Network Cluster Engineering — Firewall, Switch & Router High Availability
Firewall pairs that actually fail over on purpose, switch stacks and MLAG pairs that neither loop nor blackhole when a member dies, and routers whose routing convergence you have measured instead of assumed.
What this usually looks like
The network is the layer everyone assumes is fine — until a single uplink, a single firewall, or a single spanning-tree topology becomes the reason the whole business is unreachable.
- Redundancy exists on the diagram, but whether the standby path actually carries production traffic has never been proven.
- Firewall HA is configured and has failed over exactly once — by accident, at night, and nobody wrote down what happened.
- The switch stack or MLAG pair was set up years ago; nobody can say what happens when a member reboots mid-day.
- Two people can change the network, one of them is on holiday, and no device configuration is version-controlled anywhere.
Three ways to buy this
Audit if you want to know how bad it is. Build if you have the team and want the capability. Managed if you don't want to own the pager. Most engagements start with the audit and decide afterwards.
Audit
A fixed-price health check — the cheapest way in
- Physical and logical topology map that names every single point of failure, including shared power and shared uplinks
- Firewall HA failover test performed in a maintenance window, with measured switchover time and session survival
- L2 loop-prevention and L3 convergence review: STP/MLAG interaction, BGP timers, BFD, route recursion
- Configuration drift report across every switch, router and firewall, with firmware inventory
Build
One-off delivery: design, code, hardening, handover
- Spine-leaf or collapsed-core fabric with EVPN-VXLAN overlay and MLAG/MC-LAG dual-homing to servers
- Firewall cluster: Fortinet FGCP, PAN-OS active/passive or active/active, Check Point ClusterXL, or pfSense/OPNsense CARP + pfsync
- Routing built with explicit policy: BGP, BFD, OSPF/IS-IS, and anycast only where it earns its place
- Network source of truth in NetBox — IPAM and topology first, then template-generated configuration
- Configuration backup to Git (Oxidized) with per-change diffing and automated drift detection
- A genuinely separate out-of-band management network, so a data-plane mistake never locks you out of your own devices
Managed
Build plus 7×24 on-call, SLA and quarterly drills
- Every configuration change reviewed, committed to Git, and reversible in one command
- Quarterly HA drill — firewall pair, MLAG pair, routing path — with a written report and measured outage
- Firmware patch cycles on vendor-validated builds, staged rather than head-of-branch
- Flow and uplink utilisation analysis to find the link that is quietly saturated before it becomes an incident
What we actually deploy
Specific tooling, not categories. If a version matters to your decision, ask — we will tell you which one we would pick and why, including when the answer is the older one.
Switching & fabric
- Arista EOS
- Cumulus Linux
- SONiC
- Cisco NX-OS (vPC)
- Juniper Junos (MC-LAG)
- Dell OS10 / SmartFabric
- Extreme Fabric Engine
- MLAG / MC-LAG / StackWise / VSS
L2 / L3 design
- EVPN-VXLAN
- spine-leaf
- 802.1Q / QinQ
- LACP bonding
- RSTP / MSTP
- loop-free design (MLAG + BPDU guard)
- MTU and jumbo frames
- storm control and port security
Routing
- FRR 10
- BIRD 2
- BGP (eBGP / iBGP, route reflectors)
- OSPF / IS-IS
- BFD
- VRRP / HSRP / CARP
- anycast + RPKI filtering
- policy-based routing
- route leaking and VRFs
Firewall clusters
- Fortinet FGCP (HA active-passive / active-active)
- Palo Alto HA3 (PAN-OS 11)
- Check Point ClusterXL
- pfSense CARP + pfsync
- OPNsense HA
- VyOS
- nftables
- IPsec / DMVPN site-to-site
Network automation
- NetBox (IPAM / DCIM)
- NAPALM
- Nornir
- Netmiko / Scrapli
- Ansible network modules
- Jinja2 config templating
- gNMI / OpenConfig
- Oxidized (config backup)
- zero-touch provisioning
Validation & testing
- containerlab
- Batfish (config analysis)
- iPerf3
- Ostinato packet generation
- tcpreplay
- RFC 2544 / Y.1564 throughput tests
- optic DDM/DOM diagnostics
- cable certification report review
Telemetry & monitoring
- SNMP + snmp_exporter
- sFlow / NetFlow / IPFIX
- gNMIc streaming telemetry
- LibreNMS
- pmacct flow accounting
- syslog to SIEM
- NTP / PTP time integrity
Lossless Ethernet (shared fabric)
- PFC (priority flow control)
- ECN + DCQCN
- QoS trust and DSCP mapping
- ETS bandwidth allocation
- dedicated lossless VLAN for RDMA
What we will be measured on
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
- A firewall HA failover executed deliberately, with the measured outage published — target under 5 seconds for stateful HA, or the honest number if the platform cannot do it.
- Killing one member of an MLAG pair drops zero production packets, demonstrated under load rather than on a quiet afternoon.
- Routing convergence after a link failure measured under BFD timers — stated as a number, not as "fast".
- Every switch, router and firewall configuration version-controlled, with a diff for every change and a one-command rollback.
- At least one unannounced fault-injection drill per year: a device is powered off, and the network keeps serving.
What we would build, and where the weak point is
A firewall cluster is only as redundant as its shared parts: two HA members on one PDU, one power feed, or one upstream switch is redundancy in name only. The out-of-band network is the other half of this picture — it is what stops a data-plane mistake from locking you out of every device you need to fix it.
marks a single point of failure we would raise with you rather than hide. Every architecture has one; the question is whether you know where it is.
What we don't do
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
- Requires partner
Cable pulling, patching, rack-and-stack, optic procurement
We deliver the port map, cable schedule and optic specification. Your colo or cabling partner executes it. We do not sell transceivers.
- Requires partner
Carrier contracts, ISP circuit ordering and escalation
We design around your circuits and will be the technical contact during a carrier fault. We do not resell bandwidth or sign on your behalf.
- Requires partner
Vendor TAC cases and hardware RMA for switches and firewalls
We gather diagnostics and open cases with you. We are not a reseller and will not replace your vendor support contract.
- Out of scope
VoIP, Wi-Fi RF design, 5G RAN, and structured-cabling for offices
Data-centre and campus data networking only. Voice, radio and wireless survey work needs specialists we are not.
What it looked like last time
A colocation estate whose firewall HA had never been failed over on purpose: stateful failover tested and tuned to 2.8 seconds with sessions surviving, an MLAG member failure reproduced in a lab before it happened in production, and the first complete configuration backup of 41 network devices — nine of which were running firmware two years behind vendor-validated builds.
Anonymised under NDA. No client names, no logos, no invented metrics. Full case library on the work page.
Talk to the network engineer about your network clusters (l2/l3)
Send us the architecture, or just describe what broke most recently. You'll get an engineer's answer, not a discovery questionnaire.
Talk to a network engineer: botonwa@gmail.com · +86 130 5181 3099