Batfish

What Batfish is

Batfish is an open-source network configuration analysis tool for checking policy and expected network behavior. It works from device configurations, so core analysis does not require direct access to network devices. Teams can use it to validate deployed configurations and assess proposed changes before deployment. Checks include undefined references, MTU and AAA settings, and whether devices match specified templates. Security analysis can verify that sensitive services are reachable only from designated subnets or devices, and that traffic follows expected paths. Batfish can also check whether end-to-end reachability survives a single-link or single-device failure, compare reachability between current and planned configurations, assess ACL or firewall changes, and evaluate functional equivalence across vendors. Pybatfish provides a Python 3 SDK, and example Jupyter notebooks are available. An all-in-one Docker container includes Batfish and notebooks. It can run on operating systems that support Docker; its containers are actively tested on Mac OS X and Ubuntu 16.04 LTS. Supported configurations include platforms such as Arista, AWS, Azure, Cisco, Juniper, and Palo Alto Networks. Support is limited for Aruba, Dell Force10, and Foundry. Questions and feature requests can go to Slack or GitHub.