> ## Content Index
> Fetch the complete content index at: https://www.pinglabz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Open Source Network Config Tools: The Complete Series
- URL: https://www.pinglabz.com/network-config-tools-series/
- Published: 2026-11-03T20:11:35.000Z
- Updated: 2026-11-03T20:23:21.000Z
- Description: The hub for the PingLabz config tools series: Oxidized backups to Git, Batfish offline validation, NetBox as the Ansible source of truth, and one real IOS XE change taken through all of them.
- Author: Jaime
- Tags: Network Automation, Tools

This is the hub for the PingLabz series on open source tools for network configuration. It's four posts, built in my home lab on Cisco IOS XE 17.18 routers and switches. Each tool solves one problem: knowing what changed, catching a bad change before it ships, and keeping the intended state in one place.

Oxidized 0.37 comes first, because backups come first. It pulls running configs into Git on a schedule, so every change ends up as a diff you can read. The post shows a real change, the diff that caught a mistake in it, what remove\_secret hides, and the limits worth knowing before you rely on it.

Batfish is the second post. It models IOS XE configs offline, without touching a device. In my test it caught a shadowed ACL line and a static route that would have null-routed a LAN. It was also upfront about the 23 lines it couldn't parse, which you need to know before you trust a clean result.

The third post loads the network into NetBox 4.7 and uses it as the live Ansible inventory. Interface descriptions go from NetBox to the routers with check mode first, then apply, then an idempotent re-run, with Oxidized recording the result.

The capstone ties it together. One real IOS XE change starts as intent in NetBox, passes a Batfish check, goes out with Ansible, lands in Git through Oxidized, and then shows up in Loki, Zabbix and Akvorado. I list the versions used and where the workflow still has gaps.

![Diagram: Network config tools series. A change path runs left to right: NetBox as the source of truth, Batfish pre-change checks, Ansible check mode then apply, the change itself on IOS XE routers and switches (highlighted), then Oxidized backup to Git with readable diffs. The change is also watched in Loki, Zabbix and Akvorado. The capstone post runs one change through every tool.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/11/hub-network-config-tools-series.png)

## The series in reading order

1. [Oxidized: Automatic Cisco IOS XE Config Backups to Git, with Real Diffs](https://www.pinglabz.com/config-oxidized-git-backups/). Scheduled config backups to Git and the diff that caught a mistake.
2. [Batfish for Cisco IOS XE: Catch a Bad ACL and a Null Route Before They Go Live](https://www.pinglabz.com/config-batfish-offline-validation/). Offline checks that caught a shadowed ACL line and a null route before deployment.
3. [NetBox as a Source of Truth for Ansible: Pushing Intent to IOS XE](https://www.pinglabz.com/config-netbox-source-of-truth/). NetBox 4.7 as the live Ansible inventory, pushing interface descriptions with check mode first.
4. [One Change, Every Tool: NetBox, Batfish, Ansible, Oxidized, Zabbix, Loki and Akvorado](https://www.pinglabz.com/config-open-source-workflow-capstone/). One change from NetBox intent through Batfish, Ansible and Oxidized to Loki, Zabbix and Akvorado.

## Where to start

Who this is for: teams that want change control without a commercial platform. Start with Oxidized if you have no config backups today. The Ansible side is covered in depth in the [Ansible series](https://www.pinglabz.com/ansible-network-automation/).