AI & ML in Network Operations

Mental model

For most of networking history, “intelligence” meant a human writing if/then rules and SNMP thresholds. “Alert me when interface utilization > 80%.” That’s not AI — that’s a static threshold someone guessed once.

AI/ML in modern networks does three things humans struggle to do at scale:

1. Pattern detection — learn what “normal” looks like across hundreds of metrics, alert on deviations.
2. Root-cause correlation — given a symptom, surface the most likely cause from thousands of possible candidates.
3. Natural-language interface — translate “show me which switches are running old IOS” into a query the platform can execute.

This is now in the CCNA blueprint (added in v1.1) at a recognize-and-describe level — you should understand what AI/ML actually does in networks, not implement the models.

Predictive AI — the dominant pattern in network operations

Predictive AI (or “anomaly detection AI” or “AIOps”) consumes streaming telemetry from your network and learns what normal looks like, then alerts on deviations.

Where it shows up

Wireless (Cisco Meraki + Mist + Catalyst Wireless):

• “AP 5F-23 has unusual roaming failures over the last 4 hours — likely RF interference”
• “Client devices on SSID-CORP are seeing higher latency than baseline — root cause: WAN link saturation”
• “Today’s voice-quality score: 8.3 / 10, down from 9.1 baseline”

Wired (Cisco Catalyst Center / DNA Center):

• “Switch SW-CORE-2 saw CPU spike to 80% during a normally-quiet window — investigate”
• “OSPF reconvergence event detected 14:32 UTC, affecting these 5 prefixes, likely cause: link flap on Gi1/0/24”
• “Health score for the Charlotte office dropped 12 points — top contributing issue is DNS resolution”

Internet path (ThousandEyes, Catchpoint, AppNeta):

• “Path from your branch to Microsoft 365 now traverses an additional 3 hops via a new ISP peering”
• “Increased packet loss between us and Salesforce — issue isolated to AT&T transit”

Security (Cisco SecureX, Microsoft Defender XDR):

• “User account behavior anomalous — accessing servers it never has before”
• “Suspicious volume of data leaving over normally-quiet ports”

Inputs that feed AIOps

• Streaming telemetry via NETCONF subscriptions, gRPC/gNMI (see NETCONF & YANG, gRPC & gNMI)
• NetFlow / IPFIX / sFlow for flow-level visibility (see NetFlow)
• Syslog for events
• SNMP as the legacy backbone (see SNMP)
• Synthetic transactions from probes
• Endpoint telemetry for client-side metrics

The platform ingests millions of data points per minute, builds a baseline over weeks, then flags deviations. The “AI” is usually a mix of statistical models (Holt-Winters, ARIMA), supervised ML (random forests, gradient boosting), and increasingly transformer-based models for sequence/anomaly tasks.

What it’s actually good at vs marketing claims

Real strengths:

• Catching slow degradation that thresholds miss (“CPU is creeping up over weeks”)
• Cross-correlating events across many sources (“OSPF flap + interface error + temperature warning on the same switch”)
• Identifying patterns no human would notice in time

Marketing-driven overclaim:

• “Self-healing networks” — auto-remediation exists for narrow cases (channel change on an AP); broad auto-remediation is risky and rare in production
• “Predictive maintenance” — useful but limited; mean-time-to-failure prediction is statistical at best
• “Zero-trust AI” — buzzword salad; real zero-trust is a design pattern, not an algorithm

A CCNA engineer should expect AIOps platforms to dramatically reduce mean time to detection while modestly reducing mean time to resolution — you still need humans to investigate and fix.

Generative AI — the second wave

Large language models (GPT-class, Claude, Gemini) have entered network ops in 2024–2026. Three concrete forms:

1. Natural-language config

Engineer:  "Add VLAN 50 named GUEST to all access switches in the Charlotte site,
            with DHCP relay to 10.99.99.5, and put port Gi1/0/24 on all of them
            in access mode VLAN 50."

Cisco AI Assistant:  [generates the per-device CLI, shows diff, awaits approval,
                      executes via Catalyst Center API]

The win: fewer typos, faster bulk changes, the engineer reviews intent instead of typing 50 identical configs.

The risk: an LLM hallucinating a wrong command. Production-grade tools always preview before applying. Never auto-execute LLM output blind.

2. Incident summarization

[Pages a network engineer at 3 AM]
"User reports VPN failures from Charlotte branch starting 03:14 UTC.
 Likely root cause: ISP MPLS provider experiencing route flapping
 (correlated with peering session resets visible from ThousandEyes).
 Recommended next step: failover to backup WAN link until provider stabilizes.
 Affected users: ~120. Suggested customer comms attached."

The win: turns 30 minutes of correlation work into 60 seconds of context-loaded paging.

3. Documentation Q&A

Engineer:  "How does OSPF reconvergence interact with EIGRP redistribution
            when a stub area is involved?"

AI Assistant:  [Pulls from Cisco docs + internal runbooks + RFC references,
                synthesizes an answer with citations]

Useful for senior engineers as an “instant rubber-duck colleague.” Risky for juniors if used as a substitute for fundamentals.

