Skill: vahagn-madatyan/change-verification (version 1.0.0)

--- name: change-verification description: >- Pre/post change verification with baseline capture, diff analysis, and rollback decision guidance across Cisco IOS-XE/NX-OS, Juniper JunOS, and Arista EOS. Structured around a single change event lifecycle — before, during, and after — with impact classification and rollback criteria. license: Apache-2.0 metadata: safety: read-write author: network-security-skills-suite version: "1.0.0" openclaw: '{"emoji":"🔧","safetyTier":"read-write","requires":{"bins":["ssh"],"env":[]},"tags":["change","verification","rollback"],"mcpDependencies":["git-netops-mcp"],"egressEndpoints":[]}' --- # Change Verification Event-driven change verification skill for structured change windows. Guides baseline capture before a change, provides change execution safety patterns, performs post-change diff analysis, and supports rollback decision-making when unexpected deviations are detected. This skill covers a **single change event lifecycle** (before → during → after). For ongoing configuration drift detection and compliance auditing, use the `config-management` skill instead. Commands are labeled **[Cisco]**, **[JunOS]**, or **[EOS]** where syntax diverges. Unlabeled statements apply to all three vendors. > **Safety Note — Read-Write Operations:** This skill includes procedures that > modify device state during change execution and rollback phases. Steps that > write to devices are marked with ⚠️ **WRITE**. Always confirm authorization, > change ticket approval, and maintenance window status before executing write > operations. Baseline capture and post-change verification steps are read-only > and safe to run at any time. ## When to Use - Planned maintenance window requiring structured pre/post verification - Configuration change (routing policy, ACLs, interface config) with rollback plan - Software upgrade or patch requiring before/after state comparison - Hardware replacement (linecard, SFP, PSU) with service validation - Circuit turn-up or decommission with adjacency and traffic verification - Emergency change requiring rapid baseline capture and rollback readiness - Post-change soak period with periodic re-verification against baselines ## Prerequisites - SSH or console access to all devices in the change scope (read-only for baselines; enable/configure privilege for change execution and rollback) - Approved change ticket with documented scope, expected impact, and rollback plan including timing criteria - Pre-identified list of devices and interfaces in the change scope - Knowledge of expected state changes: which routes will move, which interfaces will bounce, which adjacencies will flap - Access to a file store (flash, SCP server, or local disk) for baseline archival - Contact information for escalation if rollback criteria are met - See `references/checklist-templates.md` for per-change-type prerequisites ## Procedure Follow these steps sequentially for each change event. Steps 1–2 are always read-only. Steps 3–4 include write operations. Steps 5–6 are analytical and drive the rollback decision. ### Step 1: Pre-Change Baseline Capture Capture device state snapshots before any changes. Store outputs with timestamps for post-change comparison. **Routing state:** **[Cisco]** ``` show ip route summary show ip bgp summary show ip ospf neighbor ``` **[JunOS]** ``` show route summary show bgp summary show ospf neighbor ``` **[EOS]** ``` show ip route summary show ip bgp summary show ip ospf neighbor ``` **Interface and adjacency state:** All vendors — capture interface status, error counters, and neighbor tables: **[Cisco]** ``` show interfaces summary show cdp neighbors show ip arp ``` **[JunOS]** ``` show interfaces terse show lldp neighbors show arp no-resolve ``` **[EOS]** ``` show interfaces status show lldp neighbors show ip arp ``` **Configuration and hardware:** **[Cisco]** ``` show running-config show environment all show inventory ``` **[JunOS]** ``` show configuration show chassis environment show chassis hardware ``` **[EOS]** ``` show running-config show environment all show inventory ``` ⚠️ **WRITE** — Archive baseline config to persistent storage: **[Cisco]** `copy running-config flash:pre-change-[ticket]-[date].cfg` **[JunOS]** `request system configuration save /var/tmp/pre-change-[ticket].conf` **[EOS]** `copy running-config flash:pre-change-[ticket]-[date].cfg` Record baseline metrics for comparison: total route count, BGP peer count (Established), OSPF neighbor count (Full), interface error counters, and hardware sensor readings. ### Step 2: Change Scope Documentation Before executing any changes, document: 1. **Change description** — what configuration lines are being added, modified, or removed 2. **Expected impact** — which peers will flap, which routes will shift, which interfaces will bounce, expected duration of disruption 3. **Rollback trigger criteria** — specific thresholds that mandate rollback (see Threshold Tables below) 4. **Rollback procedure** — exact commands to revert (see `references/cli-reference.md` for vendor-specific rollback commands) 5. **Success criteria** — what "done" looks like: all baselines restored, intended changes visible, no unexpected deviations 6. **Soak period** — how long to monitor after change before declaring success ### Step 3: Change Execution ⚠️ **WRITE** — Apply changes using commit-confirm patterns when available. **[Cisco]** — No native commit-confirm. Apply changes in config mode and immediately verify. For bulk changes, use `configure replace` with a prepared config file. **[JunOS]** — Use `commit confirmed [minutes]` to auto-rollback if not confirmed within