Managing Network Devices

1. Understanding Network Modules

Module	Description	Platform Support	Notes
ansible.netcommon.network	Base network module for Ansible network automation	IOS, NX-OS, Junos	Used as a base for other network modules
ansible.netcommon.nxos	Module for managing Cisco NX-OS devices	NX-OS	Supports NX-OS CLI and NX-API
ansible.netcommon.eos	Module for managing Arista EOS devices	EOS	Supports EOS CLI and REST API
ansible.netcommon.junos	Module for managing Juniper Junos devices	Junos	Supports Junos CLI and NETCONF
ansible.netcommon.ios	Module for managing Cisco IOS devices	IOS	Supports IOS CLI and RESTCONF

Example: Using network modules to gather facts

- name: Gather facts from network device
  ansible.netcommon.nxos_facts:
    gather_subset:
      - interfaces
  register: result

- name: Display interface facts
  debug:
    var: result.ansible_facts.interfaces

Note: Network modules require the ansible.netcommon collection to be installed.

2. Configuring Cisco IOS

Parameter	Description	Example
host	IP address or hostname of the Cisco IOS device	`192.168.1.1`
username	Username for authentication	`admin`
password	Password for authentication	`secret123`
transport	Transport method (e.g., `cli`, `netconf`)	`cli`
timeout	Timeout in seconds for connection	`30`

Example: Configure a Cisco IOS device using CLI

- name: Configure Cisco IOS device
  hosts: cisco_ios
  vars:
    ansible_network_os: cisco.ios.ios
    ansible_connection: ansible.netcommon.network_cli
  tasks:
    - name: Set hostname
      cisco.ios.ios_config:
        lines:
          - "hostname Router1"

Example: Configure interface on Cisco IOS

- name: Configure interface on Cisco IOS
  hosts: cisco_ios
  vars:
    ansible_network_os: cisco.ios.ios
    ansible_connection: ansible.netcommon.network_cli
  tasks:
    - name: Configure interface
      cisco.ios.ios_config:
        lines:
          - "interface GigabitEthernet0/1"
          - "ip address 192.168.1.10 255.255.255.0"
          - "no shutdown"

Note: Ensure the cisco.ios collection is installed using ansible-galaxy collection install cisco.ios.

Warning: The ansible.netcommon.network_cli connection plugin is required for CLI-based operations.

Feature	Description	Status
CLI Configuration	Support for CLI-based configuration changes	NEW
NETCONF Support	Support for NETCONF-based configuration (if available)	DEPRECATED

3. Configuring Juniper Devices

Parameter	Description	Example
ansible_network_os	Specifies the operating system of the network device	`juniper.junos.junos`
ansible_host	IP address or hostname of the Juniper device	`192.168.1.1`
ansible_user	Username for authentication	`admin`
ansible_ssh_pass	Password for SSH authentication	`password123`

Example: Configure a Juniper device with basic settings

- name: Configure Juniper device
  hosts: juniper_devices
  vars:
    ansible_network_os: juniper.junos.junos
    ansible_host: 192.168.1.1
    ansible_user: admin
    ansible_ssh_pass: password123
  tasks:
    - name: Set device configuration
      junos_config:
        lines:
          - set system host-name test-device
          - set system domain-name example.com

Example: Apply configuration from a file

- name: Apply configuration from file
  hosts: juniper_devices
  vars:
    ansible_network_os: juniper.junos.junos
    ansible_host: 192.168.1.1
    ansible_user: admin
    ansible_ssh_pass: password123
  tasks:
    - name: Load configuration from file
      junos_config:
        src: /path/to/config.junos

Note: Ensure that the juniper.junos collection is installed using ansible-galaxy collection install juniper.junos.

Warning: Always test configuration changes in a lab environment before applying to production devices.

Module	Description	Use Case
junos_config	Manages configuration on Juniper devices	Apply configuration changes or load from file
junos_facts	Gathers facts from Juniper devices	Retrieve device information like model, OS version
junos_command	Runs commands on Juniper devices	Execute operational mode commands like `show version`

