Network Operational State Validation with PyATS
Continuously validate operational state (BGP neighbors, OSPF adjacencies, interface counters, route tables) against intent, using PyATS and Genie.
The problem today
The configs are right but BGP is flapping. Or the OSPF adjacency is up but the route table is missing entries. Or the interface counters are showing errors that nobody is watching. Operational state is different from configuration, and most network teams check it manually, after a problem appears, by typing show commands into a terminal one device at a time.
How AI agents solve it
The Network Validation Agent uses PyATS and Genie to continuously parse operational state from every device and compare it against intent. BGP neighbors should be up. OSPF should converge within X seconds. Route tables should contain N routes. Interface error counters should be zero. Every check runs on a schedule, against every device, with the result diffed against intent. Failures alert with the exact device, command, and discrepancy.
Who this is for: Network engineers running production networks with PyATS or Cisco Genie experience
Manual workflow vs. Network Validation Agent
Manual workflow
- Operational state checked manually by typing show commands
- Checks happen after problems appear, not before
- No history of state, so you can't see when it drifted
- Every engineer has their own favorite commands to check
- BGP/OSPF flaps go unnoticed until something downstream breaks
With the Network Validation Agent
- PyATS runs operational-state checks continuously across every device
- Mismatches against intent alert immediately
- State history queryable for trend analysis and capacity planning
- Standard check library shared across the team
- BGP/OSPF/interface anomalies caught before they cause incidents
How the Network Validation Agent runs this
- 01
Define operational-state intent per device class (BGP up, OSPF converged, error counters at zero)
- 02
Network Validation Agent runs PyATS test cases against every device on a schedule
- 03
Genie parses show command output into structured data
- 04
Compare parsed state against the defined intent
- 05
For mismatches, capture the exact command, output, and expected value
- 06
Alert with the device, the failed check, and the diff
- 07
Track operational-state health as a per-device metric over time
Measurable impact
Catches operational drift before it becomes an incident
Replaces 'show command tribal knowledge' with a shared check library
Shifts state checking from reactive to continuous
State history enables trend analysis and capacity planning
Agents involved
Part of our Network Visibility solution
This use case is one piece of a larger pipeline
Operational state validation is the runtime check layer of the Network Visibility pipeline. See how it pairs with config validation in Batfish.
Explore the Network Visibility solutionGoverned by the AI Gateway
Every agent action in this use case is audited, policy-checked, and cost-tracked
Structura's AI Gateway sits between every agent and the underlying LLM providers. Every decision made during this use case. Every plan review, every policy check, every fix PR, is routed through guardrails, logged to an immutable audit trail, and evaluated against NIST AI RMF and AIUC-1 controls.
Learn about the AI GatewayRelated use cases
Keep automating
Build a Network Digital Twin with AI Agents
A continuously-updated Batfish digital twin of your production network. Test changes safely, simulate failures, and validate before you ship.
Pre-Deployment Network Validation with AI Agents
Batfish-powered reachability and ACL testing before any network change reaches production, catching breakage before it ships.
Firewall Change Validation with AI Agents
Every firewall rule change simulated against real traffic patterns before it ships, using Batfish and your production flow logs.
See this use case in a live demo
We'll walk you through exactly how the Network Validation Agent handles this in a real environment with your stack, your policies, and your constraints.