🛠️ Automation Tools & Workflow Identification

Ansible, Terraform, NSO & Workflow Analysis

🛠️ 5.6 Automation Tools Capabilities

Overview

Automation tools streamline infrastructure management through code. The three major players are Ansible, Terraform, and Cisco NSO, each with unique strengths.

graph TD A["Automation Tools"] --> B["Ansible"] A --> C["Terraform"] A --> D["Cisco NSO"] B --> B1["Agentless"] B --> B2["YAML Playbooks"] B --> B3["Configuration Mgmt"] C --> C1["Declarative"] C --> C2["HCL Language"] C --> C3["Infrastructure Provisioning"] D --> D1["YANG Models"] D --> D2["Transaction-based"] D --> D3["Service Orchestration"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff style C fill:#ab47bc,stroke:#6a1b9a,stroke-width:2px,color:#fff style D fill:#26a69a,stroke:#00695c,stroke-width:2px,color:#fff

Ansible

🔴 Configuration Management & Orchestration

Ansible is an agentless automation tool that uses SSH/API to configure systems using human-readable YAML playbooks.

Key Capabilities

Feature Description
Agentless No software required on managed nodes
Idempotent Safe to run multiple times
YAML Syntax Easy to read and write
Modules 1000+ built-in modules for various tasks
Roles Reusable and shareable automation

Use Cases

  • Configuration management (servers, network devices)
  • Application deployment
  • User and package management
  • Service configuration and orchestration
  • Multi-tier deployments
# Ansible Playbook Example
---
- name: Configure Network Devices
  hosts: routers
  gather_facts: no
  
  tasks:
    - name: Configure hostname
      cisco.ios.ios_hostname:
        config:
          hostname: "{{ inventory_hostname }}"
    
    - name: Configure NTP servers
      cisco.ios.ios_ntp:
        server: 10.1.1.1
        state: present
    
    - name: Save configuration
      cisco.ios.ios_config:
        save_when: always

Terraform

🟣 Infrastructure as Code Platform

Terraform uses declarative HCL (HashiCorp Configuration Language) to define and provision infrastructure across multiple cloud and on-premises platforms.

Key Capabilities

Feature Description
Declarative Define desired state, Terraform handles implementation
State Management Tracks infrastructure state for change detection
Provider Ecosystem 1000+ providers (AWS, Azure, GCP, Cisco, etc.)
Plan & Apply Preview changes before applying
Modules Reusable infrastructure components

Use Cases

  • Multi-cloud infrastructure provisioning
  • Network infrastructure automation
  • Resource lifecycle management
  • Infrastructure versioning and reproducibility
  • Disaster recovery automation
# Terraform Example (main.tf)
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  
  tags = {
    Name = "production-vpc"
  }
}

resource "aws_subnet" "subnet1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
  
  tags = {
    Name = "subnet-1"
  }
}

Cisco NSO (Network Services Orchestrator)

🟢 Service Orchestration Platform

Cisco NSO is an industry-leading orchestration platform that uses YANG models to provide multi-vendor network automation with transactional integrity.

Key Capabilities

Feature Description
YANG-Based Uses standard YANG data models
Transactional All-or-nothing changes with automatic rollback
Multi-Vendor Unified interface for different vendors
Service Modeling Define end-to-end services
Real-Time Sync Maintains device configuration database

Use Cases

  • Service orchestration across multi-vendor networks
  • L2/L3 VPN service automation
  • Network configuration management
  • Service lifecycle management
  • Intent-based networking
# NSO Service Example (YANG snippet)
module l3vpn {
  namespace "http://example.com/l3vpn";
  prefix l3vpn;

  import tailf-common {
    prefix tailf;
  }

  container l3vpn {
    list vpn {
      key name;
      leaf name {
        type string;
      }
      leaf as-number {
        type uint32;
      }
      list endpoint {
        key device;
        leaf device {
          type string;
        }
        leaf interface {
          type string;
        }
      }
    }
  }
}

