{"id":12848,"date":"2024-06-28T17:56:50","date_gmt":"2024-06-28T17:56:50","guid":{"rendered":"https:\/\/dmsretail.com\/RetailNews\/an-artificially-intelligent-peer-reviewer-arrives\/"},"modified":"2024-06-28T17:56:50","modified_gmt":"2024-06-28T17:56:50","slug":"an-artificially-intelligent-peer-reviewer-arrives","status":"publish","type":"post","link":"https:\/\/dmsretail.com\/RetailNews\/an-artificially-intelligent-peer-reviewer-arrives\/","title":{"rendered":"An Artificially Intelligent Peer Reviewer Arrives"},"content":{"rendered":"

\"Retail<\/a><\/p>
\n<\/p>\n

\n

Well hello everyone, it\u2019s been a minute (or many) since my last blog post, but I\u2019m excited to say that the major project I\u2019ve been working on for the last 18+ months has come to a conclusion (well, for me at least \ud83d\ude09 ) and I\u2019m looking forward to investing more time in blogs, videos, and getting back out there.<\/p>\n

I have several topics I\u2019m looking to dive into, but coming back from Cisco Live in Vegas last week, I figured I might as well jump on the AI hype train, chugga chugga chugga, and share a bit of my own thoughts on the topic.<\/p>\n

\"The
Welcome to The Artificial Era, the newest AGE of networking.<\/figcaption><\/figure>\n

Let me start by saying that I am just beginning to really dip my toe into the AI pool. There are many other engineers already way out in the deep end, and I hope to swim out and join them soon.<\/p>\n

Cisco Live 2024 in Vegas was just the compelling event I needed to step down on the first step (to keep up the metaphor), and I included AI in two of my talks during the week. There was How to be a Network Engineer in an Artificial Age in the Cisco U. Theater, an update to my talk, \u201cHow to be a Network Engineer in a Programmable Age,\u201d that I first delivered at Cisco Live in 2017. After eight years, it felt a little bittersweet to leave the programmable age behind, but exciting to be entering a new age. Artificial Intelligence also made a last-minute \u201cbonus\u201d appearance in my breakout \u201cProgrammability Skills for Engineers Who Don\u2019t Want to Code.\u201d<\/p>\n

For these talks, I spent some time thinking through how network engineers should be thinking about and using AI right now, and what to possibly expect for the future. I\u2019m not going to go through all the details in this blog post, but rather, I want to focus in on one specific use case that I found surprising and a bit exciting: Using AI to peer review your work. Buckle in, and let\u2019s check it out.<\/p>\n

\"Mr<\/p>\n

Bridget takes Hank to Network Engineering School<\/h2>\n

One of the examples in \u201cProgrammability Skills for Engineers Who Don\u2019t Want to Code\u201d revolves around creating IPSEC VPN configurations for routers based on a configuration template and spreadsheet of data.\u00a0 I first show how to use formulas within the spreadsheet to create the configurations, and later use Ansible and Jinja2 templates to do the same thing.<\/p>\n

\"Slides<\/p>\n

As I was rehearsing the session, I wondered\u2026 Could AI do the same work?<\/em><\/p>\n

If I\u2019m honest, I figured it would get close, but need to be fixed\/finished to be done.\u00a0 So I crafted this prompt and sent it to Cisco\u2019s ChatGPT implementation known as \u201cBridgeIT\u201d.<\/p>\n

