NetPilot

Is this network change safe for production?

Nobody can tell from the diff alone. Rebuild the devices the change touches on the same network OS, apply the change there and compare the device output before and after: routing table, neighbours, the prefixes you expect and the ones you do not. Take the verified commands and both outputs into the change window as the rollback evidence. With NetPilot connected in ChatGPT, Claude or Meta Muse, you ask the assistant to build the devices, apply the change and show the before and after, and it runs the commands on real Cisco, Arista, Juniper, Nokia, SONiC or FRR images in your own lab VM.

How to find out, in five steps

  1. 1

    Name the devices the change touches

    Two or three devices is usually enough: the one you edit and the neighbours whose state can move. Give the assistant their network OS and the current configs, pasted with the secrets removed, or describe them. It designs the matching topology and deploys it on your lab VM with containerlab.

  2. 2

    Capture the before state

    Ask for the routing table, the neighbour summary and the prefixes on each device. The assistant runs the show commands on the real devices and quotes the output. This is the baseline the change is judged against.

  3. 3

    Apply the change

    Paste the exact lines you plan to push in the window. The assistant applies them to the lab devices, nothing else, and tells you if a line is rejected by that OS version.

  4. 4

    Capture the after state with the same commands

    Same commands, same devices. The difference between the two outputs is the whole effect of the change: a prefix that disappeared, a neighbour that reset, a next hop that moved. If something moved that should not have, you found it here.

  5. 5

    Carry both outputs into the window

    The before output is the rollback target, the after output is what success looks like, and the command list is the verification script. Run the same commands on the production devices after the push and compare.

Say this to the assistant

Build R1 and R2 on Cisco IOL with the configs I pasted. Run show ip bgp summary and show ip route bgp on R1. Then apply the inbound prefix-list on R1 toward R2, clear the session soft inbound, run the same two commands again and show me both outputs side by side.

What the output looks like

An inbound prefix-list on R1 is meant to drop one prefix from the peer and leave the rest alone. The same two commands, run before and after, say whether it did exactly that. Here the prefix count on the session goes from 3 to 2, the one prefix is gone from the routing table, and the session never reset, since Up/Down kept counting.

Before the change
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65001
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.12.2       4 65002      48      46        7    0    0 00:41:17        3

R1# show ip route bgp
B        10.20.0.0/24 [20/0] via 10.0.12.2, 00:41:17
B        10.30.0.0/24 [20/0] via 10.0.12.2, 00:41:17
B        10.99.0.0/16 [20/0] via 10.0.12.2, 00:41:17
After the change
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65001
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.12.2       4 65002      52      49        8    0    0 00:44:03        2

R1# show ip route bgp
B        10.20.0.0/24 [20/0] via 10.0.12.2, 00:44:03
B        10.30.0.0/24 [20/0] via 10.0.12.2, 00:44:03

The commands, by network OS

Run the same set before and after. The assistant knows the syntax for each network OS, so you can say "show me the BGP neighbours on every device" and read the per-vendor output it quotes.

Network OSCommands to run before and after
Cisco IOS (IOL)
show ip bgp summaryshow ip routeshow ip ospf neighbor
Arista EOS (cEOS)
show ip bgp summaryshow ip routeshow bgp evpn summary
Juniper Junos (cRPD)
show bgp summaryshow routeshow ospf neighbor
Nokia SR Linux
show network-instance default protocols bgp neighborshow network-instance default route-table
SONiC
show ip bgp summaryshow ip routeshow vxlan tunnel
FRR
vtysh -c "show ip bgp summary"vtysh -c "show ip route"

The report the assistant hands back

Ask for the comparison as a table and the assistant lays the before and after side by side per check, with the line that changed called out. The same report from the NetPilot web app, for an iBGP change on a branch router, looks like this.

app.netpilot.io

What you need

  • A NetPilot account on Pro, Max, Team or Signature, including a Team seat or a Signature seat in an organization. On Free or Plus you can connect and sign in, and each tool answers with a note that the feature is included from Pro.
  • NetPilot connected in your assistant: ChatGPT, Claude.ai, Claude Code or Meta Muse. The lab VM is created the first time you ask the assistant to start it.
  • The configs of the devices the change touches, with the secrets removed, or a description of them. Nokia SR Linux and FRR are built in. Cisco IOL, Arista cEOS, Juniper cRPD and SONiC run as bring-your-own-image (BYOI), added once in the NetPilot app.

Run it from the chat you already have open

  1. 1Connect NetPilot in ChatGPT, Claude or Meta Muse: how to connect, step by step.
  2. 2A NetPilot account on Pro, Max, Team or Signature, including a Team seat or a Signature seat in an organization. On Free or Plus you can connect and sign in, and each tool answers with a note that the feature is included from Pro. Plans and lab credits.

Common questions

You find out by running the change on the same devices and the same network OS before the window, not by reading the diff. Build the two or three devices the change touches, capture the routing table and neighbour state, apply the change, capture again and compare. With NetPilot connected in ChatGPT, Claude or Meta Muse, the assistant builds the devices on real images in your lab VM, runs the commands and quotes both outputs, so the same commands verify the change on the production devices during the window.
Five things, with the same commands run twice: the routing table on each device the change touches, the neighbour or adjacency state (BGP, OSPF, IS-IS, EVPN), the prefixes received and advertised on the affected sessions, reachability from a host behind the change, and the running config diff. A change is clean when only the lines you intended differ between the two captures.
On their own, ChatGPT and Claude read a config and reason about it. With NetPilot connected, the assistant has tools that build the devices on real network operating systems in your NetPilot lab VM, apply the change and run show commands on them, so the answer comes from device output instead of a prediction. NetPilot in an assistant needs a Pro, Max, Team or Signature plan.

Keep reading

Network change validation

The method in full: mirror lab, pre and post snapshot, the diff a change board signs off on.

Test a route-map, ACL or OSPF cost change

Three worked experiments with the before command, the change and the after output.

Reproduce a BGP issue before the vendor case

The smallest topology that shows the symptom, the configs and the commands whose output is wrong.

Stop testing network changes in production

BGP, ACL and routing change validation patterns, with the commands.

NetPilot in ChatGPT, Claude and Meta Muse

How to connect, what the tools do, which plan is needed, lab credits and the idle timeout.

Plans

What each plan includes, with lab credits and idle timeouts.

Test the next change from the chat you already use

Create a NetPilot account, pick Pro or above, and connect NetPilot in ChatGPT, Claude or Meta Muse.

Create an account