Using synthetic packets to validate forwarding and control implementation on network systems

A coordination point operating on a network, comprising:

• a processor programmed to:
• obtain network flow data corresponding to a network device in the network;
• determine, based on the network flow data, configuration coverage associated with an access control list (ACL) of the network device;
• identify, using the configuration coverage and the ACL, non-covered ACL entries of the ACL,
• generate a synthetic packet based on the non-covered ACL entries;
• providing the synthetic packet to a second network device, wherein the second network device transmits the synthetic packet to the network device;
• obtain a result associated with the synthetic packet from the network device;
• make a determination, based on the result, that the network device is not implementing at least one of the non-covered ACL entries correctly;
• and
• based on the determination, initiate a remediation action on the network device.

A method for managing a network device, the method comprising:

• generating a plurality of synthetic packets;
• transmitting the plurality of synthetic packets to the network device;
• obtaining a set of results associated with the plurality of synthetic packets;
• making a determination, based on the set of results, that the network device is not implementing at least a portion of a forwarding control configuration correctly;
• and
• based on the determination, initiating a remediation action.