Blueprint Wizard
Build a whole multi-site network — one tab per site, wired through the Overview, with deploy-ready configs.
The Blueprint wizard builds a complete multi-site network from your answers: one canvas tab per site, wired through a WAN Overview tab, with deploy-ready, hardened configuration on every router, switch, SD-WAN edge, firewall and console server it places. Generation is deterministic — the same answers always produce the same network — and additive: re-running the wizard later adds sites without touching anything you have hand-edited.
The seven steps#
| 1 · Sites | Company prefix (heads every hostname) and the site mix: data centers, campuses, branches — each S/M/L. Tier drives the build: branches get 1/2/4 access switches, campuses add dual HSRP cores, DCs get a spine/leaf fabric, a firewall breakout pair and dual WAN edges. |
| 2 · WAN | SD-WAN overlay (EdgeConnect on MPLS + Internet underlays), classic MPLS + Internet (CE routers), or Internet-only DIA. |
| 3 · Routing | LAN IGP (OSPF / EIGRP / static) × WAN advertisement (eBGP to the provider / static). EIGRP requires the Cisco kits. |
| 4 · Vendors | Kit per role family: Arista or Nexus DC fabric; Catalyst or Aruba CX campus and access; Palo Alto or Firepower firewalls. Plus the out-of-band console layer toggle. |
| 5 · Addressing | One supernet (/8–/16), carved into right-sized per-site blocks you can override, plus the editable subnet profile per site kind. |
| 6 · Credentials | Org credential vault references (nothing secret in the design) or one placeholder token applied everywhere a secret belongs. |
| 7 · Review | Tiles and per-site cards for what will be generated — and, on re-runs, which existing sites stay untouched. |
Addressing: carve, override, subnet profiles#
Give the wizard one supernet and it proposes a right-sized block per site — data centers and campuses around a /20, branches a /21, computed from the subnet profile with growth headroom (large-tier sites get one extra bit). Every pending site row in the Addressing step is an editable CIDR override; the proposal shows as the placeholder. Overlap, alignment, containment and capacity are all validated before Next.
The subnet profile table (per site kind: DC / campus / branch) decides what lives inside each block: Data, Voice, Servers, Guest, Management, Transit and Loopback rows with editable names, VLAN ids and sizes. Everything derives from it — VLAN databases, HSRP gateway SVIs, DHCP relay on user-facing subnets, voice VLANs on access ports, trunk allowed-lists, and IPAM pools pinned to their VLANs.
Routing designs#
The wizard generates whole-network reachability, not per-box fragments. WAN edges join the site's IGP and originate the default route into it (OSPF default-information originate; EIGRP redistributes its static default), so cores and leaves learn their exit instead of carrying blind statics. With BGP advertisement, edges speak eBGP to the provider with BFD and advertise the site block anchored on a Null0 discard route. Static mode writes every path down explicitly — edge return routes, core defaults, per-subnet spine routes. Firewalls stay out of the IGP with explicit statics to the Internet breakout and back into the fabric.
Out-of-band console layer#
With the Vendors-step toggle on (the default), every site gets a Lantronix SLC console server sized to its device count (8/16/32/48 ports, chained past 48) on the management subnet, with a console run to every router, switch and firewall and an eth0 uplink into the management VLAN. The generated config includes the full device-port bank — names, baud, SSH access per port.
Credentials: vault or placeholder#
Vault mode writes only credential references into the design — every secret (enable, TACACS keys, NTP auth, SNMPv3, admin password) resolves server-side at generation from your org vault profile; nothing secret is ever stored in the design. Placeholder mode writes one unmistakable token — {{NETFORGE_ADMIN_PASSWORD}} — everywhere a secret belongs, and the generation drawer banners every occurrence so it cannot ship silently: real configs are one find-and-replace away.
Additive re-runs & locking#
The wizard's model persists with the project. Reopen it later and generated site rows show a padlock; the structural inputs — WAN architecture, routing, kits, supernet, subnet profiles, credentials, company prefix — collapse into read-only summary cards. Add new sites and only they generate: new tabs appear, their blocks append to the Overview, and every existing tab (including your hand edits) stays byte-for-byte untouched. Review shows the diff — new sites as cards, existing ones as locked chips.
Every device ships hardened#
SSHv2-only with 4096-bit keys, ssh-only VTY lines with exec-timeouts, TACACS+ AAA with local fallback, authenticated NTP, SNMPv3-only, central syslog, login banners, a Common-Criteria password policy, CDP off on WAN-facing ports with LLDP inside — on every generated device, from both credential modes.