NA011 - Netlab, ACLs and AI-Generated Configs with Ivan Pepelnjak

Network Auto Magic Podcast  

Netlab, ACLs and AI-Generated Configs with Ivan Pepelnjak

Episode Overview  

Ivan Pepelnjak joins Steinn and Urs for episode eleven — in decimal, before you ask. Ivan is a CCIE Emeritus, the author of more Cisco Press books than most of us have read, the voice behind ipSpace.net, and the creator of netlab, an open source tool that builds and configures virtual labs across roughly twenty platforms. He describes it himself as an “intent based digital twin lifecycle management system”, then immediately admits that’s a bullshit bingo winner if you have the right card. The conversation digs into why LLMs write decent Python and terrible router configs, the ChatGPT doom loop Ivan hit trying to configure EVPN on Nokia SR OS, and the endless device quirks hiding behind multi-vendor abstraction — Juniper loopbacks, Nokia prefix lengths, and one vendor with roughly 400 keywords you are simply not allowed to use as a VLAN name. Plus: why every layer 3 switch is really a bridge in disguise, why ACLs are containable and QoS never will be, what a real CCIE engagement looks like when you inherit twenty years of customer mistakes and get exactly one command to fix them, and a closing controversial opinion about conferences that will annoy at least one organiser.

Episode Guest  

• Ivan Pepelnjak: CCIE Emeritus, network architect, trainer, and prolific author. Writes at ipSpace.net, where he has been documenting and dismantling networking vendor claims for the better part of two decades. Creator and maintainer of netlab, and author of the free BGP, IS-IS and VXLAN/EVPN hands-on lab collections.
  • Blog: ipSpace.net
  • netlab: netlab.tools
  • LinkedIn: Ivan Pepelnjak

Listen to the show on YouTube:  

Listen to the show anywhere:  

• YouTube: @networkautomagic
• Spotify: Network AutoMagic
• Apple Podcasts: Network AutoMagic
• RSS Feed: Anchor.fm

Show notes resources:  

• netlab — Ivan’s open source lab builder: describe a topology in YAML, get addressed, configured devices across ~20 platforms
• netlab on GitHub — Source, issues, and the device quirk modules discussed in the episode
• netlab examples — Community-contributed topologies showing how things are actually done
• BGP labs — Free hands-on BGP exercises, runnable in a GitHub Codespace
• IS-IS labs — The same format, for IS-IS
• VXLAN/EVPN labs — And again, for VXLAN with EVPN
• ipSpace.net blog — netlab tag — 100+ posts of tips, tricks and vendor bug archaeology
• Batfish — Config analysis by reverse-engineering what’s already deployed, the opposite problem to netlab’s
• Capirca — Google’s multi-platform ACL generator
• Aerleon — The actively maintained fork of Capirca

What we cover:  

What Netlab Actually Is  

• The Bullshit Bingo Definition: “Intent based digital twin lifecycle management system” — Ivan’s own description, delivered with full awareness of what it sounds like
• Five Years, Twenty Platforms: Built with a group of contributors, targeting things that work in real life, which is exactly why it generates so much material for bitching blog posts
• Is It a Crutch for Beginners?: Ivan’s answer depends on where you are — if you’re learning subnetting, do the subnetting. If you’re past that, don’t hand-craft Vagrant files for fun
• Scaling Across Servers: An August release feature — split a lab across a rack of servers, with VXLAN tunnels built automatically between nodes on different hosts. “Mini Kubernetes without the overhead of Kubernetes”

Why AI Writes Python Fine and Configs Badly  

• The Volume Problem: Search for Python and get a hundred times more hits than entry-level Cisco material. The niche scenarios simply aren’t out there
• Urs on Near-Identical Syntax: Two vendors with configuration that is almost the same but not quite — the worst possible training data
• One Way to Do It: With Python you can weasel around until something works. A router config usually has exactly one right answer
• The Nokia SR OS Doom Loop: Three pages of EVPN documentation, a confident ChatGPT answer that didn’t work, and five rounds of “you’re absolutely right” before landing back at square one. The real answer was behind a well-hidden Design Guides link

Cloning Production Into a Lab  

• The Hot Tub Dream: Ask a bot from Slack to rip configs off two production routers, build a facsimile in netlab, and test OSPF options
• Ivan’s One-Line Verdict: “Control plane probably works. Data plane is a lottery.” Starting with interface names, and going downhill from there
• Where AI Genuinely Delivers: Steinn’s production story — small-context agents auditing ACLs router by router, finding a /24 split into two /25s on some devices and not others, and producing a CSV of exactly which routers drifted

