Translate a network config from one vendor to another — and get a list of everything that didn’t.

What translates. What refuses. On purpose.

Translates: hostnames, interfaces (names, addresses, VRF bindings, MTU), VLANs and L2 membership, static routes, DNS/NTP, SNMP, LAGs, local users, DHCP pools, VRFs — the boring 80% of a migration. Cross-vendor interface naming included: GigabitEthernet1/0/1 becomes ge-1/0/1.

Detects and lists, deliberately does not translate: firewall rules, NAT, VPN, QoS, route-maps, dynamic routing stanzas. These are vendor-specific stateful policy that does not translate cleanly across vendors — so netcanon surfaces them by name in a banner instead of pretending.

Netcanon is the right tool for the router portion of a migration — and explicitly the wrong tool to claim it does the firewall portion.

Netcanon is built and maintained by one person. The audit machinery below exists because you shouldn’t have to take one person’s word for fidelity.

What works for your vendor: Cisco IOS-XE · NX-OS · IOS-XR · Junos · Arista EOS · Aruba AOS-S · Aruba AOS-CX · FortiGate · MikroTik · OPNsense · VyOS

Because you are being asked to paste a network config into someone else’s website

Your session is a throwaway container. Your config is never stored. Sensitive? Don’t paste it — run it locally instead.

Run it on your machine

docker run --rm -p 8000:8000 -e NETCANON_ALLOW_INSECURE_BIND=1 \
    ghcr.io/netcanon/netcanon:latest

then open http://localhost:8000. The image refuses an unauthenticated non-loopback bind by default; the flag acknowledges you’re running it locally. For anything reachable by other hosts, set NETCANON_API_KEY instead.

Image is amd64/x86-64 only today.

Prefer pip? pip install netcanon — same app, same CLI. Windows? There’s an MSI on Releases.

No telemetry, no phone-home, no update checks — on any install path (pip, Docker, MSI). The only network connections netcanon makes are the SSH sessions you configure for backups.

The audit underneath

Every covered vendor pair is audited cell-by-cell for silent translation loss — the kind that produces output that looks valid but quietly drops a field. The methodology is published. So is the list of cells currently open: every residual is enumerated and triaged, nothing swept under the rug.

The honest follow-up: the audit only covers cells we have fixtures for. Real-world configs reach paths synthetic fixtures haven’t. That’s where you come in — see Contribute.

Also in the box

Config backup over SSH. Netcanon pulls running-configs on a schedule and stores them verbatim — its backup half exists to feed translation. If backup and diff is your only need, Oxidized and RANCID are purpose-built and more mature on device-driver breadth; we say so ourselves.

Config sanitizer. Sharing a config in a ticket or a forum post? Sanitize it first:

netcanon sanitize -i my-config.txt --source-vendor cisco_iosxe_cli --dry-run

Every substitution is shown for your review.

Drive it from your stack

Run netcanon as a container beside your stack; drive it over the versioned HTTP API or the CLI. It is an app with an API, not an embeddable library — process isolation keeps its dependency tree out of yours.

curl -s -H "Authorization: Bearer $NETCANON_API_KEY" \
  -H "Content-Type: application/json" \
  -X POST http://localhost:8000/api/v1/migration/plan \
  -d '{"source":"cisco_iosxe_cli","target":"juniper_junos","raw_text":"..."}'

The response carries the rendered config and the declared losses in the same payload:

{
  "status": "completed",
  "validation": { "severity": "ok", "lossy_paths": [], "unsupported_paths": [] },
  "rendered": "set system host-name access-sw-01\n...",
  "port_renames": { "GigabitEthernet1/0/1": "ge-1/0/1" },
  "dropped_tier3_sections": [ "ip access-list extended MGMT-PROTECT" ]
}

Response excerpt — bookkeeping fields elided; the full shape is in the running app’s own /docs (OpenAPI).

v0.x promise: /api/v1 request/response shapes don’t break; changes ship as new endpoints; the CHANGELOG names every break.

Found a config it gets wrong?

That’s the contribution this project values most. Sanitize it first — the sanitizer shows every substitution for your review — then submit it as a fixture.

Sanitize + submit