Batfish Configuration Analysis

MCP Server

• Source: Built-in (mcp-servers/batfish-mcp/)
• Command: python3 -u mcp-servers/batfish-mcp/batfish_mcp_server.py (stdio transport)
• Requires: Batfish Docker container running, BATFISH_HOST and BATFISH_PORT environment variables
• Python: 3.10+
• Dependencies: pybatfish, mcp[cli], python-dotenv

Available Tools (8)

| Tool | Parameters | What It Does | |------|-----------|--------------| | batfish_upload_snapshot | snapshot_name, configs/config_path, network | Upload device configs to Batfish and create a named snapshot | | batfish_validate_config | snapshot_name, network | Validate configs with per-device pass/fail status, vendor detection, warnings | | batfish_test_reachability | snapshot_name, src_ip, dst_ip, protocol, dst_port | Test if traffic can flow between two endpoints with full path trace | | batfish_trace_acl | snapshot_name, device, filter_name, src_ip, dst_ip, protocol, dst_port | Trace a packet through ACL rules to find matching permit/deny rule | | batfish_diff_configs | reference_snapshot, candidate_snapshot, include_routes, include_reachability | Compare two snapshots for route and reachability differences | | batfish_check_compliance | snapshot_name, policy_type | Check configs against compliance policies (6 built-in policy types) | | batfish_list_snapshots | network | List all available snapshots | | batfish_delete_snapshot | snapshot_name, network | Delete a snapshot |

Workflow: Pre-Change Validation

When a user wants to validate configurations before deployment:

1. Upload configs: batfish_upload_snapshot with inline configs dict or path to config directory
2. Validate: batfish_validate_config to check parse status, vendor detection, warnings/errors
3. Test reachability: batfish_test_reachability for critical traffic paths
4. Check compliance: batfish_check_compliance against organizational policies
5. Report: Structured pass/fail results with specific findings
6. GAIT: All operations automatically logged

Example: Validate Before Deploy

bash
# Upload proposed configs
batfish_upload_snapshot snapshot_name="pre-change-site-a" config_path="/path/to/configs/"

# Validate parse status
batfish_validate_config snapshot_name="pre-change-site-a"

# Test critical path
batfish_test_reachability snapshot_name="pre-change-site-a" src_ip="10.1.1.1" dst_ip="10.2.2.1" protocol="TCP" dst_port=443

# Check compliance
batfish_check_compliance snapshot_name="pre-change-site-a" policy_type="interface_descriptions"

Workflow: Change Impact Analysis

When comparing before/after configurations:

1. Upload "before" snapshot: batfish_upload_snapshot with current configs
2. Upload "after" snapshot: batfish_upload_snapshot with proposed configs
3. Diff: batfish_diff_configs to find route and reachability differences
4. Investigate: Use batfish_trace_acl on any newly denied traffic
5. Report: Structured diff showing added/removed/changed routes and flows

Workflow: ACL Troubleshooting

When investigating access control issues:

1. Upload configs: batfish_upload_snapshot with device configs
2. Trace packet: batfish_trace_acl with device, ACL name, and packet headers
3. Review: Identify matching rule, line number, permit/deny action
4. Test alternatives: Modify config, re-upload, trace again

Integration with Other Skills

| Skill | Integration | |-------|-------------| | pyats-config-mgmt | Validate configs with Batfish before pushing via pyATS | | gait-session-tracking | All Batfish operations automatically logged | | servicenow-change-workflow | Reference Batfish validation in change request evidence | | fwrule-analyzer | Complement ACL trace with cross-vendor overlap analysis | | cml-lab-lifecycle | Validate CML lab configs with Batfish analysis |

Important Rules

• All operations are strictly read-only -- Batfish analyzes uploaded configs, never modifies network devices
• GAIT audit mandatory -- All operations logged automatically
• Snapshots are ephemeral -- Batfish manages snapshot lifecycle; use GAIT for persistent records
• Multi-vendor -- Supports Cisco IOS/IOS-XE/NX-OS, JunOS, Arista EOS, Palo Alto, F5

Error Handling

• BATFISH_UNREACHABLE: Verify Docker container is running (docker ps | grep batfish)
• SNAPSHOT_NOT_FOUND: Use batfish_list_snapshots to see available snapshots
• INVALID_INPUT: Check configs dict is non-empty or config_path exists
• DEVICE_NOT_FOUND: Use batfish_validate_config to list devices in snapshot
• FILTER_NOT_FOUND: Verify ACL/filter name exists on the specified device

Environment Variables

• BATFISH_HOST -- Batfish hostname (default: localhost)
• BATFISH_PORT -- Batfish port (default: 9997)
• BATFISH_NETWORK -- Default network name (default: netclaw)