4. Using Network CLI Connection

Parameter	Description	Default	Notes
ansible_connection	Connection type to use	`network_cli`	Must be set to `network_cli` for CLI-based network device connections
ansible_network_os	Operating system of the network device	`None`	Required for proper module execution; e.g., `ios`, `nxos`, `junos`
ansible_host	IP address or hostname of the network device	`None`	Must be resolvable from the Ansible control node
ansible_user	Username for CLI login	`None`	Must have sufficient privileges for CLI access
ansible_password	Password for CLI login	`None`	Can be encrypted using Ansible Vault
ansible_port	Port for CLI connection (e.g., SSH)	`22`	Typically 22 for SSH; may vary (e.g., 830 for NETCONF)
ansible_become	Use privilege escalation (e.g., enable mode)	`false`	Set to `true` if CLI commands require elevated privileges
ansible_become_method	Privilege escalation method	`enable`	For most network OSes, `enable` is used to enter privileged mode
ansible_become_password	Password for privilege escalation	`None`	Required if `ansible_become` is true

Example: Basic Network CLI Connection Configuration

---
- name: Configure network device via CLI
  hosts: network_devices
  vars:
    ansible_connection: network_cli
    ansible_network_os: ios
    ansible_host: 192.168.1.1
    ansible_user: admin
    ansible_password: "secret"
    ansible_port: 22
    ansible_become: true
    ansible_become_method: enable
    ansible_become_password: "enable_secret"
  tasks:
    - name: Gather device facts
      ios_facts:
        gather_subset: all

Note: Ensure that the network device supports CLI access and that the required credentials are available. The network_cli connection plugin is part of the Ansible core network modules and requires appropriate OS-specific modules (e.g., ios_facts, nxos_config) to be installed.

Warning: Be cautious with privilege escalation settings. Misconfigurations can lead to failed connections or unintended command execution.

5. Using NETCONF Connection

Option	Values	Description
ansible_network_os	`netconf`	Specifies the network OS to use for NETCONF connection
ansible_connection	`netconf`	Connection plugin to use for NETCONF communication
ansible_user	`admin`	Username for NETCONF authentication
ansible_password	`password123`	Password for NETCONF authentication
ansible_host	`192.168.1.1`	IP address or hostname of the network device
ansible_port	`830`	NETCONF SSH port (default is 830)

Example: Configure a Network Device via NETCONF

- name: Configure network device via NETCONF
  hosts: network_devices
  vars:
    ansible_network_os: netconf
    ansible_connection: netconf
    ansible_user: admin
    ansible_password: password123
    ansible_host: 192.168.1.1
    ansible_port: 830
  tasks:
    - name: Set interface description
      netconf_config:
        xml: |
          <config>
            <interfaces xmlns="urn:ietf:params:xml:ns:yang:iana-if-type">
              <interface>
                <name>eth0</name>
                <description>Managed by Ansible</description>
              </interface>
            </interfaces>
          </config>

Note: Ensure the network device supports NETCONF and has the appropriate YANG models installed.

Warning: NETCONF connections require secure transport (SSH) and proper authentication.

6. Backing Up Configurations

Module	Description	Parameters	Notes
ansible.netcommon.network_cli	Manages network device configurations via CLI	`host`, `username`, `password`, `transport`	Supports various network OS like Cisco IOS, Junos, etc.
ansible.netcommon.napalm	Uses NAPALM for configuration management and backup	`host`, `username`, `password`, `platform`	Supports multiple platforms including EOS, NX-OS, etc.

Example: Backup Configuration Using network_cli

- name: Backup network device configuration
  hosts: network_devices
  gather_facts: no
  tasks:
    - name: Backup running configuration
      ansible.netcommon.network_cli:
        host: "{{ inventory_hostname }}"
        username: "admin"
        password: "secret"
        transport: cli
        command: "show running-config"
      register: config_output

    - name: Save configuration to file
      ansible.builtin.copy:
        content: "{{ config_output.stdout[0] }}"
        dest: "/backup/{{ inventory_hostname }}_config.txt"

Example: Backup Configuration Using napalm

- name: Backup network device configuration using NAPALM
  hosts: network_devices
  gather_facts: no
  tasks:
    - name: Backup configuration using NAPALM
      ansible.netcommon.napalm:
        host: "{{ inventory_hostname }}"
        username: "admin"
        password: "secret"
        platform: "cisco_ios"
        operation: "get_config"
      register: config_output

    - name: Save configuration to file
      ansible.builtin.copy:
        content: "{{ config_output.config }}"
        dest: "/backup/{{ inventory_hostname }}_config.txt"

Note: Ensure proper permissions and credentials are set up for network device access.

Warning: Backup configurations should be encrypted and stored securely.

