EEM

Failover

event manager applet FAILOVER_TO_AKAMAI
 event track 1 state down
 action 1.0 syslog msg "Cloudflare SLA down – initiating Akamai advertisement"

 ! Step 1: Advertise to Akamai
 action 2.0 cli command "enable"
 action 3.0 cli command "configure terminal"
 action 4.0 cli command "router bgp 1"
 action 5.0 cli command "neighbor 13.0.0.2 route-map RM_OUT-AK out"
 action 6.0 cli command "neighbor 14.0.0.2 route-map RM_OUT-AK out"
 action 7.0 cli command "end"

 ! Step 2: Wait before verification
 action 8.0 wait 30
 action 8.1 syslog msg "Waited 30 seconds – checking Akamai advertisement"

 ! Step 3: Verify advertisement to Akamai
 action 9.0 cli command "show ip bgp neighbors 13.0.0.2 advertised-routes | include 150.0.0.0"
 action 9.1 regexp "150.0.0.0" "$_cli_result" result

 ! Step 4: Conditional withdrawal from Cloudflare
 action 10.0 if $result eq "1"
 action 10.1  syslog msg "Confirmed 150.0.0.0/24 advertised to Akamai – withdrawing from Cloudflare"
 action 10.2  cli command "enable"
 action 10.3  cli command "configure terminal"
 action 10.4  cli command "router bgp 1"
 action 10.5  cli command "no neighbor 11.0.0.2 route-map RM_OUT-CF out"
 action 10.6  cli command "no neighbor 12.0.0.2 route-map RM_OUT-CF out"
 action 10.7  cli command "end"
 action 10.8 end

Fail back

event manager applet RECOVER_TO_CLOUDFLARE
 event track 1 state up
 action 1.0 syslog msg "Cloudflare SLA restored – re‑advertising to Cloudflare"

 ! Step 1: Re‑advertise to Cloudflare
 action 2.0 cli command "enable"
 action 3.0 cli command "configure terminal"
 action 4.0 cli command "router bgp 1"
 action 5.0 cli command "neighbor 11.0.0.2 route-map RM_OUT-CF out"
 action 6.0 cli command "neighbor 12.0.0.2 route-map RM_OUT-CF out"
 action 7.0 cli command "end"

 ! Step 2: Wait before withdrawing Akamai
 action 8.0 wait 30
 action 8.1 syslog msg "Waited 30 seconds – withdrawing Akamai advertisement"

 ! Step 3: Withdraw from Akamai
 action 9.0 cli command "enable"
 action 9.1 cli command "configure terminal"
 action 9.2 cli command "router bgp 1"
 action 9.3 cli command "no neighbor 13.0.0.2 route-map RM_OUT-AK out"
 action 9.4 cli command "no neighbor 14.0.0.2 route-map RM_OUT-AK out"
 action 9.5 cli command "end"

Python Script

 #!/usr/bin/env python3
import requests
import sys
import logging

logging.basicConfig(level=logging.INFO)

API_URL = "https://api.example.com/health"   # Replace with Cloudflare/Akamai endpoint
TIMEOUT = 5

def main():
    try:
        resp = requests.get(API_URL, timeout=TIMEOUT)
        if resp.status_code == 200 and "healthy" in resp.text.lower():
            print("API_OK")
            sys.exit(0)
        else:
            print("API_FAIL")
            sys.exit(1)
    except Exception as e:
        logging.error(f"API check failed: {e}")
        print("API_FAIL")
        sys.exit(1)

if __name__ == "__main__":
    main()

EEM failover

event manager applet API_CHECK_FAILOVER
 event track 1 state down
 action 1.0 syslog msg "Track 1 down – running API check via Python"
 action 2.0 cli command "guestshell run python3 /home/admin/check_api.py"
 action 2.1 regexp "API_OK" "$_cli_result" result

 ! If API_OK, advertise to Akamai
 action 3.0 if $result eq "1"
 action 3.1  syslog msg "API check passed – advertising 150.0.0.0/24 to Akamai"
 action 3.2  cli command "enable"
 action 3.3  cli command "configure terminal"
 action 3.4  cli command "router bgp 1"
 action 3.5  cli command "neighbor 13.0.0.2 route-map RM_OUT-AK out"
 action 3.6  cli command "neighbor 14.0.0.2 route-map RM_OUT-AK out"
 action 3.7  cli command "end"
 action 3.8 end

 ! If API_FAIL, log and do nothing
 action 4.0 else
 action 4.1  syslog msg "API check failed – not advertising to Akamai"
 action 4.2 end

Fail back

event manager applet API_RECOVER
 event track 1 state up
 action 1.0 syslog msg "Cloudflare SLA restored – re‑advertising to Cloudflare"
 action 2.0 cli command "enable"
 action 3.0 cli command "configure terminal"
 action 4.0 cli command "router bgp 1"
 action 5.0 cli command "neighbor 11.0.0.2 route-map RM_OUT-CF out"
 action 6.0 cli command "neighbor 12.0.0.2 route-map RM_OUT-CF out"
 action 7.0 cli command "end"

API

• https://techdocs.akamai.com/prolexic/reference/post-routed-bgp-sessions

• https://developers.cloudflare.com/api/resources/radar/subresources/bgp/subresources/ips/methods/timeseries/

PYthon script to query API

#!/usr/bin/env python3
import requests
import sys

# Replace with your prefix and ASN
PREFIX = "150.0.0.0/24"
ASN = 1
API_URL = f"https://radar.cloudflare.com/api/bgp/routes/{PREFIX}"

def main():
    try:
        resp = requests.get(API_URL, timeout=10)
        resp.raise_for_status()
        data = resp.json()

