You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The output shows that **R1** announces two /24 routes only in the second configuration (indicated by ‘+’), a red flag if the change was never intended to leak such routes. Had it shown no routes, or only routes expected due to the change, the configuration can be deemed safe to deploy (assuming other correctness checks pass too).
@@ -63,7 +63,7 @@ The output shows that **R1** announces two /24 routes only in the second config
63
63
```
64
64
batfish> get bgpAdvertisements prefixSpace=\["10.1.1.0/24:0-23"\]
Copy file name to clipboardExpand all lines: _posts/2019-06-14-announcing-batfish-ansible.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,7 +31,7 @@ To extract “facts” (config settings) from configuration files, one can simpl
31
31
- name: Setup connection to Batfish service
32
32
bf_session:
33
33
host: localhost
34
-
name: local\_batfish
34
+
name: local_batfish
35
35
36
36
- name: Initialize the example network
37
37
bf_init_snapshot:
@@ -108,7 +108,7 @@ Those advantages aside, the real power of Batfish is in being able to _validate_
108
108
109
109
## Use case II: Fact validation
110
110
111
-
Validating that facts in device configs match what is expected is easy with the **_bf\_validate\_facts_** module.
111
+
Validating that facts in device configs match what is expected is easy with the **_bf_validate_facts_** module.
112
112
113
113
```
114
114
- name: Validate facts gathered by Batfish
@@ -150,7 +150,7 @@ Beyond parsing configs, Batfish builds a full model of device configurations and
150
150
name: Confirm that there are NO undefined references on any network device
151
151
```
152
152
153
-
The task above includes four example assertions from our assertion library. The _**bf\_assert**_ module includes more, and based on community feedback, we’ll continue to make more of Batfish’s capabilities available this manner.
153
+
The task above includes four example assertions from our assertion library. The _**bf_assert**_ module includes more, and based on community feedback, we’ll continue to make more of Batfish’s capabilities available this manner.
154
154
155
155
Today’s release makes network validating broadly accessible, furthering our commitment to helping network engineers build secure and reliable networks.
Copy file name to clipboardExpand all lines: _posts/2020-10-09-pre-deployment-validation-of-bgp-route-policies.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,22 +51,22 @@ The _testRoutePolicies_ question enables you to test the behavior of a route pol
51
51
52
52
For example, to test the "_deny all incoming routes with private addresses_" intent you would run _testRoutePolicies_ on routes with prefixes in the private address space and check that all of them are denied.
53
53
54
-
Let’s take a look at an example route-policy from\_customer and evaluate its behavior with testRoutePolicies.
54
+
Let’s take a look at an example route-policy from_customer and evaluate its behavior with testRoutePolicies.
Batfish has found a route advertisement 192.168.0.0/32 that will be allowed by the routing policy, despite our intent being for it to be denied. There may be multiple route advertisements that violate our intent, Batfish picks one as an example to highlight the error. If you look closely at the routing policy, the route-map from\_customer is going to deny routes that match the prefix-list private-ips. The last entry in that prefix-list is incorrect. It is missing the "ge 16" option. As defined, that entry only matches the exact route 192.168.0.0/16, which means any other prefix from that 192.168.0.0/16 space will not be matched and therefore not be denied by the route-map.
126
+
Batfish has found a route advertisement 192.168.0.0/32 that will be allowed by the routing policy, despite our intent being for it to be denied. There may be multiple route advertisements that violate our intent, Batfish picks one as an example to highlight the error. If you look closely at the routing policy, the route-map from_customer is going to deny routes that match the prefix-list private-ips. The last entry in that prefix-list is incorrect. It is missing the "ge 16" option. As defined, that entry only matches the exact route 192.168.0.0/16, which means any other prefix from that 192.168.0.0/16 space will not be matched and therefore not be denied by the route-map.