7. Validating Configurations

Validation Method Description Example Notes

ansible.builtin.netconf

Uses NETCONF protocol to validate configurations on network devices

Validation Method	Description	Example	Notes
ansible.builtin.netconf	Uses NETCONF protocol to validate configurations on network devices	`- name: Validate configuration via NETCONF ansible.netcommon.netconf: content: "<rpc><get-config><source><running/></source></get-config></rpc>" format: "xml"`	Requires NETCONF support on the device
ansible.builtin.napalm	Uses NAPALM to validate configurations on network devices	`- name: Validate configuration using NAPALM ansible.netcommon.napalm: config: "interface GigabitEthernet0/1\n description Test Interface" replace: false`	Supports multiple network OSes like Junos, EOS, IOS-XR
ansible.builtin.cli	Uses CLI commands to validate configurations on network devices	`- name: Validate configuration via CLI ansible.builtin.cli_command: command: "show running-config \| section interface"`	Works with any device that supports CLI access

- name: Validate configuration via NETCONF
  ansible.netcommon.netconf:
    content: "<rpc><get-config><source><running/></source></get-config></rpc>"
    format: "xml"

Requires NETCONF support on the device

ansible.builtin.napalm

Uses NAPALM to validate configurations on network devices

- name: Validate configuration using NAPALM
  ansible.netcommon.napalm:
    config: "interface GigabitEthernet0/1\n  description Test Interface"
    replace: false

Supports multiple network OSes like Junos, EOS, IOS-XR

ansible.builtin.cli

Uses CLI commands to validate configurations on network devices

- name: Validate configuration via CLI
  ansible.builtin.cli_command:
    command: "show running-config | section interface"

Works with any device that supports CLI access

Example: Validate configuration using NETCONF

- name: Validate configuration via NETCONF
  ansible.netcommon.netconf:
    content: "<rpc><get-config><source><running/></source></get-config></rpc>"
    format: "xml"

Note: Ensure the device supports NETCONF and has the appropriate capabilities enabled.

Warning: Validate configurations before applying changes to avoid network disruptions.

8. Using Command Module

Parameter	Description	Example
cmd	Command to execute on the network device	`show version`
free_form	Free form string to pass to the command	`show ip route \| begin 10.0.0.0`
prompt	Regular expression to match the command prompt	`#`
answer	Answer to provide when prompted	`yes`

Example: Execute a command on a network device

- name: Execute command on network device
  ansible.netcommon.cli_command:
    cmd: show version

Example: Execute command with prompt and answer

- name: Execute command with prompt and answer
  ansible.netcommon.cli_command:
    cmd: "show ip route | begin 10.0.0.0"
    prompt: "#"
    answer: "yes"

9. Managing VLANs

Property	Description	Example
vlan_id	Unique identifier for the VLAN (1-4094)	`100`
name	Name of the VLAN	`web_servers`
interfaces	List of interfaces to assign to the VLAN	`['eth0', 'eth1']`

Example: Create a VLAN

- name: Create VLAN
  ansible.netcommon.network_cli:
    command: "vlan {{ vlan_id }} name {{ name }}"

Example: Assign Interface to VLAN

- name: Assign interface to VLAN
  ansible.netcommon.network_cli:
    command: "interface {{ interfaces[0] }} switchport access vlan {{ vlan_id }}"

Note: VLAN configuration is device-specific and may vary depending on the network device model.

10. Managing Interfaces

Property	Description	Example
name	Name of the interface	`eth0`
state	Desired state of the interface	`up` or `down`
ip_address	IP address to assign to the interface	`192.168.1.10/24`
netmask	Netmask for the interface	`255.255.255.0`
mtu	Maximum Transmission Unit	`1500`

Example: Configure Interface

- name: Configure network interface
  ansible.netcommon.network_interfaces:
    config:
      - name: eth0
        state: up
        ip_address: 192.168.1.10/24
        netmask: 255.255.255.0
        mtu: 1500

Note: The ansible.netcommon.network_interfaces module is used to manage network interfaces on network devices.

11. Managing Static Routes

Property	Description	Example
destination	The destination network or host address	`192.168.10.0/24`
gateway	The next hop IP address for the route	`10.0.0.1`
metric	Route preference (lower is preferred)	`10`
interface	Interface to use for the route (optional)	`eth0`

Example: Configure Static Route on Cisco IOS

Router(config)# ip route 192.168.10.0 255.255.255.0 10.0.0.1

Example: Ansible Playbook for Static Route

- name: Configure static route on network device
  hosts: network_devices
  tasks:
    - name: Add static route
      cisco.ios.ios_static_routes:
        config:
          - destination: 192.168.10.0/24
            gateway: 10.0.0.1
            metric: 10
        state: present

Note: Ensure the gateway IP is reachable from the device's current routing table.