You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The output shows that **R1** announces two /24 routes only in the second configuration (indicated by ‘+’), a red flag if the change was never intended to leak such routes. Had it shown no routes, or only routes expected due to the change, the configuration can be deemed safe to deploy (assuming other correctness checks pass too).
60
60
61
61
- To confirm if these additional prefixes are part of a less specific route that is already being advertised, one can run the following command
62
62
63
63
```
64
-
batfish> get bgpAdvertisements prefixSpace=\["10.1.1.0/24:0-23"\]
64
+
batfish> get bgpAdvertisements prefixSpace=["10.1.1.0/24:0-23"]
Copy file name to clipboardExpand all lines: _posts/2019-06-14-announcing-batfish-ansible.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,7 +31,7 @@ To extract “facts” (config settings) from configuration files, one can simpl
31
31
- name: Setup connection to Batfish service
32
32
bf_session:
33
33
host: localhost
34
-
name: local\_batfish
34
+
name: local_batfish
35
35
36
36
- name: Initialize the example network
37
37
bf_init_snapshot:
@@ -108,7 +108,7 @@ Those advantages aside, the real power of Batfish is in being able to _validate_
108
108
109
109
## Use case II: Fact validation
110
110
111
-
Validating that facts in device configs match what is expected is easy with the **_bf\_validate\_facts_** module.
111
+
Validating that facts in device configs match what is expected is easy with the **_bf_validate_facts_** module.
112
112
113
113
```
114
114
- name: Validate facts gathered by Batfish
@@ -150,7 +150,7 @@ Beyond parsing configs, Batfish builds a full model of device configurations and
150
150
name: Confirm that there are NO undefined references on any network device
151
151
```
152
152
153
-
The task above includes four example assertions from our assertion library. The _**bf\_assert**_ module includes more, and based on community feedback, we’ll continue to make more of Batfish’s capabilities available this manner.
153
+
The task above includes four example assertions from our assertion library. The _**bf_assert**_ module includes more, and based on community feedback, we’ll continue to make more of Batfish’s capabilities available this manner.
154
154
155
155
Today’s release makes network validating broadly accessible, furthering our commitment to helping network engineers build secure and reliable networks.
Copy file name to clipboardExpand all lines: _posts/2020-10-09-pre-deployment-validation-of-bgp-route-policies.md
+20-20Lines changed: 20 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,22 +51,22 @@ The _testRoutePolicies_ question enables you to test the behavior of a route pol
51
51
52
52
For example, to test the "_deny all incoming routes with private addresses_" intent you would run _testRoutePolicies_ on routes with prefixes in the private address space and check that all of them are denied.
53
53
54
-
Let’s take a look at an example route-policy from\_customer and evaluate its behavior with testRoutePolicies.
54
+
Let’s take a look at an example route-policy from_customer and evaluate its behavior with testRoutePolicies.
Batfish has found a route advertisement 192.168.0.0/32 that will be allowed by the routing policy, despite our intent being for it to be denied. There may be multiple route advertisements that violate our intent, Batfish picks one as an example to highlight the error. If you look closely at the routing policy, the route-map from\_customer is going to deny routes that match the prefix-list private-ips. The last entry in that prefix-list is incorrect. It is missing the "ge 16" option. As defined, that entry only matches the exact route 192.168.0.0/16, which means any other prefix from that 192.168.0.0/16 space will not be matched and therefore not be denied by the route-map.
126
+
Batfish has found a route advertisement 192.168.0.0/32 that will be allowed by the routing policy, despite our intent being for it to be denied. There may be multiple route advertisements that violate our intent, Batfish picks one as an example to highlight the error. If you look closely at the routing policy, the route-map from_customer is going to deny routes that match the prefix-list private-ips. The last entry in that prefix-list is incorrect. It is missing the "ge 16" option. As defined, that entry only matches the exact route 192.168.0.0/16, which means any other prefix from that 192.168.0.0/16 space will not be matched and therefore not be denied by the route-map.
127
127
128
128
```
129
-
route-map from\_customer deny 100 match ip address prefix-list private-ips
129
+
route-map from_customer deny 100 match ip address prefix-list private-ips
130
130
131
131
ip prefix-list private-ips seq 5 permit 10.0.0.0/8 ge 8 ip prefix-list private-ips seq 10 permit 172.16.0.0/28 ge 28
132
132
ip prefix-list private-ips seq 15 permit 192.168.0.0/16
Copy file name to clipboardExpand all lines: _posts/2021-05-18-automating-the-long-pole-of-network-changes.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,10 +39,10 @@ Let us illustrate how they work via an example: Allowing access to a new service
39
39
40
40
Your change generation script will use the request parameters to generate the configuration commands for one or more devices. For example, it may generate the following change to the Palo Alto firewall at the edge of the network:
41
41
42
-
set service S\_TCP\_80 protocol tcp port 80
43
-
set service-group SG\_NEWSERVICE members S\_TCP\_80
44
-
set service S\_TCP\_8080 protocol tcp port 8080
45
-
set service-group SG\_NEWSERVICE members S\_TCP\_8080
42
+
set service S_TCP_80 protocol tcp port 80
43
+
set service-group SG_NEWSERVICE members S_TCP_80
44
+
set service S_TCP_8080 protocol tcp port 8080
45
+
set service-group SG_NEWSERVICE members S_TCP_8080
46
46
47
47
set address tkt123-dst1 ip-netmask 10.100.40.0/24
48
48
set address-group tkt123-dst static tkt123-dst1
@@ -54,7 +54,7 @@ set rulebase security rules tkt123 to INSIDE
54
54
set rulebase security rules tkt123 source any
55
55
set rulebase security rules tkt123 destination tkt123-dst
56
56
set rulebase security rules tkt123 application any
57
-
set rulebase security rules tkt123 service SG\_NEWSERVICE
57
+
set rulebase security rules tkt123 service SG_NEWSERVICE
58
58
set rulebase security rules tkt123 action allow
59
59
60
60
This change may be generated using Jinja2 templates, an internal source-of-truth like Netbox, or the Palo Alto Ansible module. Regardless of how it is generated, you can submit it to Batfish Enterprise and analyze it using three criteria.
0 commit comments