Introduction to Batfish for Automated Network Testing & Verification
summary
Demonstrates using Batfish plus Ansible templates and Docker to run offline config analysis inside a Travis CI pipeline: snapshots of configs, interfaces and layer‑1 topology feed Batfish’s vendor‑neutral model; extract‑facts and validate-facts catch concrete issues — missing logging servers, typos in IPs, absent ACL 110, an undefined ACL 299, two interfaces left up, and a proposed static default that would create a forwarding loop — then shows PR diffs, rerun CI and a passing merge.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:20What is Batfish?
- 2:22What problems is Batfish solving?
- 3:24Use cases for Batfish
- 4:03How Batfish works
- 4:49Batfish - Snapshot Layout
- 7:37Ansible - Inventory, Pt. 1
- 8:27Ansible - Config Generation - Playbook
- 9:13Batfish - Expected Facts
- 14:17Fix Hygiene Issues
- 15:06Firewall Rule Addition
- 17:11Add ASA ACL Rules
- 18:58Topology Diagram
- 19:26Implement Static Routes
related talks
12mMetha: Network Verifiers Need To Be Correct Too!
17mDifferential Network Analysis
32mAutomating Web Application Bug Hunting
56mA Practical Look at NetDevOps
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
35mContainer security automation with Ansible
39mAutomating myself out of a job...
16mTest Coverage for Network Configurations