Pseudowire redundancy: pre/post change checks¶

Adding a backup pseudowire, or moving a customer between aggregation routers, is a common change. Before it, you want proof that the service is healthy. After it, you want proof that the primary still forwards and the backup is a ready, standby path. clijson parses every command involved on Cisco IOS XR, Juniper Junos and Huawei VRP. It maps them to one model, l2vpn.pseudowires, so the same script checks every vendor.

The model¶

Each pseudowire becomes one record. The fields are the same whatever the vendor:

Commands by device role¶

Running the checks¶

import clijson

PW_COMMANDS = {
    "vrp": ["display vsi verbose", "display vsi protect-group"],
    "iosxr": ["show l2vpn bridge-domain detail", "show l2vpn xconnect detail"],
    "junos": ["show l2circuit connections extensive"],
}


def pseudowires(capture: str, command: str, platform: str) -> list[dict]:
    return clijson.parse(capture, command, platform, normalize=True).normalized or []


# one forwarding PW per service, backups in standby, nothing down
report = clijson.checks.pseudowire_redundancy(pseudowires(capture, "show l2circuit connections", "junos"))
print(report.ok, report.problems)

Pre-check. Capture the commands above and save the results. If clijson.checks.pseudowire_redundancy() already reports problems, stop: the change would build on a broken service. Pass require_backup=True to list the services that don't have a backup yet.

Post-check. Capture again, then run clijson.checks.pseudowire_redundancy() and clijson.diff():

before = clijson.parse(pre_capture, "show l2circuit connections", "junos", normalize=True)
after = clijson.parse(post_capture, "show l2circuit connections", "junos", normalize=True)
for change in clijson.diff(before, after):
    print(change)
# + [neighbor=198.51.100.21,pw_id=3100]: {... 'state': 'standby', 'role': 'backup', ...}    <- the new backup

Pseudowires are matched by neighbor + pw_id, so a reordered output or new labels don't show up as changes. Counters and timers are ignored unless you pass ignore=None.

Failover test. Inside the change window, take the primary down (shut the primary PW or its aggregation-router IFL) and capture again. The diff should show the primary going down and the backup going standby -> up / active False -> True. Then restore the primary and check that the PWs revert within the configured revert timer.

clijson diff pre.txt failover.txt -c "show l2circuit connections" -p junos

From an AI assistant. The MCP server has a check_pseudowire_redundancy tool. Give it the post-change capture as output and the pre-change capture as before, and it returns both verdicts plus the changes in one call.

Common findings¶