Using synthetic packets to validate forwarding and control implementation on network systems

1. A method for managing a network, the method comprising:

obtaining network flow data corresponding to a network device in the network;

determining, based on the network flow data, configuration coverage associated with forwarding control configuration of the network device;

identifying, using the configuration coverage and the forwarding control configuration, non-coverage, wherein the non-coverage specifies at least a portion of the forwarding control configuration that has not yet been utilized by the network device during normal operation of the network device;

generating a plurality of synthetic packets based on the non-coverage;

transmitting the plurality of synthetic packets to the network device;

obtaining a set of results associated with the plurality of synthetic packets;

making a determination, based on the set of results, that the network device is not implementing at least a portion of the forwarding control configuration associated with the non-coverage correctly; and

based on the determination, initiating a remediation action on the network device.

2. The method of claim 1 ,

wherein the forwarding control configuration comprises an access control list (ACL),

wherein the non-coverage comprises non-covered ACL entries of the ACL,

wherein the set of results comprises a result indicating that the network device transmitted a synthetic packet to a second network device,

wherein making the determination comprises determining that an ACL entry of the non-covered ACL entries improperly permitted the transmission of the synthetic packet.

3. The method of claim 1 ,

wherein the forwarding control configuration comprises an access control list (ACL),

wherein the non-coverage comprises non-covered ACL entries of the ACL,

wherein the set of results comprises a result indicating that the network device dropped a synthetic packet obtained from a second network device;

wherein making the determination comprises determining that an ACL entry of the non-covered ACL entries improperly dropped the synthetic packet.

4. The method of claim 1 , wherein the remediation action comprises rebooting the network device.

5. The method of claim 1 ,

wherein the non-coverage comprises non-covered ACL entries of an access control list (ACL),

wherein the remediation action comprises installing a new ACL entry on the network device, wherein the new ACL entry replaces at least one of the non-covered ACL entry that was not implemented correctly.

6. The method of claim 1 , wherein the remediation action comprises:

quarantining the network device;

performing an evaluation on the network device to determine a configuration issue; and

resolving the configuration issue.

7. The method of claim 1 , wherein the network flow data is obtained based on packets transmitted by the network device to other network devices in the network.

8. A coordination point operating on a network, comprising:

a processor programmed to:

obtain network flow data corresponding to a network device in the network;

determine, based on the network flow data, configuration coverage associated with an access control list (ACL) of the network device;

identify, using the configuration coverage and the ACL, non-covered ACL entries of the ACL,

generate a synthetic packet based on the non-covered ACL entries;

providing the synthetic packet to a second network device, wherein the second network device transmits the synthetic packet to the network device;

obtain a result associated with the synthetic packet from the network device;

make a determination, based on the result, that the network device is not implementing at least one of the non-covered ACL entries correctly; and

based on the determination, initiate a remediation action on the network device.

9. The coordination point of claim 8 , wherein the result indicates that the network device forwarded the synthetic packet to a third network device.

10. The coordination point of claim 8 , wherein the result indicates that the network device dropped a packet obtained from the second network device.

11. The coordination point of claim 8 , wherein the remediation action comprises initiating a rebooting of the network device.

12. The coordination point of claim 8 , wherein the remediation action comprises providing a new ACL on the network device.

13. The coordination point of claim 8 , wherein the remediation action comprises:

quarantining the network device;

performing an evaluation on the network device to determine a configuration issue; and

initiating resolution of the configuration issue.

14. The coordination point of claim 8 , wherein the network flow data is obtained based on packets transmitted by the network device to other network devices in the network.

15. A method for managing a network device, the method comprising:

obtaining network flow data corresponding to the network device;

generating a plurality of synthetic packets;

transmitting the plurality of synthetic packets to the network device;

obtaining a set of results associated with the plurality of synthetic packets;

making a determination, based on the set of results, that the network device is not implementing at least a portion of a forwarding control configuration correctly;

determining, based on the network flow data, configuration coverage associated with the forwarding control configuration;

identifying, using the configuration coverage and the forwarding control configuration, non-coverage,

wherein the generation of the plurality of synthetic packets is based on the non-coverage; and

based on the determination, initiating a remediation action.

16. The method of claim 15 , wherein the forwarding control configuration comprises at least one of: an access control list, a set of routing policies, and a quality of service (QoS) configuration.

17. The method of claim 15 , wherein the remediation action comprises rebooting the network device.

18. The method of claim 15 , wherein the remediation action comprises quarantining the network device.

19. The method of claim 15 , wherein the remediation action comprises installing updated software on the network device.