Batfish Configuration Analysis
MCP Server
- Source: Built-in (mcp-servers/batfish-mcp/)
- Command:
python3 -u mcp-servers/batfish-mcp/batfish_mcp_server.py (stdio transport)
- Requires: Batfish Docker container running,
BATFISH_HOST and BATFISH_PORT environment variables
- Python: 3.10+
- Dependencies:
pybatfish, mcp[cli], python-dotenv
Available Tools (8)
| Tool |
Parameters |
What It Does |
batfish_upload_snapshot |
snapshot_name, configs/config_path, network |
Upload device configs to Batfish and create a named snapshot |
batfish_validate_config |
snapshot_name, network |
Validate configs with per-device pass/fail status, vendor detection, warnings |
batfish_test_reachability |
snapshot_name, src_ip, dst_ip, protocol, dst_port |
Test if traffic can flow between two endpoints with full path trace |
batfish_trace_acl |
snapshot_name, device, filter_name, src_ip, dst_ip, protocol, dst_port |
Trace a packet through ACL rules to find matching permit/deny rule |
batfish_diff_configs |
reference_snapshot, candidate_snapshot, include_routes, include_reachability |
Compare two snapshots for route and reachability differences |
batfish_check_compliance |
snapshot_name, policy_type |
Check configs against compliance policies (6 built-in policy types) |
batfish_list_snapshots |
network |
List all available snapshots |
batfish_delete_snapshot |
snapshot_name, network |
Delete a snapshot |
Workflow: Pre-Change Validation
When a user wants to validate configurations before deployment:
- Upload configs:
batfish_upload_snapshot with inline configs dict or path to config directory
- Validate:
batfish_validate_config to check parse status, vendor detection, warnings/errors
- Test reachability:
batfish_test_reachability for critical traffic paths
- Check compliance:
batfish_check_compliance against organizational policies
- Report: Structured pass/fail results with specific findings
- GAIT: All operations automatically logged
Example: Validate Before Deploy
# Upload proposed configs
batfish_upload_snapshot snapshot_name="pre-change-site-a" config_path="/path/to/configs/"
# Validate parse status
batfish_validate_config snapshot_name="pre-change-site-a"
# Test critical path
batfish_test_reachability snapshot_name="pre-change-site-a" src_ip="10.1.1.1" dst_ip="10.2.2.1" protocol="TCP" dst_port=443
# Check compliance
batfish_check_compliance snapshot_name="pre-change-site-a" policy_type="interface_descriptions"
Workflow: Change Impact Analysis
When comparing before/after configurations:
- Upload "before" snapshot:
batfish_upload_snapshot with current configs
- Upload "after" snapshot:
batfish_upload_snapshot with proposed configs
- Diff:
batfish_diff_configs to find route and reachability differences
- Investigate: Use
batfish_trace_acl on any newly denied traffic
- Report: Structured diff showing added/removed/changed routes and flows
Workflow: ACL Troubleshooting
When investigating access control issues:
- Upload configs:
batfish_upload_snapshot with device configs
- Trace packet:
batfish_trace_acl with device, ACL name, and packet headers
- Review: Identify matching rule, line number, permit/deny action
- Test alternatives: Modify config, re-upload, trace again
Integration with Other Skills
| Skill |
Integration |
| pyats-config-mgmt |
Validate configs with Batfish before pushing via pyATS |
| gait-session-tracking |
All Batfish operations automatically logged |
| servicenow-change-workflow |
Reference Batfish validation in change request evidence |
| fwrule-analyzer |
Complement ACL trace with cross-vendor overlap analysis |
| cml-lab-lifecycle |
Validate CML lab configs with Batfish analysis |
Important Rules
- All operations are strictly read-only -- Batfish analyzes uploaded configs, never modifies network devices
- GAIT audit mandatory -- All operations logged automatically
- Snapshots are ephemeral -- Batfish manages snapshot lifecycle; use GAIT for persistent records
- Multi-vendor -- Supports Cisco IOS/IOS-XE/NX-OS, JunOS, Arista EOS, Palo Alto, F5
Error Handling
- BATFISH_UNREACHABLE: Verify Docker container is running (
docker ps | grep batfish)
- SNAPSHOT_NOT_FOUND: Use
batfish_list_snapshots to see available snapshots
- INVALID_INPUT: Check configs dict is non-empty or config_path exists
- DEVICE_NOT_FOUND: Use
batfish_validate_config to list devices in snapshot
- FILTER_NOT_FOUND: Verify ACL/filter name exists on the specified device
Environment Variables
BATFISH_HOST -- Batfish hostname (default: localhost)BATFISH_PORT -- Batfish port (default: 9997)BATFISH_NETWORK -- Default network name (default: netclaw)
1---2name: batfish-config-analysis3description: Batfish network configuration analysis -- pre-deployment validation, reachability testing, ACL/firewall tracing, differential analysis, compliance checking. Use when validating configs before deployment, testing traffic paths, tracing ACL rules, comparing config versions, or auditing compliance policies. Strictly read-only.4license: Apache-2.05---6
7# Batfish Configuration Analysis
8
9## MCP Server
10
11- **Source**: Built-in (mcp-servers/batfish-mcp/)
