"How" vs. "What"
There's a fundamental distinction in NetDevOps between two levels of abstraction:
Configuration (the "How"): The specific, vendor-specific commands you type into a device. For example, on a Cisco router:
ip access-list extended BLOCK_SSH
deny tcp any any eq 22
permit ip any any
This is imperative — you're telling the device exactly what to do, step by step.
Intent (the "What"): A higher-level declaration of the desired network behavior, independent of vendor syntax. For example: "No external host should be able to initiate an SSH connection to any internal server." This is declarative — you describe the outcome, not the mechanism.
Network Verification is the bridge between these two levels. It takes your configuration (the "How") and mathematically proves whether it correctly implements your intent (the "What"). If there's a gap — if the config doesn't actually enforce the intent — verification catches it before deployment.
This distinction matters architecturally. As networks grow, maintaining intent-to-config alignment manually becomes impossible. A team might have a security policy document that says "the management network must never be reachable from the internet," but after three years of incremental changes by different engineers, does the actual configuration still enforce that? Formal verification answers that question definitively.