---
name: network-ipam-bgp-operations
description: Plan, inspect, validate, and operate IPAM, IPv4 and IPv6 prefixes, BGP sessions, routing policy, WireGuard tunnels, Proxmox SDN, VLAN/VXLAN, DNS and reverse DNS, UFW/nftables firewalls, and network automation. Use for mvnet, Lunexor hosting, Peer4Host, gregIPAM, rack planning, tunnel products, outage diagnosis, allocation conflict detection, and controlled network changes.
compatibility: Requires authoritative inventory and read access to routing and firewall state. Route, firewall, prefix, DNS, tunnel, or peering changes require a reviewed plan, rollback, lockout analysis, and explicit authorization.
license: Apache-2.0
---

# Network, IPAM and BGP operations

Use one source of truth for allocations and intent. Device configuration is observed state, not the authoritative inventory.

## Change workflow

1. Identify tenant, service, ASN, prefix, site, device and interface.
2. Read current IPAM, routing, firewall, DNS and tunnel state.
3. Detect overlaps, duplicate assignments, stale reservations and conflicting route advertisements.
4. Calculate the desired state and every affected device.
5. Produce a dry-run with exact additions, removals and policy-order changes.
6. Evaluate management-plane lockout, asymmetric routing, route leaks, MTU, RPKI and return-path effects.
7. Define rollback commands and an out-of-band access path.
8. Apply the smallest ordered change.
9. Verify control plane and data plane separately.
10. Update the source of truth and record evidence.

## BGP checks

- neighbor state, uptime and flap history;
- local/remote ASN and address family;
- accepted, advertised and rejected prefix counts;
- import/export filters and maximum-prefix limits;
- local preference, MED, communities and next hop;
- RPKI validity and origin consistency;
- route propagation from multiple observation points;
- graceful restart and BFD behavior where configured.

## Firewall checks

Explain the effective rule path, default policy, established-state behavior, interface direction, address family and ordering. Never append broad allow rules merely to make a test pass. Preserve SSH, VPN and management access before changing default policy.

## IPAM rules

Allocate only from an authoritative available pool. Record purpose, owner, status, parent prefix, VLAN/VRF, DNS, reverse DNS and lifecycle dates. Do not recycle addresses until deprovisioning and retention checks complete.

## DNS and rDNS

Treat forward and reverse changes as one transaction. Validate zone authority, TTL, DNSSEC where used, PTR ownership, propagation and service expectations before lowering or restoring TTL.

## Output

Return current state, desired state, conflicts, affected devices and prefixes, exact ordered plan, capability gate, lockout risk, rollback, verification probes, propagation expectations and source-of-truth updates.