the timer window. Confirm with `commit` after verification. ``` configure # ... apply changes ... commit confirmed 5 # ... verify ... commit ``` **[EOS]** — Use `configure session` for atomic staged changes. Review before committing. ``` configure session change-[ticket] # ... apply changes ... show session-config commit ``` **Staged rollout for multi-device changes:** Apply to one device first, verify post-change state (Step 4), then proceed to remaining devices only after the first device passes all checks. ### Step 4: Post-Change Verification Re-capture all baseline metrics from Step 1 using identical commands. Perform a structured diff against pre-change baselines. **Key comparisons:** | Metric | Compare Against | Expected Outcome | |--------|----------------|------------------| | Route count | Pre-change summary | Within deviation threshold | | BGP peers Established | Pre-change peer list | All peers restored (or changed per plan) | | OSPF neighbors Full | Pre-change neighbor list | All adjacencies restored | | Interface errors | Pre-change counters | No new sustained errors | | Config diff | Archived pre-change config | Only intended lines changed | **Config diff verification:** **[Cisco]** ``` show archive config differences flash:pre-change-[ticket]-[date].cfg system:running-config ``` **[JunOS]** ``` show | compare rollback 1 ``` **[EOS]** ``` diff running-config flash:pre-change-[ticket]-[date].cfg ``` Review every line in the diff output. Classify each changed line as **expected** (directly part of the change plan) or **unexpected** (not in the change scope). ### Step 5: Impact Assessment Classify all deviations from baseline into categories: 1. **Expected — Intended:** Changes that are the direct goal of the change window (e.g., new BGP peer appearing, old ACL removed). No action needed. 2. **Expected — Side Effect:** Changes caused by the intended change but not the primary goal (e.g., route count increase because a new peer is now advertising). Verify they are benign. 3. **Unexpected — Minor:** Deviations not related to the change scope but low severity (e.g., a single interface counter increment). Investigate but do not necessarily roll back. 4. **Unexpected — Critical:** Deviations indicating collateral damage (e.g., adjacency loss on an unrelated interface, route withdrawal not in change scope). Evaluate rollback immediately. If any deviation is classified as **Unexpected — Critical**, proceed directly to Step 6 rollback evaluation. ### Step 6: Rollback Decision Evaluate whether to accept the change or roll back using the criteria below. **Rollback if ANY of these conditions are true:** - Service-affecting outage on interfaces/peers outside the change scope - Route count deviation exceeds threshold AND routes are not accounted for in the change plan - Adjacency loss persists beyond the expected convergence window - Hardware errors (PSU, fan, temperature) emerged that were not present in baseline - The change did not achieve its intended effect (success criteria from Step 2 not met) **Accept if ALL of these conditions are true:** - All success criteria from Step 2 are met - Config diff contains only expected change lines - All baseline metrics are within acceptable deviation thresholds - No unexpected critical deviations detected - Soak period has elapsed without regression ⚠️ **WRITE** — If rolling back: **[Cisco]** `configure replace flash:pre-change-[ticket]-[date].cfg force` **[JunOS]** `rollback 1` then `commit` **[EOS]** `configure replace flash:pre-change-[ticket]-[date].cfg` After rollback, re-run Step 4 post-change verification to confirm the device has returned to its pre-change state. ## Threshold Tables ### Acceptable Deviation Thresholds | Metric | Normal Deviation | Warning | Rollback Trigger | |--------|-----------------|---------|------------------| | IPv4 route count | ±2% of baseline | ±5% of baseline | >10% or unplanned loss | | IPv6 route count | ±2% of baseline | ±5% of baseline | >10% or unplanned loss | | BGP Established peers | 0 lost (unless planned) | 1 lost (if in scope) | ≥1 lost outside scope | | OSPF Full adjacencies | 0 lost (unless planned) | Flap then recover <2 min | Lost >2 min | | Interface errors (new) | 0 new CRC/input errors | <10 in first 5 min | Sustained >10/min | | Interface flaps | 0 (unless planned bounce) | 1 flap on in-scope intf | Any flap outside scope | ### Rollback Timing Thresholds | Phase | Maximum Duration | Action if Exceeded | |-------|-----------------|-------------------| | Change execution | Per change ticket | Pause and escalate | | Post-change convergence | 5 minutes | Begin rollback assessment | | Adjacency re-establishment | 2 minutes per peer | Escalate if critical peer | | Route table stabilization | 3 minutes | Check for route oscillation | | Soak period (minor change) | 15 minutes | Declare success or investigate | | Soak period (major change) | 60 minutes | Declare success or investigate | | Rollback execution | 5 minutes | Escalate to senior engineer | ## Decision Trees ### Post-Change Diff Contains Unexpected Lines ``` Config diff shows unexpected changes ├── Lines are in sections RELATED to change scope │ ├── Side effect of intended change (e.g., auto-generated route-map sequence) │ │ └── Classify as Expected — Side Effect → Document and accept │ └── Unintended consequence (e.g., wrong interface affected) │ └── Classify as Unexpected — Critical → Evaluate rollback └── Lines are in sections UNRELATED to change scope ├── Timestamps, counters, or cosmetic changes (e.g., "Last configuration change") │ └── Classify as Expected — Side Effect → Ignore └── Substantive config changes (e.g., ACL modified, route-map added) └── Classify