Using the data from the below CSV data,<\/span><\/p>\n

\n
vpn_name,tunnel_interface,side_1_public_ip,source_network,source_mask,side_2_outside,tunnel_destination,destination_network,destination_mask,preshared_key
\nVPN_101,GigabitEthernet0\/1,203.0.113.101,10.98.128.0,0.0.3.255,GigabitEthernet1\/1,198.51.100.33,172.28.11.0,0.0.0.255,ZA788I
\nVPN_102,GigabitEthernet0\/1,203.0.113.102,10.98.128.0,0.0.3.255,GigabitEthernet1\/1,198.51.100.34,172.28.12.0,0.0.0.255,AM285I
\n<\/code><\/pre>\n
\n
generate a configuration from each row based on the below jinja2 template<\/span><\/p>\n
\n
! VPN {{ vpn_name }}
\ncrypto isakmp policy 10
\n encryption aes
\n hash sha256
\n authentication pre-share
\n group 14 
\n
\ncrypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac
\n
\naccess-list 100 permit ip {{ source_network }} {{ source_mask }} {{ destination_network }} {{ destination_mask }}
\n
\ncrypto isakmp key {{ preshared_key }} address {{ tunnel_destination }}
\n
\ncrypto map {{ vpn_name }} 10 ipsec-isakmp
\n set peer {{ tunnel_destination }} 
\n set transform-setvpn_transform 
\n match address 100
\n
\ninterface {{ tunnel_interface }} 
\n crypto map {{ vpn_name }}
\n<\/code><\/pre>\n
I sent it away and waited\u2026 and waited\u2026 and waited.\u00a0 But then this reply came back:<\/p>\n
Based on the provided Jinja2 template and the CSV data, here are the generated configurations for each VPN:<\/span><\/p>\n
For VPN_101:<\/span><\/p>\n
! VPN VPN_101
\ncrypto isakmp policy 10
\n    encryption aes
\n    hash sha256
\n    authentication pre-share
\n    group 14
\n
\ncrypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac
\n
\naccess-list 100 permit ip 10.98.128.0 0.0.3.255 172.28.11.0 0.0.0.255
\n
\ncrypto isakmp key ZA788I address 198.51.100.33
\n
\ncrypto map VPN_101 10 ipsec-isakmp
\n    set peer 198.51.100.33
\n    set transform-set vpn_transform
\n    match address 100
\n
\ninterface GigabitEthernet0\/1
\n    crypto map VPN_101
\n<\/code><\/pre>\n
For VPN_102:<\/span><\/p>\n
! VPN VPN_102
\ncrypto isakmp policy 10
\n    encryption aes
\n    hash sha256
\n    authentication pre-share
\n    group 14
\n
\ncrypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac
\n
\naccess-list 100 permit ip 10.98.128.0 0.0.3.255 172.28.12.0 0.0.0.255
\n
\ncrypto isakmp key AM285I address 198.51.100.34
\n
\ncrypto map VPN_102 10 ipsec-isakmp
\n    set peer 198.51.100.34
\n    set transform-set vpn_transform
\n    match address 100
\n
\ninterface GigabitEthernet0\/1
\n    crypto map VPN_102
\n<\/code><\/pre>\n
I was duly impressed. Bridget (as BridgeIT is affectionately known as) understood exactly what I wanted and was able to create the configurations for me perfectly. Score one for our artificially intelligent robot overlords.<\/p>\n
But wait\u2026 she wasn\u2019t done.\u00a0 The message continued:<\/p>\n
Please note that there\u2019s a typo in the Jinja2 template, specifically in the line where it says:<\/span><\/p>\n
set transform-setvpn_transform<\/pre>\n
There should be a space before \u201cvpn_transform\u201d. Here\u2019s the corrected line that should appear in the template:<\/span><\/p>\n
set transform-set vpn_transform<\/code><\/pre>\n
Oh man<\/em>\u2026 I had a typo in my template? Inconceivable!!! I quickly went and checked my prompt and the source Jinja2 template that I copied for the prompt\u2014a template I\u2019ve used in my Ansible demo in this presentation for two years.<\/p>\n
Sure enough, I had a typo. Whoops\u2026 boy, did I feel embarrassed. And if you go back and look at the configurations that Bridget provided to my prompt, you\u2019ll see that she actually fixed the mistake<\/em> and sent the correct configs. Very, very well done. Score two and three.<\/p>\n
But she still wasn\u2019t done\u2026<\/p>\n
Additionally, you might face an issue when applying two different crypto maps to the same interface. Usually, a physical interface only supports one crypto map. If you need to support multiple VPNs on the same interface, you would typically use the same crypto map name with different sequence numbers for each peer.<\/span><\/p>\n
Here\u2019s how you can modify the second crypto map to use the same crypto map name with a different sequence number (assuming you want to use the crypto map name VPN_MAP for both):<\/span><\/p>\n
