🛠️ 5.6 Automation Tools Capabilities
Overview
Automation tools streamline infrastructure management through code. The three major players are Ansible, Terraform, and Cisco NSO, each with unique strengths.
Ansible
🔴 Configuration Management & Orchestration
Ansible is an agentless automation tool that uses SSH/API to configure systems using human-readable YAML playbooks.
Key Capabilities
| Feature | Description |
|---|---|
| Agentless | No software required on managed nodes |
| Idempotent | Safe to run multiple times |
| YAML Syntax | Easy to read and write |
| Modules | 1000+ built-in modules for various tasks |
| Roles | Reusable and shareable automation |
Use Cases
- Configuration management (servers, network devices)
- Application deployment
- User and package management
- Service configuration and orchestration
- Multi-tier deployments
# Ansible Playbook Example
---
- name: Configure Network Devices
hosts: routers
gather_facts: no
tasks:
- name: Configure hostname
cisco.ios.ios_hostname:
config:
hostname: "{{ inventory_hostname }}"
- name: Configure NTP servers
cisco.ios.ios_ntp:
server: 10.1.1.1
state: present
- name: Save configuration
cisco.ios.ios_config:
save_when: alwaysTerraform
🟣 Infrastructure as Code Platform
Terraform uses declarative HCL (HashiCorp Configuration Language) to define and provision infrastructure across multiple cloud and on-premises platforms.
Key Capabilities
| Feature | Description |
|---|---|
| Declarative | Define desired state, Terraform handles implementation |
| State Management | Tracks infrastructure state for change detection |
| Provider Ecosystem | 1000+ providers (AWS, Azure, GCP, Cisco, etc.) |
| Plan & Apply | Preview changes before applying |
| Modules | Reusable infrastructure components |
Use Cases
- Multi-cloud infrastructure provisioning
- Network infrastructure automation
- Resource lifecycle management
- Infrastructure versioning and reproducibility
- Disaster recovery automation
# Terraform Example (main.tf)
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
}
provider "aws" {
region = "us-west-2"
}
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
tags = {
Name = "production-vpc"
}
}
resource "aws_subnet" "subnet1" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.1.0/24"
tags = {
Name = "subnet-1"
}
}Cisco NSO (Network Services Orchestrator)
🟢 Service Orchestration Platform
Cisco NSO is an industry-leading orchestration platform that uses YANG models to provide multi-vendor network automation with transactional integrity.
Key Capabilities
| Feature | Description |
|---|---|
| YANG-Based | Uses standard YANG data models |
| Transactional | All-or-nothing changes with automatic rollback |
| Multi-Vendor | Unified interface for different vendors |
| Service Modeling | Define end-to-end services |
| Real-Time Sync | Maintains device configuration database |
Use Cases
- Service orchestration across multi-vendor networks
- L2/L3 VPN service automation
- Network configuration management
- Service lifecycle management
- Intent-based networking
# NSO Service Example (YANG snippet)
module l3vpn {
namespace "http://example.com/l3vpn";
prefix l3vpn;
import tailf-common {
prefix tailf;
}
container l3vpn {
list vpn {
key name;
leaf name {
type string;
}
leaf as-number {
type uint32;
}
list endpoint {
key device;
leaf device {
type string;
}
leaf interface {
type string;
}
}
}
}
}Comparison Summary
| Aspect | Ansible | Terraform | Cisco NSO |
|---|---|---|---|
| Approach | Imperative | Declarative | Declarative |
| Language | YAML | HCL | YANG |
| Agent | Agentless | Agentless | Agent-based |
| Best For | Config management | Infrastructure provisioning | Service orchestration |
| Rollback | Manual | State-based | Automatic transactions |
🐍 5.7 Identify Python API Workflows
Overview
Python scripts automate workflows by interacting with Cisco APIs. By analyzing the code, you can identify what operations are being automated such as retrieving data, creating resources, updating configurations, or orchestrating complex tasks.