AI Code Review vs AI Code  

• Great at Checking: Ivan now feels anxious merging a PR that GitHub Copilot hasn’t looked at — it finds problems across modules he wouldn’t think to check
• Bad at Fixing: The generated code is technically correct, handles every edge case that can never happen, and comes back three to five times longer than the one-line fix the problem actually needed
• “Only an LLM Will Understand It a Year From Now”: The real cost of verbose, defensive generated code in a codebase you have to maintain
• The 99% Rule: “How many of your one-off scripts were only used once?” — the question that ends the whole quality-versus-speed argument
• Vibe Coders, 1982 Edition: A regional airline pilot deciding to solve the NP-hard crew scheduling problem on a ZX Spectrum. Same movie, twentieth technology

The ACL Problem (and Every Problem It Stands For)  

• What Netlab Supports: Source and destination prefixes, protocols, port numbers, node references that expand into addresses — roughly 20% of the Cisco IOS ACL parameter space, on purpose
• Cartesian Products: Five addresses to three addresses becomes fifteen entries. Dual-stack doubles the lists, and the entry counts diverge between IPv4 and IPv6. Sequence numbers get regenerated because there’s no alternative
• Leaky Abstractions: Steinn’s Apstra example — VRF names capped at fifteen characters because that’s Nokia’s limit, inherited by every customer whether they run Nokia or not
• ACLs Are Containable. QoS Is Not.: Ivan draws the line, and Steinn’s verdict on QoS: “It never works. It never has worked. It’s a lie.”
• Solving a Different Problem to Batfish: Batfish, Forward Networks and IP Fabric reverse-engineer deployed networks. Netlab generates simple filters that deploy identically across vendors — different problem, non-transferable code

Device Quirks and Vendor Archaeology  

• The Quirks Architecture: Every device gets a Python module with final say on whether a configuration will actually work on that platform
• Juniper: Cannot have more than one loopback, unless it can, and then it’s one per routing instance
• Nokia SR OS: Really doesn’t like anything but a /128 on the system loopback, though /64 on a regular loopback is fine
• EXOS and the 400 Forbidden VLAN Names: A documented, pages-long table of keywords you cannot use as a VLAN name, scraped by a contributor into twenty lines of Python. Ivan’s assessment of the parser authors is not printable
• Every Layer 3 Switch Is a Bridge in Disguise: The clearest explainer in the episode — layer 3 switches are bridges with routers attached, every L3 interface is secretly a hidden VLAN, and that’s why reserved VLAN ranges exist. Arista grabs whatever’s free instead, which is great until you want that VLAN

Labs, Learning and the Job  

• BGP Labs Built Like Gym Machines: One concept per exercise — here’s the problem, here’s a hint, here are the verification steps, you work out local preference yourself
• Free in a Codespace: If you’re happy with FRR, SR Linux, VyOS or Arista containers, the labs run for free in GitHub Codespaces
• Why CCIE Scenarios Are So Insane: Because that’s the job — twenty years of accumulated bad design, nothing you’re allowed to touch, and one command to fix it
• The Power of Saying No: A CCIE’s back-to-back VRF and NAT design on a single router, replaced with three simple boxes and an honest conversation. Everyone expected to lose the deal. The customer’s manager said thank you
• Hardware Is Not the Lab: Virtual platforms diverge from silicon. Go find the word “maximum” in the hardware guide before you find it the hard way

Controversial Opinion  

• Presentations Stopped Paying Off Decades Ago: Once you reach a certain level you’re only there for the last 20%, and the speaker always burns the clock on the intro
• The Hallway Track Is the Only Track: Most conferences kill it by never creating a shared space, so the corridors sit empty while everyone’s in a session
• “They Sold You the Ticket. They Don’t Care Where You Are.”: The line that will annoy at least one conference organiser

Key Takeaways  

1. AI Is a Checker, Not an Author: It finds bugs across modules you’d never think to inspect, and it writes fixes five times longer than the problem deserves. Use it accordingly
2. Multi-Vendor Abstraction Is Paid For in Device Quirks: Four hundred forbidden VLAN names, loopback rules that contradict themselves, prefix-length preferences. Someone does that work so you don’t have to
3. Know Where the Abstraction Leaks: ACLs are containable if you accept limits. QoS isn’t. Picking the wrong side of that line costs years
4. Every Layer 3 Interface Is a Hidden VLAN: Once you see it, reserved ranges and Arista’s initialisation dance both stop being mysterious
5. Lab It Before You Need It: Netlab has a learning curve. Discovering that during an outage is the wrong time
6. Say No Earlier: The customer who hears an honest “we won’t do that, here’s what will work” is more likely to thank you than fire you
7. Talk to People in the Hallway: The presentations are recorded. The conversations aren’t