Interview Q&A — 30 questions with model answers + your STAR stories

Format: expected question → the shape of a winning answer. Answers reference files 02-06 for depth. Don't memorize word-for-word; internalize the structure, then say it in your own voice. Your real stories (Penske) beat any textbook answer.

Part 1 — BGP core (he will ladder these)

Q1. "Walk me through how a BGP session comes up." A: TCP 179, FSM states Idle→Connect→Active→OpenSent→OpenConfirm→Established; OPEN exchanges ASN/hold-timer/router-ID/capabilities; keepalives at hold/3; UPDATEs carry NLRIs. Then add the on-prem color: "I've debugged more sessions stuck in Active than I can count — it's almost always a firewall ACL dropping 179, or a routing problem to the peer. First checks: ACL, reachability, then ASN/password mismatch."

Q2. "eBGP vs iBGP — what actually changes?" A: Loop prevention (AS_PATH vs split-horizon), next-hop handling (rewritten vs inherited — hence next-hop-self), TTL (1 vs 255), LOCAL_PREF propagation, and iBGP needing full mesh/RR/confederations. (Table in 02.)

Q3. "Two paths to the same prefix — how does the router pick?" A: Recite the path-selection ladder (02 §4): weight → local-pref → locally originated → AS-path length → origin → MED → eBGP/iBGP → IGP metric → router ID. Then volunteer: "In the datacenter the two knobs I actually touch are local-pref for outbound control and AS-path prepend/MED for inbound influence — everything else is rarely changed."

Q4. "Route is in the BGP table but not installed. Why?" A: Inbound policy filtered it; NEXT_HOP unreachable (iBGP without IGP route — fix next-hop-self); max-prefix tripped; or a better path exists for the same prefix. Walk the ladder in order.

Q5. "Session flaps every few minutes — where do you start?" A: Logs + session state alerting → check physical link errors/CRC, MTU blackholing large UPDATEs, CPU/CoPP starvation eating keepalives, duplicate router IDs in the iBGP mesh. "Flap is a symptom — I go find the root, usually L1 or control-plane starvation."

Q6. "How do you make inbound vs outbound traffic flow the way you want?" A: Outbound = your call: local-pref/weight. Inbound = hints to the other AS: AS-path prepend (longer = less preferred), MED (lower = preferred), communities agreed with the peer. "You never fully control inbound — you influence it, and you verify with looking glasses/traceroutes."

Q7. "Why route reflectors?" A: iBGP split-horizon forces full mesh (N² sessions). RR reflects routes client→client with originator-id/cluster-id loop protection. Design: 2 RRs for redundancy, iBGP sessions to loopbacks for stability.

Q8. "BFD vs just tuning BGP timers?" A: BFD = sub-second L1/L2 failure detection independent of BGP timers; aggressive BGP timers eat CPU and flap under load. Use BFD on critical fabric/MetalLB sessions, leave BGP at defaults. "Convergence quality beats timer heroics."

Q9. "Why would you build the DC on eBGP leaf-spine instead of classic 3-tier + OSPF?" A: Every link active (no STP), ECMP scale-out, simple unnumbered peering, no L2 blast radius, BGP policy knobs at the fabric level, and it's the same protocol the K8s edge (MetalLB/Calico) speaks. "It makes the network look like the app layer: horizontal and redundant."

Q10. "BGP unnumbered — what problem does it solve?" A: No IPAM on fabric links; IPv6 link-local + RFC 5549 extended next-hop carries IPv4. Plug in a leaf, sessions come up. "Cuts provisioning time and eliminates a whole class of addressing mistakes."

Q11. "What does ECMP need to actually work, and what breaks it?" A: Same best-path attributes, multipath enabled, and hash diversity — 5-tuple hashing; hash polarization when spine+leaf share the same algorithm. Also: flows, not packets, stay on one path — asymmetric return is normal, design for it.

Q12. "Your datacenter loses a WAN link. Walk me through your response." A (show on-call maturity): Alert fires (session down) → confirm scope (is it just us or the carrier?) → check redundant path took traffic (local-pref design) → check apps (sessions re-hashed) → verify inbound via the other ISP (prepend already advertised) → diagnose L1 with carrier → post-incident: was failover fast enough? BFD? Was traffic asymmetric during failover? Write it into the runbook. "Failover that works in a test fails in production — I run DR tests for exactly this."

