Intent Automation — EVPN Provisioning & SROS CLI Agent

AI-driven provisioning of EVPN MAC-VRF services and SROS-style CLI monitoring on Nokia SR Linux nodes via gNMI, using Google ADK agents backed by an LLM.

Two agents are included:

Agent	Purpose
evpn_agent	Provisions and deletes EVPN MAC-VRF services on SR Linux leaf nodes
cli_agent	Fetches gNMI state from SR Linux nodes and renders it in SROS-style CLI output

Prerequisites

• uv (Python package manager)
• Containerlab (to run the network topology)
• Docker (for Containerlab and optional local Ollama)
• A Nokia SROS license file at license-srsim25.txt (one level above the repo root) for the SROS DCGWs

Quick Start

1. Deploy the network topology

cd containerlab
containerlab deploy

This brings up a full Clos fabric: 2 SR Linux spines, 4 SR Linux leaves, 2 SROS DCGWs, and 2 Linux clients. All nodes start pre-configured with eBGP underlay and EVPN iBGP overlay.

To tear it down:

containerlab destroy

2. Configure credentials

Create python-agent/evpn_agent/.env and python-agent/cli_agent/.env:

OPENAI_API_KEY=<your-key>
SRL_PASSWORD=<srlinux-admin-password>   
SROS_PASSWORD=<srlinux-admin-password>   

A. EVPN Agent

The agent manages all four SR Linux leaf nodes (clab-evpn-leaf1 … clab-evpn-leaf4), discovered dynamically from the Containerlab topology YAML. Given a natural-language request like "provision a MAC-VRF for tenant A", it autonomously:

1. Calls list_nodes() and list_interfaces() to inspect available nodes and VLAN IDs.
2. Calls validate_provision_intent() — two-layer validation (Pydantic field checks + live gNMI conflict checks) before touching any device.
3. Calls provision_mac_vrf() to push the full MAC-VRF config (bridged subinterface + VXLAN tunnel interface + network-instance with BGP-EVPN/BGP-VPN) via gNMI. If any node fails, partial changes are automatically rolled back.
4. Calls get_mac_vrf_status() to verify the service is active.
5. Prints a structured provisioning summary.

Deletion follows a similar workflow: status check → delete_mac_vrf() (removes network-instance, then vxlan-interface, then subinterface in dependency order).

1. Run the agent

cd python-agent

# --- EVPN Agent ---
uv run adk run evpn_agent          # interactive ADK CLI
uv run adk web evpn_agent          # web UI (opens browser)
uv run python -m evpn_agent.agent  # simple interactive script

2. Example interaction:

> create an EVPN service named my-BEST-evpn between e-1/11 on leaf1 and e-1/14 on leaf4 using VLAN 123
> check status of EVPN my-BEST-evpn

Agent provisions the service which can be verified on each node

ssh clab-evpn-leaf1
show network-instance summary

B. SROS CLI Agent

The agent fetches live state from SR Linux nodes via gNMI and renders the output in familiar SROS CLI format. This lets SROS-familiar operators query SR Linux nodes using the commands they already know.

1. Run the agent

cd python-agent

# --- SROS CLI Agent ---
uv run adk run cli_agent          # interactive ADK CLI
uv run adk web cli_agent          # web UI (opens browser)
uv run python -m cli_agent.agent  # simple interactive script

2. Example interaction:

> show router bgp summary on leaf1
> show network-instance default protocols bgp neighbor * on dcgw1

Returns a formatted table matching the SROS show router bgp summary layout, with router-id, AS, per-peer stats (packets, uptime, state, Rcv/Act/Sent routes), and peer count — sourced from SR Linux gNMI paths.

Command-to-gNMI-path mappings are defined in cli_agent/sros_commands.yaml. SROS router contexts map to SR Linux network-instances (e.g., Base → default, management → mgmt).

Using a Local Ollama Model

Start Ollama with the qwen2.5:7b model:

cd ollama
docker compose up -d

Then change the model in the relevant python-agent/<agent>/agent.py:

model=LiteLlm(model="ollama/qwen2.5:7b")

gNMI Utilities

python-agent/src/ contains standalone interactive scripts for ad-hoc gNMI operations:

cd python-agent

# SR Linux nodes
uv run python src/gnmi_srlinux.py

# SROS nodes
uv run python src/gnmi_sros.py

Both scripts prompt for a router, operation (GET / SUBSCRIBE / SET), and path.

Accessing Lab Nodes

# SSH to SR Linux nodes
ssh admin@clab-evpn-leaf1
ssh admin@clab-evpn-spine1

# SSH to SROS DCGWs
ssh admin@clab-evpn-dcgw1

# Access Linux clients (no SSH)
docker exec -it clab-evpn-client1 bash