This free browser-based simulator lets you build IP network topologies, configure routing protocols, and observe how packets actually travel through your network. Add routers, L3 switches, and hosts; connect them with links; assign IP addresses; then run OSPF SPF convergence, IS-IS L1/L2 adjacency formation, BGP best-path selection, MPLS LDP label distribution, SR-MPLS segment forwarding, SR-TE explicit path steering, MPLS L3VPN with VRF isolation, or EVPN/VXLAN leaf-spine fabric — all in your browser. The simulator implements real protocol math — Dijkstra SPF for OSPF and IS-IS, RFC 4271 best-path for BGP, LDP label binding for MPLS, SRGB-based label allocation for SR-MPLS, SR-TE segment list resolution to label stacks, RT-based VPN route import/export for L3VPN, and VTEP peer discovery for EVPN — so the routing tables, LFIB entries, VRF routes, and EVPN BGP tables you see are correct, not simplified guesses.
• Topology builder — drag-and-drop routers, L3 switches, L2 switches, and hosts. Connect devices in any topology: linear chain, hub-and-spoke, ring, full mesh, or three-tier campus. • IP addressing — configure IPv4 address and subnet mask per interface. Interfaces turn green when configured, amber when unconfigured, red when shut down. • OSPF — enable OSPF per device, configure network statements (network <net> <wildcard> area <area>), click Run OSPF to converge all routing tables via Dijkstra SPF. Supports multi-area OSPF with ABRs that generate Type 3 Summary LSAs. Inter-area routes appear as O IA in the routing table. • IS-IS — assign a NET address (e.g., 49.0001.0000.0000.0001.00) and level (L1, L2, or L1L2) per router. Click Run IS-IS to parse NETs, form L1 adjacencies within each area, form L2 adjacencies across areas, and run Dijkstra on both topology databases. L1L2 routers act as ABRs and leak L1 prefixes into the L2 backbone. Routes install as I (L1, AD 115) and i (L2, AD 115). • BGP — enable BGP per router, set the AS number, add eBGP or iBGP neighbors by IP and remote ASN. Configure next-hop-self for iBGP transit. Mark neighbors as route-reflector-client to eliminate full iBGP meshes: the Route Reflector reflects client routes to all other clients and to non-clients. Redistribute connected, OSPF, or static routes. Click Run BGP to propagate routes and run 8-step RFC 4271 best-path selection. View the RIB in the BGP tab or via 'show ip bgp'. • MPLS LDP — enable LDP per device, click Run MPLS to build the Label Information Base (LIB), exchange bindings with neighbors, and compute the LFIB. PHP is applied automatically at the penultimate hop. View LFIB and LIB in the MPLS tab. • SR-MPLS — enable Segment Routing per router, set the Node-SID. The simulator assigns labels from the SRGB (base 16000, size 8000), so Node-SID 1 → label 16001. Adj-SIDs are auto-allocated from 24000+. Click Run SR to build the LFIB: transit routers SWAP labels; the last-hop performs PHP/POP. View the LFIB and Adj-SID table in the SR-MPLS tab or via 'show segment-routing mpls forwarding-table'. • SRv6 — configure a per-device locator (an IPv6 /48 prefix, e.g., fc00:1::/48). The simulator derives End SIDs (node endpoints) and End.X SIDs (adjacency endpoints, one per outgoing interface) from the locator. View SIDs in the SRv6 tab or via 'show segment-routing srv6 sid'. • SR-TE (Traffic Engineering) — define policies on a head-end router: give each policy a name, color (numeric identifier), endpoint IP, and segment list (ordered Node-SID indices). Run SR-TE to resolve each SID to its MPLS label (SRGB_base + SID), build the full label stack, and look up the first-hop next-hop. A binding SID is assigned per policy. View in the SR-TE tab or via 'show segment-routing traffic-eng policy'. • MPLS L3VPN (VRF) — create VRF instances on PE routers with a Route Distinguisher (e.g., 65000:100) and RT-export/import values. Assign interfaces to VRFs. Run L3VPN to build VRF routing tables (connected + CE-peer routes with VPN labels from 200000+) and perform RT-based inter-PE route exchange. Remote