I'm currently working on a project focused on automating network configuration in an existing network environment. I'm completely new to network automation, so I'm looking for advice, recommendations, and experiences from people who have worked with network automation in production environments.

The goal is to automate repetitive configuration tasks while keeping the existing infrastructure in place. A complete migration to Infrastructure as Code (IaC) as I see it isn't realistic for now, so I'm particularly interested in solutions that can be introduced incrementally into an existing environment.

Our environment includes equipment from multiple vendors:

• MikroTik (BRAS)
• HPE / Aruba
• Edgecore
• Ruckus ICX
• Extreme Networks (VDX / MLX)
• Fortinet (FortiGate)

The main tasks we wouldd like to automate for now are:

• VLAN provisioning along the required network path: The tool should determine which switches are on the network path between the relevant access router or BRAS and the customer connection, and configure the VLAN only on the devices that need it. The VLAN does not need to exist on every switch in the network, only on the relevant switches along that path.
• BRAS and RADIUS configuration: Automate the configuration required to provision a customer connection.
• Resource allocation and documentation: Automatically select an available VLAN ID, IPv4 address, and IPv6 prefix/address while ensuring that resources are not already in use or reserved. Currently, our network documentation is spread across multiple systems and only some of these systems provide API access. Any recommendations for centralizing network documentation, tracking resource allocation, and integrating/replacing existing documentation sources would therefore also be appreciated.

I've already looked into some tools and products, such as Ansible with AWX, Nornir, Cisco NSO, NetBox for documentation, and Oxidized for configuration backups (we currently use RANCID). However, there are many options and design decisions to consider, and it's difficult to know which approach would work best for our environment.

Ideally, we would like a solution that supports the vendors mentioned above. A interface or GUI to make configuration changes would also be a nice thing to have. Support for reviewing and approving (certern) changes before they are applied would be particularly useful for audit trails that record who requested, approved, and executed each change.

Recommendations for suitable tools, example architectures, or ways to implement this into our environment would be greatly appreciated. I'm also particularly interested in approaches to determining the required network path and resource assignments, and integrating automation into documentation.

Thanks in advance!

I'm a network engineer working with ACI daily. The APIC GUI kept costing me time on simple questions (which EPG is VLAN X on, which ports), so in my own time I built two tools.

**ACI Dashboard** (read-only): VLAN, MAC, IP and port search in one view, faults with plain explanations, topology, 30 compliance checks for valid-but-wrong config, PSIRT advisories for your versions.

**ACI Configuration Tool**: tenants, VRFs, EPGs, L3Outs, bulk interface bindings from CSV/Excel. Every write is validated, previewed, and can be rolled back per session.

Both talk directly to the APIC. No cloud, the AI assistant runs locally. Windows, Mac, Docker/Podman.

Dsclosure: they're commercial. There's a live demo of the dashboard and a free 7-day trial for both:

https://demo.madolka.com

https://license.madolka.com/trial

What would you want a tool like this to do that the APIC GUI doesn't?

hey all! im new to the networking automation world, but i have basic understanding of Python only.

I have this idea to create a marketplace that helps to provision end to end VPN service for a hobby project.

The scenario is:

Company A provides VPN services worldwide

A client from anywhere can choose to go into the marketplace (the orchestrator I'll be making) and choose from the marketplace what VPN vendor to choose from.

Client has to fill up provisioning form like what is their endpoint to route traffic from.

Once requested, Company A can choose to accept or decline the service requested by the client and im trying to lab out as the middleman, how can we automate the configurations of both parties?

Ive looked into Ansible, but i dont think that fulfills what i want to achieve as from what i know, Ansible is a tool deployed at the side of each party's network infrastructure.

Im diving into YANG models, NETCONF and RESTCONF but im hitting into a hardwall. Any tips?

POC stage of switch for educational purposes

Hello team

This is an open source project written purely in rust for network switch currently features are limited

I am also working on router

The goal is simple the images should be light weight for an user to run and practice their lab with all features integrated and without licence

Strictly for educational purposes only

https://github.com/singhdeepaks2293/NetworkSandbox

Hi everyone!

I'm an IT student working on a university Action Learning project. We have around 3 months to identify a real-world problem, research existing solutions, and build a working prototype.

