# Senior Ne Runbook

> Run senior-network-engineer incident response from first page to RCA. Use when a SEV-1/2 hits BGP, WAN, DC fabric, or firewall and you need a timed, fail-closed playbook.

- Skill: `gesh75/senior-ne-runbook` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gesh75/senior-ne-runbook`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gesh75/senior-ne-runbook/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: gesh75 (https://skillmd.com/u/gesh75)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gesh75/senior-ne-runbook

---


# Senior NE runbook

Do not use for project design or CAB paperwork (use network-manager-cadence). Not for app-layer incidents.

## Procedure

1. Clock starts. Declare SEV, name an incident commander, open a war-room channel. No config yet.
2. Dual-signal: telemetry AND a human-reproducible symptom. One signal is not a change.
3. Scope: one site, one VRF, one prefix, or global. If global, page the manager.
4. Mitigate with the smallest reversible action (withdraw a prefix, fail over a color, shut a bad peer).
5. After restore: timeline, root cause, detection gap, and one prevention item. No blame.

```text
T+0   declare SEV-2  WAN site 2401  dual-color down
T+5   confirm BFD down both colors  circuit IDs collected
T+12  LTE backup carrying 40%  voice on-net degraded
T+25  ISP restores MPLS  failback  verify MOS
```

## Anti-patterns

- Never bounce BGP as the first step.
- Do not invite vendors before you have a packet capture or log excerpt.

## Safety

Mitigations are change-guarded unless the commander invokes emergency break-glass, which is logged.