Predictika · Cisco Catalyst 9300 agent action control

Agent Action-Control Gate for Cisco Catalyst 9300

An AI network agent prepares a change to a Catalyst 9300 switch stack: more ACL entries, more routed ports, a new stack member or a license change. Before the change is released to the network management tool, the agent sends it to Predictika, which checks it against a declarative model of the limits in Cisco's public Catalyst 9300 data sheet and the customer's own change policy, and returns a verdict, every reason and the figures it computed. Execution is allowed only when the verdict is allow, or after an approval.

This sits beside Cisco AgenticOps Trusted Validation, which Cisco describes as evaluating proposed changes against the live topology, configuration and telemetry before execution and verifying the outcome afterward. It is not a rebuild of it. This validator checks the request itself against published product limits and the customer's change policy, and holds the release gate.

Scope: Cisco Catalyst 9300 Series stacks (C9300, C9300X, higher-scale C9300 and fixed-uplink C9300L). See everything this validator covers

This validator handles any change to a Catalyst 9300 stack that touches the rules below — not just the scenarios pictured here.

  • Scale limits — ACL entries after the change (5,120 on C9300 and C9300L, 8,000 on C9300X, 18,000 on higher-scale models); 1,000 switched virtual interfaces in total; routed ports per stack (448, or 416 for C9300L).
  • Stacking — up to 8 members; a fixed-uplink C9300L does not stack with modular-uplink C9300 models; higher-scale models stack only with other higher-scale models; all members share one license level; StackPower on up to 4 switches (up to 8 with the XPS-2200), modular-uplink C9300 and C9300X only.
  • Needs approval — a C9300 and C9300X in one stack (supported at StackWise-480, but Cisco does not publish the mixed-stack scale limits); and two customer-policy inputs, a change freeze and a missing change ticket, which are the customer's rules, not Cisco facts.

Not covered: which features need which license tier, minimum IOS XE releases, MAC address scale, power budgets and other Catalyst 9300 data-sheet entries that are inconsistent or not modeled. Cisco's data sheet also says any combination of Catalyst 9300 models can form a stack, which contradicts its own stacking table; this validator follows the specific table rules. Stack inventory, current counts, license levels and the change window come from the customer's own systems and are not Cisco facts.

The AI network agentPrepares the change to the Catalyst 9300 stack and says it is ready to run.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

8 scenarios in 4 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI network agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI network agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      
Waiting for the call.

Where rules-based CPQ gets it wrong

Click to expand

Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

What the validator caughtTypical rules-based CPQPredictika
A limit that depends on the stack type (ACL entries 5,120, 8,000 or 18,000; routed ports 448 or 416) applied to the total after the change, not to the added amountOnly with workarounds
A CPQ rule knows the added quantity. The current inventory has to be fetched, added and compared with a limit that changes with the model family.
Current and added values travel with the request; the total is computed and compared with the limit for that stack type.
Which models may share a stack: 9300L with 9300L only, higher-scale models only with each other, a license level shared by all members, at most 8 switchesOnly with workarounds
Each mixing rule reads the stack and the new member together. Rules multiply with every model family and every change to Cisco's table is a rule edit.
Stack type, new member and license are checked together on every call.
A total stated by an outside AI agent (ACL entries, routed ports, stack size) compared with the inventory plus the changeNot what it is built for
A rules-based tool computes its own figures; it has no field for a number an agent asserts, so a wrong statement is never compared.
The stated figure is a field of the request and is compared with the computed total on every call.
The customer's own change freeze and change-ticket policy kept apart from Cisco's published limitsOnly with care
Policy and product facts end up in one rule set, so a policy change looks like a product change and the source of a block is unclear.
Customer policy findings are labeled as the customer's rule and routed to approval; Cisco limits are labeled as Cisco's.
Where Cisco does not publish the limit (mixed Catalyst 9300 and 9300X stack scale) the answer is "ask a person", not a guessOnly when vigilant
A rule either blocks or allows. Routing a missing published limit to an approver means an approval path next to each such rule.
The gap is a needs-approval finding with the reason spelled out.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as a step is completed, so a requester fixes one error and meets the next.
All findings come back together, whatever order the choices arrived in.

What this validator catches: findings from its test cases

Click to expand

Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the request; approval findings need a person to sign off; everything else is computed.

15,121 ACL entries exceed the 5,120 entries this stack type supports.
2SUMMARY: switched virtual interfaces after the change: 1,001 of 1,000 supported.
3449 routed ports exceed the 448 routed ports supported per stack of this type.
4a stack of 9 members exceeds the 8 members a Catalyst 9,300 stack supports.
5fixed-uplink Catalyst 9,300L switches cannot stack with modular-uplink Catalyst 9,300 models.
6higher-scale Catalyst 9,300 models stack only with other higher-scale models, not with standard C9,300 or C9,300X.
7stack members must share one license level; the new member has Essentials and the stack has Advantage.
8stack members must share one license level; changing Advantage to Essentials on a single member of a 6-member stack is not allowed.
9StackPower is supported only on the modular-uplink Catalyst 9,300 and 9,300X models, not the fixed-uplink 9,300L.
10a StackPower stack of 5 switches needs the XPS-2,200 appliance and supports at most 8; without it the limit is 4.
11the request states 400 routed ports after the change; 380 plus 60 gives 440.
12Cisco supports mixing C9,300 and C9,300X in one stack at StackWise-480 speed but does not publish the scale limits of a mixed stack; confirm the ACL, routed-port and MAC limits.
13this change falls inside a change freeze set by the customer own policy; it needs the customer approver (a customer rule, not a Cisco rule).
14the customer own policy requires a change ticket for this change and none is linked (a customer rule, not a Cisco rule).

