All Network Automation Scripts

Unified SLA collector across Cisco/VMware/Fortinet: normalised TunnelMetric dataclass, InfluxDB writer, Grafana dashboard provisioner and PagerDuty alerting on site-down.

Phased migration orchestrator: coexistence BGP handoff, per-site traffic shift by app class, SLA monitoring during cutover, auto-revert on SLA breach and a decom checklist.

FortiManager API: retrieve all SD-WAN rules, compare vs a golden YAML baseline, flag drift (wrong SLA target, priority, interface), produce an HTML report and optionally push the baseline.

VCO API: per-edge tunnel state, link quality (loss/latency/jitter), business policy compliance, software version audit and a bulk upgrade scheduler with staged rollout.

Full ISE infrastructure setup: node registration, NAD bulk import with Vault secrets, CoA port config, RADIUS test validation, replication health check and HTML report.

Multi-vendor 802.1X port config: IOS/IOS-XE/NX-OS/EOS/JunOS, MAB fallback, guest/fail/critical VLAN, CoA, uplink protection, per-switch validation and rollback.

CPPM API: posture condition creation (AV/patch/BitLocker/FileVault), remediation actions, enforcement profiles, compliant/non-compliant VLAN assignment and CoA verification.

CSV→NAC endpoint DB: OUI validation, ISE ERS bulk import, ClearPass PATCH endpoint, rate-limit handling, conflict resolution, CMDB write-back and an import summary report.

VPC lifecycle: route table management, security group audit, Transit Gateway route propagation, VPN tunnel state, VPC flow log analysis and inter-VPC reachability tests.

Azure SDK: VNET peering lifecycle, NSG rule audit (shadow/overpermissive), ExpressRoute circuit health, BGP route table pull and UDR consistency checks across a subscription.

NSX-T REST API: distributed firewall rule lifecycle, security group management, policy drift vs baseline, rule shadow analysis, traffic flow simulation and HTML report.

Verify hybrid cloud connectivity: BGP session on the cloud router, prefix count in/out, route preference (Direct Connect vs VPN), failover simulation and RTT baseline.

ZIA firewall + URL rules: shadow detection, ANY/ANY overpermissive, disabled rules, ZPA app segments without policy, posture bypass, DLP pattern overlap and HTML report.

Prisma Access API: service-connection tunnel state, PoP latency trends, mobile-user session count, certificate expiry, policy push status and Slack alerting on tunnel down.

Map network config checks to NIST CSF functions (ID/PR/DE/RS/RC): access control, encryption-in-transit, logging, segmentation and recovery config — scored HTML report.

Verify CDE isolation: ACL/firewall rules blocking CDE↔non-CDE, segmentation testing, wireless isolation, split-DNS check and log forwarding — mapped to PCI DSS 4.0 requirements.

Git-backed network as code: config render from Jinja2+YAML intent, PR-triggered dry-run with diff annotation, merge-triggered push to fleet and rollback on CI failure.

Collect running configs, diff vs Git golden state, auto-create a PR with per-device diff, annotate with severity, assign to a team via CODEOWNERS and send a Slack notification.

Deploy a complete BGP community scheme: origin tags, traffic-engineering communities, NO_EXPORT/BLACKHOLE and large-community (RFC 8092) per vendor — IOS-XR/JunOS/EOS/Nokia.

NetBox API: subnet utilisation trending, duplicate IP detection, stale DHCP leases, DNS A/PTR mismatch, top subnets by growth rate, exhaustion prediction and HTML report.

Event ingestion (syslog/SNMP/Kafka/webhook) → correlation → enrichment → ServiceNow incident or Jira ticket or PagerDuty alert, with dedup and escalation logic.

Dual-stack enablement pusher, 6PE/6VPE config generator, RA guard deploy, DHCPv6 relay config, IPv6 prefix-utilisation tracking and a migration readiness scorecard.

Deploy and reconcile Netskope DLP rules/profiles from declarative YAML — dictionary/profile/rule sync, drift detection vs the live tenant, dry-run diff and idempotent apply with rollback.

Automate provisioning of new eBGP peering sessions with an IXP or transit/customer neighbor: validates inputs, renders vendor config, applies prefix-limits, MD5/TCP-AO auth, and verifies the session reaches Established.

