Agentic Ai Workshop

ws-a3-autocon4

Transforming Network Engineers to Automation Practitioners with MCP

Workshop Overview

Welcome to WS:A3 at the Network Automation Forum AutoCon4!

This hands-on workshop will transform your approach to network operations by leveraging the revolutionary Model Context Protocol (MCP) framework with AI assistance. You'll work with live HPE Juniper Networks virtual topologies running JunOS to develop intelligent automation capabilities that eliminate traditional UI-driven operations.

Workshop Details

• Event: Network Automation Forum - AutoCon4
• Title: Transforming Network Engineers to Automation Practitioners w/ MCP
• Proctors: Jose Miguel Izquierdo, Jessica Garrison, Nilesh Simaria
• Organization: Juniper Networks (now Hewlett Packard Enterprise - HPE)
• Levels:
• Networking: Intermediate
• Systems/Linux: Intermediate
• Programming: Intermediate

Learning Objectives

By the end of this workshop, you will be able to:

• Understand MCP Fundamentals: Understand the architecture and capabilities of the Model Context Protocol
• Implement AI-Assisted Configuration Management: Deploy and Audit network device configurations
• Develop Automated Testing & Verification: Create smart validation workflows
• Perform AI-Powered Root Cause Analysis: Leverage AI for troubleshooting and diagnostics
• Simulate Network Resilience: Test failure scenarios and recovery procedures

Workshop Agenda

🏗️ MCP Fundamentals

• Architecture and capabilities overview
• Setting up MCP with Claude Desktop
• Understanding the AI-network automation interface

⚙️ Configuration Management through AI-Assisted Automation

• Intelligent device discovery and topology mapping
• Dynamic configuration generation and deployment
• Template-based automation with Jinja2

🧪 Automated Testing and Verification

• Protocol state validation
• Network connectivity testing
• Performance verification workflows

🔍 AI-Powered Root Cause Analysis (RCA) and Troubleshooting

• Configuration blame analysis
• Core dump investigation
• Intelligent fault diagnosis

💥 Failure Simulation Scenarios

• Network resilience testing
• Recovery automation
• Health assessment workflows

Workshop Structure

Each use case in this workshop follows a consistent structure to help you navigate and complete the exercises efficiently.

• Every use case directory contains a README.md file with detailed instructions, objectives, and step-by-step guidance.
• The workspace includes all necessary configuration files, templates, report examples and resources needed to complete the exercises.
• Each use case is independent from the others and can be executed in any order. It is recommended to follow the instructions of the workshop proctors.
• You'll also find a accomplishments list to track your progress as you work through each task.

This standardized scaffolding ensures you can focus on learning the concepts rather than searching for materials.

Use cases

This is the list of use cases to be done in this workshop:

• [Use case #1](uc1-lldp/README.md) - LLDP protocol and topology
• [Use case #2](uc2-ifs-desc/README.md) - Interfaces description audit
• [Use case #3](uc3-ospf/README.md) - OSPF - Core dumps analysis
• [Use case #4](uc4-isis/README.md) - ISIS - Config blame
• [Use case #5](uc5-j2/README.md) - Jinja2 template configuration
• [Use case #6](uc6-l3vpn/README.md) - L3VPN troubleshooting
• [Use case #7](uc7-jvd/README.md) - JVD topology
• [Use case #8](uc8-health/README.md) - Network health assessment

These 8 use cases are located in different folders inside /home/claude/workspace/. Each of them is designed to understand different ways of how agentic AI can assist you on your daily tasks as a network engineer:

🔗 UC1 - LLDP (Link Layer Discovery Protocol)

• Focus: Network Discovery & Topology Mapping
• Skills: Device configuration, neighbor relationships, topology visualization
• AI Tasks: Automated LLDP configuration, neighbor analysis, interactive topology diagrams
• Goal: Deploy and configure LLDP across all network devices, then configure the interfaces descriptions aligned with the data gathered from the LLDP protocol and generate an interactive topology diagram that should match the topology defined in Container Lab.

