Half 1 of a five-part collection on AI community design: constructing a production-grade sandbox community with Claude as a second architect within the room, not a software I queried for information. The remainder of the collection: Half 2 – The Cloth Claude Designed; Half 3 – Why I Let Claude Discuss Me Out of Its Personal Design; Half 4 – From Whiteboard to Rack; Half 5 – The Outage Claude Recognized in Minutes.
I’ll be upfront about the place I began: skeptical. In a single brief AI community design assessment, Claude caught a cabling mistake I used to be about to make, and some questions later, two routers I’d budgeted for had grow to be spares.
I used to be constructing a sandbox community with actual Cisco firewalls, actual edge routers, and an actual Nexus switching cloth: the form of gear that prices actual cash and doesn’t get re-cabled on a whim. I’d used AI chatbots lots for drafting and summarizing, however I didn’t anticipate one to push again on an enterprise community topology. At greatest, I figured, it will politely agree and recite a spec sheet again at me.
So earlier than I ran a single cable, I opened a chat with Claude, laid out my full topology, and requested the best doable query: Is that this a legitimate setup?
The plan: Firewalls, routers, and a Nexus cloth
My plan was two Cisco Safe Firewall 3100 home equipment working Safe Firewall Menace Protection (FTD) for the web edge, two Cisco C8475-G2 Safe Routers (Cisco 8400 Sequence) behind them for edge connectivity, and a two-tier Nexus cloth beneath: Cisco Nexus 93600CD-GX switches as spines, Cisco Nexus 93180YC-FX switches as leaves. On paper it learn cleanly: web, firewalls, routers, cloth, finished.
It checked the {hardware} earlier than it answered
Claude’s first transfer wasn’t an opinion on my design. It mentioned it needed to confirm one of many {hardware} fashions first, then went and looked for it.
That small transfer instructed me greater than I anticipated. It might have been trivial to nod alongside (“sure, that’s an inexpensive topology”), and I in all probability wouldn’t have questioned it. As a substitute it handled “do I truly know this field” as a query value answering first, the identical intuition I’d need from a colleague reviewing my work reasonably than agreeing to be agreeable.
The {hardware} checked out: the C8475-G2 is a authentic, pretty latest platform, a part of Cisco’s 8400 Sequence Safe Routers. The issue was elsewhere.
The catch: Spines ought to join solely to leaves
Right here’s roughly the way it went:
Me: I’ve two FTDs for web, two C8475 routers behind them, then 93600 spines and 93180 leaves.
Claude: The gear all checks out, and the general form is sound, however there are two issues I’d change. In a spine-leaf cloth, spines ought to join solely to leaves. Nothing else (no servers, no firewalls, no WAN routers) attaches to a backbone. Exterior connectivity is available in by means of devoted border leaves as an alternative. Connecting your routers to the spines breaks that.
I sat with that for a second, as a result of my diagram hadn’t felt unsuitable after I drew it. “Routers are the sting, spines are the highest of the material, edge plugs into high” appeared like an inexpensive psychological shortcut.
Claude was describing Cisco’s advisable follow: spines join solely to leaves, and the Cisco VXLAN BGP EVPN design information places exterior connections on border leaves. Border spines are supported, however they complicate scaling.
My format broke the one property that lets a Clos cloth scale cleanly. Spines keep pure transit, carrying zero exterior state, so including cloth capability later by no means means touching backbone config. Dangle a router on a backbone and each future backbone inherits that exception.
Claude backed this up with one thing I may examine in 30 seconds: the C8475-G2 tops out at 25G per port (SFP28), whereas the 93600 backbone ports are QSFP (40/100G, plus 400G). Wiring them straight meant breakout cables or adapters simply to carry up a hyperlink. In hindsight, that was a bodily trace the 2 bins have been by no means meant to speak level to level.
The repair was easy as soon as it was named: transfer the routers and firewalls onto a devoted border-leaf pair, and let the spines return to doing nothing however backbone issues. A five-minute dialog saved me from cabling a mistake that might have been annoying to unwind as soon as racked.
The topology after the primary repair: the firewalls join by means of a border-leaf pair, and the spines join solely to leaves.
The query that mattered greater than the repair
That is what modified how I considered the remainder of the venture. Claude didn’t cease at “mounted your diagram, you’re welcome.” It requested a query I hadn’t answered for myself:
Claude: What are the routers truly for? “Community edge connectivity” may imply a WAN/SD-WAN headend for distant websites and a number of ISPs, which is what this {hardware} is constructed for, or it may simply imply an additional hop behind firewalls which are already doing NAT and inspection. These are totally different jobs, they usually result in totally different topologies.
I didn’t have a crisp reply. I’d inherited “routers behind firewalls” as a form with out interrogating why. It’s a sample I’d see many times on this venture: essentially the most helpful factor Claude did wasn’t correcting my diagram; it was refusing to let a imprecise requirement slide by unexamined.
One sure/no query modified the structure
Over the subsequent change, I clarified: the routers wouldn’t run BGP, the firewalls simply wanted a default route from the ISP, and the material would use traditional VLANs reasonably than an overlay. That raised one other query I hadn’t thought by means of: If the routers aren’t doing BGP, have been they purported to personal inter-VLAN routing for the material?
Claude’s reply was blunt and backed by actual numbers: no. Each Nexus switches are full Layer 3 switches that route in {hardware} at line charge, whereas the routers high out at roughly 91 Gbps, the utmost forwarding charge within the Cisco 8400 Sequence Safe Routers knowledge sheet.
Put the material’s gateways on the routers and each inter-VLAN packet (a lot of the site visitors in a compute atmosphere) leaves the material, hairpins by means of that bottleneck, and comes again. The switches ought to route; the routers, in the event that they’re wanted in any respect, maintain a northbound default and nothing extra.
Then got here the fork that determined all the pieces downstream: Did my VLANs have to stay on a couple of leaf? Basic VLANs can’t stretch throughout a routed spine-leaf cloth with out an overlay, so the reply would resolve between a routed-access Clos design and a two-tier aggregation/entry design.
I confirmed: sure, they wanted to span. Claude’s conclusion was plain: the material wasn’t actually a spine-leaf design anymore. It was a two-tier vPC design.
With out the Layer 3 job I’d implicitly assigned them, the routers had nothing left within the knowledge path. Preserve them as spares, or for a future WAN want. Not thrown away. Simply not doing something at the moment.
What this primary change taught me about AI community design
I went in anticipating a fast examine. What I obtained was one thing nearer to a design assessment from somebody who refused to let “it appears to be like proper” stand in for “I checked why it’s proper.”
Two bins I’d budgeted for as core infrastructure turned out to be spares earlier than I’d spent a greenback on cabling. That’s the form of catch that’s low cost in a chat window and costly in an information middle.
What this spherical made clear to me:
- Ask for a assessment, not a reality. Give the agent the entire design and an open query. assessment doesn’t simply repair the diagram; it asks what you have been truly making an attempt to construct.
- Make it confirm, then confirm it. Claude checked the half quantity earlier than opining, and I confirmed its port-speed argument in 30 seconds. That behavior is value having in an individual or a software.
- Reply its questions exactly. Essentially the most consequential query on this venture, do the VLANs have to span a couple of leaf, was one sentence lengthy, and I hadn’t thought to ask it of myself.
Earlier than you rack something, strive the identical AI community design assessment by yourself topology.
We’d landed on a two-tier vPC design as a result of it match the necessities I’d truly acknowledged. However I needed to know what I’d surrender by skipping an overlay on day one, so within the subsequent dialog I requested Claude to design that model too. Half 2 is that cloth: the one we designed in full, and in the end didn’t construct.