▋ Vendor-Neutral IR + AI Fallback Engine

Translate Network Configs
Across Every Vendor

Convert Cisco IOS-XE, IOS-XR, NX-OS · Juniper Junos MX/SRX · Arista EOS — with automated redaction, validation, and AI-powered fallback.

Try the Converter Explore Architecture
6+
Vendor Platforms
10+
Platform Families
100%
Private Redaction
AI
Fallback Engine
CISCO IOS-XE CSR1000v / C8kv JUNIPER JUNOS MX / SRX ARISTA EOS 7000 Series BUBBLN Config Converter IR · AI · Redact · Validate CISCO IOS-XR ASR / NCS Series CISCO NX-OS Nexus 9000 JUNOS MX/SRX Service Routers SOURCE TARGET
Process

How the Conversion Works

Six guided steps take you from raw vendor config to a validated, deployment-ready output — with zero credential leakage.

01
🎯
Select Source & Target
Choose your source OS family and target platform. Platform-specific quirks (interface naming, VRF syntax) are resolved automatically.
→
02
📋
Paste Configuration
Provide your raw device config. Secrets are redacted client-side before any processing — passwords never leave in plaintext.
→
03
⚙️
Set Options
Configure AI fallback, SSH bootstrap inclusion, object prefixes, and interface naming conventions for your target platform.
→
04
⚡
Run Conversion
The IR engine parses every statement. AI fallback translates unparsed fragments. Output is encrypted and stored securely at rest.
→
05
🧩
Supply Missing Inputs
A guided wizard collects any remaining parameters (ASNs, interface mappings) so the final output has zero TODO placeholders.
→
06
✅
Review & Download
A confidence report shows parsed/unparsed coverage, UNSAFE blocks, and validation warnings before you download the final config.
converted_config.txt — Junos MX → Cisco IOS-XE ISR4k 
! --- Conversion Confidence Report ---
! Parsed statements: 247/251 (98.41%)
! Unparsed fragments: 2
! UNSAFE blocks: 0
! TODO items: 0
! SAFE-SKIP lines: 4
! --- End Confidence Report ---
!
hostname CORE-RTR-01
ip domain-name corp.example.com
!
vrf definition MGMT
 rd 65001:100
 address-family ipv4
 exit-address-family
!
interface GigabitEthernet0/0/0
 description WAN-UPLINK :: ge-0/0/0
 ip address <redacted> 255.255.255.252
 no shutdown
!
router ospf 1
 router-id <redacted>
 network 0.0.0.0 255.255.255.255 area 0
 auto-cost reference-bandwidth 10000
!
snmp-server community <redacted> RO SNMP-ACL
snmp-server contact noc@corp.example.com
Compatibility

Supported Platforms

Every platform conversion is handled by a dedicated, purpose-built engine — not a generic translator.

● Cisco Systems
IOS-XE — Catalyst 8000 / C8kv
Full interface mapping, VRF definition syntax, dot1q subinterfaces, SVI support, and platform-specific OSPF/BGP emission.
C8kC8kv (Virtual)ASR 1000
● Cisco Systems
IOS-XE — ISR 4000 Series
ISR-specific runbook generation, firewall filter emission, control-plane protection, VTY ACL hardening, and AAA configuration.
ISR 4300ISR 1000No SVI
● Cisco Systems
IOS-XE — CSR1000v / Catalyst 9k
Virtual router interface mapping, Gi/Eth naming styles, subinterface support. Catalyst 9000 full L2/L3 switching support.
CSR1000vCat9kCat3k
● Cisco Systems
IOS-XR & NX-OS
IOS-XR service-provider syntax, NX-OS Nexus data-centre features. Subinterface conversion without VLAN database overhead.
IOS-XRNX-OSNo switchport
◆ Juniper Networks
Junos MX Series
Full set-style parsing, IRB interfaces, ethernet-switching, inter-VLAN routing via IRB, Junos-to-IOS policer/filter translation.
Junos MXIRBNo security zones
◆ Juniper Networks
Junos SRX Series
SRX security zone and policy translation, RPM probe support, NetFlow/sFlow sampling config. Full firewall term mapping.
Junos SRXSecurity ZonesRPM
▲ Arista Networks
Arista EOS
EOS switchport/SVI semantics, dot1q subinterfaces, OSPF/BGP best-effort translation with platform-aware VRF handling.
EOS7000 SeriesSVI
Capabilities

Built for Production Networks

Every feature is designed around operator trust, accuracy, and day-zero deployment safety.

