--- title: Policy as Code for the Network: Guardrails with Open... description: This post shows how to use Open Policy Agent (OPA) to write network configuration guardrails as code. You write rules in Rego, feed them a device's running... canonical: https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Policy as Code for the Network: Guardrails with Open Policy Agent | daily.dev og:description: This post shows how to use Open Policy Agent (OPA) to write network configuration guardrails as code. You write rules in Rego, feed them a device's running... og:url: https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal og:image: https://api.daily.dev/og/posts/kEdArnLAL.png og:image:alt: Policy as Code for the Network: Guardrails with Open Policy Agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Policy as Code for the Network: Guardrails with Open Policy Agent **[Cisco](https://daily.dev/sources/cisco)** · 13 min read · 0 upvotes · 0 comments ## Summary This post shows how to use Open Policy Agent (OPA) to write network configuration guardrails as code. You write rules in Rego, feed them a device's running configuration as JSON, and OPA returns structured violations. For Cisco IOS XE, it pulls config over RESTCONF and checks for telnet left enabled and an insecure HTTP server. A separate Rego package checks Meraki Dashboard API SSID data for open networks. A top-level package combines both into one compliance report, and the examples include OPA's built-in test runner showing 'PASS: 2/2'. Adding SD-WAN later is additive: write one new package and add one line to the domain list. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use Open Policy Agent to check if telnet is enabled on a Cisco IOS XE device? Pull the device's running configuration as JSON via RESTCONF, where the root is 'Cisco-IOS-XE-native:native', then write a Rego rule that inspects config.line.vty entries for a 'transport.input' field containing 'telnet' or an empty 'all' leaf. A rule like 'telnet_allowed(transport) if "telnet" in transport.input' flags the violation, returning a structured object with guardrail name, domain, detail and remediation text. _Developers automating Cisco config checks can follow policy-as-code patterns like this one on daily.dev._ ### How can I write one security policy that checks both Cisco IOS XE and Meraki configurations with OPA? Create a separate Rego package per domain, such as cisco.iosxe.hardening and cisco.meraki.hardening, each producing violation objects with the same shape: guardrail, domain, detail and remediation. A top-level package like cisco.report lists the domain packages in an array and combines their violations into one report, so adding a new domain like SD-WAN only requires a new package and one added line. _Teams standardizing security checks across network domains can track approaches like this on daily.dev._ ### How do I write unit tests for Rego policies in Open Policy Agent? Write a rule whose name starts with 'test_', use the 'with input as {...}' syntax to pin an inline JSON input, and assert the expected outcome, such as 'count(violations) == 2'. Running 'opa test hardening.rego hardening_test.rego' executes these rules and reports pass/fail counts, for example 'PASS: 2/2', letting guardrails be tested the same way as application code. _Engineers treating network guardrails as testable code can follow workflows like this on daily.dev._ ## Similar posts on daily.dev - [What Is Open Policy Agent? Best Practices and Use Cases](https://daily.dev/posts/what-is-open-policy-agent-best-practices-and-use-cases-wqsdtv48j) · Orca Security Blog · 0 upvotes · 0 comments - [How to Govern AI-Generated Infrastructure with Policy as Code and OPA \[Full Handbook\]](https://daily.dev/posts/how-to-govern-ai-generated-infrastructure-with-policy-as-code-and-opa-full-handbook--cgwuxyobm) · freeCodeCamp · 1 upvotes · 0 comments - [Governance That Ships: Embedding Policy as Code Into Your System of Record](https://daily.dev/posts/governance-that-ships-embedding-policy-as-code-into-your-system-of-record-k5du9rdlm) · JFrog · 0 upvotes · 0 comments - [Octopus Easy Mode - Policies](https://daily.dev/posts/octopus-easy-mode---policies-a2bj9tghs) · OctopusDeploy · 1 upvotes · 0 comments - [Terraform Compliance and Governance Guide](https://daily.dev/posts/terraform-compliance-and-governance-guide-xfo3gbkpo) · Spacelift · 1 upvotes · 0 comments --- Tags: [#networking](https://daily.dev/tags/networking), [#cisco](https://daily.dev/tags/cisco), [#policy-as-code](https://daily.dev/tags/policy-as-code) [View this post on daily.dev](https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Policy as Code for the Network: Guardrails with Open Policy Agent","url":"https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal"},"datePublished":"2026-10-26T14:01:40.138Z","dateModified":"2026-10-26T14:02:12.987Z","description":"This post shows how to use Open Policy Agent (OPA) to write network configuration guardrails as code. You write rules in Rego, feed them a device's running...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/548d93bd02cdbe984e7d1f3f27b5a718?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/548d93bd02cdbe984e7d1f3f27b5a718?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cisco","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cisco","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/68b8a8be17184235a5067d7c84162f77","url":"https://daily.dev/sources/cisco"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"networking,cisco,policy-as-code","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cisco","item":"https://daily.dev/sources/cisco"},{"@type":"ListItem","position":3,"name":"Policy as Code for the Network: Guardrails with Open Policy Agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/policy-as-code-for-the-network-guardrails-with-open-policy-agent-kedarnlal#faq","mainEntity":[{"@type":"Question","name":"How do I use Open Policy Agent to check if telnet is enabled on a Cisco IOS XE device?","acceptedAnswer":{"@type":"Answer","text":"Pull the device's running configuration as JSON via RESTCONF, where the root is 'Cisco-IOS-XE-native:native', then write a Rego rule that inspects config.line.vty entries for a 'transport.input' field containing 'telnet' or an empty 'all' leaf. A rule like 'telnet_allowed(transport) if \"telnet\" in transport.input' flags the violation, returning a structured object with guardrail name, domain, detail and remediation text. Developers automating Cisco config checks can follow policy-as-code patterns like this one on daily.dev."}},{"@type":"Question","name":"How can I write one security policy that checks both Cisco IOS XE and Meraki configurations with OPA?","acceptedAnswer":{"@type":"Answer","text":"Create a separate Rego package per domain, such as cisco.iosxe.hardening and cisco.meraki.hardening, each producing violation objects with the same shape: guardrail, domain, detail and remediation. A top-level package like cisco.report lists the domain packages in an array and combines their violations into one report, so adding a new domain like SD-WAN only requires a new package and one added line. Teams standardizing security checks across network domains can track approaches like this on daily.dev."}},{"@type":"Question","name":"How do I write unit tests for Rego policies in Open Policy Agent?","acceptedAnswer":{"@type":"Answer","text":"Write a rule whose name starts with 'test_', use the 'with input as {...}' syntax to pin an inline JSON input, and assert the expected outcome, such as 'count(violations) == 2'. Running 'opa test hardening.rego hardening_test.rego' executes these rules and reports pass/fail counts, for example 'PASS: 2/2', letting guardrails be tested the same way as application code. Engineers treating network guardrails as testable code can follow workflows like this on daily.dev."}}]} ```