A golden template for 57 customer routers

The situation

Every CPE on the network worked, more or less, and every one was slightly different. Management access came from different addresses, some sites still logged to a server that no longer existed, some took their DHCP address on the same bridge as the client LAN and the service tunnel.

What we did

Three read-only tools. A health sweep per CPE. A configuration audit that reads 115 settings from each device, strips secrets, and takes the most common value as the baseline so that outliers show up as a diff. And a generator that writes a per-site .rsc plus a batch plan, and never connects to anything.

The template itself was the operator's decision, setting by setting: spanning tree off on the bridge, CPE NAT disabled but not removed, the management mesh interface named consistently, a dead logging target removed, management services limited to the NOC ranges in a second phase. We added one thing, a keepalive on the mesh peers, and said so.

The pilot site was applied and verified. When four unrelated sites went dark upstream a few minutes later, the batches stopped until they were back, because a change window and an outage must never be allowed to blur together.

What changed

Each batch that is applied drops out of the audit on the next run, so the diff shrinks toward zero and the standing findings, including chronic port flaps and management services open to any address on 56 of 57 devices, have an owner and a list.