How does Ansible work against network devices?
Show the answer
Say this first
Ansible is agentless. On servers it copies Python modules over SSH and runs them on the host, but network
devices cannot run Python, so network modules run on the control node and talk to the device through a
connection plugin: network_cli for SSH CLI, netconf, or httpapi for REST-style APIs. An inventory
lists the devices and their variables, a playbook holds plays, and each play runs tasks that call modules
from collections such as cisco.ios or arista.eos.
Go deeper
The pieces
- Inventory: hosts and groups, in INI or YAML, static or dynamic (for example from NetBox).
- Variables:
group_vars/andhost_vars/, plus secrets in Ansible Vault. - Playbook: a YAML list of plays. A play targets hosts and runs tasks in order.
- Modules: do the work, ideally idempotently. Network modules live in collections.
- Roles: reusable bundles of tasks, templates and defaults.
Inventory
all:
children:
ios:
hosts:
SW1:
ansible_host: 10.0.0.11
SW2:
ansible_host: 10.0.0.12
vars:
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: cisco.ios.ios
ansible_user: netops
ansible_password: "{{ vault_netops_password }}"
ansible_become: true
ansible_become_method: enableA first playbook
- name: Collect versions
hosts: ios
gather_facts: false
tasks:
- name: Run show version
cisco.ios.ios_command:
commands:
- show version
register: ver
- name: Print the first line
ansible.builtin.debug:
msg: "{{ ver.stdout_lines[0][0] }}"gather_facts: false is common in network plays; call cisco.ios.ios_facts when you need facts.
They will ask next
What does ansible_network_os do?
It tells the connection plugin which platform it is talking to, so it loads the right terminal and cliconf plugins: how to spot the prompt, disable paging, enter enable and config mode.
How many devices does Ansible work on at once?
forksdefaults to 5. Raise it inansible.cfgfor big runs, and useserialin the play to roll a change out in batches.
Traps
- Saying Ansible installs an agent on the switch. Network modules run on the control node.
- Using
ios_commandto push configuration. It runs commands; it does not manage config idempotently.