Network change guard
Do not use for read-only show commands or lab toys with no production path. Not for firewall policy design.
Procedure
- Capture pre-state (
show run,show bgp summary, interface counters) and store it next to the change ticket. - Render the candidate config from intent. Diff against running. Reject secrets,
shutdownof uplinks, and default-route wipes. - Apply with confirmed-commit (NETCONF RFC 6241 or vendor equivalent) and a 5–10 minute confirm window.
- Verify forwarding: ping, traceroute, BGP Established, EVPN MAC count, or synthetic probe — two agreeing signals.
- Confirm the commit only after verification. Otherwise let it roll back and page the owner.
<commit>
<confirmed/>
<confirm-timeout>600</confirm-timeout>
</commit>
Anti-patterns
- Never
commitwithout a confirm window on a PE, spine, or edge firewall. - Do not paste running-config with TACACS or SNMP strings into an LLM.
Safety
Read-only until a named human approves the write. Fail closed if rollback is unavailable.