Part 2 — OpenShift + MetalLB (the stack)

Q13. "Where does BGP live in your OpenShift stack?" A: THE layering answer (03 §2, §4): OVN-K = overlay CNI (Geneve), no BGP. MetalLB/FRR speakers on workers run eBGP to the ToR, announcing service VIP /32s; ToRs ECMP to nodes. "Two distinct layers — OVN does east-west pod networking, BGP only exists at the north-south edge. Keeping that boundary clean is what makes it debuggable."

Q14. "How does a request actually get to a pod in MetalLB BGP mode?" A: VIP /32 ECMP'd to a node → DNAT to a backend pod IP (SNAT with policy Cluster) → if pod is elsewhere, OVN-K routes over Geneve. Walk the whole path (03 §4) — naming each hop is the senior tell.

Q15. "MetalLB L2 vs BGP mode — when would you pick which?" A: L2 = simple, any switch, but single-node bottleneck + hairpin + election-based failover. BGP = ECMP across nodes, graceful withdraws on drain, real redundancy — needs a BGP fabric and someone who knows BGP. "For production with this traffic pattern: BGP mode. That's why I'm here." (Confident + ties to the role.)

Q16. "externalTrafficPolicy Cluster vs Local?" A: Cluster = SNAT, ECMP-friendly, loses source IP. Local = preserves source IP but only nodes with pods advertise, strict return path, blackhole risk if misconfigured. "Same tradeoff as F5 SNAT automap vs transparency — I've fought both bugs."

Q17. "A node dies. What happens to the VIP?" A: Speaker session drops → /32 withdrawn → ECMP set shrinks (sub-second with BFD) → OVN-K reprograms service backends. Pending flows break, new flows fine. "And on drain we withdraw gracefully BEFORE terminating pods — zero impact. That's the on-prem LB story cloud users never learn."

Q18. "OVN-K vs OpenShift SDN — why does it matter?" A: OVN-K is the default since 4.12 and the future (SDN deprecated); distributed routing, efficient NetworkPolicy→ACL compilation, EgressIP/EgressFirewall, and better convergence. "If they're still on OpenShift SDN, migrating to OVN-K is a project I'd propose early."

Q19. "How would you design the service IP announcement policy?" A: Dedicated VIP CIDR (never overlapping pod/service CIDRs), per-environment pools, /32 announcements with aggregation if the fabric table needs it, communities to tag (e.g. site/team) so the network team can policy on them, localPref per ToR for deterministic primary-path behavior, BFD + max-prefix + authentication on every peer. "Announcement policy is a security boundary too — only what's supposed to be reachable gets announced."

Part 3 — Virtualization & migration (the project)

Q20. "How do VMs actually run on OpenShift?" A: KubeVirt: VM = CRD; each running VM = virt-launcher pod with QEMU/KVM; disks = PVCs (CDI imports VMDKs/ISOs); NICs via pod network or bridge NADs on real VLANs; live migration moves VMs between nodes in milliseconds. (04 §1.)

Q21. "Walk me through migrating a Windows VM from vCenter to OpenShift." A: MTV plan: provider (vCenter) + NetworkMap (VLAN→NAD) + StorageMap (datastore→StorageClass) → warm migration: full copy with virt-v2v (injects VirtIO drivers) → CBT incrementals → cutover (power off, final sync, boot on OCP) → verify (IP, AD, app) → keep source offline N days as rollback. (04 §2.)

Q22. "What breaks in Windows VMs during migration?" A: VirtIO drivers missing (boot with SATA first, then switch to virtio-SCSI/NetKVM); RDM disks; static IPs/MAC-sensitive licensing (preserve via NAD/sysprep); VMware Tools vs qemu-ga; time sync drift (Kerberos/AD!); snapshots needed for CBT. Name-drop these and you're instantly credible.

Q23. "How do migrated VMs keep talking to legacy VLANs?" A: Multus NADs: Linux bridge (or OVS) on the worker's trunked NIC → bridge binding → VM gets an interface on the original VLAN. "During migration, both worlds must coexist — the VM keeps its VLAN leg while the rest of the app moves to the overlay. NetworkMap in MTV formalizes exactly this."

Q24. "How do you patch nodes without breaking the VMs?" A: Node maintenance mode → live migration off → drain pods → patch via MCO/dnf → uncordon. "Zero-downtime patching is the whole point of running VMs on KubeVirt — it deletes the maintenance-window problem they probably live with today."