as Unexpected — Critical → Immediate rollback ``` ### Adjacency Loss Detected Post-Change ``` Neighbor/peer no longer in expected state ├── Device IS in the change scope │ ├── Interface was intentionally bounced per change plan │ │ ├── Adjacency recovers within timing threshold │ │ │ └── Expected — document recovery time │ │ └── Adjacency does NOT recover within threshold │ │ └── Investigate → Check interface state, cable, peer config │ └── Interface was NOT intentionally bounced │ └── Unexpected — Critical → Check for config error → Rollback if unresolved └── Device is NOT in the change scope ├── Peer is on a device that IS in scope (far-end impact) │ └── Expected side effect → Verify peer recovers within threshold └── Peer is on a device NOT in scope (unrelated) └── Unexpected — Critical → Unrelated failure, separate investigation ``` ### Route Count Deviation Outside Normal Threshold ``` Route count differs from baseline beyond ±2% ├── Change plan includes prefix addition or removal │ ├── Deviation direction matches plan (added routes = count increase) │ │ └── Expected — verify exact prefix matches plan │ └── Deviation direction opposes plan (planned addition but count decreased) │ └── Unexpected — Critical → Check BGP/OSPF process, peer state ├── Change plan does NOT include routing changes │ ├── Deviation is <5% and routes are from in-scope device peers │ │ └── Warning — likely convergence artifact → Monitor for 3 min │ └── Deviation is >5% OR routes from out-of-scope sources │ └── Unexpected — Critical → Evaluate rollback └── Route oscillation detected (count fluctuating) └── Unexpected — Critical → Routing loop or flapping → Immediate rollback ``` ## Report Template ``` # Change Verification Report — [Ticket ID] ## Change Summary - **Ticket:** [ID] - **Date/Time:** [Start] — [End] - **Devices:** [list] - **Change Type:** [routing | switching | security | upgrade | other] - **Executed By:** [name/team] ## Pre-Change Baseline - Route count (IPv4/IPv6): [count] - BGP peers Established: [count] - OSPF adjacencies Full: [count] - Interface errors (notable): [any] - Config archived to: [location] ## Change Execution - Method: [manual | commit-confirm | session | replace] - Duration: [minutes] - Issues during execution: [none | description] ## Post-Change Verification - Route count (IPv4/IPv6): [count] (Δ [change]) - BGP peers Established: [count] (Δ [change]) - OSPF adjacencies Full: [count] (Δ [change]) - Interface errors (new): [count] - Config diff lines: [expected: N, unexpected: N] ## Impact Assessment - Expected — Intended: [list] - Expected — Side Effect: [list] - Unexpected — Minor: [list or none] - Unexpected — Critical: [list or none] ## Decision - **Result:** [ACCEPTED | ROLLED BACK | ESCALATED] - **Rationale:** [reason] - **Soak period:** [duration, outcome] ## Action Items - [ ] [any follow-up tasks] ``` ## Troubleshooting ### Baseline capture commands fail or return incomplete output - Verify SSH session stability — long command outputs may be truncated by terminal buffer limits. Use `terminal length 0` **[Cisco/EOS]** or `set cli screen-length 0` **[JunOS]** before capture. - Check device CPU — high CPU may cause CLI timeouts. Run `show processes cpu` **[Cisco]** / `show system processes extensive` **[JunOS]** / `show processes top` **[EOS]** to verify. - If archival to remote storage fails, save to local flash as fallback and note the location for later retrieval. ### Config diff shows excessive noise - Filter out timestamp and comment lines that change on every config display (e.g., `! Last configuration change at ...`). - On **[JunOS]**, `show | compare rollback 1` gives clean structured diffs. On **[Cisco]**, `show archive config differences` may include line-order differences that are not real changes — focus on substantive config lines. - Use `references/checklist-templates.md` checklists to focus verification on change-relevant sections rather than full config comparison. ### Adjacency does not recover after expected bounce - Check interface state: `show interfaces [intf]` — look for `down/down` vs `up/down` to distinguish physical vs protocol issues. - Verify the peer device accepted the change — a mismatched configuration on both sides of a link (e.g., mismatched OSPF area, BGP ASN) will prevent adjacency formation. - Check for hold-timer expiry: OSPF default dead interval is 40s; BGP default hold time is 180s. Wait at least one full timer cycle before escalating. ### Rollback command fails or produces unexpected state - **[Cisco]** `configure replace` requires the IOS archive feature to be enabled. If unavailable, manually reverse the config changes line by line. - **[JunOS]** `rollback N` may fail if the commit history has been cleared or the device has rebooted since the baseline commit. Use `show system commit` to verify available rollback points. - **[EOS]** `configure replace` requires the replacement file to be a complete config, not a partial fragment. Verify the archived file is a full `show running-config` capture. - After any rollback, re-run the full post-change verification (Step 4) to confirm the device has returned to its pre-change state. ### Change window time exceeded before verification completes - Prioritize critical services: check routing adjacencies and interface states first, defer detailed config diff analysis to after the window if services are healthy. - If the soak period must be shortened, document the reduced observation window and schedule a follow-up verification at the next opportunity. - Escalate if service impact is detected and the change window has closed — do not delay rollback due to window constraints if there is active service degradation.

