Skip to main content

Overview

Forward Predict evaluates a proposed change against a model of your network. It computes a predicted snapshot from a collected snapshot and a change on one or more devices (a config change, a firewall rule, or a BGP advertisement): a full model of how the network would behave once that change is in place. Nothing is pushed to a device and no live traffic is sent.

A prediction re-derives network behavior from a configuration change. Forward Predict merges the change into each affected device's config text, re-parses it, and re-models the device, then propagates the resulting state changes across the topology. Because the result comes from re-parsing and re-modeling rather than from a fixed rule set, its accuracy tracks how completely it models the platforms and protocols in scope. See Prediction Scope for the supported scope and How Predict Works for the mechanics.

This page covers the concepts the rest of the Predict documentation builds on: the stages a prediction moves through, what it does and does not do, and its two inputs.

The Predict analysis home page listing saved analyses with their base snapshot, modified-device count, and last-edited time, and the Start a new analysis button

Stages of a Prediction​

A prediction moves through five stages.

StageWhat happens
1. Propose a changeA change set combines one or more of:
  • a config change, as CLI commands or a full replacement file
  • a firewall rule change
  • a BGP advertisement to inject or withdraw
2. Predict the configurationForward Predict merges the change into each device's current running config the way that vendor's CLI would, applying command order and no-form overrides, to produce the resulting running config.
3. Re-model the changed devicesEach changed device is re-parsed from its predicted config, recomputing that device's own local state:
  • the routes it originates or derives locally
  • ACLs
  • NAT
  • security rules
4. Re-propagate the control planeRouting protocols are re-computed across the modeled topology, so the change propagates to every downstream device in the snapshot, with each device's import and export policies applied along the way. A snapshot that does not include a device cannot predict the change on it.
5. Analyze and verifyForward Predict computes end-to-end forwarding on the predicted snapshot and produces results that compare it against the base: config changes, effect-of-changes diffs (routing and new risks), and pass/fail intent validation (Verify and NQE). Analyze the predicted snapshot further with Path Analysis, diffs, and NQE.

Only the changed devices are re-parsed; every other device updates only through the routing propagation in stage 4. See How Predict Works for what each stage does in detail.

What Predict Does Not Do​

  • No deployment. Forward Predict is analysis only. It never pushes or applies a change to a live device.
  • No topology changes. Forward Predict uses only the devices and links already in the snapshot. It does not add or remove a device or link, or model a link going down.
  • No prediction on a prediction. The base is a collected snapshot; a prediction produces a predicted snapshot, which the base picker does not offer as a new base. Refine a scenario by editing and re-running within the same change set.
  • No live-hardware quirks. A prediction models protocol logic and many device-specific behaviors, but not timing-dependent behavior or every implementation-specific detail of a device. See Accuracy Boundaries.

For what affects a prediction's accuracy, see Accuracy and Limitations.

Base Snapshot and Change Set​

Every prediction has two inputs.

  • A base snapshot: the collected snapshot the prediction starts from. Forward Predict always models against a collected base. It defaults to the network's most recent collected snapshot. Select a different base before committing.
  • A change set: the per-device changes to apply. One change set can span many devices and mix change types, such as CLI edits on one device and an injected BGP advertisement on another.

Running a Predict analysis on a change set produces a predicted snapshot. Change sets are versioned: edit a change set and run the analysis again to produce a new predicted snapshot, and earlier versions are preserved.

Build a change set in the prediction wizard, a single workflow that advances through numbered steps. See How Predict Works for the step-by-step walkthrough.

Two inputs feed the Predict engine: a base snapshot (a collected snapshot) and a change set (a config change as CLI commands or a full replacement file, a firewall rule change, or a BGP advertisement). Predict merges the change into each device's config, re-parses and re-models the changed devices, and re-propagates routing across the topology. The result is a predicted snapshot: a full network model. Comparing it against the base yields config changes (per-device config and CLI diffs), effect of changes (routing and new risks), intent validation (pass or fail Verify and NQE checks), and further analysis such as path analysis, diffs, and NQE run on the predicted snapshot.

Predicted Snapshot​

A predicted snapshot is a full snapshot. Run the standard analysis tools on it:

  • Run Path Analysis for end-to-end reachability.
  • Re-run Verify intent checks.
  • Diff the predicted snapshot against the base.
  • Query it with NQE.

Next​