Audit and enforce a canonical BGP community policy (RFC 8642-style action communities, no-export/no-advertise hygiene, and customer signalling) against live route-policy configuration.

Continuously validate received prefixes against RPKI ROAs via an RTR/validator HTTP API, flag Invalid/NotFound origins, and correlate with router validation state.

Build per-customer/peer prefix-lists from IRR (AS-SET) data via an IRR/whois proxy, audit live device prefix-lists for drift, and emit corrected configuration.

Audit IXP route-server sessions through a looking-glass/BGP API: session state, received vs accepted prefixes, filtered-prefix ratio, and per-peer policy compliance.

Explain why a given prefix's best path was chosen by replaying the BGP decision process (weight, local-pref, AS-path, origin, MED, eBGP>iBGP, IGP metric, router-id) across candidate paths.

Compute the minimal AS-path prepend count needed to shift inbound traffic away from an over-utilized transit by sampling looking-glass visibility, then render the route-policy change.

Drain traffic from a router or peer before maintenance using RFC 8326 GRACEFUL_SHUTDOWN community + local-pref lowering, verify traffic has moved, and provide a one-command rollback.

Audit MPLS label allocation across the backbone: LDP/RSVP label bindings, label-range exhaustion, orphaned bindings, and FEC-to-label consistency between LSRs.

Provision RSVP-TE tunnels with explicit/dynamic paths, bandwidth reservation, affinity/admin-group constraints, FRR protection, and post-change up-state verification.

Validate readiness and forwarding consistency during an LDP-to-Segment-Routing migration: SRGB consistency, prefix-SID uniqueness, LDP/SR ships-in-the-night parity, and label-imposition diff.

Verify Fast-ReRoute / TI-LFA backup path coverage: per-prefix protection status, unprotected prefix list, backup next-hop sanity, and convergence-readiness scoring.

Audit and recommend IGP (IS-IS/OSPF) metrics against a reference-bandwidth policy, detect asymmetric metrics and accidental shortest-path shifts, and emit corrected interface metrics.

Validate Inter-AS L3VPN interconnects across Options A/B/C: VRF/RT import-export consistency, VPNv4 label exchange, ASBR next-hop reachability, and end-to-end route presence.

Validate L2VPN/VPLS and EVPN-based Carrier Ethernet services: pseudowire/VC status, MAC table health, split-horizon group integrity, MTU consistency, and per-service flap detection.

Trigger Remotely-Triggered Black Hole (destination/source RTBH) or divert traffic to a scrubbing center via BGP community injection, with TTL-based auto-withdrawal and audit logging.

Provision a new MPLS L3VPN customer end-to-end: VRF, RD/RT, PE-CE protocol (BGP/static/OSPF), import/export policy, and per-site interface binding with idempotent re-runs.

Provision point-to-point L2VPN (VPWS / EoMPLS) pseudowires with VC-ID allocation, attachment-circuit binding, control-word/MTU consistency checks, and dual-PE verification.

Generate day-0 managed-CPE configurations from a service template: WAN/LAN addressing, NAT, DHCP, default route, management ACL, and SNMP/NetFlow export — rendered per customer without touching the device.

Apply and verify per-customer hierarchical QoS on PE access interfaces: parent shaper to CIR, child classes (EF/AF/BE) with DSCP marking, and post-apply policy-map counter verification.

Validate customer-advertised prefixes against the agreed allow-list and IRR/RPKI: detect bogons, unexpected/more-specific prefixes, and AS-origin mismatches before they reach the route policy.

Translate a validated DDoS-mitigation intent into BGP FlowSpec rules (match 5-tuple, action rate-limit/discard/redirect) with destination-scope guardrails and TTL-based auto-withdraw logging.

Poll customer access interfaces via SNMP, compute 95th-percentile billing utilization against CIR, and emit a per-customer usage report flagging sustained over-CIR burst patterns.

Audit per-customer SLA compliance from collected latency/jitter/loss/availability metrics against contracted targets, compute breach windows and monthly availability %, and emit a credit-eligibility report.

Compare BGP/RIB tables across multiple ASBRs or route-reflectors to detect inconsistent best-paths, missing prefixes, and next-hop divergence between vantage points.

