Change impact simulation analysis

1. A method of network configuration simulation, the method comprising:

receiving, at data processing hardware, one or more parameter changes for a production network model of a network;

generating, by the data processing hardware, a simulation network model based on a production network log comprising a recorded workflow for the production network model, the simulation network model including the one or more parameter changes;

analyzing, by the data processing hardware, a simulated network flow within the simulation network model;

generating, by the data processing hardware, a report including an impact of the one or more parameter changes on the network, the report indicating differences between the production network model and the simulation network model;

in response to generating the report, receiving, at the data processing hardware, an acceptance of the one or more parameter changes; and

in response to receiving the acceptance of the one or more parameter changes, implementing, by the data processing hardware, the one or more parameter changes in the network.

2. The method of claim 1 , further comprising:

receiving, at the data processing hardware, the production network log including the recorded workflow for the production network model; and

simulating, by the data processing hardware, the recorded workflow of the production network model within the simulation network model to generate a simulation network log.

3. The method of claim 2 , wherein analyzing the simulated network flow comprises:

comparing, by the data processing hardware, the production network log to the simulation network log; and

identifying, by the data processing hardware, differences between the production network log and the simulation network log.

4. The method of claim 2 , wherein the production network log is one of a virtual private connection flow log and a firewall rules log.

5. The method of claim 1 , further comprising determining, by the data processing hardware, an impact of the one or more parameter changes on the production network model.

6. The method of claim 5 , wherein determining the impact of the one or more parameter changes on the production network model comprises determining an impact to at least one of network reachability, a firewall shadow rules predicted firewall hit rates, user intent rules, security compliance rules, and resource quotas and utilization.

7. The method of claim 1 , wherein generating the simulation network model includes incrementally incorporating, by the data processing hardware, the one or more parameter changes into the production network model.

8. The method of claim 1 , further comprising receiving, by the data processing hardware, one or more invariant parameters of the production network model.

9. The method of claim 1 , further comprising changing, by the data processing hardware, a configuration of the network when the impact of the one or more parameter changes on the network are acceptable.

10. A system comprising:

data processing hardware; and

memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:

receiving one or more parameter changes for a production network model of a network;

generating a simulation network model based on a production network log comprising a recorded workflow for the production network model, the simulation network model including the one or more parameter changes;

analyzing a simulated network flow within the simulation network model;

generating a report including an impact of the one or more parameter changes on the network, the report indicating differences between the production network model and the simulation network model;

in response to generating the report, receiving an acceptance of the one or more parameter changes; and

in response to receiving the acceptance of the one or more parameter changes, implementing the one or more parameter changes in the network.

11. The system of claim 10 , wherein the operations further comprise:

receiving the production network log including the recorded workflow for the production network model; and

simulating the recorded workflow of the production network model within the simulation network model to generate a simulation network log.

12. The system of claim 11 , wherein analyzing the simulated network flow comprises:

comparing the production network log to the simulation network log; and

identifying differences between the production network log and the simulation network log.

13. The system of claim 11 , wherein the production network log is one of a virtual private connection flow log and a firewall rules log.

14. The system of claim 10 , wherein the operations further comprise determining an impact of the one or more parameter changes on the production network model.

15. The system of claim 14 , wherein determining the impact of the one or more parameter changes one the production network model comprises determining an impact to at least one of network reachability, a firewall shadow rules predicted firewall hit rates, user intent rules, security compliance rules, and resource quotas and utilization.

16. The system of claim 10 , wherein generating the simulation network model includes incrementally incorporating the one or more parameter changes into the production network model.

17. The system of claim 10 , wherein the operations further comprise receiving one or more invariant parameters of the production network model.

18. The system of claim 10 , wherein the operations further comprise changing a configuration of the network when the impact of the one or more parameter changes on the network are acceptable.

19. A computer program product encoded on a non-transitory computer readable storage medium comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

receiving one or more parameter changes for a production network model of a network;

generating a simulation network model based on a production network log comprising a recorded workflow for the production network model, the simulation network model including the one or more parameter changes;

analyzing a simulated network flow within the simulation network model;

generating a report including an impact of the one or more parameter changes on the network, the report indicating differences between the production network model and the simulation network model;

in response to the report, receiving an acceptance of the one or more parameter changes; and

in response to the acceptance of the one or more parameter changes, implementing the one or more parameter changes in the network.

20. The computer program product of claim 19 , wherein the operations further comprise:

receiving the production network log including the recorded workflow for the production network model; and

simulating the recorded workflow of the production network model within the simulation network model to generate a simulation network log.

21. The computer program product of claim 20 , wherein analyzing the simulated network flow comprises:

comparing the production network log to the simulation network log; and

identifying differences between the production network log and the simulation network log.

22. The computer program product of claim 20 wherein the production network log is one of a virtual private connection flow log and a firewall rules log.

23. The computer program product of claim 19 , wherein the operations further comprise determining an impact of the one or more parameter changes on the production network model.

24. The computer program product of claim 23 , wherein determining the impact of the one or more parameter changes on the production network model comprises determining an impact to at least one of network reachability, a firewall shadow rules predicted firewall hit rates, user intent rules, security compliance rules, and resource quotas and utilization.

25. The computer program product of claim 19 , wherein generating the simulation network model includes incrementally incorporating the one or more parameter changes into the production network model.

26. The computer program product of claim 19 , wherein the operations further comprise receiving one or more invariant parameters of the production network model.

27. The computer program product of claim 19 , wherein the operations further comprise changing a configuration of the network when the impact of the one or more parameter changes on the network are acceptable.