🔐
Automatic Secret Redaction
Passwords, SNMP community strings, BGP MD5 keys, and VPN pre-shared keys are locally redacted before any processing. Secrets are replaced with <redacted> tokens and restored in the final encrypted output — never sent to AI.
🤖
AI-Powered Fallback
When the deterministic IR parser can't match a fragment, OpenAI fallback translates it intelligently. Results are cached in an encrypted SQLite database to ensure speed and reproducibility on re-runs.
📊
Conversion Confidence Report
Every output begins with a coverage report — parsed vs total statements, unparsed fragment count, UNSAFE blocks, TODO items, and SAFE-SKIP lines. Know exactly what was translated and what needs review.
🔒
Encrypted-at-Rest Storage
All converted configs, Ansible playbooks, and host files are stored as Fernet-encrypted blobs. Even database-level access cannot read config content without the encryption key.
🧙
Guided Wizard Interface
A six-step wizard walks operators through source/target selection, config input, option tuning, missing-input collection, and final review — eliminating conversion errors from misconfiguration.
✅
Output Validation Engine
Post-conversion, the validator checks for non-ASCII characters in Cisco CLI strings, token leakage, dangling references, and platform constraint violations — ensuring paste-safe output on first try.
🌐
Protocol Coverage
Full support for OSPF, OSPFv3, BGP, static routes, VRF, VLAN, SVI, IRB, ACL/firewall filters, SNMP, NTP, AAA, NetFlow, DHCP relay, and more — across all vendor dialects.
🚀
Lab Device Testing
Push converted configs directly to Bubbln Lab devices (CSR1000v, C8kv, vIOS, ISR4300) over VPN for zero-risk validation before production deployment. Real hardware, real results.
📦
Ansible Playbook Generation
Convert configs then immediately generate ready-to-run Ansible playbooks targeting your chosen platform. SSE streaming shows live deployment output.
Technical Design

System Architecture

A layered, security-first design where each component has a single responsibility — and no component ever touches raw secrets unnecessarily.

🌐
Web Interface
Step-by-step wizard, SSE streaming, real-time conversion feedback
Flask + Jinja2
🔑
Auth & Identity
OAuth2, session management, guest vs member pricing tiers
Authlib + Flask-Login
🧠
Conversion Engine
Vendor-neutral IR, per-platform renderers, AI fallback, validation
Python IR + OpenAI
💾
Encrypted Storage
All configs, playbooks & user data encrypted at rest with Fernet
SQLAlchemy + Fernet
⚙️
Automation Layer
Ansible runner for playbook generation and device config push
Ansible Runner
💳
Payments & Access
Stripe checkout with voucher bypass. Voucher codes SHA-256 hashed at rest.
Stripe + SHA-256
OPERATOR FLASK WEB APP Auth · Routes · SSE Streaming CONFIG CONVERTER ENGINE IR Parser · Redaction · Platform Renderers AI FALLBACK OpenAI · Encrypted Cache ENCRYPTED STORE Fernet · SQLite · .enc files ANSIBLE Playbook Gen · Push BUBBLN LAB (VPN) CSR1kv · C8kv · vIOS · ISR4k STRIPE PAYMENTS GITHUB PUSH bubbln.io — system architecture v2.0
Security First

Zero-Trust by Design

Network configs contain your most sensitive data. Bubbln is built to handle it with the respect it deserves.

🛡️
Local-First Redaction
Secrets (enable passwords, community strings, BGP keys, RADIUS secrets) are removed before any translation occurs. Redacted markers are restored in the encrypted output file — never in transit.
🔑
Fernet Encryption at Rest
Every converted config, Ansible playbook, and host file is stored as an .enc blob. The database layer never stores or queries plaintext config content.
🪙
Hashed Voucher Codes
Payment voucher codes are stored as SHA-256 hashes only — one-way, non-reversible. A compromised database cannot reconstruct valid vouchers.
🌐
Privacy-Sanitized AI Calls
When AI fallback is used, IP addresses are tokenized to __IP_N__ before sending fragments to OpenAI. Tokens are resolved back in post-processing.
🔐
Credential Isolation
Lab device credentials, VPN keys, and API secrets are environment-variable-only. No credential ever appears in source code, UI, or log output.
📋
Input Sanitization
All vendor, platform, OS, and interface naming inputs are validated against strict allowlists. Injection of unsupported values is rejected with clear error messages.
"The only multi-vendor config converter that redacts your secrets before translation, gives you a line-by-line confidence score, and lets you test the output on a real lab device — all in one wizard."
— Bubbln product design principle
Pricing

Simple, Transparent Pricing

No hidden fees. Cancel anytime. Use a voucher to skip checkout entirely.

Guest
$50/mo
Full converter access, no registration required.
  • All vendor platform conversions
  • AI fallback engine
  • Confidence report on every conversion
  • Encrypted output download
  • Guided 6-step wizard
  • Lab device testing
  • Ansible playbook generation
  • GitHub push integration
Get Guest Access
Member
$30/mo
Full platform access. Save $240/year vs guest.
  • Everything in Guest
  • Lab device testing (CSR1kv, C8kv, vIOS, ISR4k)
  • Ansible playbook generation
  • GitHub push integration
  • Conversion history & re-runs
  • Priority AI fallback queue
  • Voucher code support
Start Member Access

Have a voucher? Enter it at checkout to skip Stripe entirely.

Ready to Convert Your
First Config?

Join network engineers who trust Bubbln for cross-vendor migrations.

Launch Converter → View All Features