Sweep the fleet for control-plane health: poll CPU, memory, and top processes via SSH, rank devices by pressure, and flag those above warning/critical thresholds for NOC triage.

Read transceiver DOM telemetry (Rx/Tx power, temperature, bias current) per interface, compare against vendor thresholds and historical baseline, and flag fibers trending toward failure.

Provision and collect IP SLA probes (ICMP/UDP-jitter) and Ethernet Y.1731 OAM (DMM/SLM) measurements, computing per-path latency/jitter/loss against SLA targets for proactive NOC alerting.

Ingest a stream of SNMP traps, correlate related events within a time window (link flaps, BGP resets, power), suppress duplicates, and emit deduplicated incidents with root-cause hints.

Collect interface counters and protocol state across the fleet and push them as InfluxDB line-protocol points (via HTTP /write) with tag/field normalization, batching, and back-off retry.

Gate a planned change against NOC rules: verify the current time falls within an approved maintenance window, no conflicting freeze is active, and required pre-checks (no active P1, backups present) pass before authorizing execution.

Crawl the network from seed devices via CDP/LLDP neighbor discovery, collect hardware/serial/version facts, and reconcile the discovered topology against the source-of-truth inventory to flag drift.

Audit eBGP-learned prefixes against RPKI validation state (valid / invalid / not-found) and flag invalids that are still installed or propagated, plus ROA coverage gaps for the operator's own space.

Resolve an AS-SET via IRR data and render vendor-specific prefix-lists/route-policies for customer and peer sessions, with max-prefix limits and change-diff against the currently applied filter.

Audit edge/core infrastructure ACLs and control-plane policers against a golden baseline: missing anti-spoofing (BCP38/uRPF), exposed management protocols, and absent CoPP classes.

Validate the DDoS diversion/return path during a scrubbing event: confirm BGP diversion advertisement, scrubbing-center next-hop, GRE/return tunnel health, and clean-traffic reinjection.

Audit device AAA configuration for management-plane security: enforced TACACS+ authentication/authorization/accounting, command logging, fallback-local guardrails, and absence of shared local accounts.

Verify management-plane hardening: SSHv2-only with strong ciphers/KEX, NTP authentication, SNMPv3-only, syslog over TLS, login banners, and disabled legacy services (telnet, HTTP, CDP on edge).

Map fleet OS versions against a vendor PSIRT/CVE feed to report exposed devices, severity-ranked advisories, fixed-release recommendations, and end-of-support flags.

Score eBGP peering sessions against MANRS actions: ingress/egress prefix filtering, max-prefix limits, anti-spoofing, IRR/RPKI validation, and accurate PeeringDB/global contact data.

Deep BGP diagnostic: neighbor state analysis, flap detection, prefix count anomalies, route reflector topology verification, AS-path policy violations, and MED/LOCAL_PREF inconsistencies.

Real-time interface health scanner: error rate trending, CRC/input error correlation, flap detection, duplex/speed mismatch, LACP bundle integrity, and bandwidth utilisation anomalies.

Spanning-tree topology change forensics: TCN flood detection, root bridge verification, blocked port audit, BPDU guard/filter violations, PVST+ inconsistency across VLANs, and loop-risk scoring.

Correlate syslog events across 100s of devices to detect cascading failures, identify root-cause vs symptom events, compute blast radius, and auto-generate incident timelines.

End-to-end path verification: bi-directional ping with statistics, traceroute asymmetry detection, MTU path discovery (PMTUD simulation), RPF check, QoS DSCP marking verification, and latency SLA baseline.

Network forensics for Layer 2/3 address anomalies: duplicate IP detection, MAC address flapping, stale ARP entry audit, DHCP snooping binding verification, and rogue host detection.

Multi-device CPU/memory crisis triage: process-level analysis, spike correlation with network events, memory pool health, EEM/alarm history, and automatic remediation suggestions.

BGP route leak detection: unexpected prefix origins, AS-path manipulation, unexpected route sources in VRF/global table, RPKI ROA violation detection, and route leak blast radius assessment.

OSPF full health check: neighbor state matrix, adjacency instability detection, LSA database consistency, stub/NSSA area verification, SPF convergence time analysis, and split-brain detection.

Pre/post change validation: automated config diff, routing table delta verification, BGP prefix stability check, connectivity SLA re-measurement, and auto-rollback trigger on SLA breach.