📝 UC2 - Interface Descriptions

• Focus: Smart Configuration Management
• Skills: Context-aware configuration, automated doc generation
• AI Tasks: Dynamic interface description generation, configuration audit
• Goal: Audit configured interface descriptions based on discovered network connections (matching naming convention and real physical links), creating self-documenting network infrastructure that accurately reflects the physical topology

🛡️ UC3 - OSPF & Core Dump Analysis

• Focus: Network Health Assessment & Troubleshooting
• Skills: Protocol analysis, crash investigation, health monitoring
• AI Tasks: OSPF state validation, core dump forensics, root cause analysis
• Goal: Investigate a simulated network failure scenario by analyzing OSPF protocol health and performing forensic analysis of core dump files to determine root cause

🔀 UC4 - ISIS & Configuration Blame

• Focus: Change Attribution & Configuration Forensics
• Skills: Change tracking, configuration auditing, blame analysis
• AI Tasks: Systematic configuration change attribution, commit history analysis and timeline reconstruction
• Goal: Implement comprehensive configuration change tracking by creating a git blame equivalent for network device configurations, attributing every configuration line to its author and commit

📋 UC5 - Jinja2 Templates

• Focus: Template-Based Automation
• Skills: Dynamic configuration generation, template management
• AI Tasks: Template rendering, dry-run and configuration deployment
• Goal: Design and deploy standardized network configurations using Jinja2 templates, enabling scalable and consistent device provisioning across the entire topology

🌐 UC6 - L3VPN Troubleshooting

• Focus: Troubleshooting L3VPN service
• Skills: Complex service configuration, multi-device orchestration
• AI Tasks: End-to-end VPN troubleshooting, service validation, topology awareness, service provisioning.
• Goal: Orchestrate complete L3VPN service deployment across multiple PE routers, including automatic route target assignment, VRF configuration, and end-to-end connectivity validation

🏗️ UC7 - Juniper Validated Design (JVD)

• Focus: Architectural Best Practices
• Skills: Design pattern implementation, standards compliance
• AI Tasks: Design validation, architectural analysis, compliance checking
• Goal: Validate network architecture against Juniper Validated Design principles and automatically implement recommended configuration patterns for optimal performance and reliability

📊 UC8 - Network Health Assessment

• Focus: Comprehensive Network Monitoring & Documentation-Driven Operations
• Skills: Multi-layer health checking, performance analysis, documentation-driven automation, health policy definition
• AI Tasks: Holistic network assessment, predictive analysis, alerting, compliance validation against custom health policies
• Goal: Create a custom NETWORK.HEALTH.md methodology document defining your network health criteria, then have the AI agent validate and maintain network compliance according to your documented standards

Technology Stack

Network Infrastructure

• HPE Juniper Networks cRPD: Containerized routing protocol daemon
• JunOS: Industry-leading network operating system (limited to cRDP)
• JVDs: Juniper Validated Designs
• Container Lab: Network topology orchestration
• Docker: Containerization platform

Automation & AI

• Model Context Protocol (MCP): Revolutionary AI-network interface
• Claude Desktop Application: AI assistant with network automation capabilities
• LLM model: Sonnet 4.5
• Jinja2: Advanced templating engine
• Python: Automation scripting

Protocols & Technologies

• LLDP: Network discovery and topology mapping
• OSPF/ISIS: Interior gateway protocols
• BGP L3VPN: Service provider technologies
• SSH/NETCONF: Network management protocols

Prerequisites

Networking Knowledge

• Understanding of TCP/IP fundamentals
• Familiarity with routing protocols (OSPF, ISIS, BGP)
• Basic knowledge of network topologies and design

Systems/Linux

• Command line navigation and file operations
• Basic understanding of [Docker](https://www.docker.com/ ) and ContainerLab
• Comfort with SSH and remote system access

Programming

• Basic Python scripting concepts
• Understanding of jinja2 templates *.j2 and variables {{ }}
• Familiarity with JSON/YAML data formats (*.yaml or *.yml)

Workshop Environment

Lab Infrastructure

• Pre-configured Linux VM with Docker, ContainerLab, Python3 and uv
• Multiple JunOS cRPD instances per use case
• Persistent workspace at /home/claude/workspace/
• Integrated AI assistant with MCP connectivity

Access Requirements

• Claude Desktop application installed in your laptop
• Claude PRO plan ($20 (1 month)). See Claude pricing
• SSH access to workshop environment (.ssh/config)
• Visual Studio Code (recommended) with the following extensions (last 4 you will need to install them in the remote VM once you have the session open on it):
• Remote SSH extension
• ContainerLab extension
• Markdown Preview Enhanced (recommended)
• Markdown All in One (recommended)
• Auto-Open Markdown Preview (recommended)

Here you can find a screenshot with all the extensions and their icons to help you install them:

• Web browser for topology visualization
• Terminal/command line access (SSH) (recommended character encoding system: UTF-8)

Getting Started

You should have received an e-mail with the details of the workshop (if not, ask the workshop support team). It should have included the following details related to the workshop:

• Repository link
• VM details
• ${PROVIDEDVMIP}
• ${PROVIDEDVMPORT} (if nothing provided, port is default SSH port (e.g. 22))
• private SSH key (id_rsa_claude)

You need to keep all these for you and not share them with anyone else (only workshop support team if needed).

