Fleet Network Automation + Always-On RCA

See The Closed Loop In Action

Watch the Digital Twin guide a fleet change through one real exception.

Netcode prepares and verifies the fleet change. Rez follows the shared Digital Twin to the failed BGP dependency. Healthy devices stay protected while an engineer reviews the scoped fix.

Book a closed-loop pilot

86 seconds Digital Twin → fleet plan → verified exception → Rez RCA → human-approved fix

Automated Digital Twin

One operational model for every change and investigation.

Discover devices once, organize them by site and role, and overlay physical, BGP and OSPF dependencies. Netcode scopes the change; Rez scopes the exception.

01

Site and role aware

Map the network your engineers actually operate.

02

Protocol aware

See physical, L2, BGP and OSPF dependencies.

03

Shared by Netcode and Rez

Automation and diagnostics start from the same context.

Digital TwinLive-discovered topology

Live

PhysicalL2 / LLDPBGPOSPFSites

Discover onceMap sites automaticallyOverlay physical + routingAutomate and investigate from one model

Four High-Value Programs

Standardize, modernize and transform the network at fleet scale.

Use one operating model for exact plans, first-device proof, verified rollout, rollback and read-only exception handling.

Standardize

Golden configuration and drift control

Bring NTP, DNS, SNMP, logging, AAA, routing policy and security standards into one approved multi-vendor baseline.

Business value: consistent operations across thousands of devices.

Modernize

Network software lifecycle

Assess readiness, stage images, prove the first devices, verify routing and services after reboot, then continue in controlled groups.

Business value: complete more upgrades with less manual coordination.

Transform

WAN, routing, QoS and firewall policy

Standardize BGP, OSPF, SD-WAN, QoS, firewall objects, NAT and egress policy while validating application reachability.

Business value: move complex policy without losing service context.

Migrate

Site, cloud and data-center migration

Model dependencies, generate exact deltas and move sites or applications in verified groups with rollback ready.

Business value: reduce migration time and isolate exceptions early.

One Platform, Three Operational Surfaces

Automate with Netcode. Investigate with Rez. Work live in Shell.

All three use the same discovered inventory, Digital Twin, device identity and customer-side access boundary.

NFleet automation

Netcode Automation

Makes network-as-code accessible to operations teams: define the standard, preview every change, roll out safely and prove the outcome.

Golden configuration and bulk change
Dry-run, first-device proof and controlled groups
Human approval, verification and rollback

RAlways-on RCA

Rez Diagnostics

Receives failed checks, monitoring alerts or engineer questions, investigates live read-only and returns the recommended action.

SolarWinds, ThousandEyes and Slack entry points
Live SSH/API evidence and topology context
Netcode remediation draft, never a direct write

>_Human operations

Netcode Shell

A full network terminal through the local runner, with saved sessions and a path from one-off work into repeatable automation.

Interactive multi-vendor SSH
Searchable session history
Transcript-to-workflow handoff

Shared foundationDiscovery + inventory + topology + live state

Customer boundaryLocal runner + local credentials

Existing ecosystemSSH + APIs + Ansible + Git + ITSM

Under the Hood / How Network Automation Works

The automation logic is simple: compare intended state to live state, then apply only what is proven safe.

Netcode does not blindly push templates. It follows a deterministic automation loop: read live state, model intended state, calculate the delta, validate policy, dry-run or canary, apply through gates, verify actual state, and keep rollback tied to Git.

Netcode automation is not template push. It is intent - plan - validation - controlled execution - verification - drift control.

Live State

Interfaces, VLANs, BGP neighbors, routes, ACLs, NTP, SNMP, firmware, interface state.

Intended State

Approved NTP servers, VLAN standards, interface roles, routing peers, ACL rules.

Delta Plan

Devices affected, commands to add, commands to remove, rollback commands, risk summary.

Git Branch + Policy Gate

Each change is isolated, reviewed, checked, and blocked before execution if unsafe.

Dry-run / Canary

Candidate config, device syntax check, first-batch canary, and no-commit validation where supported.

