Ten Years of Network Automation at LINX#

Riccardo Verzeni · Director of Software Engineering — LINX

• Why: A decade-long incremental journey at a large IXP — customer port provisioning, MAC ACL port security, rate limiting, quarantine testing, thousands of route-server BGP sessions — the physical interconnect + BGP combination this PM lives in.
• What: Three phases: NCA (config-as-code from structured data, Jinja2/Ansible/NAPALM, reviewable diffs, git audit trails), NCA 2.0 (unsupervised, asynchronous member self-service via API → message queue → worker), and OMS-based service orchestration plus route-server automation. A bespoke SoT (TSI) was built because nothing on the market fit an IXP with a telco's workflows but not its scale — today they'd probably use NetBox.
• How: The standout pattern is the pause–resume hybrid model: the OMS workflow pauses when external action is required (member validates config in quarantine VLAN, invited member accepts a private VLAN, NOC patches a physical port) and resumes automatically once satisfied. Explicit guardrails: locking, serialized deploys, hash-verification of pushed files, defaulting to humans for corner cases.
• Where applicable: IXP workflows are LINX-specific, but the pause-resume pattern, the phase-by-phase trust building, and the DO/DON'T list (don't build bespoke by default; don't over-engineer error handling) are broadly transferable.