127
127
128
128
```
129
-
route-map from\_customer deny 100 match ip address prefix-list private-ips
129
+
route-map from_customer deny 100 match ip address prefix-list private-ips
130
130
131
131
ip prefix-list private-ips seq 5 permit 10.0.0.0/8 ge 8 ip prefix-list private-ips seq 10 permit 172.16.0.0/28 ge 28
132
132
ip prefix-list private-ips seq 15 permit 192.168.0.0/16
Copy file name to clipboardExpand all lines: _posts/2021-05-18-automating-the-long-pole-of-network-changes.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,10 +39,10 @@ Let us illustrate how they work via an example: Allowing access to a new service
39
39
40
40
Your change generation script will use the request parameters to generate the configuration commands for one or more devices. For example, it may generate the following change to the Palo Alto firewall at the edge of the network:
41
41
42
-
set service S\_TCP\_80 protocol tcp port 80
43
-
set service-group SG\_NEWSERVICE members S\_TCP\_80
44
-
set service S\_TCP\_8080 protocol tcp port 8080
45
-
set service-group SG\_NEWSERVICE members S\_TCP\_8080
42
+
set service S_TCP_80 protocol tcp port 80
43
+
set service-group SG_NEWSERVICE members S_TCP_80
44
+
set service S_TCP_8080 protocol tcp port 8080
45
+
set service-group SG_NEWSERVICE members S_TCP_8080
46
46
47
47
set address tkt123-dst1 ip-netmask 10.100.40.0/24
48
48
set address-group tkt123-dst static tkt123-dst1
@@ -54,7 +54,7 @@ set rulebase security rules tkt123 to INSIDE
54
54
set rulebase security rules tkt123 source any
55
55
set rulebase security rules tkt123 destination tkt123-dst
56
56
set rulebase security rules tkt123 application any
57
-
set rulebase security rules tkt123 service SG\_NEWSERVICE
57
+
set rulebase security rules tkt123 service SG_NEWSERVICE
58
58
set rulebase security rules tkt123 action allow
59
59
60
60
This change may be generated using Jinja2 templates, an internal source-of-truth like Netbox, or the Palo Alto Ansible module. Regardless of how it is generated, you can submit it to Batfish Enterprise and analyze it using three criteria.
Copy file name to clipboardExpand all lines: _posts/2021-05-26-closing-the-loop-on-testing-network-changes.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,7 +75,7 @@ The **.answer().frame()** part transforms the information returned by the questi
75
75
76
76
Suzieq’s Python interface is defined [here](https://suzieq.readthedocs.io/en/latest/developer/pythonAPI/). Suzieq organizes information in tables. For example, you can get the BGP table via:
77
77
78
-
bgp\_tbl = get\_sqobject(‘bgp’)
78
+
bgp_tbl = get_sqobject('bgp')
79
79
80
80
Every table contains a set of functions that return a Pandas DataFrame. Two common functions are get() and aver() (because assert is a Python keyword, Suzieq uses aver, an old synonym). Because Suzieq analyzes the operational state of the network, you must first gather this state by running the Suzieq poller for the devices of interest. [These instructions](https://suzieq.readthedocs.io/en/latest/poller/) will help you start the poller on your network.
81
81
@@ -91,19 +91,19 @@ You can write Python programs that use the Batfish API to automate your pre-appr
91
91
92
92
{:width="800px"}
93
93
94
-
This program initializes the network snapshot (with planned config modifications) in **init\_bf()** and defines two tests. **test\_bgp\_status()** uses the **bgpSessionStatus** question to validate that all BGP sessions will be established after the change. **test\_all\_svi\_prefixes\_are\_on\_all\_leafs()** verifies that the SVI prefixes will be reachable on all nodes. It uses the **interfaceProperties** question to retrieve all SVI prefixes and verifies that each is reachable on all nodes. You retrieve the list of nodes using the **nodeProperties** question
94
+
This program initializes the network snapshot (with planned config modifications) in **init_bf()** and defines two tests. **test_bgp_status()** uses the **bgpSessionStatus** question to validate that all BGP sessions will be established after the change. **test_all_svi_prefixes_are_on_all_leafs()** verifies that the SVI prefixes will be reachable on all nodes. It uses the **interfaceProperties** question to retrieve all SVI prefixes and verifies that each is reachable on all nodes. You retrieve the list of nodes using the **nodeProperties** question
95
95
96
96
**TIP:** The first time you use Batfish on your network, take a look at the output of **bfq.initIssues().answer().frame()** to confirm that Batfish understands it well. The output of this command is also a good thing to check when a test fails because problems such as syntax errors are also reported in it.