        # Cloudflare Radar returns a list of route objects
        advertised = False
        for route in data.get("routes", []):
            origin_asn = route.get("origin_asn")
            if origin_asn == ASN:
                advertised = True
                break

        if advertised:
            print("ADVERTISED")
            sys.exit(0)
        else:
            print("NOT_ADVERTISED")
            sys.exit(1)

    except Exception as e:
        print(f"ERROR: {e}")
        sys.exit(2)

if __name__ == "__main__":
    main()

EEM

event manager applet CHECK_BGP_ADVERTISEMENT
 event track 1 state down
 action 1.0 syslog msg "Track down – running BGP advertisement check"
 action 2.0 cli command "guestshell run python3 /home/admin/check_api.py"
 action 2.1 regexp "ADVERTISED" "$_cli_result" result

 ! If prefix is advertised, withdraw Cloudflare
 action 3.0 if $result eq "1"
 action 3.1  syslog msg "Prefix confirmed advertised – withdrawing Cloudflare"
 action 3.2  cli command "enable"
 action 3.3  cli command "configure terminal"
 action 3.4  cli command "router bgp 1"
 action 3.5  cli command "no neighbor 11.0.0.2 route-map RM_OUT-CF out"
 action 3.6  cli command "no neighbor 12.0.0.2 route-map RM_OUT-CF out"
 action 3.7  cli command "end"
 action 3.8 end

Python script to query Akamai

#!/usr/bin/env python3
import requests
import sys

# Replace with your Akamai API base URL and credentials
API_BASE = "https://akaa-baseurl.luna.akamaiapis.net/prolexic/v1"
PREFIX = "150.0.0.0/24"

# Akamai authentication headers (example using API client token)
HEADERS = {
    "Authorization": "Bearer <YOUR_ACCESS_TOKEN>",
    "Accept": "application/json"
}

def main():
    try:
        # Query BGP sessions/routes
        resp = requests.get(f"{API_BASE}/routed-bgp-sessions", headers=HEADERS, timeout=10)
        resp.raise_for_status()
        data = resp.json()

        advertised = False
        for session in data.get("sessions", []):
            for route in session.get("advertisedRoutes", []):
                if route.get("prefix") == PREFIX:
                    advertised = True
                    break

        if advertised:
            print("ADVERTISED")
            sys.exit(0)
        else:
            print("NOT_ADVERTISED")
            sys.exit(1)

    except Exception as e:
        print(f"ERROR: {e}")
        sys.exit(2)

if __name__ == "__main__":
    main()

Python Script to Query BGP Tools

#!/usr/bin/env python3
import requests
import sys

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <search_term>")
        sys.exit(1)

    search_term = sys.argv[1]

    url = "https://bgp.tools/table.txt"
    headers = {
        "Accept": "application/json",
        "User-Agent": "tuan-network-automation bgp.tools - [email protected]"
    }

    try:
        resp = requests.get(url, headers=headers, timeout=10)
        resp.raise_for_status()
    except Exception as e:
        print(f"Error fetching data: {e}")
        sys.exit(2)

    matches = [line for line in resp.text.splitlines() if search_term in line]

    if matches:
        for line in matches:
            print(line)
    else:
        print(f"No matches found for {search_term}")

if __name__ == "__main__":
    main()

EEM

event manager applet CHECK_AKAMAI_ADVERTISEMENT
 event track 1 state down
 action 1.0 syslog msg "Track down – running Akamai advertisement check"
 action 2.0 cli command "guestshell run python3 /home/admin/check_akamai.py"
 action 2.1 regexp "ADVERTISED" "$_cli_result" result

 ! If prefix is advertised, withdraw Cloudflare
 action 3.0 if $result eq "1"
 action 3.1  syslog msg "Prefix confirmed advertised via Akamai – withdrawing Cloudflare"
 action 3.2  cli command "enable"
 action 3.3  cli command "configure terminal"
 action 3.4  cli command "router bgp 1"
 action 3.5  cli command "no neighbor 11.0.0.2 route-map RM_OUT-CF out"
 action 3.6  cli command "no neighbor 12.0.0.2 route-map RM_OUT-CF out"
 action 3.7  cli command "end"
 action 3.8 end

Other EEM Notification

SNMP Trap

event manager applet ALERT_SNMP
 event track 1 state down
 action 1.0 snmp-trap strdata "Cloudflare SLA down"

Email

event manager environment _email_server 192.0.2.10
event manager environment _email_to [email protected]
event manager environment _email_from [email protected]

event manager applet ALERT_EMAIL
 event track 1 state down
 action 1.0 mail subject "Cloudflare SLA down" body "Failover triggered"

Message to team

#!/usr/bin/env python3
import requests
import sys

# Replace with your Teams webhook URL
WEBHOOK_URL = "https://outlook.office.com/webhook/XXXX"

def send_alert(message):
    payload = {
        "text": message
    }
    try:
        resp = requests.post(WEBHOOK_URL, json=payload, timeout=5)
        if resp.status_code == 200:
            print("TEAMS_ALERT_SENT")
            sys.exit(0)
        else:
            print(f"TEAMS_ALERT_FAIL: {resp.status_code}")
            sys.exit(1)
    except Exception as e:
        print(f"ERROR: {e}")
        sys.exit(2)

if __name__ == "__main__":
    send_alert("🚨 Cloudflare SLA down – failover triggered to Akamai")

EEM to team via python script

event manager applet TEAMS_ALERT_FAILOVER
 event track 1 state down
 action 1.0 syslog msg "Track down – sending Teams alert"
 action 2.0 cli command "guestshell run python3 /home/admin/send_teams_alert.py"