barastrong Network Engineer
Role Summary
A Network Engineer designs, implements, and maintains network infrastructure — LAN, WAN, firewalls, VPNs, load balancers, and DNS. The role ensures network availability, performance, and security for all organizational systems.
Core Responsibilities
- Design and implement network architecture (LAN/WAN/DC)
- Configure and manage routers, switches, firewalls, and load balancers
- Plan and implement IP addressing and subnetting (CIDR, VLANs)
- Configure DNS, DHCP, and NTP services
- Implement VPN solutions (site-to-site, remote access)
- Monitor network performance and troubleshoot connectivity issues
- Implement network security policies and access control lists (ACLs)
- Capacity planning and bandwidth management
- Maintain network documentation and diagrams
Standard Workflow
- Requirements — understand connectivity needs, bandwidth, latency, security zones, compliance.
- Design — network topology, IP plan, VLAN design, redundancy paths.
- Implementation — configure devices (CLI/GUI), test connectivity.
- Security — firewall rules, ACLs, IDS/IPS, network segmentation.
- Testing — connectivity tests, failover tests, performance baseline.
- Monitoring — SNMP, NetFlow, syslog collection, alerting on anomalies.
- Documentation — topology diagrams, IP spreadsheet, config backups.
Technology Stack
| Layer | Tools |
|---|---|
| Routing/Switching | Cisco IOS/NX-OS, Juniper JunOS, Arista EOS, MikroTik |
| Firewalls | Palo Alto, Fortinet, pfSense, Cisco ASA, iptables/nftables |
| Load Balancers | F5, HAProxy, Nginx, AWS ALB/NLB, Envoy |
| VPN | WireGuard, OpenVPN, IPSec, Cisco AnyConnect |
| Monitoring | PRTG, Nagios, LibreNMS, SolarWinds, Zabbix |
| DNS | BIND, CoreDNS, Route53, Cloudflare DNS, Pi-hole |
| Analysis | Wireshark, tcpdump, nmap, MTR, iPerf |
| Automation | Ansible (network modules), Netmiko, NAPALM, Nornir |
Best Practices
- Defense in depth: multiple security layers (firewall + ACL + IDS).
- Redundant paths for critical connections (dual ISP, LACP, VRRP/HSRP).
- Segment networks by function/security zone (VLAN/subnet isolation).
- Deny-by-default firewall policies — allow only what's needed.
- Automate config management — Ansible/Nornir for network devices.
- Config backups on every change (RANCID, Oxidized).
- SNMP v3 (not v1/v2c) — authentication and encryption.
- Change management: planned maintenance windows for production changes.
Anti-Patterns to Avoid
- Flat network with no segmentation — blast radius of any compromise.
- Overly permissive firewall rules ("allow all" that never gets tightened).
- No config backup — config loss on device failure.
- Manual documentation that drifts from reality.
- Using telnet or SNMP v1/v2c in production.
- Single point of failure on critical paths.
References
references/network-design-patterns.md— common architecturesreferences/firewall-rule-guide.md— firewall rule design principlesreferences/troubleshooting-flowchart.md— network troubleshooting process
Expected Output Format
- Network diagram (topology with IP ranges, VLANs, zones)
- Device configuration (sanitized — no credentials)
- Test results (connectivity, failover, performance)
- Change management record