I'm interested in networking, cybersecurity, network automation, and AI.

I'm looking for ideas that:

* Solve a genuine real-world problem.
* Are realistic to build and test within 3 months.
* Offer something different from existing tools.
* Can be tested through practical experiments with measurable results.
* Don't require expensive hardware.

I've already considered network troubleshooting tools and virtual lab projects, but I found that many similar solutions already exist.

**I'm especially looking for practical examples, not just broad ideas.** For example:

* A problem you've personally faced while configuring or managing networks.
* A repetitive task that you wish could be automated.
* A limitation in an existing networking or security tool.
* A real problem that current tools don't solve well.
* A project you've seen someone build that could be improved in a meaningful way.

If you suggest an idea, please explain **what the problem is, who faces it, how it could be solved, and what makes it different from existing solutions.**

I'm happy to explore niche or unusual ideas, as long as they're practical and can be demonstrated with a working prototype.

Thanks in advance! I'd really appreciate your experience and suggestions.

My typical automation method is to generate a new config from a data model (some source of truth) and all changes are done to the source of truth.

Configs are pushed as a complete config replacement.

NXOS, EOS, and JunOS/JunOS Evolved handle this well with only disrupting aspects of the config that were changed. For example, if you're only adding VLAN 20 to the VLAN database, it doesn't restart BGP.

Has anyone run into a NOS that doesn't handle this well? That loading up a new running config (or equivalent) disrupts all services instead of those that have any kind of change from the old config to the new config?

I build open-source tooling that takes an Arista AVD repository as it is (inventory, group_vars, playbook) and runs it from Kubernetes: AVD's own eos_designs role builds each switch's configuration in the cluster, and it is pushed over eAPI and kept there.

New since I first shared it in r/Arista: a containerlab twin, cabled as AVD cables the fabric.

uvx "netadopt[avd]" avd lab single-dc-l3ls --playbook build.yml --for containerlab \
  --ceos-image ceos:4.36.1F --extra-vars-out lab-vars.yml > single-dc-l3ls.clab.yml
sudo containerlab deploy -t single-dc-l3ls.clab.yml
uvx "netadopt[avd]" avd emit single-dc-l3ls --playbook build.yml -e @lab-vars.yml \
  | kubectl apply --server-side -f -

On AVD's own single-dc-l3ls example, 8 cEOS switches:

• a VLAN added to the model with kubectl edit is on the six leaves about half a minute later, and on neither spine
• a change made by hand on a switch is pushed back within a minute
• the twin and production run from the same objects; only the lab's extra vars differ
• before anything moves, netadopt avd compare renders the repository and the objects and compares every host

Limits today: one AVD version per release (6.4.0), YAML inventory files only, no custom_templates in eos_cli_config_gen yet.

Screenshots and a quick start: https://netclab.dev/avd/

A question for those running AVD in production: how do changes reach the fabric today - a pipeline running ansible-playbook, CloudVision, by hand? Would reconciliation from a cluster be welcome, or one more moving part?

Hi! I'm a developer from Turkey. I needed USB over IP, but I didn't want to pay for VirtualHere, FlexiHub or USB Network Gate, and plain USB/IP was too bare-bones: command line only, and it doesn't reconnect by itself. I also wanted a tool shaped around how I actually work, and above all one I could manage from a browser.

So I built USB Nexus, a free and open-source (GPL-3.0) tool for using USB devices over the network as if they were plugged in locally.

GitHub: https://github.com/inversa-bilisim/usb-nexus

How I use it: install it on two machines and plug the USB device into one of them. Then I pair the computers and attach the device from the web interface, without walking over to the other computer.

What it does

• Share USB devices from one computer and use them on another: printers, scanners, licence dongles, storage and so on
• Manage everything from a browser, or from the desktop app
• Pair computers once with a PIN. All traffic is encrypted with TLS 1.3 and mutual authentication
• Finds other computers on the LAN automatically
• Reconnects by itself after a network drop, a service restart or replugging the device, even into another port
• Per-device access control, plus a queue with automatic handover when several computers need the same device
• Interface in 10 languages

Honest status It's an early pre-release (v0.1.1). So far it has been tested on two Windows 11 PCs, sharing a USB stick and moving it between ports while it was in use. Linux and macOS packages are built but haven't been tried on real hardware yet. A Mac can only share devices, not use remote ones, because macOS doesn't allow third-party virtual USB controllers. The Windows installer isn't code-signed yet, so SmartScreen will show a warning.

