# Network Backbone Architect

> Design carrier- and enterprise-scale backbone networks—core/distribution/edge topology, OSPF, IS-IS, BGP and route policy, WAN/MPLS/SD-WAN, DCI, peering, transit, IX, anycast, ECMP, BFD, FRR, addressing, backbone QoS, capacity, maintenance domains, and observability (NetFlow, SNMP, telemetry); EVPN/VXLAN spine-leaf where relevant. This skill should be used when the user asks about network backbone, backbone architect, BGP design, OSPF, IS-IS, WAN architecture, MPLS, SD-WAN, data center interconnect, DCI, internet peering, transit provider, IX, core network design, route policy, ECMP, network redundancy, spine-leaf, or EVPN—not app HTTP/API (enterprise-integration-api-developer), cloud landing zone or VPC only (cloud-architect, enterprise-cloud-architect), host or endpoint security (information-security-engineer), cloud/Linux sysadmin (cloud-system-administrator), cabling without routing (infrastructure-engineer), or OT/ICS (scada-ics-cyber-security-specialist).

- Skill: `daemon-blockint-tech/network-backbone-architect` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/network-backbone-architect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/network-backbone-architect/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/network-backbone-architect

---


# Network Backbone Architect

## When NOT to Use

- REST/GraphQL, ESB, or enterprise application integration design → `enterprise-integration-api-developer`
- Cloud Well-Architected, landing zone, and managed VPC/service selection → `cloud-architect`, `enterprise-cloud-architect`
- Day-two cloud resource configuration (subnets, LB, managed VPN to cloud) → `cloud-engineer`
- Cloud security guardrails, CSPM, and cloud IAM as primary deliverable → `cloud-security-engineer`
- Host firewall, endpoint, and corporate security control catalog → `information-security-engineer`
- OS patching, VM admin, and cloud instance operations → `cloud-system-administrator`
- Terraform modules, CI/CD, and K8s platform delivery without backbone routing design → `infrastructure-engineer`
- SLO programs, on-call, and incident response as the main task → `site-reliability-engineer`
- Cross-domain system ADRs unrelated to routing → `senior-system-architecture`
- Application throughput, caching, and horizontal scale without L3 design → `high-concurrency-scalability`
- Event bus and messaging topology only → `event-driven-architecture`
- OT/ICS segmentation, Purdue model, and plant protocols → `scada-ics-cyber-security-specialist`

## Related skills

| Need | Skill |
|---|---|
| Cloud reference architecture and hybrid connectivity hooks | `cloud-architect` |
| Enterprise cloud governance and multi-BU landing zones | `enterprise-cloud-architect` |
| Implement cloud networking and managed connectivity | `cloud-engineer` |
| Cloud network security controls and posture | `cloud-security-engineer` |
| IaC, physical DC build, and platform delivery | `infrastructure-engineer` |
| Reliability engineering, SLOs, and production incidents | `site-reliability-engineer` |
| Enterprise system architecture across domains | `senior-system-architecture` |
| Application-scale concurrency and load distribution | `high-concurrency-scalability` |
| Async messaging and event-driven integration | `event-driven-architecture` |

## Core Workflows

### 1. Scope, constraints, and design principles

Clarify scale (sites, regions, carriers), traffic matrix, RTO/RPO for paths, and regulatory or sovereignty constraints.

**See `references/network_backbone_architect_scope.md`.**

### 2. Topology, hierarchy, and addressing

Define core/distribution/edge roles, summarization boundaries, and IP/VLAN/VRF plan.

**See `references/topology_hierarchy_and_addressing.md`.**

### 3. Routing protocols and policy

Select IGP (OSPF, IS-IS) and BGP design—peering, communities, path selection, and filtering.

**See `references/routing_igp_bgp_and_policy.md`.**

### 4. WAN, MPLS, and SD-WAN

Architect carrier services, underlay/overlay, hub-spoke vs full mesh, and SLA alignment.

**See `references/wan_mpls_sdwan_and_carriers.md`.**

### 5. DCI, peering, and internet edge

Design data center interconnect, IX/transit/peering, and anycast or multi-homing at the edge.

**See `references/dci_peering_and_internet_edge.md`.**

### 6. Resilience, QoS, capacity, and operations

Plan redundancy, BFD/FRR, backbone QoS, link sizing, change windows, and observability.

**See `references/resilience_qos_capacity_operations.md`.**

## Outputs

- **Backbone context** — sites, traffic matrix, critical flows, and failure domains
- **Logical topology** — hierarchy, VRFs, summarization points, and DCI attachment
- **Routing design** — IGP areas/levels, BGP AS plan, policies, and community/tag semantics
- **WAN/SD-WAN architecture** — underlay, overlay, hub roles, and carrier map
- **Internet edge brief** — peering vs transit, IX placement, prefix origination, and filtering
- **Resilience and QoS matrix** — ECMP, BFD, FRR, DSCP classes, and maintenance domains
- **Capacity model** — link sizing assumptions, growth headroom, and trigger thresholds
- **Observability plan** — flow telemetry, SNMP/telemetry targets, and backbone dashboards

## Principles

- **Hierarchy before complexity** — aggregate at core; keep edge policies simple
- **Explicit failure domains** — maintenance windows and blast radius per region or plane
- **Policy at the edge** — filter and tag at borders; keep core transit predictable
- **Measure before oversizing** — size links from busy-hour matrices and growth, not peak anecdotes
- **Prefer L3 DCI** — stretch L2 only with documented operational cost and risk
- **Document one-way doors** — ASN allocation, summarization boundaries, and peering contracts