Comparison Summary

Aspect Ansible Terraform Cisco NSO
Approach Imperative Declarative Declarative
Language YAML HCL YANG
Agent Agentless Agentless Agent-based
Best For Config management Infrastructure provisioning Service orchestration
Rollback Manual State-based Automatic transactions

🐍 5.7 Identify Python API Workflows

Overview

Python scripts automate workflows by interacting with Cisco APIs. By analyzing the code, you can identify what operations are being automated such as retrieving data, creating resources, updating configurations, or orchestrating complex tasks.

graph LR A["Python Script"] --> B["Cisco API"] B --> C["ACI"] B --> D["Meraki"] B --> E["DNA Center"] B --> F["RESTCONF"] C --> G["Tenant Management"] D --> H["Network Operations"] E --> I["Device Provisioning"] F --> J["Config Changes"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff style G fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style H fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style I fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style J fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff

1. Cisco ACI API Workflow

🏗️ Application Centric Infrastructure

Workflow Identification: Creating tenants, application profiles, EPGs, and contracts in ACI

# ACI Python Workflow
import requests
import json

# ACI API Details
apic_url = "https://apic.example.com"
username = "admin"
password = "password"

# Step 1: Authentication
login_url = f"{apic_url}/api/aaaLogin.json"
credentials = {
    "aaaUser": {
        "attributes": {
            "name": username,
            "pwd": password
        }
    }
}

session = requests.Session()
response = session.post(login_url, json=credentials, verify=False)
token = response.cookies.get('APIC-cookie')

# Step 2: Create Tenant
tenant_url = f"{apic_url}/api/node/mo/uni.json"
tenant_data = {
    "fvTenant": {
        "attributes": {
            "name": "Production_Tenant"
        }
    }
}
response = session.post(tenant_url, json=tenant_data, verify=False)
print(f"Tenant created: {response.status_code}")

# WORKFLOW IDENTIFIED:
# 1. Authenticate to APIC
# 2. Create new tenant in ACI fabric
# 3. Configure tenant-specific policies

Common ACI Workflows

  • Tenant and VRF creation
  • Application Profile deployment
  • EPG (Endpoint Group) configuration
  • Contract (policy) creation
  • Bridge Domain and Subnet management

2. Cisco Meraki API Workflow

☁️ Cloud-Managed Networking

Workflow Identification: Managing organizations, networks, devices, and clients via Meraki Dashboard API

# Meraki Python Workflow
import meraki

# API Key
API_KEY = "your_api_key_here"
dashboard = meraki.DashboardAPI(API_KEY)

# Step 1: Get all organizations
orgs = dashboard.organizations.getOrganizations()
org_id = orgs[0]['id']

# Step 2: Get all networks in organization
networks = dashboard.organizations.getOrganizationNetworks(org_id)

#Step 3: Create a new network
new_network = dashboard.organizations.createOrganizationNetwork(
    org_id,
    name="Branch_Office_5",
    productTypes=["appliance", "switch", "wireless"]
)

# Step 4: Configure SSID
dashboard.wireless.updateNetworkWirelessSsid(
    new_network['id'],
    number=0,
    name="Corp-WiFi",
    enabled=True,
    authMode="psk",
    psk="SecurePassword123"
)

print(f"Network created: {new_network['name']}")

# WORKFLOW IDENTIFIED:
# 1. Retrieve organization details
# 2. List existing networks
# 3. Create new branch network
# 4. Configure wireless SSID

Common Meraki Workflows

  • Organization and network management
  • Device provisioning and claiming
  • SSID configuration
  • Client tracking and reporting
  • Alert and webhook configuration

3. Cisco DNA Center API Workflow

🎯 Intent-Based Networking

Workflow Identification: Device discovery, template deployment, and network provisioning via DNA Center

