Networking / Advanced: policy, evidence, capacity, and resilient design / Lesson 14

Design routing and reason about convergence

Separate learned reachability, installed forwarding, traffic distribution, and failure recovery when choosing a routing architecture.

About 4 min readContent reviewed 2026-10-25

On this page

Lesson goals

Compare static routing, OSPF, and BGP responsibilities without universal tuning rules.
Explain longest-prefix forwarding, ECMP, and bounded convergence models.

A learned route is not the same as working forwarding

The control plane learns or configures reachability and selects routes according to protocol and policy. The forwarding plane uses installed entries to move packets. A healthy routing session does not prove that the expected prefix was accepted, selected, installed, or usable toward the next hop. Static routes avoid a dynamic exchange but still depend on valid next-hop resolution and failure detection. Distinguish intended policy, candidate routes, selected routes, and effective forwarding when describing evidence. A route visible in one table is only one milestone in that chain.

Choose protocols for administrative and failure boundaries

OSPF is a link-state interior routing protocol; routers derive paths from their topology information within the defined area design. BGP exchanges reachability with path attributes and applies policy, commonly across autonomous-system boundaries and also within larger networks. They solve related but different problems, and neither implies one universal convergence speed. Consider topology scale, ownership, summarization, policy needs, operational skill, and failure scope. A small stable edge may suit a reviewed static route, while another design requires dynamic learning and carefully controlled advertisement.

Forwarding uses the most specific matching prefix

The following offline lookup assumes the candidate entries are already installed and usable. It selects the longest matching prefix rather than comparing every route’s cost as if all prefixes competed equally. Real route selection also includes protocol-specific policy and implementation rules before forwarding. Administrative preference, OSPF cost, and BGP attributes are not interchangeable universal metrics. Keeping selection and lookup distinct explains why a more specific route can redirect a subset of traffic despite an attractive aggregate route.

python Perform a synthetic longest-prefix lookup

from ipaddress import ip_address, ip_network
routes = [
    (ip_network('0.0.0.0/0'), 'edge-A'),
    (ip_network('198.51.100.0/24'), 'core-A'),
    (ip_network('198.51.100.128/25'), 'core-B'),
]
destination = ip_address('198.51.100.200')
matches = [(prefix, hop) for prefix, hop in routes if destination in prefix]
prefix, hop = max(matches, key=lambda route: route[0].prefixlen)
print(f'{destination} -> {hop} via {prefix}')

Expected output

198.51.100.200 -> core-B via 198.51.100.128/25

The destination belongs to both the /24 and /25, so the /25 wins. The code reads fixed data and does not inspect or alter a host route table. It does not implement BGP or OSPF route selection.

Equal-cost paths need flow and failure reasoning

ECMP can distribute traffic among eligible equal-cost next hops, often using a flow-based hash. It does not guarantee equal byte volumes, because flows have different sizes and hash distributions. Changing the eligible set may remap flows, and packet-by-packet distribution can introduce reordering unless the design accounts for it. Two next hops also may share one power supply, transit link, or upstream dependency. Count independent failure domains rather than treating two entries or two visible cables as proof of resilient capacity.

Bound the recovery model and verify each stage

A failure may require detection, route recomputation or withdrawal propagation, and forwarding installation before traffic can use an alternative. Some stages overlap in real systems; the fixture below explicitly models three serial stages. Its numbers are assumptions, not measured OSPF or BGP behavior. Verify successful application recovery separately because stateful devices, retransmissions, and naming can extend the outage. A useful design states the failure being tolerated, expected recovery objective, remaining capacity, observation method, and rollback trigger rather than prescribing a universal timer.

python Calculate a declared serial recovery budget

stages_ms = {'detect': 200, 'recompute': 150, 'install': 50}
blackout_ms = sum(stages_ms.values())
failure_at_ms = 10000
print(f'modeled_blackout_ms={blackout_ms}')
print(f'modeled_forwarding_resume_ms={failure_at_ms + blackout_ms}')

Expected output

modeled_blackout_ms=400
modeled_forwarding_resume_ms=10400

The model totals 400 milliseconds and resumes forwarding at 10,400 milliseconds. It sends no probes and predicts no real protocol timer. Concurrent stages, unsuccessful alternatives, and application recovery are outside this deliberately bounded arithmetic.

Common errors and fixes

An established routing session is called complete reachability

Why it happens: Advertisement, selection, installation, and next-hop usability were conflated.
How to fix it: Verify the intended prefix through each stage and both traffic directions.
Prevent it next time: Define separate control-plane and forwarding acceptance evidence.

The lowest metric is chosen across unrelated prefix lengths

Why it happens: Route preference rules were mixed with longest-prefix forwarding lookup.
How to fix it: First identify the matching prefix and then the applicable selection context.
Prevent it next time: Test specific, aggregate, and default routes independently.

Two next hops are assumed to survive any single failure

Why it happens: Both alternatives depend on an unrecorded shared component or capacity limit.
How to fix it: Map shared dependencies and verify usable capacity after the stated failure.
Prevent it next time: Measure diversity by failure domain, not route count.

Check your understanding

1. Which next hop handles 198.51.100.70 in the lookup fixture?

Show worked solution

The address matches the /24 but not 198.51.100.128/25, so core-A is selected. The default route also matches but is less specific. This answer assumes all declared entries are installed and usable; it says nothing about actual interface or neighbor state.

2. Does the 400-millisecond fixture establish a service recovery guarantee?