Verify Actual State

NTP peers active, VLAN present, BGP session established, route installed, ACL ordered correctly.

Git Rollback + Drift Watch

Rollback to previous approved intent, validate reverse plan, apply through the same gates, and monitor drift.

Product Modules

Everything needed to move from scripts to governed NetDevOps.

Change Workspace

One guided workspace for intent, plan, validation, dry-run, apply, verify, rollback, and drift.

Bulk Change Planner

Select device groups by site, role, vendor, tag, or source-of-truth query. Plan one change across many devices.

Command Preview

Show exact generated commands and rollback commands before anything touches a device.

Git Workflow

Create review branches, commit generated artifacts, review diffs, merge approved intent, and roll back by reverting Git state.

Policy Gates

Block unsafe changes before apply using device groups, command patterns, maintenance windows, approvals, and rollback requirements.

Canary and Batch Apply

Apply to a small canary first, verify, then promote in controlled batches with automatic stop conditions.

Drift Watch

Continuously compare intended state to live state and create remediation plans when drift appears.

Netcode Shell

Open full live SSH sessions through the local runner with transcripts, before/after evidence, optional ticket attachment, and runner-side credentials.

Workflow Packs

Start with guided OS upgrade campaigns, then add golden baseline, VLAN rollout, interface standards, BGP neighbor updates, ACL cleanup, and drift checks.

Netcode Shell

A real network CLI, connected to the automation loop.

Network engineers still need a full shell. Netcode Shell gives them one: live SSH through the customer-side runner, credentials kept local, every command recorded, and a clean path from an ad-hoc fix into governed automation when the work should be repeated.

Credentials stay local

Device credentials resolve on the customer-side runner, not in the browser and not in the control plane.

Full live CLI

Engineers can troubleshoot and configure from the shell. The human at the keyboard is the approval for this interactive path.

Every session is useful later

Transcripts and before/after diffs can attach to a ticket, change, RCA, drift investigation, rollback, or approval record.

Netcode Shell Live SSH

Session recording · optional ticket CHG-2048

Core-RTR-02 · Region 3

Runner customer-side Mode full live SSH Transcript recording Evidence before/after diff

Core-RTR-02# show bgp ipv4 unicast 10.204.210.0/24
BGP routing table entry for 10.204.210.0/24
  Paths: 2 available, best #1
  Community: region3-app-segment

Core-RTR-02# configure terminal
[live] config mode entered · transcript recording
Core-RTR-02(config)# route-map REGION3-EDGE permit 20
Core-RTR-02(config-route-map)# set local-preference 180
Core-RTR-02(config-route-map)# end
Core-RTR-02# show archive config differences
[diff] route-map REGION3-EDGE permit 20 added

Automation handoff If this fix should repeat, turn the transcript into a Netcode plan with rollback, validation, canary, and human-approved apply.

NetDevOps Governance

Every change has a branch. Every rollback has a known previous state.

Netcode uses Git as the system of record for network intent and generated artifacts. Engineers can review plans before apply, promote approved changes, and roll back by reverting to the last known good intent.

A change branch isolates every network change.
The plan shows exact intended delta.
Policy checks run before apply.
Canary result is committed back to the branch.
Merge means approved intent.
Drift watch compares live state to approved intent.

main change/region3-app-segmentation-2048 intent.yaml plan.md commands.txt rollback.txt validation.md canary-result.md verify.md

Git Rollback Panel

Rollback CHG-2048

Previous approved state: main@8f31a2
Current branch: change/region3-app-segmentation-2048
Rollback action: revert app segment, route policy, and firewall object references
Rollback commands: 384 generated
Validation: Passed
Status: ready for rollback canary

Rez · The Always-On Network Engineer

Alerts arrive. Automation fails. Rez starts the investigation.

Rez receives failed Netcode checks, SolarWinds or ThousandEyes alerts, and questions from Slack. It resolves the affected site and dependencies, gathers fresh SSH/API evidence and performs scoped triage like an engineer on your team.

Always availableAutomation verification, monitoring webhook or engineer request can start the same investigation.

