Netops Change Guard

Guard network writes behind dry-run, RFC 6241 confirmed-commit, and explicit rollback. Use when applying config to Cisco, Juniper, Arista, or Nokia and a human must own the blast radius.

gesh75 e654de7 1.3 KB Updated

File contents

Network change guard

Do not use for read-only show commands or lab toys with no production path. Not for firewall policy design.

Procedure

  1. Capture pre-state (show run, show bgp summary, interface counters) and store it next to the change ticket.
  2. Render the candidate config from intent. Diff against running. Reject secrets, shutdown of uplinks, and default-route wipes.
  3. Apply with confirmed-commit (NETCONF RFC 6241 or vendor equivalent) and a 5–10 minute confirm window.
  4. Verify forwarding: ping, traceroute, BGP Established, EVPN MAC count, or synthetic probe — two agreeing signals.
  5. Confirm the commit only after verification. Otherwise let it roll back and page the owner.
<commit>
  <confirmed/>
  <confirm-timeout>600</confirm-timeout>
</commit>

Anti-patterns

  • Never commit without a confirm window on a PE, spine, or edge firewall.
  • Do not paste running-config with TACACS or SNMP strings into an LLM.

Safety

Read-only until a named human approves the write. Fail closed if rollback is unavailable.

gesh75/claude-skill-lint/tree/main/skills/netops/netops-change-guard commit e654de7438

Frequently asked questions

npx skillmds@latest add gesh75/netops-change-guard