# DNA Center Python Workflow
import requests
from requests.auth import HTTPBasicAuth

# DNA Center Details
DNAC_URL = "https://dnac.example.com"
USERNAME = "admin"
PASSWORD = "password"

# Step 1: Get Authentication Token
auth_url = f"{DNAC_URL}/dna/system/api/v1/auth/token"
response = requests.post(
    auth_url,
    auth=HTTPBasicAuth(USERNAME, PASSWORD),
    headers={"Content-Type": "application/json"},
    verify=False
)
token = response.json()['Token']

headers = {
    "X-Auth-Token": token,
    "Content-Type": "application/json"
}

# Step 2: Get all network devices
devices_url = f"{DNAC_URL}/dna/intent/api/v1/network-device"
response = requests.get(devices_url, headers=headers, verify=False)
devices = response.json()['response']

print(f"Found {len(devices)} devices")

# Step 3: Get device by hostname
for device in devices:
    if device['hostname'] == 'ROUTER-01':
        device_id = device['id']
        print(f"Device ID: {device_id}")

# WORKFLOW IDENTIFIED:
# 1. Authenticate to DNA Center
# 2. Retrieve network device inventory
# 3. Filter devices by specific criteria
# 4. Extract device details for further operations

Common DNA Center Workflows

  • Device discovery and inventory
  • Template deployment
  • Site hierarchy management
  • Network health monitoring
  • Client and host tracking

4. RESTCONF API Workflow

🔧 Device-Level Configuration

Workflow Identification: Direct device configuration using RESTCONF with YANG models

# RESTCONF Python Workflow
import requests
from requests.auth import HTTPBasicAuth

# Device Details
DEVICE_IP = "192.168.1.1"
USERNAME = "admin"
PASSWORD = "cisco"

headers = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json"
}

# Step 1: Get interface configuration
url = f"https://{DEVICE_IP}/restconf/data/ietf-interfaces:interfaces"
response = requests.get(
    url,
    auth=HTTPBasicAuth(USERNAME, PASSWORD),
    headers=headers,
    verify=False
)

interfaces = response.json()
print(f"Retrieved {len(interfaces['ietf-interfaces:interfaces']['interface'])} interfaces")

# Step 2: Update interface configuration
interface_data = {
    "ietf-interfaces:interface": {
        "name": "GigabitEthernet1",
        "description": "WAN Link - Updated via RESTCONF",
        "enabled": True
    }
}

url = f"https://{DEVICE_IP}/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1"
response = requests.patch(
    url,
    json=interface_data,
    auth=HTTPBasicAuth(USERNAME, PASSWORD),
    headers=headers,
    verify=False
)

print(f"Interface updated: {response.status_code}")

# WORKFLOW IDENTIFIED:
# 1. Connect to device via RESTCONF
# 2. Retrieve current interface configuration
# 3. Update specific interface attributes
# 4. Verify configuration change

Common RESTCONF Workflows

  • Interface configuration (IP, description, status)
  • Routing protocol configuration
  • ACL and security policy updates
  • Operational data retrieval
  • Device health monitoring

📋 5.8 Identify Ansible Playbook Workflows

Overview

Ansible playbooks automate system administration tasks through YAML-defined plays and tasks. By analyzing playbooks, you can identify workflows for package management, user management, service configuration, and service lifecycle management.

graph TD A["Ansible Playbook"] --> B["Package Management"] A --> C["User Management"] A --> D["Service Configuration"] A --> E["Service Control"] B --> B1["Install/Update/Remove"] C --> C1["Create/Modify/Delete"] D --> D1["Config Files/Templates"] E --> E1["Start/Stop/Restart"] style A fill:#ef5350,stroke:#c62828,stroke-width:3px,color:#fff style B fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style C fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff style D fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff style E fill:#ab47bc,stroke:#6a1b9a,stroke-width:2px,color:#fff

