Advanced Lab
Comparing Candidate and Running Configuration
Objective
Use NAPALM's real load_merge_candidate()/compare_config() review flow directly (no Nornir), then write a risk heuristic that inspects the diff text itself before deciding whether a change looks safe.
Builds on NAPALM for Network Engineers.
Prerequisites
- Comfortable with load_merge_candidate() and compare_config() (Candidate Configuration and compare_config())
- Comfortable with commit_config() vs. discard_config() (Committing, Discarding, and Rollback)
Scenario
The problem
Candidate Configuration and compare_config() taught you how to preview a change before committing it. This lab asks the next question: once you have that diff, how do you decide -- automatically -- whether it's safe? A diff that only adds lines is usually fine. A diff that removes a line like ntp server or logging host deserves a second look before anyone commits it.
Review only -- never committed
This lab always ends by calling discard_config(), regardless of what the risk check finds. Nothing is ever committed to either sample device. The task is deciding whether a change looks risky from its diff, not applying it.
Starter data
Two devices, two different proposed changes -- fixture-driven, exactly like NAPALM's own mock driver in every earlier lesson.
{"diff": "+logging host 10.10.10.50"}A pure addition -- one new logging destination, nothing removed.
{"diff": "-ntp server 10.10.10.2\n+ntp server 10.10.10.99"}A removal followed by a replacement -- the existing NTP server (10.10.10.2, the same server the curriculum's own migration scenario introduced) is being swapped for an address nobody approved.
Task
Write review_change(hostname, fixtures_dir) that:
- Gets the mock driver via
get_network_driver("mock")and opens a connection usingoptional_args={"path": f"{fixtures_dir}/{hostname}"}. - Calls
load_merge_candidate()with any placeholder configuration string, thencompare_config()to get the diff. - Calls
discard_config()— this lab never commits. - Returns the diff string.
Then write assess_risk(diff) that:
- Splits the diff into lines and finds every line starting with
"-"(a removed line). - Flags the diff as risky if any removed line contains
"ntp server"or"logging". - Returns
{"diff": diff, "risky": bool, "risky_lines": [...]}.
Expected output
SAFE-RTR: {'diff': '+logging host 10.10.10.50', 'risky': False, 'risky_lines': []}
RISKY-RTR: {'diff': '-ntp server 10.10.10.2\n+ntp server 10.10.10.99', 'risky': True, 'risky_lines': ['-ntp server 10.10.10.2']}Real, verified output. SAFE-RTR's pure addition is correctly cleared; RISKY-RTR's NTP server removal is correctly flagged, with the exact offending line named.
Self-check only -- nothing here is submitted or graded. Compare against your own output manually.
Solution
Try the task yourself first -- the full solution and explanation stay hidden until you click above.
Key takeaways
- A diff isn't just something to display -- its content is enough to make an automatic first-pass safety judgment before a human ever looks at it.
- This lab reviews and discards, never commits -- deciding a change looks safe is a different, earlier step than actually applying it.
- NAPALM's real mock driver only -- no real device was used or required, and no config was ever committed to anything.
Related lessons
Done with this lesson?