batfish-config-analysis

name	batfish-config-analysis
description	Batfish network configuration analysis -- pre-deployment validation, reachability testing, ACL/firewall tracing, differential analysis, compliance checking. Use when validating configs before deployment, testing traffic paths, tracing ACL rules, comparing config versions, or auditing compliance policies. Strictly read-only.
license	Apache-2.0
user-invocable	true
metadata	{"openclaw":{"requires":{"bins":"[Truncated]","env":"[Truncated]"}}}

Batfish Configuration Analysis

MCP Server

• Source: Built-in (mcp-servers/batfish-mcp/)
• Command: python3 -u mcp-servers/batfish-mcp/batfish_mcp_server.py (stdio transport)
• Requires: Batfish Docker container running, BATFISH_HOST and BATFISH_PORT environment variables
• Python: 3.10+
• Dependencies: pybatfish, mcp[cli], python-dotenv

Available Tools (8)

Tool	Parameters	What It Does
batfish_upload_snapshot	snapshot_name, configs/config_path, network	Upload device configs to Batfish and create a named snapshot
batfish_validate_config	snapshot_name, network	Validate configs with per-device pass/fail status, vendor detection, warnings
batfish_test_reachability	snapshot_name, src_ip, dst_ip, protocol, dst_port	Test if traffic can flow between two endpoints with full path trace
batfish_trace_acl	snapshot_name, device, filter_name, src_ip, dst_ip, protocol, dst_port	Trace a packet through ACL rules to find matching permit/deny rule
batfish_diff_configs	reference_snapshot, candidate_snapshot, include_routes, include_reachability	Compare two snapshots for route and reachability differences
batfish_check_compliance	snapshot_name, policy_type	Check configs against compliance policies (6 built-in policy types)
batfish_list_snapshots	network	List all available snapshots
batfish_delete_snapshot	snapshot_name, network	Delete a snapshot

Workflow: Pre-Change Validation

When a user wants to validate configurations before deployment:

1. Upload configs: batfish_upload_snapshot with inline configs dict or path to config directory
2. Validate: batfish_validate_config to check parse status, vendor detection, warnings/errors
3. Test reachability: batfish_test_reachability for critical traffic paths
4. Check compliance: batfish_check_compliance against organizational policies
5. Report: Structured pass/fail results with specific findings
6. GAIT: All operations automatically logged

Example: Validate Before Deploy

# Upload proposed configs
batfish_upload_snapshot snapshot_name="pre-change-site-a" config_path="/path/to/configs/"

# Validate parse status
batfish_validate_config snapshot_name="pre-change-site-a"

# Test critical path
batfish_test_reachability snapshot_name="pre-change-site-a" src_ip="10.1.1.1" dst_ip="10.2.2.1" protocol="TCP" dst_port=443

# Check compliance
batfish_check_compliance snapshot_name="pre-change-site-a" policy_type="interface_descriptions"

Workflow: Change Impact Analysis

When comparing before/after configurations:

1. Upload "before" snapshot: batfish_upload_snapshot with current configs
2. Upload "after" snapshot: batfish_upload_snapshot with proposed configs
3. Diff: batfish_diff_configs to find route and reachability differences
4. Investigate: Use batfish_trace_acl on any newly denied traffic
5. Report: Structured diff showing added/removed/changed routes and flows

Workflow: ACL Troubleshooting

When investigating access control issues:

1. Upload configs: batfish_upload_snapshot with device configs
2. Trace packet: batfish_trace_acl with device, ACL name, and packet headers
3. Review: Identify matching rule, line number, permit/deny action
4. Test alternatives: Modify config, re-upload, trace again

Integration with Other Skills

Skill	Integration
pyats-config-mgmt	Validate configs with Batfish before pushing via pyATS
gait-session-tracking	All Batfish operations automatically logged
servicenow-change-workflow	Reference Batfish validation in change request evidence
fwrule-analyzer	Complement ACL trace with cross-vendor overlap analysis
cml-lab-lifecycle	Validate CML lab configs with Batfish analysis

Important Rules

• All operations are strictly read-only -- Batfish analyzes uploaded configs, never modifies network devices
• GAIT audit mandatory -- All operations logged automatically
• Snapshots are ephemeral -- Batfish manages snapshot lifecycle; use GAIT for persistent records
• Multi-vendor -- Supports Cisco IOS/IOS-XE/NX-OS, JunOS, Arista EOS, Palo Alto, F5

Error Handling

• BATFISH_UNREACHABLE: Verify Docker container is running (docker ps | grep batfish)
• SNAPSHOT_NOT_FOUND: Use batfish_list_snapshots to see available snapshots
• INVALID_INPUT: Check configs dict is non-empty or config_path exists
• DEVICE_NOT_FOUND: Use batfish_validate_config to list devices in snapshot
• FILTER_NOT_FOUND: Verify ACL/filter name exists on the specified device

Environment Variables

• BATFISH_HOST -- Batfish hostname (default: localhost)
• BATFISH_PORT -- Batfish port (default: 9997)
• BATFISH_NETWORK -- Default network name (default: netclaw)