Centralize, audit, and securely enforce switch configurations across your entire enterprise infrastructure. Define the intended state once, then prove it continuously.
The Problem
Across hundreds of switches, intent erodes gradually. A change is made directly on a device during an incident and never returned. A template is updated for one site but not the others. A temporary exception outlives the reason for it.
The estate still works, so nothing is escalated. The gap between what the organization believes is deployed and what is actually running keeps widening, until it surfaces as unplanned downtime or as a finding during a compliance review.
Undocumented manual changes
Applied under pressure, rarely reconciled
Out-of-sync templates
Site-level divergence with no single source of truth
Unverified assumptions
Inventory and state reported from memory, not evidence
Audit exposure
No dependable record of the deployed configuration
The Solution
Discovery
Authorized, rate-limited scanning builds an accurate inventory and classifies every device it can positively identify.
Definition
Hierarchical workspace variables and templates express intent once, then inherit down to sites and individual devices.
Continuous Audit
A two-way comparison detects both missing and unexpected lines, evaluated against strict compliance criteria.
Safe Execution
Human-in-the-loop review, explicit approval for deletions, atomic deployment where supported, and state re-verification before push.
Hierarchical Workspaces
Values resolve downward. Each level inherits everything above it and only declares what genuinely differs.
Global
Baseline standards, AAA, logging, banners
Site
Regional overrides for addressing and VLANs
Device
Per-device exceptions, reviewed and tracked
Drift Detection
A two-way comparison. Missing lines and unexpected lines are both reported, with no assumptions filled in.
Intended State
Resolved from workspace templates
Actual State
Read from the device on last audit
Key Capabilities
Automated Guardrails
Management addressing and uplink interfaces are protected by policy, so a routine change cannot isolate a device.
Out-of-band Credential Alerts
Credential changes made outside the platform are surfaced immediately instead of failing silently at the next audit.
Unified Engine
The same evaluation and execution logic applies to a single device and to a thousand. No separate bulk path.
Safe Onboarding
Import the configurations you already run, review what is captured, and adopt devices without a rebuild.
Impact Preview
See precisely which lines change before anything is applied, with compliance recalculated the moment work completes.
State Re-verification
Device state is confirmed again immediately before a push, so decisions are never made on stale information.
Device Lifecycle
Zero Touch Provisioning (ZTP)
Seamless onboarding of factory-default devices directly into the management hierarchy. A switch is racked, powered, and cabled; the platform discovers it, claims it, and pushes its intended configuration — no console session, no manual staging.
Factory-default devices are discovered and positively identified on first contact
Each device is auto-assigned to the correct site and inherits its intended state
Credentials and management addressing are bootstrapped by policy, ready to audit from day one
Firmware Lifecycle Management
Secure, hash-verified OS updates with automated pre- and post-flight health checks. Upgrades roll out under the same human-in-the-loop discipline as configuration changes, and only proceed when the device proves it is healthy.
Images are verified against trusted hashes before a single byte reaches a device
Pre-flight checks gate the upgrade; post-flight checks confirm interfaces, sessions, and state
Failed health checks halt the rollout and flag the device instead of leaving it stranded
Security Principles
The platform holds privileged access to critical infrastructure, so it is built to do the least it can while still being useful, and to be explicit about what it does not know.
Encrypted Vault
Credentials are held in an encrypted vault. No plaintext secrets appear in the interface or in logs.
Controlled Access
Strictly authorized, rate-limited session pooling keeps device access predictable and within agreed limits.
Principle of Accuracy
No result is better than a guessed result. Where the platform cannot verify a fact, it reports that instead of inferring one.
On-Premise Deployment
Runs as a secure on-premise container deployment, suitable for air-gapped and tightly segmented environments.
Supported Platforms
Walk through NetForgeSH with our team against your own topology, and see where your intended state and your running configuration differ.