VPN routes appear as proto V. View in the VRF tab or via 'show bgp vpnv4 unicast all'. • EVPN/VXLAN — enable EVPN on leaf switches, set EVI, VNI, and VTEP loopback IP. Run EVPN to generate Type-2 MAC/IP routes (one per connected host) and Type-5 IP prefix routes, then discover VTEP peers via underlay reachability and import their routes. View in the EVPN tab or via 'show bgp l2vpn evpn' and 'show nve peers'. • Route-map engine — define named route-maps with ordered clauses (seq permit/deny). Match conditions: ip address prefix-list, as-path regex, community string. Set actions: local-preference, metric (MED), weight, community (add or delete), next-hop. Assign per BGP neighbor as in-filter (applied on receipt) or out-filter (applied before advertisement). Policy tab shows all prefix-lists, route-map clauses with match/set detail, and neighbor filter assignments. • BGP community propagation — every BGP route carries a communities array. Inbound route-maps merge community tags (e.g. 65001:100). Use 'show ip bgp community' to filter routes by community. • VRRP — configure Virtual Router groups with virtual IP, priority, and preemption. Interface tracking: specify trackIface and trackDecrement; effective priority = base − decrement when the tracked interface is down. VRRP election re-runs on effective priorities, enabling automatic failover (preemption) when an upstream link fails. • PIM-SM multicast — enable PIM-SM per device. (*,G) shared tree: OIL = PIM neighbors minus RPF interface toward RP. (S,G) shortest-path tree: OIL excludes RPF interface toward source. Multicast tab shows both tree types with group, RP, RPF interface, OIL, and age. CLI: 'show ip pim rp mapping'. • Static routes — add ip route entries with destination, prefix length, next-hop, and administrative distance. • Simulated ping and traceroute — follow routing tables hop-by-hop. Detects routing loops, black holes, and unreachable destinations. • Link control — toggle links up/down, change bandwidth (10M to 100G), set per-interface OSPF cost. OSPF and IS-IS reconverge automatically after link state changes. • Realistic CLI — Show Cmds tab: show ip route, show ip bgp, show ip bgp summary, show ip bgp neighbors, show route-map, show ip bgp community, show ip pim rp mapping, show isis neighbors, show isis database, show clns protocol, show segment-routing mpls forwarding-table, show segment-routing srv6 sid, show segment-routing traffic-eng policy, show bgp vpnv4 unicast all, show bgp l2vpn evpn, show nve peers, show evpn evi, show mpls forwarding-table, show mpls ldp bindings, show interfaces, show running-config. Each vendor uses native interface naming.
OSPF / Static: • Linear 3-Router OSPF — R1–R2–R3 with loopbacks and /30 transit links. Try pinging R3's loopback from R1, then bring down R1-R2 and watch OSPF reconverge. • Hub & Spoke, Ring, Redundant Core — explore OSPF path selection and redundancy. • Multi-Area OSPF — R2 and R3 as ABRs between Area 0, Area 1, and Area 2. Select an ABR → Routes tab to see O IA entries generated by Type 3 Summary LSAs. • Static Routing Demo — three routers, no OSPF, all routes manually configured.
IS-IS: • IS-IS L2 Backbone — four routers all running IS-IS Level 2. Every router sees the full L2 topology. Run IS-IS, then select any router → IS-IS tab to see adjacencies and → Routes tab for i routes. • IS-IS Multi-Area — R1 and R4 are L1-only in Area 49.0001; R3 is L2-only; R2 is an L1L2 ABR. R2 leaks L1 prefixes into L2 so R3 can reach Area 49.0001 subnets. Inspect I vs i routes on R2.
BGP: • eBGP Two-AS Peering — R1 (AS 65001) and R2 (AS 65002) exchange routes via eBGP. Redistribute connected subnets and run 'show ip bgp' to see AS-path attributes. • BGP Transit ISP — CE1 (AS 65001) and CE2 (AS 65002) connected via an ISP (AS 65000) with two PE routers running iBGP with next-hop-self. • BGP Route Reflector — one RR and three RR-clients all in AS 65001. No full iBGP mesh: the RR reflects client prefixes to all other clients. Check RR-client badges in the BGP tab.