Where it lives in real products

• Cisco AI Assistant for Networking — Catalyst Center add-on
• Cisco AI Assistant for ThousandEyes — application path analysis
• Microsoft Copilot for Security — log/incident summarization
• Palo Alto AIOps for NGFW — firewall config recommendations
• Juniper Mist AI (Marvis) — wireless and wired troubleshooting

What CCNA candidates should know

For the 200-301 v1.1 exam, you should be able to:

1. Distinguish predictive vs generative AI — anomaly detection (predictive) vs natural-language assistants (generative).
2. Recognize that AIOps platforms exist (Catalyst Center, Mist AI, ThousandEyes, Cisco AI Assistant, Marvis).
3. Identify the telemetry sources that feed them — NetFlow, gNMI, syslog, SNMP.
4. Understand the typical outputs — health scores, anomaly alerts, root-cause hypotheses, configuration recommendations.
5. Know the deployment model — usually cloud or on-prem appliance, ingesting from devices via streaming protocols.

You won’t implement AI/ML on the CCNA. The exam tests recognition and the ability to describe what these systems do.

A simple mental contrast

Era	How you find a problem
Pre-2000	A user calls. You SSH in, look at show log, guess.
2000-2015	SNMP threshold trips, you get a page. You SSH in, look at show log, guess.
2015-2022	Centralized monitoring (Splunk, ELK) shows a graph spike. You SSH in, look at show log, guess faster.
2022-2026	Catalyst Center / Mist AI says: “Health score dropped, root cause likely X, here’s a remediation suggestion.” You verify and apply.
2026+	Generative assistant: “Want me to drain VLAN 20 off SW-CORE-1, push the config to standby, and bring it back?” You approve.

We’re not replacing engineers. We’re shifting them from typing CLI to reviewing intent.

Limits to know

• Cold-start problem — AIOps platforms need weeks of baseline data before useful. Day 1 = noisy.
• Concept drift — what was normal in winter may not be normal in summer (HVAC patterns, seasonal user counts).
• Black box problem — when a model flags something as anomalous, it may not explain why. Engineers still need fundamentals to investigate.
• Hallucination in generative AI — LLMs can produce syntactically perfect but wrong Cisco config. Always preview, never auto-apply.
• Privacy & data residency — sending telemetry to cloud AI providers raises compliance questions in regulated industries.
• Cost — AIOps platforms scale by ingested telemetry volume. Plan budget per node + per flow.

Common mistakes

1. Trusting AI-generated config blind. Always preview. Cisco’s AI Assistant shows the diff before applying — use that workflow.

2. Confusing AI with automation. Automation (Ansible, Terraform) is rule-based. AI is pattern-based. Both useful; different.

3. Buying AIOps without baseline telemetry. If you don’t have NetFlow, gNMI, and syslog flowing to a collector, no AI platform can help you. Foundation first.

4. Believing “self-healing” hype. Auto-remediation is narrow. Don’t authorize broad changes by AI without human approval.

5. Treating AI suggestions as facts. A model is offering a probability, not a diagnosis. Verify before acting.

6. Skipping fundamentals. AI removes the need to memorize but not the need to understand. An engineer who relies on the AI assistant without understanding OSPF will eventually face an outage the assistant can’t explain.

7. Ignoring data residency. Sending European customer telemetry to a US cloud AI service may violate GDPR. Check before deploying.

8. Conflating CCNA-level recognition with implementing AI. You need to describe AI in networking for the exam, not build models.

Lab to try (mostly observational)

1. Cisco DevNet sandbox has free Catalyst Center reservations. Log in, navigate to Assurance, look at the AI-generated health scores and root-cause panels.
2. ThousandEyes free tier — set up a synthetic test from any agent to any service. Watch the path map + AI-suggested degradations.
3. Cisco AI Assistant demo at the Cisco Live keynote videos on YouTube — search “Cisco AI Assistant for Networking” — see the natural-language config flow.
4. Try a public LLM on a real network question: “Generate Cisco IOS config to apply MAB on VLAN 20 with fallback to a guest VLAN.” Evaluate the output. Note where it’s right, where it hallucinates.
5. Mist AI / Marvis demo — Juniper offers public demos of the Mist UI with Marvis queries. Watch how natural-language troubleshooting plays out.
6. Open-source AIOps experiment: ingest NetFlow into ElastiFlow or ntopng. Look for anomalous flow patterns. This is what the commercial tools’ models are trained to spot — at scale.

Cheat strip

Concept	Plain English
Predictive AI / AIOps	Watches telemetry, learns baseline, alerts on anomalies
Generative AI	LLMs translating natural language → config, summaries, Q&A
Telemetry sources	Streaming via gNMI/gRPC, NetFlow, syslog, SNMP
Anomaly detection	”This metric deviates from baseline” — the core useful pattern
Root-cause hypothesis	Correlated guess from many signals, ranked by likelihood
Cisco AI Assistant	Generative AI inside Catalyst Center for config + ops
Mist AI (Marvis)	Juniper’s wireless + wired AI ops
ThousandEyes	Internet path AI — application reachability + ISP issues
Self-healing network	Real but narrow (channel change, retry). Not magic.
Cold-start problem	AIOps needs weeks of data before useful
Hallucination	LLM producing wrong-but-plausible Cisco syntax. Always preview
What replaces	Static SNMP thresholds, manual correlation, ticket-by-ticket triage
What doesn’t	OSPF fundamentals, packet capture skill, network design judgment
CCNA depth	Recognize the platforms, distinguish predictive vs generative, know the telemetry sources