Scenarios and results

Click to expand

The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

1. Adding a switch: A Catalyst 9300L with a different license added to a modular stack

The agent's request. Please add a Catalyst 9300L switch with the Essentials license to the Catalyst 9300 stack of 6 switches, which runs the Advantage license. The stack will then have 7 switches. It is ready to run.

Verdict: Blocked.

  • 9300L cannot mix with modular 9300. Fixed-uplink Catalyst 9300L switches cannot stack with modular-uplink Catalyst 9300 models.
  • Different license level. Stack members must share one license level; the new member has Essentials and the stack has Advantage.

2. Adding a switch: The agent resubmits after fixing the errors

The agent's request. Please add a Catalyst 9300 switch with the Advantage license to the Catalyst 9300 stack of 6 switches, which runs the Advantage license. The stack will then have 7 switches. It is ready to run.

Verdict: Allowed.

  • Summary. The stack grows from 6 to 7 members (the maximum is 8).

3. ACL scale: Access-list growth beyond the stack limit

The agent's request. Please add 2,300 ACL entries to the Catalyst 9300 stack of 4 switches, which holds 3,900 ACL entries now. The change results in 6,200 ACL entries in the stack. It is ready to run.

Verdict: Blocked.

  • ACL entries above the stack limit. 6,200 ACL entries exceed the 5,120 entries this stack type supports.

4. ACL scale: The agent resubmits after fixing the errors

The agent's request. Please add 1,200 ACL entries to the Catalyst 9300 stack of 4 switches, which holds 3,900 ACL entries now. The change results in 5,100 ACL entries in the stack. It is ready to run.

Verdict: Allowed.

  • Summary. ACL entries after the change: 5,100 of 5,120 supported on this stack type.

5. Routed ports and change freeze: Routed-port growth during a change freeze

The agent's request. Please add 60 routed ports to the Catalyst 9300X stack of 8 switches, which has 380 routed ports now. The change results in 400 routed ports in the stack. It is scheduled inside the current change freeze.

Verdict: Blocked.

  • Stated routed-port total does not match. The request states 400 routed ports after the change; 380 plus 60 gives 440.
  • Customer change freeze. This change falls inside a change freeze set by the customer own policy; it needs the customer approver (a customer rule, not a Cisco rule).

6. Routed ports and change freeze: The agent resubmits after fixing the errors

The agent's request. Please add 60 routed ports to the Catalyst 9300X stack of 8 switches, which has 380 routed ports now. The change results in 440 routed ports in the stack. It is scheduled inside the current change freeze.

Verdict: Needs approval.

  • Customer change freeze. This change falls inside a change freeze set by the customer own policy; it needs the customer approver (a customer rule, not a Cisco rule).
  • Summary. Routed ports after the change: 440 of 448 supported per stack of this type.

7. Routed ports and change freeze: The agent resubmits after fixing the errors

The agent's request. Please add 60 routed ports to the Catalyst 9300X stack of 8 switches, which has 380 routed ports now. The change results in 440 routed ports in the stack. It is scheduled inside the current change freeze.

Verdict: Allowed.

  • Summary. Routed ports after the change: 440 of 448 supported per stack of this type.

8. License level: A license change on one switch of a stack

The agent's request. Please change the license on one switch of the Catalyst 9300 stack of 6 switches from Advantage to Essentials. It is ready to run.

Verdict: Blocked.

  • License changed on one member. Stack members must share one license level; changing Advantage to Essentials on a single member of a 6-member stack is not allowed.

Narration transcript

Click to expand

The text of the narrated walkthrough, step by step.

  1. Welcome to a demo of Predictika's Validator. An AI network agent prepares a change to a Catalyst 9300 switch stack: more ACL entries, more routed ports, a new stack member or a license change. Before the change is released to the network management tool, the agent sends it to Predictika, which checks it against a declarative model of the limits in Cisco's public Catalyst 9300 data sheet and the customer's own change policy, and returns a verdict, every reason and the figures it computed. Execution is allowed only when the verdict is allow, or after an approval.
  2. I will start with the first request by the agent.
  3. The agent says. Please add a Catalyst 9300L switch with the Essentials license to the Catalyst 9300 stack of 6 switches, which runs the Advantage license. The stack will then have 7 switches. The rest of the request is on screen.
  4. Before it goes out, the agent calls the validator.
  5. Blocked, with two findings, all in one answer. Fixed-uplink Catalyst 9300L switches cannot stack with modular-uplink Catalyst 9300 models. Stack members must share one license level; the new member has Essentials and the stack has Advantage.
  6. The validator returned two blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the change are checked against each other.
  7. What this shows: for which models may share a stack: 9300L with 9300L only, higher-scale models only with each other, a license level shared by all members, at most 8 switches, a rules-based CPQ can do this only with workarounds.
  8. Now the agent resubmits.
  9. The corrected request. It changes the switch to add to Catalyst 9300 and the license of the switch to add to advantage.
  10. It calls the validator again.
  11. This time the validator clears it.
  12. Both earlier findings are cleared, and the validator's figure matches the change.
  13. Two problems caught in one call, fixed in one pass, and a clean change. That is the value of Predictika's validator: catching mistakes before they reach production.