Feedback, bug reports and testers are very welcome, especially on Linux.

Disclosure: I build Regnor, so this is our product. Posting for the pattern and the gotchas, not the pitch.

The flow, per device: back up, preview what the change adds, wait for approval, apply, wait for the switch to settle, then check two things: nothing else in the config moved, and the intended lines are really there. If either check fails, it restores the backup with configure replace, reads the config back and compares it with the backup.

Things we hit building it:

2:52 video, failing the check on purpose at 1:49: https://youtu.be/i9yQpuT5cWk

What do you check after a change before you call it done?

I'm part of a student team exploring a networking-related startup idea. Before building anything, we want to understand how network professionals handle real incidents.

When a network problem occurs:

• How do you collect diagnostic results from tools such as ping, tracert, Wireshark, or router logs?
• How do you document the investigation, root cause, and resolution?
• Do you find it difficult or time-consuming to combine evidence from multiple tools into one incident report?
• What tools or processes do you currently use to manage this workflow?

We're particularly interested in the experiences of network engineers, NOC teams, system administrators, and managed IT service providers.

We're researching the problem before developing a solution, so honest feedback—including if existing tools already solve it well—is welcome.

Thank you!

I noticed there was no community for automation related discussion for HPE Juniper Mist platform specifically, and this board may not be the place for it, so I have created one and I hope seasoned folks here would consider joining and sharing. If there are topics for discussion and code-related matters that you would like to advertise (and homebrew code that you would like to advertise for free utility in the community), please consider joining this group. Searching the web I have found a derth of community for such a cool API driven platform. We are living in the era when people can create anything and this is the platform that can respond to that. r/MistAutomation

Right now, I'm using Lynus and Trivy. Scripts output reports and I've added a few tools for my local AI to filter the report and add it to notion. Got notifications set up through ntfy as well when a critical finding needs my attention. Curious how everyone else stays on top of it all.

Discover how CopperTree Analytics and Optigo Networks turn network issues into action. Network diagnostics and building analytics work together to identify underlying issues, understand their impact, and prioritize corrective actions to supercharge building performance.

Let's talk about it. Join us for a one-hour joint webinar Oct. 28th exploring how to move beyond diagnostic reports and turn network findings into meaningful action.

Register today for free: https://register.gotowebinar.com/register/886415737951323480

Hi all,

Network engineer here. Not everyone on my team writes Python/Ansible, but we all need to push the same change to 30 switches or check which ones are missing a config line. So I built Vty SSH, a Windows app that sits between PuTTY and full automation:

- Multi-exec: type once, send to every checked tab

- Mass commands: run a command on a whole folder of switches, results side by side, CSV export

- Config backups with diff (keeps a version only when the config changed)

- Security audit of the configs (CIS / DISA STIG / ANSSI checks), A–E grade per switch, ready-to-paste fixes

- Guards against risky commands in the wrong tab (understands abbreviations like "rel" or "wr er")

- SSH, Telnet, serial console, imports from PuTTY / MobaXterm / CSV

- Backups encrypted at rest, secrets masked in logs and exports

The core is free, no account, no telemetry: https://getvty.com/en

I'm not trying to replace Ansible/Nornir. It's more for the "GUI people" on a team, or quick changes. Curious what you'd expect from a tool like this, and what's missing.

I'm looking for an experienced network expert or OpenWrt/OPNsense specialist to help me design and implement a custom routing and firewall system using an existing server that I already have.

I'm open to working with someone remotely.

The expert I'm looking for is someone with hands-on experience configuring advanced routing, policy-based routing, multiple proxy/VPN endpoints, firewall rules, and network isolation, not just  installing a standard router operating system.

1. Brief objectives

A network gateway that can serve approximately 5–10 computers or workstations used for freelance AI work.

The main requirement is that each device must consistently use its own dedicated, static residential public IP address, distinct from the IP addresses assigned to the other devices.

