This is the hub for the PingLabz series on open source tools for network configuration. It's four posts, built in my home lab on Cisco IOS XE 17.18 routers and switches. Each tool solves one problem: knowing what changed, catching a bad change before it ships, and keeping the intended state in one place.
Oxidized 0.37 comes first, because backups come first. It pulls running configs into Git on a schedule, so every change ends up as a diff you can read. The post shows a real change, the diff that caught a mistake in it, what remove_secret hides, and the limits worth knowing before you rely on it.
Batfish is the second post. It models IOS XE configs offline, without touching a device. In my test it caught a shadowed ACL line and a static route that would have null-routed a LAN. It was also upfront about the 23 lines it couldn't parse, which you need to know before you trust a clean result.
The third post loads the network into NetBox 4.7 and uses it as the live Ansible inventory. Interface descriptions go from NetBox to the routers with check mode first, then apply, then an idempotent re-run, with Oxidized recording the result.
The capstone ties it together. One real IOS XE change starts as intent in NetBox, passes a Batfish check, goes out with Ansible, lands in Git through Oxidized, and then shows up in Loki, Zabbix and Akvorado. I list the versions used and where the workflow still has gaps.
The series in reading order
- Oxidized: Automatic Cisco IOS XE Config Backups to Git, with Real Diffs. Scheduled config backups to Git and the diff that caught a mistake.
- Batfish for Cisco IOS XE: Catch a Bad ACL and a Null Route Before They Go Live. Offline checks that caught a shadowed ACL line and a null route before deployment.
- NetBox as a Source of Truth for Ansible: Pushing Intent to IOS XE. NetBox 4.7 as the live Ansible inventory, pushing interface descriptions with check mode first.
- One Change, Every Tool: NetBox, Batfish, Ansible, Oxidized, Zabbix, Loki and Akvorado. One change from NetBox intent through Batfish, Ansible and Oxidized to Loki, Zabbix and Akvorado.
Where to start
Who this is for: teams that want change control without a commercial platform. Start with Oxidized if you have no config backups today. The Ansible side is covered in depth in the Ansible series.