Gated Device Onboarding: Automated Validation

Only reachable, verified devices reach NetBox. FlowWeaver runs the SSH health check first.

The Problem: "Ghost" Inventory and Data Decay

Every NetOps team has them: "ghost" records in NetBox — devices that exist in the Source of Truth but are unreachable, misconfigured, or running the wrong software version. They accumulate silently, and they break downstream automation at the worst possible moment. Manual onboarding bypasses vital reachability checks, leaving an inventory full of stale, unverified data. Without a validation gate, the SoT becomes a liability rather than an asset — triggering failures and increasing troubleshooting noise across the entire automation stack.

FlowWeaver canvas for the onboard_device workflow: ssh-version, classify-result, create-netbox-devic

Workflow Anatomy

How It Works

This workflow implements a gated logic pattern to ensure only verified, reachable hardware enters the production inventory:

Inventory Abstraction: The flow targets a specific inventory object (node-l3) using pre-stored Nokia SR Linux credentials, eliminating manual credential handling and ensuring consistent access.

Validation Gate: Before any record is created in NetBox, the workflow executes a show version command via SSH. This acts as a reachability and health check.

Deterministic Branching: "On Success". The flow proceeds to create/update the device in NetBox, setting its status to active and populating custom fields with the actual software version retrieved during the validation step.

On Failure: If the SSH session fails, the workflow terminates the onboarding path, preventing the creation of a "dead" record in the SoT.

Multi-Channel Telemetry: Real-time execution status is pushed to Slack for immediate visibility, followed by a detailed execution report sent via email for auditability.

Execution Artifacts: SoT and ChatOps

Enriched Inventory Commit

NetBox device page for a Nokia 7220 IXR-D2L created by the workflow with status Active and the softw

The workflow executes a write operation to NetBox only after the SSH reachability gate has been successfully cleared. The new device record (Nokia node l3) is provisioned with an active status, and the exact software version retrieved directly from the hardware (e.g., SRLinux-v23.10.2) is injected into a custom field. This strict sequence ensures that the Source of Truth reflects the verified, real-world state of the network rather than a theoretical or statically assigned baseline.

Slack: Execution Telemetry

Slack message posted by the workflow with the workflow name, the target device, the execution status

Simultaneous to the inventory update, FlowWeaver pushes a structured notification to the engineering team's communication channels. This payload delivers immediate, context-rich visibility—detailing the workflow name, target device, execution status, and the specific output from the validation step. By surfacing this telemetry directly in Slack, the workflow eliminates the need for operators to dig through backend execution logs to confirm a successful onboarding.

Establishing a High-Fidelity Automation Baseline

The true value of this onboarding workflow extends far beyond saving a few minutes of manual data entry. By enforcing a strict reachability and validation gate before committing any data to the Source of Truth, FlowWeaver protects the integrity of your entire automation ecosystem.

How this runs in FlowWeaver today: site, role and device type are mapped explicitly before promotion; both branches are validated in simulation before the workflow can be marked ready; an operator or a schedule starts the approved version, with the assistant outside the execution path; and timeouts and retries are part of the versioned definition.

It eliminates the "garbage in, garbage out" cycle that frequently breaks downstream scripts. When your NetBox instance is populated exclusively with verified, queryable hardware data, it stops being a passive documentation tool and becomes a reliable, high-fidelity engine for network orchestration.

See the validation gate run against a real device in your environment.

Schedule a Technical Deep Dive