NA011 - Netlab, ACLs and AI-Generated Configs with Ivan Pepelnjak

Ivan Pepelnjak joins Steinn and Urs to talk about netlab, why multi-vendor ACLs are a hellscape, and what AI can and cannot do with network configuration. Ivan is a CCIE Emeritus, the author of more Cisco Press books than most of us have read, the voice behind ipSpace.net, and the creator of netlab — an open source tool that builds and configures virtual labs across roughly twenty platforms. He describes it himself as an "intent based digital twin lifecycle management system", then immediately admits that's a bullshit bingo winner if you have the right card. The conversation digs into why LLMs write decent Python and bad router configs (vendor CLIs are almost identical but not quite, which is the worst possible training data), the ChatGPT doom loop Ivan hit trying to configure EVPN on Nokia SR OS, and the endless device quirks behind multi-vendor abstraction — Juniper loopbacks, Nokia prefix lengths, and one vendor with roughly 400 keywords you are not allowed to use as a VLAN name. Plus: why every layer 3 switch is really a bridge in disguise, why ACLs are containable and QoS never will be, what a real CCIE engagement looks like when you have twenty years of customer mistakes and exactly one command to fix them, and Ivan's controversial opinion on conferences. **What we cover** - What netlab actually is, and the five years behind it - Whether netlab is a crutch for beginners - Splitting a lab across multiple servers with automatic VXLAN tunnels - Netlab vs containerlab and Kubernetes-based labs - Why AI generates good Python and bad router configs - The ChatGPT doom loop on Nokia SR OS EVPN - Cloning production into a lab: control plane works, data plane is a lottery - ACL support in netlab, Cartesian products and resequencing - AI code review vs AI code — technically correct and five times too long - Vibe coders, 1982 edition, on a ZX Spectrum - Leaky abstractions and worst common denominators - Device quirks: Juniper, Nokia, Cisco, and 400 forbidden VLAN names on EXOS - Why every layer 3 switch is a bridge with a router attached - ACLs are containable. QoS is not. - BGP labs designed like gym machines - Why CCIE lab scenarios are so insane — and why they're accurate - The power of saying no, and the customer who said thank you - Controversial opinion: the hallway track is the only track **Links from the episode** - netlab: netlab.tools - netlab on GitHub: github.com/ipspace/netlab - netlab examples: github.com/ipspace/netlab-examples - Ivan's blog: blog.ipspace.net - Free BGP labs: bgplabs.net - Free IS-IS labs: isis.bgplabs.net - Free VXLAN/EVPN labs: evpn.bgplabs.net - Batfish: github.com/batfish/batfish - Aerleon: github.com/aerleon/aerleon **Guest** Ivan Pepelnjak — ipspace.net | netlab.tools Hosted by Steinn "Steinzi" Bjarnarson and Urs Baumann. **Subscribe and follow** Watch on YouTube: youtu.be/odcwCByRj6g Channel: youtube.com/@networkautomagic Web: networkautomagic.net #networkautomation #networkautomagic #netlab #ipspace #AI #networkengineering