path: references/checklist-templates.md
content: # Change Verification Checklist Templates

Pre/post verification checklists organized by change type with a rollback
decision matrix. Use these templates to ensure comprehensive baseline capture
and post-change validation.

## Generic Pre-Change Checklist

Run before **any** change, regardless of type. Captures the minimum baseline
needed for post-change comparison.

| # | Check | Command(s) | Capture |
|---|-------|-----------|---------|
| 1 | Archive running config | See cli-reference.md Config Archival | Save to flash with ticket ID |
| 2 | Route table summary | `show ip route summary` / `show route summary` | Total route count per protocol |
| 3 | BGP peer states | `show ip bgp summary` / `show bgp summary` | Peer count, Established count, prefix counts |
| 4 | OSPF adjacency states | `show ip ospf neighbor` / `show ospf neighbor` | Neighbor count, all in Full state |
| 5 | Interface summary | `show interfaces summary` / `show interfaces terse` | Up/down counts, error counters |
| 6 | CDP/LLDP neighbors | `show cdp neighbors` / `show lldp neighbors` | Neighbor count and identities |
| 7 | Hardware environment | `show environment all` / `show chassis environment` | PSU, fan, temperature status |
| 8 | CPU and memory | `show processes cpu` / `show system processes extensive` | Baseline utilization |
| 9 | Uptime | `show version` | Confirm no recent unexpected reload |
| 10 | Document timestamp | Note wall-clock time of baseline capture | Correlate with syslog later |