1. Cisco ACI API Workflow
🏗️ Application Centric Infrastructure
Workflow Identification: Creating tenants, application profiles, EPGs, and contracts in ACI
# ACI Python Workflow
import requests
import json
# ACI API Details
apic_url = "https://apic.example.com"
username = "admin"
password = "password"
# Step 1: Authentication
login_url = f"{apic_url}/api/aaaLogin.json"
credentials = {
"aaaUser": {
"attributes": {
"name": username,
"pwd": password
}
}
}
session = requests.Session()
response = session.post(login_url, json=credentials, verify=False)
token = response.cookies.get('APIC-cookie')
# Step 2: Create Tenant
tenant_url = f"{apic_url}/api/node/mo/uni.json"
tenant_data = {
"fvTenant": {
"attributes": {
"name": "Production_Tenant"
}
}
}
response = session.post(tenant_url, json=tenant_data, verify=False)
print(f"Tenant created: {response.status_code}")
# WORKFLOW IDENTIFIED:
# 1. Authenticate to APIC
# 2. Create new tenant in ACI fabric
# 3. Configure tenant-specific policiesCommon ACI Workflows
- Tenant and VRF creation
- Application Profile deployment
- EPG (Endpoint Group) configuration
- Contract (policy) creation
- Bridge Domain and Subnet management
2. Cisco Meraki API Workflow
☁️ Cloud-Managed Networking
Workflow Identification: Managing organizations, networks, devices, and clients via Meraki Dashboard API
# Meraki Python Workflow
import meraki
# API Key
API_KEY = "your_api_key_here"
dashboard = meraki.DashboardAPI(API_KEY)
# Step 1: Get all organizations
orgs = dashboard.organizations.getOrganizations()
org_id = orgs[0]['id']
# Step 2: Get all networks in organization
networks = dashboard.organizations.getOrganizationNetworks(org_id)
#Step 3: Create a new network
new_network = dashboard.organizations.createOrganizationNetwork(
org_id,
name="Branch_Office_5",
productTypes=["appliance", "switch", "wireless"]
)
# Step 4: Configure SSID
dashboard.wireless.updateNetworkWirelessSsid(
new_network['id'],
number=0,
name="Corp-WiFi",
enabled=True,
authMode="psk",
psk="SecurePassword123"
)
print(f"Network created: {new_network['name']}")
# WORKFLOW IDENTIFIED:
# 1. Retrieve organization details
# 2. List existing networks
# 3. Create new branch network
# 4. Configure wireless SSIDCommon Meraki Workflows
- Organization and network management
- Device provisioning and claiming
- SSID configuration
- Client tracking and reporting
- Alert and webhook configuration
3. Cisco DNA Center API Workflow
🎯 Intent-Based Networking
Workflow Identification: Device discovery, template deployment, and network provisioning via DNA Center
# DNA Center Python Workflow
import requests
from requests.auth import HTTPBasicAuth
# DNA Center Details
DNAC_URL = "https://dnac.example.com"
USERNAME = "admin"
PASSWORD = "password"
# Step 1: Get Authentication Token
auth_url = f"{DNAC_URL}/dna/system/api/v1/auth/token"
response = requests.post(
auth_url,
auth=HTTPBasicAuth(USERNAME, PASSWORD),
headers={"Content-Type": "application/json"},
verify=False
)
token = response.json()['Token']
headers = {
"X-Auth-Token": token,
"Content-Type": "application/json"
}
# Step 2: Get all network devices
devices_url = f"{DNAC_URL}/dna/intent/api/v1/network-device"
response = requests.get(devices_url, headers=headers, verify=False)
devices = response.json()['response']
print(f"Found {len(devices)} devices")
# Step 3: Get device by hostname
for device in devices:
if device['hostname'] == 'ROUTER-01':
device_id = device['id']
print(f"Device ID: {device_id}")
# WORKFLOW IDENTIFIED:
# 1. Authenticate to DNA Center
# 2. Retrieve network device inventory
# 3. Filter devices by specific criteria
# 4. Extract device details for further operationsCommon DNA Center Workflows
- Device discovery and inventory
- Template deployment
- Site hierarchy management
- Network health monitoring
- Client and host tracking
4. RESTCONF API Workflow
🔧 Device-Level Configuration
