Batfish
What it is
Batfish is a free, open-source tool for analyzing network-device configurations and checking policy and behavior before or after deployment. It works from configuration files, so core analysis does not require direct access to network devices. Batfish can validate planned changes, inspect deployed configurations, compare current and proposed reachability, and assess functional equivalence between configurations from different vendors. Checks include undefined references, MTU and AAA settings, template compliance, ACL or firewall changes, expected traffic paths, and access to sensitive services from specified subnets or devices. Reliability analysis tests whether end-to-end reachability survives a single-link or single-device failure and whether services such as DNS remain globally reachable. Pybatfish provides a Python 3 SDK, with example Jupyter notebooks and an all-in-one Docker container. Batfish runs on operating systems supporting Docker. Documented device support includes Arista, AWS, Azure, Cisco, Juniper, Palo Alto Networks, SONiC, and others; Aruba, Dell Force10, and Foundry have limited support.
For and against
For
- Open-source and free
- Validates changes before deployment
- Analyzes configurations without device access
- Provides Python 3 SDK and notebooks
- Checks single-link and single-device failures
Against
- Limited support for Aruba, Dell Force10, and Foundry
- Requires configuration files for core analysis
- Docker support is required to run it
- Community support is through Slack or GitHub
The verdict
Batfish offers broad configuration, reachability, security, and change analysis without requiring live device access. Its open-source model and vendor coverage are balanced by limited support for some platforms and a Docker-based setup.
Who it suits
Batfish suits network engineers who need configuration validation, security checks, and failure analysis before deployment. It is also useful to teams working with multiple network vendors and Docker-capable environments.
On the record
- Change analysis
- Batfish can compare current and planned reachability, assess ACL or firewall changes, and test functional equivalence between configurations from different vendors.github.com · read 5 Oct 2026
- Change comparisons
- Batfish can compare reachability across current and planned configurations and assess functional equivalence between configurations from different vendors.github.com · read 5 Oct 2026
- Change validation
- Batfish can validate planned configuration changes before deployment and deployed configurations as well.github.com · read 5 Oct 2026
- Community support
- The project directs users with questions or feature requests to its Slack community or GitHub.batfish.org · read 5 Oct 2026
- Configuration checks
- Checks include undefined references, settings such as MTU and AAA, and whether devices meet specified configuration templates.github.com · read 5 Oct 2026
- Deployment
- The project provides an all-in-one Docker container that includes Batfish and example Jupyter notebooks.github.com · read 5 Oct 2026
- Device access
- Core analysis requires network device configurations and does not require direct access to network devices.github.com · read 5 Oct 2026
- Failure analysis
- Batfish can check whether end-to-end reachability is preserved after any single-link or single-device failure.github.com · read 5 Oct 2026
- Integrations
- The maker documents Ansible modules for extracting and validating configuration facts and asserting network behavior in playbooks.batfish.org · read 5 Oct 2026
- License
- Batfish is released under the Apache Software License, Version 2.0.github.com · read 5 Oct 2026
- Operating systems
- Batfish can run on any operating system that supports Docker; its containers are actively tested on Mac OS X and Ubuntu 16.04 LTS.github.com · read 5 Oct 2026
- Pre-deployment checks
- Batfish can validate configuration changes before deployment to help ensure only correct changes are deployed.github.com · read 5 Oct 2026
- Purpose
- Batfish analyzes network device configurations to find policy violations and validate network behavior.github.com · read 5 Oct 2026
- Python client
- Pybatfish is a Python SDK for interacting with the Batfish service.github.com · read 5 Oct 2026
- Reliability analysis
- Batfish can check reachability after single-link or single-device failures and whether services such as DNS are globally reachable.github.com · read 5 Oct 2026
- Security analysis
- Checks can verify that sensitive services are reachable only from specified subnets or devices and that traffic follows expected paths.github.com · read 5 Oct 2026
- Security checks
- Supported checks include verifying that sensitive services are reachable only from specified subnets or devices.github.com · read 5 Oct 2026
- Support
- The maker directs users with questions or feature requests to its Slack community or GitHub repository.batfish.org · read 5 Oct 2026
