Pybatfish

Batfish allows you to query the network model and parsed configuration settings using a set of specialized queries known as 'Batfish Questions'. These questions enable you to verify network behavior, inspect topology, and validate routing and forwarding logic based on the configuration and data you have provided to Batfish.

Questions are categorized into several domains, including:

• Config Properties: Inspecting parsed configuration settings.
• Topology: Querying the network structure and device relationships.
• Routing Protocols: Analyzing protocol-specific behavior (e.g., BGP, OSPF).
• Routing Tables: Inspecting RIB/FIB data.
• Forwarding: Simulating traffic flows and reachability.
• Filters: Verifying ACLs and policy application.
• Snapshot: Querying metadata about the network snapshot.
• IPsec & VXLAN/EVPN: Specialized queries for tunnel and overlay technologies.
• Resolving Specifiers: Checking how names or specifiers resolve.
• Differential Questions: Comparing differences between two network snapshots.

For detailed instructions on how to execute these questions, refer to the interacting with Batfish notebooks.

Batfish questions use specifiers to define sets of entities like nodes, interfaces, or IP addresses. Specifiers support rich selection logic including regex, set operations, and functional selectors.

Core Grammar Rules

• Set Operations: Use , for union, & for intersection, and \ for difference. Example: (node1, node2)\node1 resolves to node2.
• Regexes: Must be enclosed in forward slashes (e.g., /abc/). Batfish uses Java's regex syntax. Matching is case-insensitive.
• Escaping Names: Names starting with a digit, quote, or slash, or containing spaces/special characters (e.g., [ ] ( ) @ ! # $ % ^ ; ? < > = { }), must be double-quoted. Example: "1startsWithADigit" or "has space".
• Enum Set Grammar: Many specifiers follow a common pattern for selecting values from a set:
  • val1: Singleton set.
  • /val.*/: Regex match.
  • val1, val2: Union of values.
  • ! val1: All values except val1.
  • !/regex/: All values not matching the regex.

Batfish supports several categories of network correctness checks:

• Configuration Compliance: Validates that settings (MTU, AAA, NTP, logging, etc.) match templates and flags undefined or unreferenced structures like ACLs or route maps. It can also ensure devices are only accessible via SSHv2 with non-null passwords.
• Reliability: Checks if end-to-end reachability is maintained during single-link or single-device failures and ensures global reachability for critical services like DNS.
• Security: Verifies that sensitive services are restricted to specific subnets/devices and ensures traffic paths traverse expected elements (e.g., firewalls) or meet ECMP requirements.
• Change Analysis: Compares current vs. planned configurations to ensure reachability remains identical, verifies that ACL/firewall changes cause no collateral damage, and checks functional equivalence between different vendor configurations.

To analyze how your network handles specific external prefixes or to simulate routes coming from an external peer, you can provide external BGP announcements.

Setup Requirements:

1. Create a file named external_bgp_announcements.json.
2. Place it directly inside the top-level snapshot folder.

Announcement Schema:

• type: Either ebgp_sent (attributes as sent by the external peer) or ebgp_received (attributes after local import policy processing).
• network: The prefix (e.g., 4.0.0.0/8).
• nextHopIp: The next hop IP.
• srcIp: The source IP.
• dstNode: The destination node in your network.
• dstIp: The destination IP.
• srcProtocol: The protocol (e.g., AGGREGATE).
• originType: The origin type (e.g., egp).
• localPreference: BGP local preference.
• med: Multi-Exit Discriminator.
• asPath: An array of AS path segments.
• communities: An array of community values.
• dstVrf: The destination VRF.

{
  "Announcements": [
      {
          "type" : "ebgp_sent",
          "network" : "4.0.0.0/8",
          "nextHopIp" : "10.14.22.4",
          "srcIp" : "10.14.22.4",
          "dstNode" : "as1border2",
          "dstIp" : "10.14.22.1",
          "srcProtocol" : "AGGREGATE",
          "originType" : "egp",
          "localPreference" : 0,
          "med" : 20,
          "originatorIp" : "0.0.0.0",
          "asPath" : [ [ 1239 ], [7018, 7019]],
          "communities" : [ 262145 ],
          "dstVrf":"default",
          "clusterList":[]
      }
  ]
}

The jupyter_notebooks directory contains a collection of notebooks demonstrating various network analysis and validation tasks using Batfish. These notebooks serve as practical guides for different use cases, ranging from basic configuration checks to complex failure-impact analysis. All network snapshots required by these notebooks are located in the networks subfolder of the repository.

Available notebook categories include:

Basics

• Getting Started with Batfish: Overview of Batfish capabilities.
• Pandas Examples: Using Pandas to manipulate Batfish query results.
• Validating Configuration Settings: Validating settings like NTP, TACACS, AAA, and SNMP.
• Uncovering Configuration and Behavior Drift: Comparing two network snapshots to find differences in settings or behavior.

ACLs and Firewalls

• Analyzing ACLs and Firewall Rules: General analysis of access control lists and firewall rules.
• Provably Safe ACL and Firewall Changes: Workflow for ensuring rule changes are correct and safe.
• Safely refactoring ACLs and firewall rules: Understanding the impact of refactoring complex rules.

Cloud Networking

• Analyzing public and hybrid cloud networks: Analysis of cloud and hybrid network environments.

Forwarding Analysis

• Introduction to Forwarding Analysis: Using traceroute and reachability queries to analyze forwarding paths.
• Introduction to Forwarding Change Validation: Ensuring network changes do not impact packet forwarding.

Failure-impact Analysis

• Analyzing the Impact of Failures: Conducting Chaos Monkey style testing to see how failures affect the network.

Routing Analysis

• Introduction to Route Analysis: Analyzing routing tables computed by Batfish.
• Introduction to BGP Analysis: Analyzing BGP session configurations.
• Analyzing Routing Policies: Analyzing routing policies using Batfish.