Gold standard auditing for router configurations

Network providers face a huge challenge of running their network without service disruption in the presence of constant network change. Such change often involves router configuration update. The goal of gold standard auditing is to ensure all field configs are equivalent to a certified gold config. To handle constant change involving many features configured for numerous routers at the network edge, we need a scalable system that can perform gold standard auditing in a timely fashion. We present the design of GSAT (Gold Standard Audit Tool) that utilizes the syntactic structure of configs. When there is difference between gold and field configs, GSAT can provide users with enough structural hints to understand the context of the difference. Being technology-independent, GSAT is highly scalable and extensible. We have been using GSAT to audit customer-facing routers in a large-scale operational IP network. We present the implementation details and audit performance of our system.