For VPN_102 (with a revised crypto map name and sequence number):<\/span><\/p>\n
! VPN VPN_102
\ncrypto isakmp policy 10
\n    encryption aes
\n    hash sha256
\n    authentication pre-share
\n    group 14
\n
\ncrypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac
\n
\naccess-list 102 permit ip 10.98.128.0 0.0.3.255 172.28.12.0 0.0.0.255
\n
\ncrypto isakmp key AM285I address 198.51.100.34
\n
\ncrypto map VPN_MAP 20 ipsec-isakmp
\n    set peer 198.51.100.34
\n    set transform-set vpn_transform
\n    match address 102
\n
\ninterface GigabitEthernet0\/1
\n    crypto map VPN_MAP<\/code><\/pre>\n
Notice that the access list number for VPN_102 has been changed to 102 to avoid conflict with the access list for VPN_101. The crypto map sequence number for VPN_102 has been set to 20, differentiating it from the sequence number 10 used for VPN_101. If you follow this approach, make sure that all your VPNs use the same crypto map name (VPN_MAP in this case) with different sequence numbers.<\/span><\/p>\n
Okay\u2026 this shows some serious network understanding. Combining a CSV file and a Jinja2 template together isn\u2019t that far from the code assistance and co-pilot use cases that have been in place for awhile\u2014not really that much of a stretch. And finding a typo in a configuration template that is probably present in hundreds of public Internet documentation, blog posts, and training examples? Also not really that surprising.<\/p>\n
But making this final leap related to network architecture and design\u2026 this was really quite surprising. I didn\u2019t tell Bridget that each of these configurations would be deployed on individual routers, so she reasonably \u201cworried\u201d that I was looking to deploy the configs on the same device. And if I did that, it WOULD be an issue. Her suggested solution is reasonable, though admittedly follows examples that are also well documented on the Internet.<\/p>\n
So what does this mean for us network engineers?<\/h2>\n
I was discussing this example during Cisco Live with some attendees, and the analogy of a \u201cpeer review\u201d was brought up. This was a use case for AI in network engineering that I hadn\u2019t formalized in my head yet, but had been dancing around with other examples.<\/p>\n
There is a very real risk of engineers using AI-generated configurations \u201cas is\u201d in their network.\u00a0 This is a bad idea for the same reason as copying and pasting code from Stackoverflow or another untrusted Internet source. Before using configurations generated by Bridget or another generative AI tool, it is critical to verify the accuracy.\u00a0 Otherwise, you risk becoming another victim to hallucinations or just inaccuracies from overconfident AI assistants.<\/p>\n
However, I think there is real potential in using AI as a peer reviewer for configurations and other artifacts we create.<\/strong> Here, WE, the network engineers, use our knowledge, skills, and experience to build a solution. Then, we ask AI to take a look and provide some feedback, similar to sending it to a co-worker, partner, or Cisco TAC.<\/p>\n
This second-set-of-eyes use case is one that I think engineers should consider trying out for themselves\u2014with a couple of very important caveats:<\/p>\n
    \n
  1. Check with your company and organization\u2019s AI policies. Many of the publicly available AI tools take any prompt information sent to them and use it for future training and fine-tuning. Network configurations are considered confidential for many companies as there is a serious security risk in sharing them publicly.<\/li>\n
  2. I would still recommend having another \u201corganic intelligence\u201d review any critical configurations. I\u2019m excited by the potential of AI, and we likely will get to a point where AI is so accurate we can rely on it for many use cases, but let\u2019s take the slow approach to get there.<\/li>\n<\/ol>\n
    Well, what are your thoughts on this use of AI for network engineering? What other use cases are you exploring in your daily work as an engineer? Let me know in the comments. And stay tuned for more from me as I continue to swim into the Artificial Age!<\/p>\n
    PS\u2026 This blog post was written by me, Hank Preston, and not by Bridget or another AI tool \ud83d\ude42<\/em><\/p>\n
    \u00a0<\/p>\n