Invariant

What Invariant is

Invariant helps network and security operators check whether network configurations meet connectivity and security rules. It builds a cross-vendor digital twin from configuration files, so assessment does not require direct access to routers or switches. Users write policies in YAML and evaluate them against network snapshots. They can also assess proposed configuration changes before deployment, with reports identifying policy violations and failures affecting critical flows.

For ongoing monitoring, Invariant can receive scheduled network scans and create incident alerts with virtual traceroutes and virtual route-table differences. Its listed vendor support includes Cisco, Juniper, Palo Alto, and AWS. Integration options include Jenkins, GitHub Actions, LibreNMS, Netmiko, Aerleon, Capirca, IPAM, and SIEM workflows. A CLI, SDK, and API support automation. The service is hybrid, with web and API access, and lists support for BGP, OSPF, IPSec, NAT, policy-based routing, VPN, ACL, and VLAN. The free Basic account has effectively no usage limits. Higher tiers add SSO, support for larger device counts, and early access to preview features.

Who it suits

Invariant suits network and security operators who need to review configurations for connectivity issues and security gaps. It is also suited to teams that want to validate proposed network changes or automate checks through a CLI, SDK, or API.

Limits

The free Basic account has effectively no usage limits. Higher tiers unlock SSO, support for the highest device counts described as up to hundreds or thousands of devices, and early access to preview features.

Getting started

1. Open https://www.invariant.tech/.
2. Use the free Basic account to get started.
3. Access Invariant through its web interface or API.
4. Provide configuration files to build a network model.
5. Define connectivity or security policies in YAML and evaluate them against a network snapshot.

Verdict

Choose Invariant if you need to evaluate network policies against configurations or proposed changes, with automation and scheduled monitoring available. The free Basic account has effectively no usage limits. Consider a higher tier if you need SSO or support for the largest device counts, and contact the company about fully on-premise data retention.