Workflow Identification: Direct device configuration using RESTCONF with YANG models
# RESTCONF Python Workflow
import requests
from requests.auth import HTTPBasicAuth
# Device Details
DEVICE_IP = "192.168.1.1"
USERNAME = "admin"
PASSWORD = "cisco"
headers = {
"Accept": "application/yang-data+json",
"Content-Type": "application/yang-data+json"
}
# Step 1: Get interface configuration
url = f"https://{DEVICE_IP}/restconf/data/ietf-interfaces:interfaces"
response = requests.get(
url,
auth=HTTPBasicAuth(USERNAME, PASSWORD),
headers=headers,
verify=False
)
interfaces = response.json()
print(f"Retrieved {len(interfaces['ietf-interfaces:interfaces']['interface'])} interfaces")
# Step 2: Update interface configuration
interface_data = {
"ietf-interfaces:interface": {
"name": "GigabitEthernet1",
"description": "WAN Link - Updated via RESTCONF",
"enabled": True
}
}
url = f"https://{DEVICE_IP}/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1"
response = requests.patch(
url,
json=interface_data,
auth=HTTPBasicAuth(USERNAME, PASSWORD),
headers=headers,
verify=False
)
print(f"Interface updated: {response.status_code}")
# WORKFLOW IDENTIFIED:
# 1. Connect to device via RESTCONF
# 2. Retrieve current interface configuration
# 3. Update specific interface attributes
# 4. Verify configuration changeCommon RESTCONF Workflows
- Interface configuration (IP, description, status)
- Routing protocol configuration
- ACL and security policy updates
- Operational data retrieval
- Device health monitoring
📋 5.8 Identify Ansible Playbook Workflows
Overview
Ansible playbooks automate system administration tasks through YAML-defined plays and tasks. By analyzing playbooks, you can identify workflows for package management, user management, service configuration, and service lifecycle management.
1. Package Management Workflow
📦 Installing, Updating, and Removing Packages
Workflow Identification: Managing software packages across multiple servers
---
- name: Package Management Workflow
hosts: webservers
become: yes
tasks:
# Install multiple packages
- name: Install Apache and PHP
apt:
name:
- apache2
- php
- php-mysql
state: present
update_cache: yes
# Update specific package
- name: Ensure Git is latest version
apt:
name: git
state: latest
# Remove unwanted package
- name: Remove telnet
apt:
name: telnet
state: absent
# WORKFLOW IDENTIFIED:
# 1. Install multiple packages (apache2, php, php-mysql)
# 2. Update existing package to latest version (git)
# 3. Remove security risk package (telnet)
# 4. Update package cache before installingKey Package Modules
- apt: Debian/Ubuntu package management
- yum/dnf: RHEL/CentOS package management
- package: Generic package manager
- pip: Python package installation
2. User Management Workflow
👥 Creating, Modifying, and Managing Users
Workflow Identification: User account lifecycle management and access control
---
- name: User Management Workflow
hosts: all
become: yes
tasks:
# Create new user with specific settings
- name: Create application user
user:
name: appuser
comment: "Application Service Account"
uid: 5000
group: appgroup
groups: docker,sudo
shell: /bin/bash
create_home: yes
state: present
# Add SSH key for user
- name: Add SSH key for appuser
authorized_key:
user: appuser
key: "{{ lookup('file', 'files/appuser_key.pub') }}"
state: present
# Modify existing user
- name: Update user shell
user:
name: devuser
shell: /bin/zsh
# Remove user
- name: Remove temporary user
user:
name: tempuser
state: absent
remove: yes
# WORKFLOW IDENTIFIED:
# 1. Create new user with UID, groups, and home directory
# 2. Configure SSH key authentication
# 3. Modify existing user properties
# 4. Remove user and associated filesUser Management Modules
- user: Create, modify, delete user accounts
- group: Manage user groups
- authorized_key: Manage SSH authorized keys
- lineinfile: Modify configuration files (sudoers, etc.)