MPLS/VPN integrity: VRF route-target consistency, LDP/RSVP label binding verification, PE-CE routing check, VPLS MAC learning, traffic-engineered tunnel state, and end-to-end L3VPN reachability.

BFD health monitoring across all protocol associations: session state matrix, discriminator mapping, timer parameter consistency, micro-BFD on LAG members, and rapid-failure root cause correlation.

End-to-end QoS policy audit: DSCP marking consistency, queue depth and drop monitoring, policer/shaper rate verification, class-map match accuracy, and real-time queue utilisation alerting.

Datacenter fabric integrity check: VTEP discovery, NVE peer state, EVPN type-2/3/5 route audit, VNI↔VLAN mapping consistency, ARP suppression cache drift, and silent-host detection across leaf/spine.

Statistical traffic anomaly engine: rolling-window baselining of per-prefix/per-port flows, DDoS volumetric and SYN-flood detection, top-talker drift, geographic source skew, and BGP-aware blackhole/RTBH suggestions.

Clock plane integrity: NTP stratum/offset/jitter audit, PTP master/slave state, BMCA winner verification, holdover detection, asymmetric path delay, and grandmaster failover validation.

Management/control plane crypto audit: SSH host-key strength, HTTPS/RESTCONF cert chain validity, expiry windows, weak cipher/KEX detection, RADIUS/TACACS TLS, and CRL/OCSP reachability.

Full IS-IS diagnostic: LSP database TLV parsing, DIS election verification, overload bit detection, metric consistency audit, SPF tree reconstruction with networkx, and split-brain detection across areas.

Verify ECMP load distribution across equal-cost paths: hash algorithm audit, per-path traffic entropy measurement, CEF adjacency consistency, unequal load detection, and polarisation diagnosis.

Deep ACL analysis using interval tree data structures to find shadowed ACEs (rules that can never match), redundant entries, permit-before-deny violations, stale hit-count rules, and policy inconsistencies across devices.

Collect and decode NetFlow v5/v9 and IPFIX records via UDP socket listener. Real-time top-talker analysis, protocol distribution, flow entropy anomaly detection, and DDoS pattern recognition.

Full multicast plane verification: PIM neighbor state matrix, (S,G) and (*,G) entry audit, RP reachability and failover, MSDP peer state, IGMP group inventory, RPF check, and multicast loop detection.

Async gRPC/gNMI subscription engine: SAMPLE and ON_CHANGE mode streaming, YANG path monitoring, real-time anomaly detection via z-score, automatic Prometheus metrics export, and threshold alerting.

DHCP pool health: scope utilisation tracking, pool exhaustion prediction via linear regression, rogue DHCP server detection, lease conflict analysis, and DHCP snooping binding verification.

Segment Routing integrity verification: Node/Adj SID allocation audit, SRTE policy binding check, label stack depth verification, forwarding equivalence class consistency, and SR-MPLS OAM ping.

YANG-schema validated NETCONF configuration management: candidate datastore transactions, edit-config with rollback-on-error, schema validation before push, batch multi-device transactions with atomic commit.

Network capacity planning engine: SNMP-based time-series collection, ARIMA/Holt-Winters forecasting, capacity exhaustion prediction with confidence intervals, and automated upgrade recommendations.

DNS security audit: DNSSEC chain of trust validation, zone transfer attempt detection, DNS tunneling signature detection via query entropy analysis, recursive resolver abuse, and cache poisoning indicators.

Multi-protocol topology discovery: CDP/LLDP neighbor collection, graph-based topology construction with NetworkX, automated change detection vs previous snapshot, VLAN topology overlay, and Graphviz export.

Comprehensive redundancy verification: HSRP/VRRP/GLBP state audit, automated failover testing with convergence measurement, single-point-of-failure detection via topology graph analysis, and SLA impact scoring.

MPLS-TE operational health: RSVP session inventory with bandwidth audit, FRR backup path verification, LSP ping/traceroute OAM, label binding cross-check, admission control state, and TE topology export.

AAA security audit: TACACS+ log parsing with failed attempt correlation, privilege escalation detection, session anomaly scoring, off-hours access alerting, RBAC policy gap analysis, and compliance reporting.