Check Reference Available in
All 95 built-in checks organized by engine and category. Each entry includes the check name (used in rule check_name field), description, and configurable parameters.
Check Name Description Parameters cabled_interfaces_have_ipsEvery cabled interface has at least 1 IP address exclude_types: ["virtual"]no_duplicate_ipsNo IP is assigned to multiple interfaces -- management_ip_in_prefixPrimary IP is within expected management prefix prefix: "10.0.0.0/8"ip_prefix_utilizationActive prefixes below utilization threshold max_utilization_pct: 90no_orphan_ipsNo IPs exist without an assigned interface -- loopback_has_host_routeLoopback interfaces have /32 or /128 only -- point_to_point_subnet_sizingPoint-to-point links use /30 or /31 allowed_masks: [30, 31]ip_vrf_consistencyIPs on VRF interfaces come from VRF prefixes --
Check Name Description Parameters min_cabled_uplinksDevice has N or more cabled uplink interfaces min_uplinks: 2, uplink_types: ["1000base-t", "10gbase-x-sfpp"]min_bgp_sessionsDevice has N or more BGP sessions min_sessions: 2redundant_powerDevice has N or more cabled power ports min_power_feeds: 2site_min_devices_by_roleSite has N or more devices for a given role role: "spine", min_count: 2dual_homed_circuitsDevice has N or more circuit terminations min_circuits: 2lag_min_membersLAG interfaces have N or more members min_members: 2virtual_chassis_member_countVirtual chassis has N or more members min_members: 2
Check Name Description Parameters leaf_spine_connectivityEvery leaf has cables to N or more distinct spines min_spines: 2, spine_role: "spine"no_unconnected_active_interfacesActive interfaces are cabled or uncabled type allowed_uncabled_types: ["virtual", "lag", "bridge"]symmetric_cablingBoth ends of every cable have matching speed/type -- cable_trace_completeCable paths are traceable end-to-end -- site_redundant_pathsSite has N or more distinct uplink paths min_paths: 2rear_port_mapping_completeAll rear ports have front port mappings -- console_connectivityAt least one console port is connected -- mtu_consistency_across_linkBoth ends of a cable have the same MTU --
Check Name Description Parameters bgp_asn_range_consistentBGP ASNs within allowed range min_asn: 64512, max_asn: 65534interface_naming_consistentInterfaces follow naming convention by type pattern_by_type: {"1000base-t": "^(Ethernet|eth)\\d+"}consistent_device_namingDevices at same site/role follow naming scheme pattern_by_role: {}consistent_platform_per_roleAll devices with same role at site use same platform -- vlan_id_range_by_siteVLANs at site within allowed ID ranges min_vid: 100, max_vid: 999prefix_role_assignedActive prefixes have a role assigned --
Check Name Description Parameters config_context_required_keysconfig_context contains required keys required_keys: ["ntp_servers", "dns_servers"]circuit_terminations_completeAll circuits have both A and Z terminations -- vlan_assignments_completeTagged-mode interfaces have VLANs assigned -- site_has_required_rolesSite has at least 1 device for each required role required_roles: ["spine", "leaf"]contact_assigned_to_siteSites have at least one contact assignment -- custom_field_populatedSpecified custom fields are non-empty custom_fields: []asset_documentation_completeNative device fields are populated required_fields: ["platform", "site", "rack", "position", "primary_ip4", "serial"]ntp_syslog_configuredDevice config_context has NTP and syslog servers ntp_key: "ntp.servers", syslog_key: "syslog.servers", require_both: true
Check Name Description Parameters no_forbidden_values_in_contextconfig_context has no forbidden values forbidden: [{"path": "snmp.community", "values": ["public", "private"]}]management_vrf_enforcedManagement interfaces are in the correct VRF management_vrf_name: "MGMT", management_interface_patterns: ["management", "mgmt", "oob"]required_context_structureconfig_context matches required schema schema: {"ntp_servers": {"type": "list", "min_length": 2}}no_plaintext_secrets_in_contextconfig_context has no password/key patterns patterns: ["(?i)password\\s*[:=]\\s*\\S+"]restricted_prefix_usageCertain prefixes only used by allowed roles restricted_prefixes: []secure_protocols_enforcedNo cleartext management protocols (Telnet/HTTP/SNMPv1-2c/FTP) enabled in config_context insecure_keys: ["management.telnet", "management.http", "snmp.v1", "snmp.v2c", ...], required_keys: []ephi_zone_segmentationSensitive-zone prefixes are isolated in a dedicated VRF, not co-mingled with other zones zones: [{"name": "ePHI", "prefixes": [], "vrf": "EPHI", "exclusive_vrf": true}]
Available to Premium tier customers. Config checks use engine: "config" and require the config analysis engine. The config engine is powered by Batfish; NOS support is aligned with Batfish's supported platforms .
