Negev — MAC-based VLAN automation
Managing switches by hand works when you have a handful of them. When that number grows, repetitive tasks eat time and leave room for human error.
At IFMT, we have Cisco IOS and Datacom DmOS switches spread across campuses. VLAN configuration was a manual process: identify the MAC of the connected device, find which port it was on, remember which VLAN it belonged to, configure. For dozens of ports, across several switches, that becomes impractical day to day.
That is why I built Negev.
How it works
The principle is simple: each equipment vendor uses a unique MAC prefix (OUI). Negev uses that prefix to determine which VLAN the device belongs to and configure the switch port automatically.
The flow is straightforward:
- You define in a YAML the mapping between MAC prefixes and VLANs
- Negev connects to the switch (SSH or Telnet) and discovers the platform automatically
- It reads the MAC table and identifies which port each device is on
- It checks whether the port is already on the correct VLAN — if not, it configures it
- Optionally, it creates or removes VLANs to keep only the allowed ones
Everything starts in sandbox mode: Negev shows exactly what it will do without touching the switch. When you confirm, you pass --write and it executes.
A bit of the technique
Negev is written in Go and follows a modular architecture with platform drivers. Each vendor has its own command dialect — what works on a Cisco IOS does not work on a Datacom DmOS. The solution was to create a SwitchDriver interface that each platform implements, and a registry that selects the right driver automatically.
Initial support covers:
- Cisco IOS — platform detection, MAC table reading, switchport mode access, VLAN creation and removal
- Datacom DmOS — the same set of features, with Datacom’s own syntax
The transport system is also pluggable (SSH and Telnet), with injection of custom authentication sequences for each device.
Where Negev fits at IFMT
Before, configuring a single port meant manual switch access, menu navigation, typing commands, and visual verification. With Negev, we centralize the configuration in a YAML file and let the tool do the grunt work.
The most immediate impact was standardization: every switch follows the same configuration, with no drift. If a new computer is plugged into any port, Negev identifies the MAC prefix and puts it on the right VLAN on the next run.
Open project
Negev is open source (MIT) and available on GitHub. If you face the same kind of problem — whether at a university, a company, or an ISP — feel free to use, adapt, or contribute.