Segment Routing: • SR-MPLS Ring — four routers in a ring with OSPF + SR-MPLS. Node-SIDs 1–4 map to labels 16001–16004. Select R1 → SR-MPLS tab for LFIB (SWAP/PHP entries) and Adj-SIDs. Switch to the SRv6 tab to see End/End.X SIDs derived from each router's locator prefix.
MPLS: • MPLS LDP Core — PE1–P1–P2–PE2 all running OSPF + LDP. P1 swaps labels; PE1 and PE2 perform PHP. Select P1 → MPLS tab to see the LFIB. • ISP BGP + MPLS Backbone — CE1/CE2 on eBGP, PE1/PE2 on iBGP (next-hop-self), core P router runs OSPF + MPLS only. Demonstrates a realistic ISP BGP/MPLS architecture.
SR-TE / L3VPN / EVPN: • SR-TE Explicit Path — four-router ring (R1–R2–R3–R4). R1 has two SR-TE policies both targeting R3: color 10 via R2 (segment list [2,3] → label stack [16002,16003]) and color 20 via R4 (segment list [4,3] → label stack [16004,16003]). Run OSPF → Run SR → Run SR-TE to compute. Select R1 → SR-TE tab or use 'show segment-routing traffic-eng policy' in the CLI. • L3VPN — 2 Customer VRFs — CE1–PE1–P–PE2–CE2. PE1 and PE2 run OSPF + LDP for the core. VRF-A spans both PEs (RD 65000:100, RT 65000:100) so routes flow between them. VRF-B is isolated on PE1 only (no matching RT on PE2). Run OSPF → Run MPLS → Run L3VPN, then select PE1 → VRF tab or use 'show bgp vpnv4 unicast all'. • EVPN Leaf-Spine — Spine1 (underlay only) with Leaf1 (VTEP 10.0.0.2, hosts Host1/Host2 on 192.168.10.x) and Leaf2 (VTEP 10.0.0.3, hosts Host3/Host4 on 192.168.20.x). EVI 100, VNI 10100. Run OSPF → Run EVPN to discover peers and exchange Type-2 MAC/IP + Type-5 prefix routes. Select Leaf1 → EVPN tab or use 'show bgp l2vpn evpn' and 'show nve peers'.
Route Policy / VRRP / Multicast / SRv6 (Phase 5): • BGP Route-Map Policy (bgp_rmap) — R1 (AS 65001), R2 (AS 65002), R3 (AS 65003) in a three-router eBGP chain. R1 originates two prefixes: 172.16.100.0/24 and 172.16.200.0/24. R2 applies inbound route-map RMAP-IN on the R1 neighbor: seq 10 permit (match prefix-list PL-ACCEPT — permits 172.16.100.0/24 and 10.0.0.0/8 le 30; set local-pref 200, community 65001:100) and seq 100 deny (implicit deny-all). Result: R2 and R3 carry 172.16.100.0/24 with community 65001:100; 172.16.200.0/24 is filtered. Select R2 → Policy tab to view prefix-list and route-map clauses; CLI → show route-map / show ip bgp community. • VRRP with Interface Tracking (vrrp_track) — GW1 (priority 120, tracking GigabitEthernet0/2, decrement 30) and GW2 (priority 100) sharing virtual IP 192.168.10.254. GW1 is Master while GE0/2 is up (effective priority 120 > 100). Shut GE0/2 on GW1: effective priority drops to 90. Run VRRP: GW2 preempts and becomes Master (100 > 90). Select GW1 → VRRP tab to see tracked interface state and effective priority; GW2 → VRRP tab to confirm Master state. • SRv6 with IS-IS Underlay (srv6_isis) — four routers (R1–R4) running IS-IS Level 2 adjacencies as the underlay. Each router has a /48 SRv6 locator (fc00:1::/48, fc00:2::/48, fc00:3::/48, fc00:4::/48) with auto-derived End SID (::1, node endpoint) and End.X SIDs (adjacency endpoints per outgoing interface). Select any router → SRv6 tab to view the SID table; use the trace panel to simulate a 3-segment SRH path (e.g. fc00:2::1 → fc00:3::1 → fc00:4::1).
