Config diff preflight
Do not use as a substitute for a digital twin (AEGIS) on high-risk changes. Not for generating the config itself.
Procedure
- Diff against running. Reject if the diff includes
no router bgp, interface shutdowns on uplinks, or AAA removal. - Strip and flag secrets: keys, communities used as passwords, TACACS, SNMP.
- Blast radius: count of peers, prefixes, and interfaces touched. Over a threshold, require a senior.
- Silent defaults: MTU, BFD, logging, timestamps. Missing logging is a fail.
- Verify the ticket has pre-state, diff, verification, and rollback pasted.
- neighbor 192.0.2.1 shutdown
+ neighbor 192.0.2.1 description PE-A
# fail: this un-shuts a peer without a change window
Anti-patterns
- Never approve a diff you cannot reverse in one command.
- Do not ignore "no" statements that wipe stanzas.
Safety
A failed preflight stops the pipeline. No override without a named senior.