Network Backbone Architect
When NOT to Use
- REST/GraphQL, ESB, or enterprise application integration design →
enterprise-integration-api-developer
- Cloud Well-Architected, landing zone, and managed VPC/service selection →
cloud-architect, enterprise-cloud-architect
- Day-two cloud resource configuration (subnets, LB, managed VPN to cloud) →
cloud-engineer
- Cloud security guardrails, CSPM, and cloud IAM as primary deliverable →
cloud-security-engineer
- Host firewall, endpoint, and corporate security control catalog →
information-security-engineer
- OS patching, VM admin, and cloud instance operations →
cloud-system-administrator
- Terraform modules, CI/CD, and K8s platform delivery without backbone routing design →
infrastructure-engineer
- SLO programs, on-call, and incident response as the main task →
site-reliability-engineer
- Cross-domain system ADRs unrelated to routing →
senior-system-architecture
- Application throughput, caching, and horizontal scale without L3 design →
high-concurrency-scalability
- Event bus and messaging topology only →
event-driven-architecture
- OT/ICS segmentation, Purdue model, and plant protocols →
scada-ics-cyber-security-specialist
Related skills
| Need |
Skill |
| Cloud reference architecture and hybrid connectivity hooks |
cloud-architect |
| Enterprise cloud governance and multi-BU landing zones |
enterprise-cloud-architect |
| Implement cloud networking and managed connectivity |
cloud-engineer |
| Cloud network security controls and posture |
cloud-security-engineer |
| IaC, physical DC build, and platform delivery |
infrastructure-engineer |
| Reliability engineering, SLOs, and production incidents |
site-reliability-engineer |
| Enterprise system architecture across domains |
senior-system-architecture |
| Application-scale concurrency and load distribution |
high-concurrency-scalability |
| Async messaging and event-driven integration |
event-driven-architecture |
Core Workflows
1. Scope, constraints, and design principles
Clarify scale (sites, regions, carriers), traffic matrix, RTO/RPO for paths, and regulatory or sovereignty constraints.
See references/network_backbone_architect_scope.md.
2. Topology, hierarchy, and addressing
Define core/distribution/edge roles, summarization boundaries, and IP/VLAN/VRF plan.
See references/topology_hierarchy_and_addressing.md.
3. Routing protocols and policy
Select IGP (OSPF, IS-IS) and BGP design—peering, communities, path selection, and filtering.
See references/routing_igp_bgp_and_policy.md.
4. WAN, MPLS, and SD-WAN
Architect carrier services, underlay/overlay, hub-spoke vs full mesh, and SLA alignment.
See references/wan_mpls_sdwan_and_carriers.md.
5. DCI, peering, and internet edge
Design data center interconnect, IX/transit/peering, and anycast or multi-homing at the edge.
See references/dci_peering_and_internet_edge.md.
6. Resilience, QoS, capacity, and operations
Plan redundancy, BFD/FRR, backbone QoS, link sizing, change windows, and observability.
See references/resilience_qos_capacity_operations.md.
Outputs
- Backbone context — sites, traffic matrix, critical flows, and failure domains
- Logical topology — hierarchy, VRFs, summarization points, and DCI attachment
- Routing design — IGP areas/levels, BGP AS plan, policies, and community/tag semantics
- WAN/SD-WAN architecture — underlay, overlay, hub roles, and carrier map
- Internet edge brief — peering vs transit, IX placement, prefix origination, and filtering
- Resilience and QoS matrix — ECMP, BFD, FRR, DSCP classes, and maintenance domains
- Capacity model — link sizing assumptions, growth headroom, and trigger thresholds
- Observability plan — flow telemetry, SNMP/telemetry targets, and backbone dashboards
Principles
- Hierarchy before complexity — aggregate at core; keep edge policies simple
- Explicit failure domains — maintenance windows and blast radius per region or plane
- Policy at the edge — filter and tag at borders; keep core transit predictable
- Measure before oversizing — size links from busy-hour matrices and growth, not peak anecdotes
- Prefer L3 DCI — stretch L2 only with documented operational cost and risk
- Document one-way doors — ASN allocation, summarization boundaries, and peering contracts