Read-only by designRez may inspect live state and validate a hypothesis. It cannot apply configuration.

Closes the work loopA confirmed recommendation becomes a Netcode draft. A human reviews and approves every write.

SWSolarWinds alert TEThousandEyes alert NNetcode failed check SSlack TTeams · planned

00:00

Verification failedBranch-EDGE-03 WAN routing check failed after the first-device upgrade

triage started

00:06

Site and dependency context resolvedBranch-EDGE-03 → WAN → Edge-FW-01 → application

complete

00:19

Live read-only validationSoftware and uplink are healthy; the approved WAN BGP neighbor is absent

confirmed

00:24

Recommended action preparedRestore the approved BGP neighbor on Branch-EDGE-03 and rerun routing verification

ready

Rez conclusionAutomation exception isolated to one missing WAN neighbor configuration

Netcode handoffDraft created · exact commands + rollback · awaiting human approval

Multi-Vendor, Safe By Design

Automate the network you own without surrendering control.

Keep vendor-specific SSH, APIs and Ansible content while credentials and production decisions remain inside the customer trust boundary.

CiscoAristaFortinetPalo AltoJuniperArubaNokiaHuawei

SSHREST APIsAnsibleGitSolarWindsThousandEyesSlack

Adapter depth and write support vary by workflow. Pilot scope is agreed before production use.

Credentials stay local

Outbound-only customer runner

The Windows or Linux runner opens the connection to Rezonance and resolves device credentials inside your environment.

Read-only Rez

RCA cannot apply configuration

Rez has a separate read action family, approved command filters and no path to Netcode's write actions.

Human approved

No unattended production write

Exact preview, policy checks, first-device proof and optional two-person approval sit before bulk execution.

Recoverable and auditable

Rollback and evidence stay attached

Commands, verification, approvals, transcripts, Rez findings and reverse actions remain linked to the governed change record.

Start Where You Are

Start locally, automate one fleet standard, then expand.

Community

Evaluate locally

Free

Local examples, Netcode Shell and sample workflows for engineers evaluating the platform.

Request Community access

Starter

Prove repeatable workflows

$99/month

Five workflow packs, up to 50 devices, guided planning, verification and limited Rez Diagnostics.

Request Starter access

Design Partner Pilot

Validate production deployment

Scoped

Connect a representative device group and one alert source. Prove planning, rollout, verification and Rez exception handling.

Book the pilot

Community evaluates the operating model. Starter proves controlled workflows in a small environment. Production rollout begins with a scoped pilot.

Automate the fleet. Diagnose every exception.

Map the real network

Preview exact changes

Prove the first devices

Diagnose every exception

Watch the Digital Twin guide a fleet change through one real exception.

One operational model for every change and investigation.

Site and role aware

Protocol aware

Shared by Netcode and Rez

Standardize, modernize and transform the network at fleet scale.

Golden configuration and drift control

Network software lifecycle

WAN, routing, QoS and firewall policy

Site, cloud and data-center migration

Automate with Netcode. Investigate with Rez. Work live in Shell.

Netcode Automation

Rez Diagnostics

Netcode Shell

The automation logic is simple: compare intended state to live state, then apply only what is proven safe.

Everything needed to move from scripts to governed NetDevOps.

Change Workspace

Bulk Change Planner

Command Preview

Git Workflow

Policy Gates

Canary and Batch Apply

Drift Watch

Netcode Shell

Workflow Packs

A real network CLI, connected to the automation loop.

Credentials stay local

Full live CLI

Every session is useful later

Core-RTR-02 · Region 3

Every change has a branch. Every rollback has a known previous state.

Rollback CHG-2048

Alerts arrive. Automation fails. Rez starts the investigation.

Automate the network you own without surrendering control.

Outbound-only customer runner

RCA cannot apply configuration

No unattended production write

Rollback and evidence stay attached

Start locally, automate one fleet standard, then expand.

Evaluate locally

Prove repeatable workflows

Validate production deployment

Automate one network standard. Let Rez handle every exception.