Q25. "L4 vs L7 — explain like I'm deciding where to terminate something." A: The door-vs-envelope answer (05). L4 = MetalLB/FastL4 (IP+port, fast, no parsing). L7 = Router/HAProxy/standard F5 virtual (host/path, TLS, cookies, iRules). "Most of our apps chain both: MetalLB VIP → HAProxy L7 → service."

Part 4 — Ops, hardening, breadth

Q26. "You get a call: app on OpenShift is intermittently slow. Where do you start?" A: Scope first (network or app?): metrics (Prometheus: CPU/mem/sat), pods restarting (events), endpoints healthy, node resources, then network: MTU, overlay, DNS latency in-pod, BGP flap/session logs, storage latency if PVC-backed. "I always bisect the stack — app vs platform vs network — before touching anything."

Q27. "How do you harden a BGP session?" → 06 §1 script, verbatim-able.

Q28. "How do you segment workloads in the cluster?" → default-deny NetworkPolicies + EgressFirewall + RBAC/SCC story (06 §3).

Q29. "NFS vs iSCSI vs LVM for OpenShift storage?" A: NFS = simple shared storage, fine for app PVCs, NOT for etcd/DB-consistency-critical workloads (locking/latency). iSCSI = block storage, multipath, LSO. LVM Storage = local host volumes (fast, non-shared). "Right tool per workload: shared/read-many → NFS; databases → block/iSCSI; ephemeral-fast → local."

Q30. "What questions do you have for me?" — see below; pick 3-4.

Your STAR stories (map resume bullets to narrative)

  1. BGP + F5 at Penske: "I owned BGP peers, route advertisements and policies across the private DC; when we did DR failover tests I'd walk sessions down and up, verify path convergence, and document every step into runbooks the on-call team used. F5 side: LTM/GTM VIPs, pools, health monitors, iRules, SSL — L4 and L7 in production." (Their ask: BGP + redundancy + mentoring — this story hits all three.)
  2. OpenShift ownership: patching control planes/workers, operator upgrades under change control, node/pod/scheduling incidents at 1000+ server scale. Add: "on-prem, so I know the parts AWS hides."
  3. Migration story: V2V across ESXi/VxRail/Dell PowerFlex (1000+ Linux servers) + the 50TB NetApp→PowerScale NFS cutover with "minimal disruption." Add specifics: parallel rsync + cutover window + rollback — this is literally their Windows→OCP project, different substrate.
  4. Automation + mentoring: Ansible cut patching effort 90%; runbooks + 15 mentored admins. Their #1 fear is the SPOF — this is the antidote story. Tell it slowly.
  5. Security: Nessus/PCI remediation, CrowdStrike to 1000+ servers, LDAP/Entra SAML through F5 — maps to hardening + hybrid identity.

Red flags to avoid

  • Never imply AWS "handled it" for anything BGP-related. On-prem-only framing.
  • Don't fake NinjaOne. Map SCCM/WSUS + Ansible honestly (06 §6).
  • Don't say "OpenShift Virtualization (OVN-Kubernetes)" as one thing. Split the layers.
  • Don't overclaim Windows depth — they deprioritize it anyway; say "AD in hybrid mode" and pivot to Linux.
  • If asked about salary: you know the band ($100-120k). "I'm targeting within the posted range, and I'm more focused on the work — this is exactly the stack I want to own."

Questions to ask him (pick 3-4 — show the network brain)

  1. "What's the fabric today — classic 3-tier, or have you moved to leaf-spine? And are the ToR switches already BGP peers with the cluster, or is that part of this build?" (Shows you're already architecting.)
  2. "Which OCP version and CNI — did you land on OVN-Kubernetes, and which MetalLB/FRR mode?"
  3. "For the Windows migration, what's the mix — containerizing vs lift-and-shift into OpenShift Virtualization — and are you using MTV for the VM moves?"
  4. "What's the DR posture for the cluster today? How do you test failover?"
  5. "Where does NinjaOne end and Ansible/other automation begin in your patching flow?"
  6. "Beyond BGP coverage, what's the single most painful thing the team hits on-call right now?"
  7. "What does success look like for this person at 6 months?" (Always ask this.)

2-day plan

Tue: Read 02 + 03 fully. Say Q1-Q18 answers aloud once (not silently — aloud). Read 01 + 07 stories, polish your BGP/F5/migration STAR narratives. Wed morning: 04, 05, 06 skim + Q19-Q30 aloud. 30 min before the call: re-read the "layering" answers (Q13, Q14) and your questions list.