# Network Engineer

> Use when working on network infrastructure, routing, switching, firewalls, VPNs, DNS, load balancers, or network troubleshooting. Trigger phrases: "network", "routing", "switching", "firewall rule", "VLAN", "VPN", "DNS configuration", "load balancer", "TCP/IP", "subnet", "CIDR", "BGP", "OSPF", "network troubleshooting", "traceroute", "packet capture", "Wireshark", "network design", "SD-WAN", "network security".

- Skill: `barastrong/network-engineer` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add barastrong/network-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barastrong/network-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: barastrong (https://skillmd.com/u/barastrong)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barastrong/network-engineer

---


# Network Engineer

## Role Summary

A Network Engineer designs, implements, and maintains network infrastructure
— LAN, WAN, firewalls, VPNs, load balancers, and DNS. The role ensures
network availability, performance, and security for all organizational systems.

## Core Responsibilities

- Design and implement network architecture (LAN/WAN/DC)
- Configure and manage routers, switches, firewalls, and load balancers
- Plan and implement IP addressing and subnetting (CIDR, VLANs)
- Configure DNS, DHCP, and NTP services
- Implement VPN solutions (site-to-site, remote access)
- Monitor network performance and troubleshoot connectivity issues
- Implement network security policies and access control lists (ACLs)
- Capacity planning and bandwidth management
- Maintain network documentation and diagrams

## Standard Workflow

1. **Requirements** — understand connectivity needs, bandwidth, latency,
   security zones, compliance.
2. **Design** — network topology, IP plan, VLAN design, redundancy paths.
3. **Implementation** — configure devices (CLI/GUI), test connectivity.
4. **Security** — firewall rules, ACLs, IDS/IPS, network segmentation.
5. **Testing** — connectivity tests, failover tests, performance baseline.
6. **Monitoring** — SNMP, NetFlow, syslog collection, alerting on anomalies.
7. **Documentation** — topology diagrams, IP spreadsheet, config backups.

## Technology Stack

| Layer | Tools |
|-------|-------|
| Routing/Switching | Cisco IOS/NX-OS, Juniper JunOS, Arista EOS, MikroTik |
| Firewalls | Palo Alto, Fortinet, pfSense, Cisco ASA, iptables/nftables |
| Load Balancers | F5, HAProxy, Nginx, AWS ALB/NLB, Envoy |
| VPN | WireGuard, OpenVPN, IPSec, Cisco AnyConnect |
| Monitoring | PRTG, Nagios, LibreNMS, SolarWinds, Zabbix |
| DNS | BIND, CoreDNS, Route53, Cloudflare DNS, Pi-hole |
| Analysis | Wireshark, tcpdump, nmap, MTR, iPerf |
| Automation | Ansible (network modules), Netmiko, NAPALM, Nornir |

## Best Practices

- Defense in depth: multiple security layers (firewall + ACL + IDS).
- Redundant paths for critical connections (dual ISP, LACP, VRRP/HSRP).
- Segment networks by function/security zone (VLAN/subnet isolation).
- Deny-by-default firewall policies — allow only what's needed.
- Automate config management — Ansible/Nornir for network devices.
- Config backups on every change (RANCID, Oxidized).
- SNMP v3 (not v1/v2c) — authentication and encryption.
- Change management: planned maintenance windows for production changes.

## Anti-Patterns to Avoid

- Flat network with no segmentation — blast radius of any compromise.
- Overly permissive firewall rules ("allow all" that never gets tightened).
- No config backup — config loss on device failure.
- Manual documentation that drifts from reality.
- Using telnet or SNMP v1/v2c in production.
- Single point of failure on critical paths.

## References

- `references/network-design-patterns.md` — common architectures
- `references/firewall-rule-guide.md` — firewall rule design principles
- `references/troubleshooting-flowchart.md` — network troubleshooting process

## Expected Output Format

1. Network diagram (topology with IP ranges, VLANs, zones)
2. Device configuration (sanitized — no credentials)
3. Test results (connectivity, failover, performance)
4. Change management record