You might have already done a few of these steps. If so, feel free to follow up and skip the ones you have already done.

Configure your SSH config files

Before starting the workshop, you must configure your SSH client for seamless access to all workshop components:

1. Workshop VM SSH Access

To access the workshop VM, you'll need to configure SSH authentication using the SSH private key provided via email (id_rsa_claude) or you can also find a copy of it in the [utils/](./utils/) folder of this repo (e.g. utils/id_rsa_claude).

1. Save the private key file to a secure location on your local machine (e.g. ~/.ssh/id_rsa_claude).

1. Ensure the key has the correct permissions 600 to prevent SSH from rejecting it due to overly permissive access rights.

``bash chmod 600 ~/.ssh/id_rsa_claude ``

1. Test your connection to the VM using the following command:

``bash ssh -i ~/.ssh/id_rsa_claude claude@${PROVIDED_VM_IP} -p ${PROVIDED_VM_PORT} ``

or remember, if ${PROVIDEDVMPORT} was not provided, no need to add default port 22 (skipping -p option)

``bash ssh -i ~/.ssh/id_rsa_claude claude@${PROVIDED_VM_IP} ``

replacing ${PROVIDED_VM_IP} with the VM's IP address and ${PROVIDED_VM_PORT} with the VM's port provided in the e-mail. The public SSH RSA key (~/.ssh/id_rsa_claude.pub) was already added to the user claude at the workshop VM and the cRPD devices (~/.ssh/authorized_keys) so you can SSH into the workshop VM and the cRPD devices without being asked for the password.

1. For convenience, add below code to your ~/.ssh/config file. This will allow you to connect to the workshop VM simply by typing ssh naf-ws-vm. No password asked! Keep your private key secure and never share it with others or commit it to version control systems.

Add the following configuration to your ~/.ssh/config file:

# Workshop VM Configuration
Host naf-ws-vm
    HostName ${PROVIDED_VM_IP}
    User claude
    Port ${PROVIDED_VM_PORT}
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    StrictHostKeyChecking no
    IdentitiesOnly yes

2. Container Lab cRPD Routers Access

Configure access to the containerized routers through the VM (please, pay attention to the ProxyCommand line containing the jump host VM named configured before naf-ws-vm):

⚠️ Make sure you do not have other Host entries defined with the same name (e.g. naf-ws-vm, pe1, pe2, pe3, pe4, pe5, pe6, p, ce1 and/or ce2) or you will face conflicts when connecting. If so, add a prefix (e.g. naf) and remember to use it when connecting to them.

# cRPD Devices (via Workshop VM jump host (e.g. naf-ws-vm))
Host pe1
    HostName 172.20.20.11
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

Host pe2
    HostName 172.20.20.12
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

Host pe3 p
    HostName 172.20.20.13
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

Host pe4 ce1
    HostName 172.20.20.14
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

Host pe5 ce2
    HostName 172.20.20.15
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

Host pe6
    HostName 172.20.20.16
    User claude
    IdentityFile ${ABSOLUTE_PATH_TO_SSH_RSA_CLAUDE} # e.g. /Users/my_user/.ssh/id_rsa_claude
    ProxyCommand ssh -l claude naf-ws-vm nc %h 22 2>/dev/null
    StrictHostKeyChecking no

1. Test your connection to the VM using now the following command (it does not have neither the user nor the SSH key implicit in the command):

``bash ssh naf-ws-vm ``

If it does not work, probably it is because you have been assigned a sandbox in JCL (Juniper Cloud Labs) and your public IP has not been allowed (by the support team!). Ask them to do it, or if you got the e-mail with the URL from JCL, just follow below steps. Else, you can skip next step. Please note that the containerized devices will not be accessible at this time as they are brought up and down for each lab.

3. Add your public IP to JCL

Figure out which is your public IP (seen from JCL (Juniper Cloud Labs)). Go to this website and copy the IP:

https://test-01.cloudlabs.juniper.net/

You should see something like this:

Copy this IP and add it to your JCL Sandbox allowed network prefixes. In order to do that, go to COMMANDS and on the right hand side, click on Add Allow Network Prefixes:

Add it and then click Run.

You should see a window with a console output running a script to add your prefix to JCL so you can access your

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: JNPRAutomate
• Source: JNPRAutomate/agentic-ai-workshop
• License: MIT

Install and usage instructions live in the source repository linked above.