Exercise 2 - drain spine2 with zero packet loss  (paste into spine2's vtysh)

configure terminal
route-map DRAIN permit 10
 set as-path prepend 65000 65000
exit
router bgp 65000
 address-family ipv4 unicast
  neighbor FABRIC route-map DRAIN out
end
clear bgp ipv4 unicast * soft out

Check on leaf1:
  show bgp ipv4 unicast 172.16.3.0/24   -> via spine1: 65000 65103 (best)
                                           via spine2: 65000 65000 65000 65103 (not used)
  show ip route 172.16.3.0/24           -> ONE next hop (eth0 / spine1)

Undo (on spine2):
configure terminal
router bgp 65000
 address-family ipv4 unicast
  no neighbor FABRIC route-map DRAIN out
end
clear bgp ipv4 unicast * soft out
(optional: no route-map DRAIN)

Why it's lossless: make-before-break. spine2 stays up and keeps forwarding while BGP
steers everyone to spine1; traffic moves only after the new path is installed. Multipath
(even with multipath-relax) only combines paths of EQUAL AS-path length, so the prepended
path drops out of ECMP. The suspended link in the demo was break-before-make.

Tested: GNS3 ping-only run 0/259 lost through drain + undo; containerlab ECMP 2 -> 1 -> 2.
Tip: with iperf3 -P 8 saturating the links you may see a few congestion drops unrelated to
the drain (and, if BFD is on, the 100 ms x 3 profile can flap under saturation).