OSPF (RFC 2328) is a link-state routing protocol. Each router maintains a Link State Database (LSDB) describing the entire network topology. The SPF algorithm (Dijkstra) computes the shortest path tree from each router's perspective:
1. Each router generates a Router LSA advertising its interfaces and neighbors. 2. LSAs flood throughout the OSPF area so every router has an identical LSDB. 3. Each router independently runs Dijkstra from its own Router ID as the root. 4. The algorithm assigns tentative costs to neighbors, picks the lowest-cost unexplored node, expands it, and repeats until all nodes are reached. 5. The shortest-path tree gives each destination its total cost (metric) and the first-hop next-hop IP and outgoing interface. 6. Routing table entries are installed: O prefix/len [110/metric] via next-hop, outIface.
In multi-area OSPF, Area Border Routers (ABRs) generate Type 3 Summary LSAs that carry prefixes from one area into another. Routes learned from Type 3 LSAs are installed as O IA (OSPF inter-area) — displayed in lighter blue in the routing table and as 'O IA' in show ip route output.
IS-IS (ISO 10589) is a link-state IGP that uses a two-level hierarchy instead of OSPF areas. Key concepts:
• NET address — every IS-IS router has a Network Entity Title such as 49.0001.0000.0000.0001.00. The first variable-length field is the Area ID (49.0001), the next 6 bytes are the System-ID (used like a Router-ID), and the final byte (00) is always the NSEL. • Levels — L1 routers only form adjacencies within their area. L2 routers form adjacencies across areas (backbone). L1L2 routers do both and act as Area Border Routers, leaking L1 prefixes into the L2 topology database as Type 2 TLVs. • Adjacency rules — L1 adjacency: both routers must be in the same IS-IS area and neither can be L2-only. L2 adjacency: at least one router must be L2 or L1L2, regardless of area. • SPF — the simulator runs Dijkstra separately on the L1 topology (per area) and the L2 topology (global). Routes from L1 SPF install as I (AD 115); routes from L2 SPF install as i (AD 115). • CLI — show isis neighbors (adjacency table with level and state), show isis database (LSDB with LSP IDs), show clns protocol (area address, level, system-id).
SR-TE (Segment Routing Traffic Engineering): SR-TE steers traffic via an explicit ordered segment list, bypassing the IGP shortest path. Each policy has a color (numeric ID to distinguish multiple policies to the same endpoint), an endpoint IP, and a segment list of Node-SID indices. The simulator resolves each SID index to its MPLS label (SRGB_base + SID) and builds the full label stack. The head-end router pushes the stack; each transit router pops the top label and forwards. A binding SID is allocated per policy for external steering. The SR-TE tab shows all configured policies and their computed label stacks and next-hops. CLI: show segment-routing traffic-eng policy.
MPLS L3VPN (VRF): L3VPN isolates customer routing tables from the provider core. Each VRF on a Provider Edge (PE) has a Route Distinguisher (RD, e.g. 65000:100) making prefixes globally unique in the VPNv4 address family, and Route Targets (RT-export/import) controlling inter-PE route exchange. Run L3VPN builds local VRF routes from connected interfaces and CE peers, assigns VPN labels from 200000+, then exports routes with the RT-export community. Remote PEs that import a matching RT install the routes as proto V with a two-label stack: outer transport label (LDP) + inner VPN label (identifies the destination VRF). The VRF tab shows VRF instances, RD/RT, assigned interfaces, and the VPN route table. CLI: show bgp vpnv4 unicast all.
