Xyphen IT
ConsultancyTraining

On-site BGP training: from first session to a resilient network.

One day, your whole team, your own network as the course material. Taught by an engineer who runs an AS with a terabit backbone himself.

Book an intake callView the programme
1 day on your premises2 to 8 peopleTailored hands-on labFixed price per team
Who it is for

Sound familiar?

Your own ASN is coming

You are about to request your own ASN and want a flying start: design with knowledge instead of repairing afterwards.

Moving away from your upstream

You are migrating away from your upstream or colocation provider and the IP space comes along. Routing is yours from now on.

Taking the team to the next level

You already run BGP but want to go further: security, traffic engineering and automation, with the whole team at the same level.

Programme

One day, from understanding to doing.

Not a list of subjects but a day with a storyline: in the morning everyone understands why, in the afternoon the engineers build it themselves.

  1. 01

    Morning

    Understanding

    For the whole team, including non-technical colleagues: what your own ASN brings the company, the economics of IPv4 and IPv6, transit versus peering, RPKI and MANRS in plain language, with a live look at your own prefixes. Then steering with BGP communities and traffic engineering, worked out around a realistic DDoS scenario including scrubbing via, for example, NaWaS. That scenario sticks as a playbook.

  2. 02

    Afternoon

    Doing

    Hands-on for the engineers, in pairs, on a lab that mimics your own edge at small scale: building sessions, announcing and filtering prefixes, finding and fixing a wrong ROA, actually rehearsing the DDoS playbook. To finish, you troubleshoot a scenario we deliberately broke.

  3. 03

    Common thread

    Automation

    The lab is configured with Ansible: adding a peer is editing YAML, DDoS activation is one playbook. If you already work infra-as-code, you see immediately how network and automation come together.

  4. 04

    Wrap-up

    A plan, not loose knowledge

    A concrete checklist of what still needs to happen on your side, from IRR and RPKI records to monitoring. The day ends with a plan.

Topics covered

eBGP / iBGPbest pathaggregation & filteringRPKI: ROAs and validatorsIRR & as-setsBGP communitiesprepends & conditional advertisingBCP38 / uRPFVRFsECMPFIB strategiesDDoS mitigation & RTBHmonitoring: flow data, BGPalerterPeeringDBMANRSNLNOG
What makes it tailored
Intake beforehand
A short call and a questionnaire about your architecture, prefixes, transits and plans. The examples are about your routers, not about router A.
A lab that mimics your edge
A containerlab environment with the same building blocks as your network, for example VyOS, FRR, a route server, an RPKI validator and a scrubbing node. Runs on hardware we bring; you only arrange a room with a projector.
Everything stays yours
Topology, configs, Ansible playbooks and exercises with solutions live in a Git repository that is yours after the day. Rehearse it again or onboard a new colleague with it.
Two levels in one day
The morning is accessible to management and sales, the afternoon is technical for the engineers. Afterwards everyone speaks the same language.
Who gives the training

Everything in this course runs in production.

The training is given by Yvan Watchman, owner of AS211588 (Innovation Harbor): a network with roughly a terabit of backbone capacity, 760 Gbit/s of edge and its own DDoS filtering, with core locations at NorthC and Nikhef. As a consultant he has also built networks and anycast DNS infrastructure for a range of customers, including a ccTLD, and guided dozens of data centre migrations.

AS211588±1 Tbit/s backbone760 Gbit/s edgeOwn DDoS filteringCore at NorthC and Nikhef
Practical

What to expect.

Duration
1 day on your premises. Longer programmes are possible.
Group size
2 to 8 people, hands-on in pairs.
Prerequisites
Networking basics (IP, routing). BGP experience is not required.
Language
Dutch or English.
You arrange
A room with a projector. Laptops only for the lab part.
Price
Every course is tailored. After a short intake you receive a fixed price for the whole team, not per person.
FAQ

Frequently asked questions about the BGP training

We do not have an ASN yet. Is this too early?

No, this is exactly the right moment. You design with knowledge afterwards instead of repairing later. The request route at RIPE NCC is covered in the morning.

Our team has different levels.

That is what the day is built for: the morning is for everyone, the afternoon is hands-on for the engineers.

Which equipment do you cover?

The training is vendor-neutral. The lab uses open-source routers and we translate the concepts to Juniper, Arista, Cisco, Huawei and VyOS. We have practical experience with all of these platforms.

Can you also help after the training?

Yes. Migration guidance, design reviews and implementation are separate follow-up engagements. It does not have to stop at the BGP session: we can design or redesign and build your entire network, from edge and transits to IX connections and DDoS mitigation, while you keep your ASN and full autonomy.

Is one day enough?

For a flying start, yes. Teams that want to go deeper can opt for a multi-day variant.

Read more
From the knowledge base

Curious whether this fits your team?

Book a no-obligation 30-minute intake call. Tell us briefly about your situation and you will hear whether and how the training fits.

Book an intake callor call +31 85 303 9420