## Generic Post-Change Checklist

Run after **any** change to compare against the pre-change baseline.

| # | Check | Compare Against | Pass Criteria |
|---|-------|----------------|---------------|
| 1 | Config diff | Archived pre-change config | Only intended lines changed |
| 2 | Route count | Pre-change route summary | Within ±2% (see Threshold Tables) |
| 3 | BGP peers | Pre-change BGP summary | Same Established count (unless planned) |
| 4 | OSPF adjacencies | Pre-change OSPF neighbors | Same Full count (unless planned) |
| 5 | Interface states | Pre-change interface summary | No new down interfaces (unless planned) |
| 6 | Interface errors | Pre-change error counters | No new sustained errors |
| 7 | Neighbor count | Pre-change CDP/LLDP | Same neighbor count |
| 8 | Hardware health | Pre-change environment | No new alarms |
| 9 | Syslog review | N/A | No unexpected error messages |
| 10 | Service ping tests | N/A | Critical paths reachable |

## Change-Type-Specific Checklists

### Routing Changes (BGP / OSPF / EIGRP)

**Additional pre-change captures:**

| # | Check | Command(s) | Why |
|---|-------|-----------|-----|
| 1 | BGP neighbor detail | `show ip bgp neighbors [peer]` | Capture timers, capabilities, prefix counts |
| 2 | BGP received routes | `show ip bgp neighbors [peer] received-routes` | Know exactly which prefixes come from affected peer |
| 3 | BGP advertised routes | `show ip bgp neighbors [peer] advertised-routes` | Know what the peer sees from us |
| 4 | OSPF database summary | `show ip ospf database database-summary` | LSA counts by type for comparison |
| 5 | OSPF interface detail | `show ip ospf interface [intf]` | Cost, timers, area, network type |
| 6 | Routing policy (route-maps, prefix-lists) | `show route-map [name]` / `show ip prefix-list [name]` | Document current policy for diff |

**Additional post-change checks:**

| # | Check | Look For |
|---|-------|---------|
| 1 | BGP best path for changed prefixes | Verify new path selection matches intent |
| 2 | BGP community/MED/local-pref on affected routes | Verify policy attributes applied correctly |
| 3 | OSPF SPF run count | Compare to baseline — should show incremental SPF only |
| 4 | Route table for specific affected prefixes | Verify each prefix uses intended next-hop |
| 5 | Traceroute to key destinations | Verify traffic path matches intended design |
| 6 | BGP update message log | Check for unexpected withdrawals or announcements |

### Switching Changes (VLAN / STP / MLAG)

**Additional pre-change captures:**

| # | Check | Command(s) | Why |
|---|-------|-----------|-----|
| 1 | VLAN database | `show vlan brief` / `show vlans` | Full VLAN membership before changes |
| 2 | STP root status | `show spanning-tree root` | Know current root bridges |
| 3 | STP port states | `show spanning-tree [vlan]` | Identify forwarding/blocking ports |
| 4 | MLAG/vPC status | `show mlag` / `show vpc brief` | Peer status, consistency state |
| 5 | MAC table count | `show mac address-table count` | Baseline MAC count per VLAN |
| 6 | Port-channel summary | `show etherchannel summary` / `show port-channel summary` | Bundle member states |

**Additional post-change checks:**

| # | Check | Look For |
|---|-------|---------|
| 1 | VLAN membership | Intended VLANs added/removed, no unintended changes |
| 2 | STP root unchanged (or changed per plan) | Root bridge election stable |
| 3 | STP topology change count | Compare to baseline — minimize TCNs |
| 4 | MLAG consistency | No config-sanity errors between peers |
| 5 | MAC table learning | MACs appearing on correct ports in changed VLANs |
| 6 | Trunk allowed VLANs | New VLANs appearing on intended trunks only |

