Netforge.ai Docs
Open the app →
Docs/Guide/Device Drift

Device Drift

Compare live device configs against the intended design; schedule checks and alerts.

Relevant for:Enterprise / NetOpsAdmin / Owner
Where to find itCanvas→Toolbar→Drift

Device driftcompares each device's live running-config against the config NetForge last deployed for it — the intended baseline. It closes the loop between the design and the real network: if someone changed a switch by hand, you see it.

Why
A design tool that never looks at the network drifts into fiction. Continuous drift detection turns NetForge into a system of record — the blueprint stays true, and unauthorized change is surfaced instead of silently accumulating.

How the baseline is set#

When you push a config from the Deploy drawer with a project attached, NetForge records that config (secret-scrubbed) as the device's intended baseline. Devices that have never been deployed through NetForge show No baseline until you either deploy or tick Adopt live config as baseline on the first check.

Running a check#

  • Pick a SSH credential profile from your org vault.
  • NetForge reaches every device node that carries a management IP over SSH (NAPALM).
  • Each device is reported In sync, Drifted (with a line + structural diff), Unreachable, or No baseline. Drifted/unreachable devices are badged on the canvas.
Note
Running-configs are secret-scrubbed (passwords, SNMP communities, keys) before any diff is computed or stored — nothing sensitive lands in the drift history.

Scheduled drift & alerts#

Admins/owners can enable a recurring check (every N hours). When a device transitions into a drifted or unreachable state, the project owner's notification contacts are alerted (e-mail / webhook / SMS), reusing the Watchtower alert channels.