Building an OOB network#

Phil Mawson, Vocus

• Why: The management plane is what saves you when the data plane is down — this is a multi-year, build-it-again carrier case study with real design decisions, prompted by exactly the class of outage (Optus AS7474 national outage, November 2023; Meta, October 2021) that makes OOB non-negotiable.
• What: Vocus' consolidation of many inherited bespoke OOB solutions into a dedicated national OOB MPLS network, built alongside a new zero-touch-provisioned aggregation network.
• How: Key rules: OOB must not rely on any founder IP network; per-state regions with route-reflector pairs; OSPF as IGP; own transmission interstate with diverse paths and metro dark-fiber rings. Equipment: Juniper ACX7024/SRX345 routers, EX3400/4100 switches, Opengear console servers. International sites use Megaport Layer-2 VXC back to an Australian headend (cheaper than 10G waves). Extras worth stealing: a third-party transit VPN concentrator as break-glass if AS4826 dies entirely, geographically diverse bastion hosts in three cities, and printed break-glass local credentials locked away for when your auth servers are unreachable.
• Where applicable: Vocus-specific in its parts list and assumptions (they own Australian transmission), but the design principles — independence from the production network, geographic diversity, break-glass auth — transfer to any operator or large DC operator. Budget math differs if you must buy OOB transport.