### Security Changes (ACL / Firewall / AAA)

**Additional pre-change captures:**

| # | Check | Command(s) | Why |
|---|-------|-----------|-----|
| 1 | ACL hit counters | `show access-list [name]` | Baseline hit counts for diff |
| 2 | ACL interface bindings | `show ip interface [intf]` | Know where ACLs are applied |
| 3 | AAA config | `show aaa sessions` / `show aaa` | Current auth method chains |
| 4 | SNMP community/user list | `show snmp community` / `show snmp v3` | Current SNMP access config |
| 5 | SSH session test | Verify SSH login works | Baseline access validation |
| 6 | Control plane policy | `show policy-map control-plane` (Cisco) | CoPP baseline |

**Additional post-change checks:**

| # | Check | Look For |
|---|-------|---------|
| 1 | ACL hit counters (new entries) | New deny entries not getting unexpected hits |
| 2 | SSH access test | Verify management access still works after AAA change |
| 3 | SNMP polling test | Verify monitoring still receives data |
| 4 | Console access test | Verify console login if AAA was changed |
| 5 | Traffic flow test | Verify permitted traffic passes through new ACLs |
| 6 | Syslog for deny messages | Check for unexpected ACL deny logs |

> **Critical safety note for security changes:** Always verify management
> access (SSH, console) immediately after committing AAA or ACL changes. Loss
> of management access is the highest-risk outcome and may not be reversible
> without physical console access. Use `commit confirmed` (JunOS) or prepare
> a console session before applying AAA changes.

### Software Upgrades (ISSU / Non-Disruptive / Full Reboot)

**Additional pre-change captures:**

| # | Check | Command(s) | Why |
|---|-------|-----------|-----|
| 1 | Current software version | `show version` | Document exact version string |
| 2 | Boot variable | `show boot` / `show boot-config` | Know current boot image |
| 3 | File system free space | `dir flash:` / `file list detail` | Ensure space for new image |
| 4 | Redundancy status (if HA) | `show redundancy` / `show virtual-chassis` | SSO/NSR state before upgrade |
| 5 | ISSU compatibility | Vendor-specific ISSU pre-check | Confirm upgrade is non-disruptive |
| 6 | License status | `show license` / `show system license` | Verify licenses survive upgrade |

**Additional post-change checks:**

| # | Check | Look For |
|---|-------|---------|
| 1 | New software version | `show version` matches target version |
| 2 | Uptime confirms reload | Uptime reflects expected reload time |
| 3 | All linecards online | `show module` / `show chassis fpc` — all operational |
| 4 | Process health | No crashed or restarting processes |
| 5 | License still valid | All licensed features operational |
| 6 | HA status restored | Redundancy back to SSO/NSR if applicable |
| 7 | Config persistence | Running config matches pre-upgrade archive |
| 8 | Control plane convergence | All BGP/OSPF adjacencies restored |
| 9 | Data plane forwarding | Ping/traceroute to critical destinations |

## Rollback Decision Matrix

Use this matrix when deviations are detected. Cross-reference **severity** of
the deviation against **scope** (inside/outside change plan) and **timing**
(within/beyond convergence window).

### Severity × Scope

| | In Change Scope | Outside Change Scope |
|---|----------------|---------------------|
| **Expected — Intended** | ✅ Accept — this is the goal | N/A — by definition, intended changes are in scope |
| **Expected — Side Effect** | ✅ Accept — document the side effect | ⚠️ Investigate — why is an out-of-scope device affected? |
| **Unexpected — Minor** | ⚠️ Investigate — may be benign but needs explanation | ⚠️ Investigate — could indicate broader issue |
| **Unexpected — Critical** | 🔴 Evaluate rollback — check if recoverable | 🔴 Immediate rollback — collateral damage detected |

### Severity × Timing

| | Within Convergence Window | Beyond Convergence Window |
|---|--------------------------|--------------------------|
| **Expected — Intended** | ✅ Normal convergence | ✅ Accept |
| **Expected — Side Effect** | ✅ Wait for stabilization | ⚠️ Investigate if still fluctuating |
| **Unexpected — Minor** | ⚠️ Monitor — may self-resolve | ⚠️ Investigate — should have resolved by now |
| **Unexpected — Critical** | 🔴 Start rollback preparation | 🔴 Execute rollback — not recovering |