For example:

• Workstation 1 → Dedicated residential IP 1
• Workstation 2 → Dedicated residential IP 2
• Workstation 3 → Dedicated residential IP 3
• Workstation 4 → Dedicated residential IP 4
• Workstation 5 → Dedicated residential IP 5
• Additional workstations → Their own respective dedicated residential IPs

The IP-to-device mapping should persist across reboots and reconnections. I do not want a rotating-proxy arrangement where a device receives a different public IP every session.

I will source the residential IP endpoints separately. The expert can assess the provider's connection details and implement the appropriate gateway configuration.

2. Existing hardware

There is already a capable server and would prefer to use it instead of purchasing a separate dedicated router appliance.

I can provide the server's CPU, RAM, storage, network-interface details, and current operating system.

The expert can assess whether the best implementation would be:

• OpenWrt on bare metal;
• OpenWrt virtualized on an existing hypervisor, if appropriate;
• OPNsense/pfSense with suitable proxy-routing components; or
• Another technically sound architecture.

I'm open to recommendations based on reliability, maintainability, security, and compatibility with the required proxy endpoints.

The existing server may have other responsibilities, so I would also like advice on whether the routing gateway should run on dedicated hardware resources or in an isolated virtual machine.

3. Required network architecture

The intended logical architecture is:

Internet / ISP connection → Server-based gateway and firewall → Managed switch or suitable LAN infrastructure → Individual workstations

Each workstation should have an identifiable, fixed routing assignment.

For example:

• Device identification through DHCP reservations, MAC-address-based policies, or dedicated VLANs.
• A dedicated policy-routing rule for each workstation.
• A separate outbound tunnel or proxy path for each residential IP endpoint.
• Firewall rules preventing traffic from one workstation from inadvertently using another workstation's assigned endpoint.
• DNS configuration that is consistent with the selected routing path.
• IPv4 and IPv6 leak prevention, as applicable.
• A fail-closed mechanism so that if a workstation's assigned endpoint disconnects, its traffic is blocked rather than silently falling back to the ordinary ISP connection.

I would appreciate the expert's advice on whether individual VLANs, separate SSIDs, physical switch ports, or MAC-based routing would be the most practical way to isolate the devices.

The system should be easy to expand from five devices to ten without rebuilding the entire configuration.

4. Residential proxy compatibility

One of the key parts of this project is choosing the correct implementation for the type of endpoint supplied by the residential IP provider.

I may be working with static residential SOCKS5 or HTTP/HTTPS proxy endpoints, or with endpoints that support WireGuard/OpenVPN or another suitable tunnelling protocol.

I understand these are not interchangeable technologies. The expert should be someone who knows how to assess the provider's connection method and determine whether the appropriate solution involves:

• Native VPN tunnels and policy-based routing;
• A proxy gateway or transparent-proxy arrangement;
• OpenWrt packages such as sing-box, where appropriate;
• Another suitable Linux-based routing and proxy solution; or
• A combination of these technologies.

The goal is to route supported traffic from each workstation through its assigned endpoint, rather than merely configuring proxy settings separately in individual browsers.

Should be able to assess which endpoint types of proposed architecture supports and any limitations involving UDP, DNS, IPv6, QUIC, or applications that do not natively support proxies and preferably, a solution that can be managed centrally through a clear interface or well-documented configuration.

5. Security, reliability and leak prevention

Completed system should include:

• A properly configured firewall with a minimal attack surface. I have firewall device on the side if the need to use it is necessary
• Persistent device-to-endpoint assignments.
• Endpoint-specific kill switches or equivalent fail-closed rules.
• Protection against accidental direct-WAN fallback.
• Appropriate DNS and IPv6 leak controls.
• Logging sufficient to diagnose routing failures without unnecessarily collecting sensitive browsing data.
• Secure administrative access and documented recovery procedures.
• A tested way to restore the configuration after an update, reboot, or failure.
• A clear procedure for adding, removing, or replacing an endpoint.

Ensure that the gateway itself does not expose proxy credentials or administrative services unnecessarily.

System will be used for freelance work, and the configuration should remain consistent with the applicable service providers' terms and security requirements.

Please get in touch or recommend if you are experienced in implementing this type of multi-endpoint routing system. I am looking for a reliable, properly documented solution rather than a basic VPN installation.

Email: [nytonmay@gmail.com](mailto:nytonmay@gmail.com)

Thank you.