3. Service Configuration Workflow
⚙️ Deploying and Configuring Services
Workflow Identification: Service deployment with configuration file management
---
- name: Service Configuration Workflow
hosts: webservers
become: yes
tasks:
# Copy configuration file
- name: Deploy Nginx configuration
copy:
src: files/nginx.conf
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
backup: yes
notify: Restart Nginx
# Use template for dynamic config
- name: Deploy Apache vhost from template
template:
src: templates/vhost.conf.j2
dest: /etc/apache2/sites-available/{{ domain }}.conf
owner: root
group: root
mode: '0644'
vars:
domain: example.com
doc_root: /var/www/example
# Modify configuration file
- name: Set max_connections in MySQL
lineinfile:
path: /etc/mysql/my.cnf
regexp: '^max_connections'
line: 'max_connections = 500'
backup: yes
notify: Restart MySQL
handlers:
- name: Restart Nginx
service:
name: nginx
state: restarted
- name: Restart MySQL
service:
name: mysql
state: restarted
# WORKFLOW IDENTIFIED:
# 1. Deploy static configuration files
# 2. Generate configuration from templates
# 3. Modify existing configuration values
# 4. Trigger service restart when config changesConfiguration Modules
- copy: Copy files from controller to hosts
- template: Deploy Jinja2 templates with variables
- lineinfile: Modify single lines in files
- blockinfile: Insert/update/remove text blocks
4. Service Start/Stop Workflow
🔄 Service Lifecycle Management
Workflow Identification: Starting, stopping, restarting, and enabling services
---
- name: Service Lifecycle Workflow
hosts: all
become: yes
tasks:
# Start service
- name: Start Apache service
service:
name: apache2
state: started
# Stop service
- name: Stop old application service
service:
name: legacy-app
state: stopped
# Restart service
- name: Restart Nginx after config change
service:
name: nginx
state: restarted
# Reload service (graceful restart)
- name: Reload Apache configuration
service:
name: apache2
state: reloaded
# Enable service at boot
- name: Enable Docker service
service:
name: docker
enabled: yes
state: started
# Disable service at boot
- name: Disable unnecessary service
service:
name: bluetooth
enabled: no
state: stopped
# WORKFLOW IDENTIFIED:
# 1. Start services that should be running
# 2. Stop services that should not be running
# 3. Restart services after configuration changes
# 4. Enable/disable services at system boot
# 5. Use reload for graceful restartsService States
- started: Ensure service is running
- stopped: Ensure service is not running
- restarted: Stop and start service
- reloaded: Reload configuration without stopping
- enabled: Start service at boot
- disabled: Don't start service at boot
Complete Ansible Workflow Example
🎯 Combined Workflow: Web Server Deployment
Workflow Identification: Complete server setup combining all four workflow types
---
- name: Complete Web Server Deployment
hosts: webservers
become: yes
tasks:
# 1. PACKAGE MANAGEMENT
- name: Install required packages
apt:
name:
- nginx
- php-fpm
- git
state: present
update_cache: yes
# 2. USER MANAGEMENT
- name: Create web application user
user:
name: webapp
comment: "Web Application User"
shell: /bin/bash
create_home: yes
- name: Add webapp user to www-data group
user:
name: webapp
groups: www-data
append: yes
# 3. SERVICE CONFIGURATION
- name: Deploy Nginx configuration
template:
src: templates/nginx-site.conf.j2
dest: /etc/nginx/sites-available/webapp.conf
owner: root
group: root
mode: '0644'
notify: Reload Nginx
- name: Enable Nginx site
file:
src: /etc/nginx/sites-available/webapp.conf
dest: /etc/nginx/sites-enabled/webapp.conf
state: link
notify: Reload Nginx
# 4. SERVICE START/STOP
- name: Ensure Nginx is running and enabled
service:
name: nginx
state: started
enabled: yes
- name: Ensure PHP-FPM is running
service:
name: php7.4-fpm
state: started
enabled: yes
handlers:
- name: Reload Nginx
service:
name: nginx
state: reloaded
# COMPLETE WORKFLOW IDENTIFIED:
# 1. Install web server packages (nginx, php-fpm, git)
# 2. Create dedicated application user and add to groups
# 3. Deploy configuration files from templates
# 4. Enable site and create symlinks
# 5. Start and enable services at boot
# 6. Define handlers for graceful service reloads🐍 Interactive Python Interpreter
- Write Python code in the editor
- Click "▶ Run Code" to execute
- Try sample code buttons