Case study 01 / Network automation

Network Config
Auditor

A dependency-free Python CLI for reviewing Cisco IOS-style configurations before they reach a device.

View source Sample report

Role: Design and implementation
Stack: Python · Cisco IOS · GitHub Actions
Output: Text · JSON · Markdown
Status: Tested · Public

The problem

Configuration reviews are easy to make vague: a warning without the command, location, or remediation leaves the engineer to repeat the investigation.

This project treats every finding as a reviewable claim. The analyzer preserves line numbers, identifies the exact command that triggered a rule, assigns a severity, and gives a concrete next step.

It stays offline and read-only. No device credentials are needed, and the tool never attempts to modify a running configuration.

How it works

InputIOS configuration
One file or a recursively discovered directory of configuration files.
ParseLine-aware sections
Global commands, interfaces, VTY lines, and OSPF blocks retain source locations.
EvaluateFocused rules
Deterministic checks cover management access, credentials, Layer 2, OSPF, and operations.
ReportUsable evidence
Terminal, JSON, and Markdown renderers share the same finding model.

Engineering decisions

Evidence over scores

The output avoids a made-up overall grade. Each rule stands on its own with a source line and recommendation.

Small, explainable scope

Fourteen explicit rules are more defensible than pretending to implement every IOS platform and default.

No runtime dependencies

The standard library handles parsing, the CLI, data models, and report generation.

Automation-friendly exits

Severity thresholds make the same command useful interactively or as a CI gate.

Review output

The included insecure switch configuration produces 16 findings. Its hardened counterpart produces none.

The samples are intentionally small so each result can be traced back to a deliberate configuration choice.

HIGH   SEC001  VTY access is not restricted to SSH

line vty 0 4 may accept an unencrypted
remote-management protocol.

line 22: transport input telnet

Fix: Configure 'transport input ssh'
after validating SSH access.

Validation

14audit rules

11unit tests

3Python versions in CI

0runtime dependencies

Parser behavior, rule triggering, report serialization, recursive file discovery, and CI severity thresholds are covered by the test suite. GitHub Actions repeats those checks on Python 3.11, 3.12, and 3.13.

Limits and next steps

Static analysis should start a review, not replace engineering judgment.

IOS syntax, defaults, and inherited policy vary across platforms and releases. A production assessment must also account for AAA policy, management-plane ACLs, software versions, approved exceptions, and the device’s role.

Useful next additions are per-rule suppression with documented justification, configuration diffs, and a vendor-neutral rule interface.

Next project

Routing resiliency,
tested by failure.

Read OSPF case study

Network ConfigAuditor