about
I know where AI earns its keep on a network, and where it's just confident nonsense.
Thirteen years keeping high-stakes networks locked down and online. Belt and braces on every layer. Now I point the same paranoia at my own kit.
Lately my off hours go to pointing AI at the network. A home lab where local models read device state, pull the real config, and reason about it out loud. They get to look and think. They do not get a write path, and nothing reaches a device without going through me first. Same instinct I bring to work, with a lot more freedom to break things.
Certifications
How I work
Automation that fires itself
Python and Ansible doing the repetitive graft, so I never babysit a CLI for it again.
Self-hosted AI
Local models on my own hardware, tuned where the cloud can't watch. Nothing leaves the house.
Aggressive segmentation
Every segment walled off from the rest. Default-deny or it didn't happen.
Breaking my own lab
I break my own lab before anyone else can, because that's the whole point. Better a quiet Tuesday than a Friday night.
Off the clock, I'm usually getting choked out on a jiu-jitsu mat, somewhere in the backcountry with a tent, or reading Stoics who would not approve of my screen time.
projects
Everything here checks its own work.
A self-hosted lab where I build and break network security and AIOps tools end to end. Real Cisco simulation, real local models, and a security architecture stricter than it needs to be. On purpose.
Grounded Config Auditor
I let an AI read every running-config on the network. It never gets a write path.
A local model pulls the running-config off the whole fleet, mixed vendors included, and turns it into something I can question by meaning instead of grep. Which devices are missing MACsec on uplinks. Which ACLs still permit any-any. Which boxes drifted off the standard NTP and AAA. It answers in seconds, and every finding cites the device and the exact line, so it is evidence I can verify, not a guess I have to trust.
It logs in scoped to show commands, never enters config mode, and has no path to change a device. Worst case it misreads a stanza, and the citation is sitting right there for me to check. It cannot take the network down, because it cannot touch the network.
Local embedding model, local vector store, local reasoning model, all on my own hardware. The configs never hit a cloud API, which matters when every line is addressing, keys, and topology.
Built and validated against the secured spine-leaf EVPN fabric below, so the configs it audits carry a real underlay and overlay with policy on top, not toy examples. Pointing the same pipeline at production changes one inventory file and a fair amount of paperwork. The code path stays identical.
Compliance visibility across a mixed fleet from one plain question, with an audit trail attached. Drift caught on a quiet Tuesday, instead of during the audit or after the breach.
Network Automation Toolkit
The boring, error-prone parts of network ops, handed to code that checks itself.
Four tools sharing one Netmiko layer, each aimed at a different chore: config backup with drift detection, pre and post change validation, STIG-style compliance auditing with gated remediation, and IPAM sync against NetBox.
The tools that only read (backup, audit, pre/post snapshots) run freely. The two that can change a device or a record, remediation and NetBox sync, are dry runs by default. They print exactly what they would do and touch nothing until I add an explicit apply flag.
A src-layout Python package with a Typer CLI, one command group per tool, everything routed through a single Netmiko connection layer. Inventory and rules are declarative YAML, validated on load, and credentials come from the environment, never the repo. Built and validated in an EVE-NG lab, with a setup guide that takes someone from nothing to a working run.
EVPN Fabric with External L3Out
A spine-leaf EVPN fabric that hands each tenant off to the outside world on its own eBGP session. Every hop proven before I trust it.
A spine-leaf fabric on Nexus 9000v. OSPF is the underlay and nothing more. The overlay is iBGP with both spines as EVPN route reflectors, so every leaf holds two sessions no matter how many leaves I add. The fabric above runs an eBGP underlay. This one runs OSPF and route reflectors, so between the two labs I have built the underlay both ways.
Both leaves double as border leaves. Each tenant leaves the fabric on its own dot1q subinterface and its own eBGP session, into an external IOS-XE router that has no idea EVPN or VXLAN exists behind it. External routes come back as EVPN Type-5 and reach every host inside. Two handoffs, two exits. If one border drops, traffic reroutes across the fabric to the other on its own.
It ships as an importable EVE-NG topology with every device config baked in, and a fifteen-point runbook that runs from OSPF adjacency to live border failover. Where the virtual kit falls short of real hardware, the notes say so instead of pretending. CoPP only polices in software here, and a 9000v cannot terminate MACsec at all.
tech stack
The tools that earn their keep.
Thirteen years of enterprise kit, plus the self-hosted AI stack I run at home. Grouped by what it does.
contact
Let's talk.
Networks, security architecture, or pointing AI at infrastructure without it going sideways. Always up for comparing notes.