EVPN/VXLAN: EVPN (Ethernet VPN, RFC 7432) is a BGP address family for distributing MAC/IP reachability between VXLAN tunnel endpoints (VTEPs). Each Leaf switch is a VTEP with an EVI (EVPN Instance), VNI (VXLAN Network Identifier), and loopback IP as the VTEP address. Run EVPN generates Type-2 routes (one per connected host, advertising MAC + IP) and Type-5 routes (one per IP prefix for inter-subnet routing), then checks OSPF underlay reachability to each peer VTEP and imports their routes. The EVPN tab shows the toggle, EVI/VNI config, discovered VTEP peers, and the Type-2/Type-5 route tables. CLI: show bgp l2vpn evpn, show nve peers, show evpn evi.
Segment Routing (RFC 8660 / RFC 8986) encodes paths as ordered lists of segments (labels or IPv6 addresses) prepended to packets. No per-hop signaling protocol is needed.
SR-MPLS: • SRGB (Segment Routing Global Block) — a reserved range of MPLS labels agreed across the domain. In the simulator, SRGB base = 16000, size = 8000. • Node-SID — an index assigned per router. Absolute label = SRGB_base + Node-SID. Router with SID 1 → label 16001. Any router can push this label to steer traffic to that destination. • Adj-SID — a locally significant label representing a specific outgoing interface. Auto-allocated from 24000+. Used for traffic engineering (force traffic over a particular link). • LFIB — the Label Forwarding Information Base. Transit routers SWAP the incoming label with the outgoing label. The penultimate hop pops (PHP) so the egress receives an unlabeled packet.
SRv6: • Locator — each router is assigned an IPv6 /48 prefix (e.g., fc00:1::/48). SIDs are IPv6 addresses carved from this prefix. • End SID — the node endpoint. A packet with this destination address is processed locally (route lookup on the next segment). • End.X SID — an adjacency endpoint. The router forwards the packet out the specific interface to a named neighbor, without an additional route lookup. • SID table — view all End and End.X SIDs for a device in the SRv6 tab or via 'show segment-routing srv6 sid'.
The metric shown is the cumulative OSPF cost along the full path, not the cost of a single link. In the 3-router linear scenario, all links have the default OSPF cost of 1. To reach R3's loopback (3.3.3.3/32) from R1, the path is: R1→(cost 1)→R2→(cost 1)→R3, then R3 advertises its loopback at cost 1. The cumulative path cost = 1 (R1-R2) + 1 (R2-R3) + 0 (R3's loopback is local) = 2. OSPF metric [110/2] means administrative distance 110, metric 2.
A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask has 1s for the network portion and 0s for the host portion, a wildcard has 0s for the bits that must match and 1s for the bits that are ignored. For a /30 subnet: mask = 255.255.255.252 (binary: ...11111100), wildcard = 0.0.0.3 (binary: ...00000011). OSPF network statements use wildcard masks to define which interfaces to enable: "network 10.0.0.0 0.0.0.3 area 0" enables OSPF on any interface with an IP in 10.0.0.0–10.0.0.3.
The small colored dot in the top-right of each device icon indicates its configuration state: green = device has IP addresses configured on its interfaces; blue = OSPF is enabled and the router is participating in SPF; amber = device has no IP addresses configured yet. Configure IPs via the Interfaces tab, then connect devices and enable OSPF.
After creating a link, you need to configure IP addresses on both endpoint interfaces. Click the link (not a device) to open the link panel, then set the Endpoint A and Endpoint B IP addresses and masks. Both IPs must be in the same subnet (same network address) for the link to carry traffic. Click Run OSPF after configuring IPs and enabling OSPF. If using static routing instead, add static routes on each router for the remote subnets.
The Routing Table tab shows a structured table view with columns for protocol, network, next-hop, interface, and metric — useful for quick inspection and comparing routes. The Show Cmds tab generates formatted IOS-style command output for the selected device, including "show ip route" (full routing table with protocol codes), "show ip ospf neighbor" (adjacency table with state and dead timer), "show ip ospf database" (LSDB with sequence numbers), "show interfaces" (interface status, IP, MTU, bandwidth), and "show running-config" (full device configuration). The vendor setting (Cisco, Juniper, etc.) changes interface naming in running-config.
