I am a network professional with over 18 years of experience in enterprise and data‑center networking. I am a CCIE Data Center certified engineer with strong hands‑on expertise in Cisco Nexus and Cisco ACI design, deployment, troubleshooting, and operations. I work on production ACI fabrics and am available for Cisco ACI and Nexus freelancing or consulting work.
Most teams don't have a shortage of "intelligent" tooling anymore — they have three different kinds running simultaneously, often without anyone having deliberately chosen which one belongs where. An EEM applet restarts a process. An engineer pastes a syslog snippet into ChatGPT at 2 a.m. A vendor's new "AI-powered" NOC dashboard promises to investigate incidents on its own. These are not the same technology wearing different logos — they're three genuinely different intelligence models, and picking the wrong one for a given job either wastes the tool's potential or creates real operational risk.
This post isn't another "here's what Agentic AI means" explainer. It's a working decision framework: how to tell which of the three you actually need for a specific network operations problem, with a scoring checklist you can run against your own use cases.
Table of Contents
- The Three Models, in Networking Terms
- The Same Incident, Handled Three Ways
- Decision Framework: Which One Do You Actually Need?
- Scoring Checklist for Your Own Use Case
- Where Governance and Cost Actually Change
- A Common Mistake: Over-Automating Too Early
- FAQ
1. The Three Models, in Networking Terms {#three-models}
Reactive Automation — EEM applets, SNMP trap handlers, cron-scheduled scripts, Ansible playbooks triggered on a webhook. Fixed IF-THEN logic, no memory of past events, same input always produces the same output. This has run enterprise networks reliably for decades and isn't going anywhere.
Generative AI — ChatGPT, Copilot, Claude, or a vendor's embedded assistant, used the way you'd use a very well-read colleague: you ask, it explains, you decide what to do. It understands natural language and context within a session but takes no action on its own and has no persistent memory of your fabric across conversations unless you explicitly feed it that context each time.
Agentic AI — given a goal rather than a question ("resolve this packet loss," "bring this BGP session back up"), it independently gathers telemetry, reasons through multiple hypotheses, takes or recommends action, checks whether the action worked, and either closes the loop or escalates with evidence attached.
2. The Same Incident, Handled Three Ways {#same-incident}
Take an OSPF adjacency stuck in EXSTART between two data center routers.
Reactive automation's role: a monitoring script notices the neighbor state hasn't reached FULL within an expected window and pages the on-call engineer. It has no opinion on why — it just knows the state is wrong.
Generative AI's role: the paged engineer asks an assistant "why would OSPF get stuck in EXSTART," and gets a solid explanation — MTU mismatch, duplicate router ID, or an interface flapping mid-negotiation — along with the show commands to check each. The engineer still has to run those commands and decide.
Agentic AI's role: given the goal "restore OSPF adjacency between these two routers," the agent pulls the interface MTU on both sides, checks router IDs, reviews recent interface error counters, forms a ranked hypothesis, and either proposes a specific fix or — if authorized for read-only + low-risk actions only — clears the interface counters and re-triggers negotiation, then verifies the adjacency actually reached FULL before closing the loop.
None of these three replaces the other two. The monitoring script still needs to exist to trigger the whole chain. The assistant is still useful when a human wants to understand why, not just get a fix. The agent is valuable specifically when the investigation itself is the time-consuming part.
3. Decision Framework: Which One Do You Actually Need? {#decision-framework}
Ask these questions about the specific task in front of you, in order:
Is the correct response always identical, regardless of context? If yes — stick with reactive automation. Interface down → generate a ticket. There's no ambiguity to reason through, so paying for reasoning is waste.
Does a human need to understand the "why" before acting, and is there time for that? If yes — generative AI is the right layer. Documentation review, config audits before a change window, explaining an unfamiliar error message — these benefit from an assistant, not autonomous action.
Does resolving this require pulling data from multiple sources, forming a hypothesis, and iterating — and is speed more valuable than having a human drive each step? If yes — this is where an agent earns its keep. Multi-source root cause analysis, correlating a config change with a metrics regression, is exactly the kind of "read a lot, reason a bit, then act" work reactive scripts can't do and manual assistant use is too slow for.
