CHNUG#5

Would you give an AI full access to your production
network? Neither would we. But what if AI could write
almost every network change without ever touching
production directly?

In this session, we show how Network as Code, open-source
tools, and AI come together to automate network operations
safely, across vendors and architectures.

We'll walk through a practical toolchain built on YAML,
Git, Terraform, CI/CD pipelines, and automated validation
and testing. You'll see how network intent becomes a
reviewed, tested, and repeatable deployment, and why this
approach isn't limited to Cisco.

Then we move from the lab to a real enterprise rollout: a
European insurer modernizing its network across multiple
sites, with hundreds of switches and over a thousand
access points. AI helps create data models, troubleshoot
failures, generate tests, and improve configurations. In
the lab, we let AI experiment, fail, and learn. In
production, every change passes through deterministic
pipelines and human approval.

We'll share real results, unexpected failures, and lessons
learned, including how a five-minute failover became a
matter of seconds.

No AI magic. No vendor lock-in. Just practical automation,
open-source tools, and engineering guardrails that work in
the real world.

The key takeaway: Let AI break the lab, not your
production network.

This talk describes a fully open source control- and
management plane for EVPN gateways on VPP, driven by a
custom Bird `vppevpn` implementation. It gives operators
fleet-wide life-cycle
management of EVPN instances and their IPv4 and IPv6 Bridge
Virtual Interfaces (BVIs), plus a
fast, coordinated failover of the L3 anycast default
gateway (a virtual MAC and its IPv4/IPv6 addresses) from
one VPP host to another.

This presentation explores a reusable approach to network
configuration automation that separates defining desired
state from deploying it. Operators declare shared and
device-specific settings in YAML; Ansible filter plugins
compose those layers into a concrete configuration, while
vendor-specific modules compare it with device state and
manage deployment.

Compared with assembling configuration inside playbook
tasks or templates, this approach centralizes composition
rules, makes them independently testable, and keeps
deployment logic focused on device interaction. Where
supported, schema validation and native device diffs enable
preflight checks and preview before explicitly confirmed
changes.

Developed initially as a proof of concept for NVIDIA
Cumulus, the workflow provides a foundation for a broader,
vendor-agnostic architecture - not a universal
configuration model. The representation examines which
responsibilities can be shared across vendors and which
must remain device-specific, alongside the benefits and
trade-offs of maintaining this separation.