Octet

How does Ansible work against network devices?

Show the answer

Say this first

Ansible is agentless. On servers it copies Python modules over SSH and runs them on the host, but network devices cannot run Python, so network modules run on the control node and talk to the device through a connection plugin: network_cli for SSH CLI, netconf, or httpapi for REST-style APIs. An inventory lists the devices and their variables, a playbook holds plays, and each play runs tasks that call modules from collections such as cisco.ios or arista.eos.

Go deeper

The pieces

  • Inventory: hosts and groups, in INI or YAML, static or dynamic (for example from NetBox).
  • Variables: group_vars/ and host_vars/, plus secrets in Ansible Vault.
  • Playbook: a YAML list of plays. A play targets hosts and runs tasks in order.
  • Modules: do the work, ideally idempotently. Network modules live in collections.
  • Roles: reusable bundles of tasks, templates and defaults.

Inventory

YAML
all:
  children:
    ios:
      hosts:
        SW1:
          ansible_host: 10.0.0.11
        SW2:
          ansible_host: 10.0.0.12
      vars:
        ansible_connection: ansible.netcommon.network_cli
        ansible_network_os: cisco.ios.ios
        ansible_user: netops
        ansible_password: "{{ vault_netops_password }}"
        ansible_become: true
        ansible_become_method: enable

A first playbook

YAML
- name: Collect versions
  hosts: ios
  gather_facts: false
  tasks:
    - name: Run show version
      cisco.ios.ios_command:
        commands:
          - show version
      register: ver

    - name: Print the first line
      ansible.builtin.debug:
        msg: "{{ ver.stdout_lines[0][0] }}"

gather_facts: false is common in network plays; call cisco.ios.ios_facts when you need facts.

Traps

  • Saying Ansible installs an agent on the switch. Network modules run on the control node.
  • Using ios_command to push configuration. It runs commands; it does not manage config idempotently.
How did you do?