4. Scoring Checklist for Your Own Use Case {#scoring-checklist}
Score each statement 1 (no) to 3 (strongly yes) for the task you're evaluating:
- The correct action is identical every single time this trigger fires
- A human explanation of root cause has real standalone value here, separate from fixing it
- Multiple data sources need to be correlated before you'd even know what to try
- Getting it wrong has low blast radius (a restarted service, not a routing change on a core switch)
- Speed of resolution matters more than having a human in the loop for every step
Mostly 1s on correlation/speed, high on "always identical" → reactive automation is enough; don't over-build. High on "human explanation has value," low on "always identical" → generative AI, used interactively, is the right fit. High on correlation and speed, and you've separately confirmed blast radius is controlled → agentic AI is worth piloting, with tight scoping on write access.
5. Where Governance and Cost Actually Change {#governance-cost}
This is the part most comparison posts skip. As you move from left to right across the three models, three things change together, not independently:
Blast radius. A misconfigured EEM applet affects one device. A generative AI assistant giving bad advice affects whatever the human chooses to act on — there's still a human check. An agent with write access across multiple devices, acting on its own reasoning, has a blast radius as large as the scope of its credentials — which is exactly why that scope has to be deliberately narrow.
Auditability requirements. Nobody demands to know "why" a cron job restarted a service — the rule is the explanation. An agent's action needs the reasoning chain logged alongside the command, because "why did it do that" has to be answerable after the fact, especially for anything customer-facing.
Cost per incident. Reactive automation costs almost nothing per trigger. Generative AI costs a bit more per query but is bounded by how much a human chooses to ask. An agent that calls out to a model repeatedly across a busy fabric, on every event, can accumulate real compute cost — scope which events actually warrant agentic investigation rather than routing everything through it by default.
6. A Common Mistake: Over-Automating Too Early {#common-mistake}
The most common failure pattern isn't under-using AI — it's reaching for an agent before the underlying reactive automation and monitoring are solid. An agent reasoning over noisy, incomplete telemetry will produce confident, plausible-sounding conclusions that are wrong just as often as a junior engineer working from bad data would. Get the boring Level 1 monitoring accurate and complete first; the agent is only as good as the data it's reasoning over.
Quick Comparison Table {#quick-comparison}
For anyone skimming, here's the whole post in one table:
| Approach | What Happens | Pros | Cons |
|---|---|---|---|
| Reactive | Alert → Page on-call | Reliable, fast | No diagnosis |
| Generative | ChatGPT explains possible causes | Helpful context | Human must act |
| Agentic | Agent investigates, diagnoses, proposes fix | End-to-end handling | Requires trust and guardrails |
FAQ {#faq}
Q: Do these three models replace each other, or work together? They work together — reactive automation still generates the initial trigger, generative AI still supports human-driven investigation and documentation, and agentic AI adds a new layer on top for multi-step autonomous work. None of them eliminates the need for the other two.
Q: Which one should a small network team with no AI experience try first? Generative AI, used interactively for documentation and troubleshooting explanations — it requires no new infrastructure, no write access to devices, and lets the team build intuition for what these models are good at before considering anything autonomous.
Q: Is Agentic AI overkill for a small enterprise network? Often, yes, at least initially — the operational overhead of governance and access scoping only pays off once you have enough recurring, multi-source troubleshooting volume to make the investigation-time savings meaningful.
Q: How do you decide how much autonomy to give an agent? Start read-only. Let it diagnose and recommend for a defined period, compare its conclusions against what your engineers found independently, and only extend action-taking permissions for the specific, narrow set of actions it has proven reliable on.
Q: What's the single biggest risk in this whole progression? Granting write access before trust has actually been earned through a track record — the risk isn't that the AI is unintelligent, it's that broad credentials plus a confidently wrong conclusion is a worse outcome than a slower, correct one.
No comments:
Post a Comment