### Escalation Triggers

These conditions require **immediate escalation** regardless of other matrix
outcomes:

1. **Total management access loss** to any device in the change scope
2. **Customer-affecting outage** detected or reported during the change window
3. **Cascading failures** — deviations spreading to devices outside change scope
4. **Hardware alarms** (temperature, PSU, fan) that were not present in baseline
5. **Rollback failure** — rollback command does not restore pre-change state
6. **Change window expiry** with unresolved critical deviations


path: references/cli-reference.md
content: # Change Verification CLI Reference

Multi-vendor command reference for change verification operations across Cisco
IOS-XE/NX-OS, Juniper JunOS, and Arista EOS. Commands are organized by change
lifecycle phase.

## Architecture Differences — Change Management

Each vendor handles change execution and rollback differently:

- **Cisco (IOS-XE/NX-OS):** Changes apply immediately in config mode — no
  native commit-confirm on IOS-XE (NX-OS has `checkpoint`/`rollback`). Rollback
  uses `configure replace` with a previously saved config file. Requires the
  `archive` feature for config replace on IOS-XE.
- **JunOS:** Candidate-commit model with native `commit confirmed [minutes]`
  for auto-rollback. Supports `rollback N` to any of the last 50 commits. The
  strongest native rollback capability of the three vendors.
- **EOS:** Supports `configure session` for atomic staged changes and
  `configure replace` for full config rollback. `commit timer` provides
  commit-confirm-like behavior within sessions.

## Pre-Change Baseline Capture (Read-Only)

### Routing State

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Route summary | `show ip route summary` | `show route summary` | `show ip route summary` |
| BGP peer summary | `show ip bgp summary` | `show bgp summary` | `show ip bgp summary` |
| BGP neighbor detail | `show ip bgp neighbors [peer]` | `show bgp neighbor [peer]` | `show ip bgp neighbors [peer]` |
| OSPF neighbors | `show ip ospf neighbor` | `show ospf neighbor` | `show ip ospf neighbor` |
| OSPF database summary | `show ip ospf database database-summary` | `show ospf database summary` | `show ip ospf database database-summary` |
| EIGRP topology | `show ip eigrp topology summary` | N/A | N/A |
| Static routes | `show ip route static` | `show route protocol static` | `show ip route static` |
| VRF route tables | `show ip route vrf [name] summary` | `show route table [instance] summary` | `show ip route vrf [name] summary` |

### Interface and Adjacency State

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Interface summary | `show interfaces summary` | `show interfaces terse` | `show interfaces status` |
| Interface counters | `show interfaces [intf] counters` | `show interfaces [intf] statistics` | `show interfaces [intf] counters` |
| Interface errors | `show interfaces [intf] \| include errors` | `show interfaces [intf] \| match error` | `show interfaces [intf] counters errors` |
| CDP/LLDP neighbors | `show cdp neighbors` | `show lldp neighbors` | `show lldp neighbors` |
| ARP table | `show ip arp` | `show arp no-resolve` | `show ip arp` |
| MAC address table | `show mac address-table count` | `show ethernet-switching table summary` | `show mac address-table count` |
| VLAN status | `show vlan brief` | `show vlans` | `show vlan brief` |
| STP topology | `show spanning-tree summary` | `show spanning-tree bridge` | `show spanning-tree summary` |
| MLAG/vPC status | `show vpc brief` (NX-OS) | `show virtual-chassis` | `show mlag` |

### Hardware and Environment

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Environment sensors | `show environment all` | `show chassis environment` | `show environment all` |
| Inventory | `show inventory` | `show chassis hardware` | `show inventory` |
| CPU utilization | `show processes cpu` | `show system processes extensive` | `show processes top` |
| Memory utilization | `show processes memory` | `show system memory` | `show processes top` |
| Software version | `show version` | `show version` | `show version` |
| Uptime | `show version \| include uptime` | `show system uptime` | `show uptime` |

### Configuration Archival

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Show running config | `show running-config` | `show configuration` | `show running-config` |
| ⚠️ Save to flash | `copy running-config flash:[file]` | `request system configuration save /var/tmp/[file]` | `copy running-config flash:[file]` |
| ⚠️ Save to SCP | `copy running-config scp://[user]@[server]/[file]` | `request system configuration save scp://[user]@[server]/[file]` | `copy running-config scp://[user]@[server]/[file]` |
| Set terminal length | `terminal length 0` | `set cli screen-length 0` | `terminal length 0` |

## Change Execution Commands

> ⚠️ **WRITE operations** — all commands in this section modify device state.
> Confirm change ticket approval and maintenance window before executing.