97
97
98
98
Hopefully, you now see the power of automated testing with tools like Batfish and Suzieq. A few lines of code can validate complex end-to-end behaviors across your entire network. When you add another leaf or spine, you can run this test suite as is. In fact, you can run the same test suite across different vendors. Our example network uses Arista EOS. You won’t have to change even a single line if it used Cisco or Juniper or Cumulus or a mix.
99
99
100
100
You can even use pytest, the Python testing framework, to run the tests and make full use of an advanced testing framework. If any of the assertions fail, pytest will report them, and you can investigate the error, fix the config change, and rerun the test suite.
101
101
102
-
Good testing tools also make it easy to debug test failures. How you do that depends on the test. For example, if we had assigned an incorrect interface IP address on the new leaf, **test\_bgp\_status()** would fail because not all sessions would be in **ESTABLISHED** state. You may then look at the output of **bgpSessionStatus** question, which for this example will show that the sessions on leaf03 and spine01 are incompatible. To understand why, you may then run the **bgpSessionCompatibility** question as follows.
102
+
Good testing tools also make it easy to debug test failures. How you do that depends on the test. For example, if we had assigned an incorrect interface IP address on the new leaf, **test_bgp_status()** would fail because not all sessions would be in **ESTABLISHED** state. You may then look at the output of **bgpSessionStatus** question, which for this example will show that the sessions on leaf03 and spine01 are incompatible. To understand why, you may then run the **bgpSessionCompatibility** question as follows.
103
103
104
104
{:width="1000px"}
105
105
106
-
This output tells you that you likely have the wrong IP address on leaf03 (**NO\_LOCAL\_IP**), and that spine01 expects to establish a session to 10.127.0.5 but no such IP is present in the snapshot (**UNKNOWN\_REMOTE**). If you fix the configs, and rerun the tests, they should all pass now, and you can be confident that your change is ready to be scheduled for deployment.
106
+
This output tells you that you likely have the wrong IP address on leaf03 (**NO_LOCAL_IP**), and that spine01 expects to establish a session to 10.127.0.5 but no such IP is present in the snapshot (**UNKNOWN_REMOTE**). If you fix the configs, and rerun the tests, they should all pass now, and you can be confident that your change is ready to be scheduled for deployment.
107
107
108
108
#### Deployment pre-testing
109
109
@@ -117,9 +117,9 @@ As in the case of Batfish, your automated test suite will be a Python program. T
117
117
118
118
{:width="800px"}
119
119
120
-
Each test uses **get\_sqobject()** to get the relevant tables, then uses the get function to retrieve the rows and columns of interest, and finally checks that a specific column has an expected value on all nodes. The **.all()** checks that the field has that value on all rows of the retrieved dataset. Thus, the test to check that all spines are alive uses the “device” table to retrieve information about the spines, and checks that the “status” column has the value “alive” in all rows. **test\_spine\_port\_is\_free()** assumes that the spine ports have been cabled up and uses the lack of an LLDP peer to confirm that the port connecting to the new leaf is unused
120
+
Each test uses **get_sqobject()** to get the relevant tables, then uses the get function to retrieve the rows and columns of interest, and finally checks that a specific column has an expected value on all nodes. The **.all()** checks that the field has that value on all rows of the retrieved dataset. Thus, the test to check that all spines are alive uses the “device” table to retrieve information about the spines, and checks that the “status” column has the value “alive” in all rows. **test_spine_port_is_free()** assumes that the spine ports have been cabled up and uses the lack of an LLDP peer to confirm that the port connecting to the new leaf is unused
121
121
122
-
Like Batfish, this code is vendor-agnostic and works for any Suzieq-supported vendor. If you add additional leafs, you just need to change the values of SPINE\_IFNAME and NEW\_SVI\_PREFIX. This is the power of writing tests using frameworks like Suzieq.
122
+
Like Batfish, this code is vendor-agnostic and works for any Suzieq-supported vendor. If you add additional leafs, you just need to change the values of SPINE_IFNAME and NEW_SVI_PREFIX. This is the power of writing tests using frameworks like Suzieq.
123
123
124
124
If all deployment pre-tests pass, you can confidently deploy the change. But before you declare victory, you still need to test that the deployment went as planned. So, let's do that next.
0 commit comments