Capstone Outline

Capstone Outline

This chapter is a map of finishing projects, not a single mandatory mega-lab. Pick at least one capstone and run it to the book’s definition of done: design, code, break, prove, operate.

Learning goals

By the end of this chapter you can:

• Choose a capstone that matches your goals
  
• Scope addressing, topology, and success metrics
  
• Apply models + verification + automation end-to-end
  
• Produce a portfolio-quality lab folder
  
• Identify natural next topics beyond this spine

Definition of done (all capstones)

• Written design (1–2 pages): goals, non-goals, addressing, failure modes
  
• topology.clab.yml + configs in git
  
• addressing.md + diagram
  
• verify.sh green on clean deploy
  
• ≥ 3 failure drills with incident notes
  
• One automation wrapper (make smoke or equivalent)
  
• Short retrospective: what model changed in your head

Capstone C1 — Campus-style dual core (open images)

Intent

Two access switches (or Linux bridges), dual core routers, dual-homed access, VLANs for users/servers, OSPF underlay between cores, static or OSPF toward access.

   h-user    h-srv
      |        |
     sw1      sw2
      |  \  /  |
      |   \/   |
      |   /\   |
     core1  core2

Skills exercised

• VLANs/trunks
  
• L2/L3 boundary
  
• OSPF or static redundancy
  
• Failure: core link down, trunk VLAN missing

Success metrics

• Hosts in VLAN 10 communicate across access
  
• Inter-VLAN via cores
  
• One core or one uplink loss recovers within your documented budget

Suggested stack

FRR cores + Alpine hosts + Linux bridge “switches” or SR Linux if you want NOS practice.

---

Capstone C2 — Dual-homed site to provider edge

Intent

Customer edge (CE) with two eBGP uplinks to two “ISP” PE routers; prefer primary; failover to backup; filter what you advertise/accept.

        PE1 (AS65010)
       / 
   CE (AS65001)
       \
        PE2 (AS65020)

Skills exercised

• eBGP sessions
  
• Prefix filters / route-maps
  
• Local-pref / prepend
  
• Session loss drill

Success metrics

• Only owned prefixes exported
  
• ISP rejects hijack test prefix
  
• Traffic shifts on primary PE failure

verify extras

Negative test: unauthorized prefix must not appear on PE.

---

Capstone C3 — Mini fabric snack

Intent

2 spine + 2 leaf (or 2×2) IP fabric with OSPF or eBGP underlay; endpoints on leaves; break a leaf uplink.

   s1      s2
   | \    / |
   |  \  /  |
   |   \/   |
   |   /\   |
   l1      l2
   |        |
   h1       h2

Skills exercised

• Underlay design
  
• ECMP behavior
  
• Scale of configs (templating pays off)
  
• Observability under failure

Stretch (optional)

Add a simple tunnel/overlay between leaves after underlay is solid—never before.

---

Capstone C4 — Incident week

Intent

Take any working lab (C1–C3 or static triangle). Each day for five days inject a hidden fault (or swap with a peer) and practice detect → diagnose → fix → prevent.

Day	Example inject
1	Wrong VLAN on one access port
2	Missing return route
3	MTU clamp + ICMP filter
4	OSPF cost surprise / link flap
5	BGP filter too strict

Skills exercised

• Observability under time pressure
  
• Incident notes
  
• Avoiding random change storms

Success metrics

• Each day: root cause written with evidence
  
• verify.sh restored green
  
• One new automated check added by end of week

---

How to pick

Goal	Pick
Campus / enterprise ops	C1
Edge / multihoming	C2
DC-ish fabric thinking	C3
Diagnostic mastery	C4 (optionally + another)

Time box: 1–2 weeks evenings per capstone at 5–8h/week pace.

Project template (copy)

capstones/c2-dual-home/
  DESIGN.md
  README.md
  topology.clab.yml
  addressing.md
  verify.sh
  Makefile
  config/
  journals/
    drill-1.md
    drill-2.md
    drill-3.md
  diagrams/
  RETRO.md

DESIGN.md skeleton

# Design: Dual-homed CE

## Goals
## Non-goals
## Topology
## Addressing
## Control plane
## Policy
## Failure modes
## Observability
## Test plan

RETRO.md prompts

• Which plane failed most often in your drills?
  
• What did you overcomplicate?
  
• Which verify checks caught real bugs?
  
• What would you template next?

Integration with the book spine

Book part	Capstone use
Models	Language in DESIGN.md
Lab craft	Containerlab hygiene
L2	C1 trunks/VLANs
L3	All (addressing, static edges)
Interior routing	C1 OSPF, C2 BGP, C3 underlay
Ops automation	Makefile, verify, journals

Beyond this book (next horizons)

When capstones feel comfortable:

• Multi-area OSPF / IS-IS
  
• EVPN/VXLAN on free images where feasible
  
• QoS classification labs
  
• Stronger automation (CI self-hosted, config generate)
  
• Streaming telemetry on SR Linux
  
• Traffic engineering and more advanced BGP

Stay open-tools-first unless your job provides licensed platforms.

Final checkpoint: “expert” as defined in the syllabus

You can:

• Design multi-site L2/L3 with clear underlay roles
  
• Implement in Containerlab with free images
  
• Diagnose control vs data failures with tables + captures
  
• Apply routing policy without creating loops
  
• Automate lab lifecycle and basic validation
  
• Operate with observability and recovery habits

If any bullet is weak, return to that part’s drills—not to random new features.

Summary

• Capstones prove integration, not trivia
  
• C1 campus, C2 dual-home BGP, C3 fabric snack, C4 incident week
  
• Same definition of done for all: design, code, verify, break, document
  
• Automation and negative tests separate portfolio work from toy demos
  
• The journey map continues; the habits stay

Return to the syllabus for the full long-range map (overlays, QoS, multi-area depth). Your next commit should be a capstone folder, not another unread PDF.