Check Name Description Parameters config_parse_statusConfigs parse without errors -- config_parse_warningsParse warnings in config files max_warnings: 0undefined_referencesReferences to undefined structures (e.g., route-map referencing missing prefix-list) -- unused_structuresDefined but never referenced structures --
Check Name Description Parameters bgp_sessionsBGP session compatibility -- bgp_unestablished_reasonWhy specific BGP sessions can't establish -- bgp_process_configBGP process configuration correctness -- bgp_rib_validationExpected routes present in BGP RIB expected_routes: []ospf_session_compatibilityOSPF session compatibility -- ospf_process_configOSPF process and area configuration -- routing_loop_detectionForwarding loops in the network -- multipath_consistencyECMP/multipath forwarding consistency -- bgp_localpref_equalsVerify local preference matches expected value for a prefix prefix: "0.0.0.0/0", expected_localpref: 100bgp_med_equalsVerify MED matches expected value for a prefix prefix: "0.0.0.0/0", expected_med: 0route_advertised_toVerify a prefix is advertised to specific BGP neighbors prefix: "", expected_neighbors: []
Check Name Description Parameters duplicate_ipsDuplicate IP addresses across devices -- ip_owners_conflictIP ownership conflicts -- layer3_topology_completeL3 adjacency discovery -- interface_mtu_configMTU mismatches on connected interfaces -- hsrp_vrrp_configHSRP/VRRP first-hop redundancy configuration --
Check Name Description Parameters acl_reachabilityUnreachable/shadowed ACL lines -- acl_denies_trafficACL rules that deny specified traffic flows flow: {}bgp_prefix_filter_appliedAll eBGP peers have inbound and outbound route-map or prefix-list -- bgp_authentication_configuredBGP sessions use MD5 or TCP-AO authentication -- ospf_authentication_configuredOSPF interfaces use message-digest authentication require_type: nullmanagement_access_acl_configuredVTY lines have access-class ACLs restricting management access -- assert_traffic_blockedVerify specific traffic flows are blocked (inverted reachability assertion) src_ip: "", dst_ip: "", applications: []
Check Name Description Parameters vxlan_vni_configVXLAN VNI mapping correctness -- evpn_l3_vni_consistencyEVPN L3 VNI consistency across the fabric -- snmp_community_clientsSNMP community string configuration --
These checks use the config engine to perform reachability analysis. The config engine is enabled by default for Premium tier customers.
Check Name Description Parameters reachability_assertionAssert specific source-to-destination reachability src_ip: "", dst_ip: "", applications: []traceroute_reachabilitySimulated traceroute path validation src_ip: "", dst_ip: ""route_table_completenessExpected routes present in the routing table expected_routes: []
Check Name Description Parameters differential_reachabilityLost/new reachability between main and branch configs -- routing_changesRoutes added/removed between main and branch configs --
Available to Premium tier customers. Graph checks use engine: "graph" and require enable_graph_engine: true on the policy. The graph engine is enabled by default for Premium deployments.
Check Name Description Parameters power_path_completeEvery device has N or more complete power paths to a panel min_complete_paths: 1, skip_if_no_power_ports: truepower_redundancyPower paths through independent feeds/panels independence_level: "panel", min_independent_paths: 2, skip_if_no_power_ports: truepower_feed_capacityPower feed utilization within thresholds warning_threshold: 80, critical_threshold: 95, draw_type: "allocated"power_three_phase_balanceThree-phase feeds balanced across legs max_imbalance_percent: 20power_feed_blast_radiusUnprotected devices per power feed failure max_unprotected_devices: 0power_panel_blast_radiusUnprotected devices per power panel failure max_unprotected_devices: 0
Check Name Description Parameters device_single_point_of_failureDevices whose removal disconnects the network spof_roles: null (all), min_downstream_impact: 2cable_single_point_of_failureCables whose removal disconnects the network cross_rack_only: true
Check Name Description Parameters site_connectivity_redundancySite has circuits from N or more providers min_providers: 2, min_circuits: 2circuit_path_diversityCircuits use diverse providers, racks, devices diversity_scope: "site", diversity_requirements: ["provider", "rack", "device"]rack_failure_impactNetwork impact when all rack devices are removed max_external_impact: 5shared_failure_domainDevice pairs sharing too many failure domains max_shared_domains: 2, domain_types: ["power_feed", "power_panel", "rack", "upstream_device", "circuit_provider"], compare_roles: null (all), max_devices: 500concurrent_maintainabilityAny single component can be taken offline without service impact (TIA-942 Tier III/IV) max_service_impact: 0, check_power: true, check_network: true
These checks require the config analysis engine for routing-layer analysis. They operate independently of per-policy enable_config_engine.
Check Name Description Parameters routing_convergence_impactSimulate device failure, measure prefix loss target_roles: ["spine", "border", "core"], max_unreachable_prefixes: 0, max_targets: 10bgp_session_criticalityBGP sessions whose loss affects the most prefixes min_prefix_count: 10forwarding_path_redundancyMultiple forwarding paths between flow pairs flow_pairs: "all_inter_site", min_paths: 2
routing_convergence_impact detailstarget_roles selects which device roles to simulate failures for. max_unreachable_prefixes sets the pass/fail threshold (0 = any prefix loss is a failure). max_targets (default 10) limits simulation to the N most-connected devices within the target roles, sorted by uplink count descending -- prioritizing devices whose failure would have the greatest blast radius.