12- **Command**: `python3 -u mcp-servers/batfish-mcp/batfish_mcp_server.py` (stdio transport)
13- **Requires**: Batfish Docker container running, `BATFISH_HOST` and `BATFISH_PORT` environment variables
14- **Python**: 3.10+
15- **Dependencies**: `pybatfish`, `mcp[cli]`, `python-dotenv`
16
17## Available Tools (8)
18
19| Tool | Parameters | What It Does |
20|------|-----------|--------------|
21| `batfish_upload_snapshot` | `snapshot_name`, `configs`/`config_path`, `network` | Upload device configs to Batfish and create a named snapshot |
22| `batfish_validate_config` | `snapshot_name`, `network` | Validate configs with per-device pass/fail status, vendor detection, warnings |
23| `batfish_test_reachability` | `snapshot_name`, `src_ip`, `dst_ip`, `protocol`, `dst_port` | Test if traffic can flow between two endpoints with full path trace |
24| `batfish_trace_acl` | `snapshot_name`, `device`, `filter_name`, `src_ip`, `dst_ip`, `protocol`, `dst_port` | Trace a packet through ACL rules to find matching permit/deny rule |
25| `batfish_diff_configs` | `reference_snapshot`, `candidate_snapshot`, `include_routes`, `include_reachability` | Compare two snapshots for route and reachability differences |
26| `batfish_check_compliance` | `snapshot_name`, `policy_type` | Check configs against compliance policies (6 built-in policy types) |
27| `batfish_list_snapshots` | `network` | List all available snapshots |
28| `batfish_delete_snapshot` | `snapshot_name`, `network` | Delete a snapshot |
29
30## Workflow: Pre-Change Validation
31
32When a user wants to validate configurations before deployment:
33
341. **Upload configs**: `batfish_upload_snapshot` with inline configs dict or path to config directory
352. **Validate**: `batfish_validate_config` to check parse status, vendor detection, warnings/errors
363. **Test reachability**: `batfish_test_reachability` for critical traffic paths
374. **Check compliance**: `batfish_check_compliance` against organizational policies
385. **Report**: Structured pass/fail results with specific findings
396. **GAIT**: All operations automatically logged
40
41### Example: Validate Before Deploy
42
43```bash
44# Upload proposed configs
45batfish_upload_snapshot snapshot_name="pre-change-site-a" config_path="/path/to/configs/"
46
47# Validate parse status
48batfish_validate_config snapshot_name="pre-change-site-a"
49
50# Test critical path
51batfish_test_reachability snapshot_name="pre-change-site-a" src_ip="10.1.1.1" dst_ip="10.2.2.1" protocol="TCP" dst_port=443
52
53# Check compliance
54batfish_check_compliance snapshot_name="pre-change-site-a" policy_type="interface_descriptions"
55```
56
57## Workflow: Change Impact Analysis
58
59When comparing before/after configurations:
60
611. **Upload "before" snapshot**: `batfish_upload_snapshot` with current configs
622. **Upload "after" snapshot**: `batfish_upload_snapshot` with proposed configs
633. **Diff**: `batfish_diff_configs` to find route and reachability differences
644. **Investigate**: Use `batfish_trace_acl` on any newly denied traffic
655. **Report**: Structured diff showing added/removed/changed routes and flows
66
67## Workflow: ACL Troubleshooting
68
69When investigating access control issues:
70
711. **Upload configs**: `batfish_upload_snapshot` with device configs
722. **Trace packet**: `batfish_trace_acl` with device, ACL name, and packet headers
733. **Review**: Identify matching rule, line number, permit/deny action
744. **Test alternatives**: Modify config, re-upload, trace again
75
76## Integration with Other Skills
77
78| Skill | Integration |
79|-------|-------------|
80| **pyats-config-mgmt** | Validate configs with Batfish before pushing via pyATS |
81| **gait-session-tracking** | All Batfish operations automatically logged |
82| **servicenow-change-workflow** | Reference Batfish validation in change request evidence |
83| **fwrule-analyzer** | Complement ACL trace with cross-vendor overlap analysis |
84| **cml-lab-lifecycle** | Validate CML lab configs with Batfish analysis |
85
86## Important Rules
87
88- **All operations are strictly read-only** -- Batfish analyzes uploaded configs, never modifies network devices
89- **GAIT audit mandatory** -- All operations logged automatically
90- **Snapshots are ephemeral** -- Batfish manages snapshot lifecycle; use GAIT for persistent records
91- **Multi-vendor** -- Supports Cisco IOS/IOS-XE/NX-OS, JunOS, Arista EOS, Palo Alto, F5
92
93## Error Handling
94
95- **BATFISH_UNREACHABLE**: Verify Docker container is running (`docker ps | grep batfish`)
96- **SNAPSHOT_NOT_FOUND**: Use `batfish_list_snapshots` to see available snapshots
97- **INVALID_INPUT**: Check configs dict is non-empty or config_path exists
98- **DEVICE_NOT_FOUND**: Use `batfish_validate_config` to list devices in snapshot
99- **FILTER_NOT_FOUND**: Verify ACL/filter name exists on the specified device
100
101## Environment Variables
102
103- `BATFISH_HOST` -- Batfish hostname (default: localhost)
104- `BATFISH_PORT` -- Batfish port (default: 9997)
105- `BATFISH_NETWORK` -- Default network name (default: netclaw)
gabrielmoreira