O IA stands for OSPF Inter-Area. When an OSPF Area Border Router (ABR) advertises a prefix from one area into another, it generates a Type 3 Summary LSA. Routers in the receiving area learn this prefix as an inter-area route with administrative distance 110 and install it as O IA in their routing table. It is displayed in lighter blue in the simulator to distinguish it from O (OSPF intra-area) routes, which come from Type 1 (Router) and Type 2 (Network) LSAs within the same area.
In standard iBGP (internal BGP), every router inside an AS must peer with every other router — a full mesh of n(n-1)/2 sessions. A Route Reflector (RR) relaxes this requirement: client routers peer only with the RR. The RR reflects routes received from a client to all other clients and to non-clients. This eliminates the full mesh at the cost of a single reflection point. In the simulator, enable "route-reflector-client" on each iBGP neighbor in the BGP tab. The RR badge appears on the device, and the BGP tab shows which neighbors are RR-clients and which prefixes are being reflected.
IS-IS Level 1 (L1) routers only maintain an intra-area topology database and forward all traffic to the nearest L1L2 router for inter-area destinations. Level 2 (L2) routers maintain a backbone topology database and form adjacencies with other L2 and L1L2 routers regardless of area. Level 1L2 (L1L2) routers do both: they participate in the local area L1 topology and the backbone L2 topology, making them the IS-IS equivalent of OSPF ABRs. L1L2 routers "leak" L1 area prefixes into the L2 backbone as Type 2 TLVs so that remote areas can route to them.
SR-MPLS computes paths using the IGP shortest path — the router pushes the destination's Node-SID label and lets OSPF/IS-IS decide the route. SR-TE (Traffic Engineering) overrides the IGP path with an explicit ordered list of segments (a "segment list"). You define a policy on the head-end router with a color (numeric ID), an endpoint IP, and a segment list of Node-SID indices. The simulator resolves each index to its MPLS label (SRGB_base + SID) and builds a label stack. The head-end pushes the full stack onto the packet; each transit router pops the top label as it forwards, following the explicit path rather than the shortest path. This lets you route around congested links, enforce specific paths for latency-sensitive traffic, or maintain traffic engineering without RSVP-TE. Each SR-TE policy also gets a binding SID so external controllers can steer traffic into the policy with a single label.
In MPLS L3VPN, multiple customer VRFs may use overlapping IP address space (e.g., two customers both using 192.168.1.0/24). A Route Distinguisher (RD) — typically formatted as ASN:number (e.g., 65000:100) — is prepended to each customer prefix to make it globally unique in the VPNv4 address family (RD + prefix = VPNv4 route). The RD is a uniqueness mechanism only; it does not control route distribution. Route Targets (RTs) control which PEs exchange which routes. A PE exports routes from a VRF with an RT-export community (e.g., 65000:100) and imports routes from other PEs that carry a matching RT-import value. If PE1 exports RT 65000:100 and PE2 imports RT 65000:100, PE2 installs PE1's VRF routes with a VPN label and proto V. VRFs with no matching remote RT remain isolated. The VPN label (inner MPLS label) identifies the destination VRF on the egress PE; the transport label (outer) carries the packet across the MPLS core.
EVPN (Ethernet VPN) uses BGP route types to distribute different kinds of reachability information. Type-2 (MAC/IP Advertisement) routes are generated by a VTEP for each host connected to it — the NLRI encodes the host's MAC address and IP address, the EVI (EVPN Instance), and the VNI (VXLAN Network Identifier). Remote VTEPs import Type-2 routes to populate their MAC tables, enabling direct VXLAN-encapsulated forwarding to the host without flooding. Type-5 (IP Prefix) routes advertise IP subnets rather than individual hosts, enabling inter-subnet routing across the VXLAN fabric without requiring a physical Layer 3 gateway at every leaf. In the simulator, Run EVPN generates one Type-2 route per connected host and one Type-5 route per IP prefix in the device's routing table, then checks OSPF underlay reachability to each peer VTEP's loopback before importing their routes.