1---2name: network-backbone-architect3description: Design carrier- and enterprise-scale backbone networks—core/distribution/edge topology, OSPF, IS-IS, BGP and route policy, WAN/MPLS/SD-WAN, DCI, peering, transit, IX, anycast, ECMP, BFD, FRR, addressing, backbone QoS, capacity, maintenance domains, and observability (NetFlow, SNMP, telemetry); EVPN/VXLAN spine-leaf where relevant. This skill should be used when the user asks about network backbone, backbone architect, BGP design, OSPF, IS-IS, WAN architecture, MPLS, SD-WAN, data center interconnect, DCI, internet peering, transit provider, IX, core network design, route policy, ECMP, network redundancy, spine-leaf, or EVPN—not app HTTP/API (enterprise-integration-api-developer), cloud landing zone or VPC only (cloud-architect, enterprise-cloud-architect), host or endpoint security (information-security-engineer), cloud/Linux sysadmin (cloud-system-administrator), cabling without routing (infrastructure-engineer), or OT/ICS (scada-ics-cyber-security-specialist).4---56# Network Backbone Architect78## When NOT to Use910- REST/GraphQL, ESB, or enterprise application integration design → `enterprise-integration-api-developer`11- Cloud Well-Architected, landing zone, and managed VPC/service selection → `cloud-architect`, `enterprise-cloud-architect`12- Day-two cloud resource configuration (subnets, LB, managed VPN to cloud) → `cloud-engineer`13- Cloud security guardrails, CSPM, and cloud IAM as primary deliverable → `cloud-security-engineer`14- Host firewall, endpoint, and corporate security control catalog → `information-security-engineer`15- OS patching, VM admin, and cloud instance operations → `cloud-system-administrator`16- Terraform modules, CI/CD, and K8s platform delivery without backbone routing design → `infrastructure-engineer`17- SLO programs, on-call, and incident response as the main task → `site-reliability-engineer`18- Cross-domain system ADRs unrelated to routing → `senior-system-architecture`19- Application throughput, caching, and horizontal scale without L3 design → `high-concurrency-scalability`20- Event bus and messaging topology only → `event-driven-architecture`21- OT/ICS segmentation, Purdue model, and plant protocols → `scada-ics-cyber-security-specialist`2223## Related skills2425| Need | Skill |26|---|---|27| Cloud reference architecture and hybrid connectivity hooks | `cloud-architect` |28| Enterprise cloud governance and multi-BU landing zones | `enterprise-cloud-architect` |29| Implement cloud networking and managed connectivity | `cloud-engineer` |30| Cloud network security controls and posture | `cloud-security-engineer` |31| IaC, physical DC build, and platform delivery | `infrastructure-engineer` |32| Reliability engineering, SLOs, and production incidents | `site-reliability-engineer` |33| Enterprise system architecture across domains | `senior-system-architecture` |34| Application-scale concurrency and load distribution | `high-concurrency-scalability` |35| Async messaging and event-driven integration | `event-driven-architecture` |3637## Core Workflows3839### 1. Scope, constraints, and design principles4041Clarify scale (sites, regions, carriers), traffic matrix, RTO/RPO for paths, and regulatory or sovereignty constraints.4243**See `references/network_backbone_architect_scope.md`.**4445### 2. Topology, hierarchy, and addressing4647Define core/distribution/edge roles, summarization boundaries, and IP/VLAN/VRF plan.4849**See `references/topology_hierarchy_and_addressing.md`.**5051### 3. Routing protocols and policy5253Select IGP (OSPF, IS-IS) and BGP design—peering, communities, path selection, and filtering.5455**See `references/routing_igp_bgp_and_policy.md`.**5657### 4. WAN, MPLS, and SD-WAN5859Architect carrier services, underlay/overlay, hub-spoke vs full mesh, and SLA alignment.6061**See `references/wan_mpls_sdwan_and_carriers.md`.**6263### 5. DCI, peering, and internet edge6465Design data center interconnect, IX/transit/peering, and anycast or multi-homing at the edge.6667**See `references/dci_peering_and_internet_edge.md`.**6869### 6. Resilience, QoS, capacity, and operations7071Plan redundancy, BFD/FRR, backbone QoS, link sizing, change windows, and observability.7273**See `references/resilience_qos_capacity_operations.md`.**7475## Outputs7677- **Backbone context** — sites, traffic matrix, critical flows, and failure domains78- **Logical topology** — hierarchy, VRFs, summarization points, and DCI attachment79- **Routing design** — IGP areas/levels, BGP AS plan, policies, and community/tag semantics80- **WAN/SD-WAN architecture** — underlay, overlay, hub roles, and carrier map81- **Internet edge brief** — peering vs transit, IX placement, prefix origination, and filtering82- **Resilience and QoS matrix** — ECMP, BFD, FRR, DSCP classes, and maintenance domains83- **Capacity model** — link sizing assumptions, growth headroom, and trigger thresholds84- **Observability plan** — flow telemetry, SNMP/telemetry targets, and backbone dashboards8586## Principles8788- **Hierarchy before complexity** — aggregate at core; keep edge policies simple89- **Explicit failure domains** — maintenance windows and blast radius per region or plane90- **Policy at the edge** — filter and tag at borders; keep core transit predictable91- **Measure before oversizing** — size links from busy-hour matrices and growth, not peak anecdotes92- **Prefer L3 DCI** — stretch L2 only with documented operational cost and risk93- **Document one-way doors** — ASN allocation, summarization boundaries, and peering contracts
daemon-blockint-tech