part XXXV

Route Summarisation

Aggregation, summary routes, blackhole/discard supporting routes, failure implications.

6 lessons

Part XXXVI

ECMP

Equal-cost paths, hashing, per-flow behaviour, failure handling, troubleshooting implications.

6 lessons

Part XXXVII

Firewall Fundamentals

VyOS stateful firewall, zones, input, forward, output, state tracking, conntrack.

6 lessons

Part XXXVIII

NAT Fundamentals

SNAT, DNAT, masquerade, port forwarding, 1:1 mappings.

6 lessons

Part XXXIX

Multi-WAN

Multiple defaults, failover, load distribution, policy routing, health checking.

6 lessons

Part XL

VRRP High Availability

Virtual router, virtual IP, MASTER/BACKUP, priority, advertisements, preemption, tracking.

6 lessons

Part XLI

WireGuard

Keys, peers, allowed IPs, routing, firewall, site-to-site, remote access.

6 lessons

Part XLII

IPsec

IKE, ESP, peers, tunnels, route-based VTI, NAT-T, modern proposals.

6 lessons

Part XLIII

VPN Routing

Static routes over tunnels, BGP/OSPF over tunnels, route propagation, failover.

6 lessons

Part XLIV

VXLAN

VNI, encapsulation, underlay, overlay, when VXLAN belongs in network design.

6 lessons

Part XLV

QoS Fundamentals

Classification, marking, queuing, shaping, policing, DSCP, trust boundaries.

6 lessons

Part XLVI

DHCP Services

DHCP server scopes, static mappings, options, relay, IPv6 DHCPv6.

6 lessons

Part XLVII

Management Plane Hardening

SSH, console, API, source restrictions, management VRF, out-of-band access.

6 lessons

Part XLVIII

Logging and Remote Syslog

Local logs, routing daemon logs, firewall logs, VPN logs, remote syslog forwarding.

6 lessons

Part XLIX

Monitoring and Observability Integration

Interface metrics, BGP/OSPF telemetry, route counts, CPU, memory, SNMP, exporters.

6 lessons

Part L

Performance Troubleshooting

CPU saturation, interrupts, packet drops, NIC limits, crypto performance, route churn.

6 lessons

Part LI

MTU and Fragmentation

Ethernet MTU, tunnels, IPsec overhead, WireGuard overhead, PMTUD, MSS clamping.

6 lessons

Part LII

Troubleshooting Methodology

Define source/destination, expected path, interface state, addressing, route, policy, firewall, NAT, capture, return path.

6 lessons

Part LIII

Security Hardening

Routing protocol authentication, max-prefix, prefix filtering, RPKI concepts, control-plane protection, management hardening.

6 lessons

Part LIV

API and Automation

VyOS HTTP API, Ansible integration, configuration-as-code, automated validation, change management.

6 lessons

Part LV

Backup, Restore, Disaster Recovery

Saved configuration, remote backups, replacement appliance recovery, lost router recovery.

6 lessons

Part LVI

Software Images and Production Upgrades

Image management, rolling upgrade sequencing, FRRouting compatibility, rollback.

6 lessons

Part LVII

Production Reference Architecture

A realistic dual-ISP BGP VRF-segmented VyOS estate with VPN, monitoring, backup, and DR.

6 lessons

Part Labs

Hands-On Labs

Disposable-virtualisation labs covering install, routing, BGP, OSPF, VRFs, firewall, NAT, VPN, VRRP, automation, backup, recovery.

0 lessons

Part Runbooks

Operational Runbooks

Operational procedures: deploy, troubleshoot, change, fail over, restore, recover.

0 lessons

Part Checklists

Production Checklists

Printable readiness, change, and review checklists.

0 lessons

Part Break/Fix

Break/Fix Scenarios

Deliberate operational incidents with evidence-first diagnosis.

0 lessons

Part Capstone

Capstone: Production VyOS Estate

A complete dual-ISP BGP VRF-segmented VyOS estate with VPN, VRRP, monitoring, backup, and validated DR.

0 lessons

Part Final

Final Assessment

Theory and practical assessment of every production competency.

0 lessons