### Config Mode and Commit Patterns

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| ⚠️ Enter config mode | `configure terminal` | `configure` | `configure terminal` |
| ⚠️ Enter session mode | N/A | N/A (single candidate) | `configure session [name]` |
| Review pending changes | N/A (applied immediately) | `show \| compare` | `show session-config [name]` |
| ⚠️ Commit changes | N/A (applied immediately) | `commit` | `commit` (in session) |
| ⚠️ Commit with auto-rollback | N/A | `commit confirmed [minutes]` | `commit timer [hh:mm:ss]` |
| ⚠️ Confirm pending commit | N/A | `commit` (after `commit confirmed`) | `commit` (after timer commit) |
| ⚠️ Abort staged changes | `end` | `rollback 0` | `abort` (in session) |

### Rollback and Recovery

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| ⚠️ Rollback to saved config | `configure replace flash:[file] force` | `rollback [N]` then `commit` | `configure replace flash:[file]` |
| ⚠️ Rollback to last commit | `configure replace flash:[backup] force` | `rollback 1` then `commit` | `configure replace flash:[backup]` |
| Preview rollback diff | `show archive config differences system:running-config flash:[file]` | `show \| compare rollback [N]` | `diff running-config flash:[file]` |
| Show rollback history | `show archive` | `show system commit` | `show config sessions` |
| ⚠️ Create checkpoint (NX-OS) | `checkpoint [name]` | N/A | N/A |
| ⚠️ Rollback to checkpoint (NX-OS) | `rollback running-config checkpoint [name]` | N/A | N/A |

### Vendor-Specific Rollback Notes

**JunOS — Strongest native rollback:**
- `rollback N` reverts to the Nth previous committed configuration (0 = current
  committed, 1 = previous, up to 49)
- `commit confirmed [minutes]` auto-reverts if not confirmed — ideal for remote
  changes where connectivity loss would prevent manual rollback
- `show system commit` lists all available rollback points with timestamps

**Cisco — File-based rollback:**
- IOS-XE: `configure replace` requires the `archive` feature enabled in config.
  Without it, manual line-by-line reversal is needed
- NX-OS: native `checkpoint`/`rollback` provides commit-style rollback similar
  to JunOS
- Both require pre-change config to be saved to flash before the change

**EOS — Session-based with file rollback:**
- `configure session` provides atomic changes — abort discards all session
  changes without affecting running-config
- `configure replace` works with full config files saved to flash
- `commit timer` in session mode provides time-limited commit similar to JunOS
  `commit confirmed`

## Post-Change Verification (Read-Only)

### Config Diff

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Diff running vs archived | `show archive config differences flash:[file] system:running-config` | `show \| compare rollback [N]` | `diff running-config flash:[file]` |
| Diff two files | `show archive config differences flash:[file1] flash:[file2]` | `show \| compare rollback [N1] rollback [N2]` | `diff flash:[file1] flash:[file2]` |
| Show last config change | `show running-config \| include Last` | `show system commit \| head 5` | `show running-config \| include Last` |

### Service Verification

| Operation | Cisco | JunOS | EOS |
|-----------|-------|-------|-----|
| Ping test | `ping [dest] source [src]` | `ping [dest] source [src]` | `ping [dest] source [src]` |
| Traceroute | `traceroute [dest] source [src]` | `traceroute [dest] source [src]` | `traceroute [dest] source [src]` |
| Check logging for errors | `show logging \| include %` | `show log messages \| last 50` | `show logging last 50 lines` |
| Check syslog for change events | `show logging \| include CONFIG` | `show log messages \| match CHANGE` | `show logging \| include ConfigChange` |

### Counter and Metric Recapture

Use the same commands from the Pre-Change Baseline Capture section above to
recapture all metrics. Compare each metric against the pre-change baseline
values, applying the deviation thresholds from the SKILL.md Threshold Tables.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)