Capstone: A Multi-Vendor-Ready State & Compliance Report

import json
import os
from napalm import get_network_driver
from napalm.base.exceptions import ConnectionException, ConnectAuthError

MGMT_INTERFACE = "GigabitEthernet0/1"
EXPECTED_DESCRIPTION = "mgmt-uplink"
EXPECTED_IPS = {
  "SW1": "10.10.10.1", "SW2": "10.10.10.2", "SW3": "10.10.10.3",
  "SW4": "10.10.10.4", "SW5": "10.10.10.5",
}
FLEET = ["SW1", "SW2", "SW3", "SW4", "SW5"]
FAIL_ON_OPEN = {"SW4"}  # Option B: scripted "unreachable" via Lesson 6's fail_on_open

def check_device(hostname):
  driver_cls = get_network_driver("mock")
  optional_args = {"path": os.path.join("fixtures", hostname.lower())}
  if hostname in FAIL_ON_OPEN:
      optional_args["fail_on_open"] = True

  driver = driver_cls(
      hostname=hostname,
      username=os.environ.get("NAPALM_USERNAME", ""),
      password=os.environ.get("NAPALM_PASSWORD", ""),
      optional_args=optional_args,
  )

  try:
      driver.open()
  except ConnectionException as e:
      return {"host": hostname, "status": "unreachable", "detail": str(e)}

  try:
      facts = driver.get_facts()
      interfaces = driver.get_interfaces()
      ips = driver.get_interfaces_ip()
  except ConnectAuthError as e:
      driver.close()
      return {"host": hostname, "status": "auth-failed", "detail": str(e)}

  driver.close()

  issues = []
  if facts["hostname"] != hostname:
      issues.append(f"hostname mismatch: expected {hostname}, got {facts['hostname']}")

  iface = interfaces.get(MGMT_INTERFACE)
  if iface is None:
      issues.append(f"{MGMT_INTERFACE} missing from get_interfaces()")
  elif iface["description"] != EXPECTED_DESCRIPTION:
      issues.append(
          f"{MGMT_INTERFACE} description mismatch: expected "
          f"'{EXPECTED_DESCRIPTION}', got '{iface['description']}'"
      )

  iface_ips = ips.get(MGMT_INTERFACE, {}).get("ipv4", {})
  expected_ip = EXPECTED_IPS[hostname]
  if expected_ip not in iface_ips:
      issues.append(f"{MGMT_INTERFACE} IP mismatch: expected {expected_ip}, got {list(iface_ips.keys())}")

  if issues:
      return {"host": hostname, "status": "non-compliant", "detail": issues}
  return {"host": hostname, "status": "compliant", "detail": "facts/interfaces/IP all match desired state"}

report = {"compliant": [], "non_compliant": [], "unreachable": [], "auth_failed": []}
key_by_status = {"compliant": "compliant", "non-compliant": "non_compliant",
                "unreachable": "unreachable", "auth-failed": "auth_failed"}

for hostname in FLEET:
  result = check_device(hostname)
  report[key_by_status[result["status"]]].append(result)

print(f"Checked: {len(FLEET)} devices")
print(f"compliant: {len(report['compliant'])}")
print(f"non-compliant: {len(report['non_compliant'])}")
print(f"unreachable: {len(report['unreachable'])}")
print(f"auth-failed: {len(report['auth_failed'])}")

with open("napalm_report.json", "w") as f:
  json.dump(report, f, indent=2)
print("Report written to napalm_report.json")

The complete, real, verified capstone script. Reuses the SW1-SW5 fleet's IP scheme (10.10.10.1-5) from every prior module, and Lesson 6's fail_on_open/exception-fixture mechanisms for the failure scenarios.

Checked: 5 devices
compliant: 1
non-compliant: 2
unreachable: 1
auth-failed: 1
Report written to napalm_report.json

Real, verified output from an actual run of the script above.

{
"compliant": [
  { "host": "SW1", "status": "compliant", "detail": "facts/interfaces/IP all match desired state" }
],
"non_compliant": [
  { "host": "SW2", "status": "non-compliant",
    "detail": ["GigabitEthernet0/1 description mismatch: expected 'mgmt-uplink', got 'uplink'"] },
  { "host": "SW3", "status": "non-compliant",
    "detail": ["GigabitEthernet0/1 IP mismatch: expected 10.10.10.3, got ['10.10.10.99']"] }
],
"unreachable": [
  { "host": "SW4", "status": "unreachable", "detail": "You told me to do this" }
],
"auth_failed": [
  { "host": "SW5", "status": "auth-failed", "detail": "SW5 rejected the credentials" }
]
}

Real, verified file content -- grep-confirmed to contain no credential of any kind. Note SW2 and SW3 fail for two genuinely different reasons -- one from get_interfaces(), one from get_interfaces_ip() -- not the same check twice.