1. Package Management Workflow

📦 Installing, Updating, and Removing Packages

Workflow Identification: Managing software packages across multiple servers

---
- name: Package Management Workflow
  hosts: webservers
  become: yes
  
  tasks:
    # Install multiple packages
    - name: Install Apache and PHP
      apt:
        name:
          - apache2
          - php
          - php-mysql
        state: present
        update_cache: yes
    
    # Update specific package
    - name: Ensure Git is latest version
      apt:
        name: git
        state: latest
    
    # Remove unwanted package
    - name: Remove telnet
      apt:
        name: telnet
        state: absent

# WORKFLOW IDENTIFIED:
# 1. Install multiple packages (apache2, php, php-mysql)
# 2. Update existing package to latest version (git)
# 3. Remove security risk package (telnet)
# 4. Update package cache before installing

Key Package Modules

  • apt: Debian/Ubuntu package management
  • yum/dnf: RHEL/CentOS package management
  • package: Generic package manager
  • pip: Python package installation

2. User Management Workflow

👥 Creating, Modifying, and Managing Users

Workflow Identification: User account lifecycle management and access control

---
- name: User Management Workflow
  hosts: all
  become: yes
  
  tasks:
    # Create new user with specific settings
    - name: Create application user
      user:
        name: appuser
        comment: "Application Service Account"
        uid: 5000
        group: appgroup
        groups: docker,sudo
        shell: /bin/bash
        create_home: yes
        state: present
    
    # Add SSH key for user
    - name: Add SSH key for appuser
      authorized_key:
        user: appuser
        key: "{{ lookup('file', 'files/appuser_key.pub') }}"
        state: present
    
    # Modify existing user
    - name: Update user shell
      user:
        name: devuser
        shell: /bin/zsh
    
    # Remove user
    - name: Remove temporary user
      user:
        name: tempuser
        state: absent
        remove: yes

# WORKFLOW IDENTIFIED:
# 1. Create new user with UID, groups, and home directory
# 2. Configure SSH key authentication
# 3. Modify existing user properties
# 4. Remove user and associated files

User Management Modules

  • user: Create, modify, delete user accounts
  • group: Manage user groups
  • authorized_key: Manage SSH authorized keys
  • lineinfile: Modify configuration files (sudoers, etc.)

3. Service Configuration Workflow

⚙️ Deploying and Configuring Services

Workflow Identification: Service deployment with configuration file management

---
- name: Service Configuration Workflow
  hosts: webservers
  become: yes
  
  tasks:
    # Copy configuration file
    - name: Deploy Nginx configuration
      copy:
        src: files/nginx.conf
        dest: /etc/nginx/nginx.conf
        owner: root
        group: root
        mode: '0644'
        backup: yes
      notify: Restart Nginx
    
    # Use template for dynamic config
    - name: Deploy Apache vhost from template
      template:
        src: templates/vhost.conf.j2
        dest: /etc/apache2/sites-available/{{ domain }}.conf
        owner: root
        group: root
        mode: '0644'
      vars:
        domain: example.com
        doc_root: /var/www/example
    
    # Modify configuration file
    - name: Set max_connections in MySQL
      lineinfile:
        path: /etc/mysql/my.cnf
        regexp: '^max_connections'
        line: 'max_connections = 500'
        backup: yes
      notify: Restart MySQL
  
  handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted
    
    - name: Restart MySQL
      service:
        name: mysql
        state: restarted

# WORKFLOW IDENTIFIED:
# 1. Deploy static configuration files
# 2. Generate configuration from templates
# 3. Modify existing configuration values
# 4. Trigger service restart when config changes

Configuration Modules

  • copy: Copy files from controller to hosts
  • template: Deploy Jinja2 templates with variables
  • lineinfile: Modify single lines in files
  • blockinfile: Insert/update/remove text blocks

4. Service Start/Stop Workflow

🔄 Service Lifecycle Management

Workflow Identification: Starting, stopping, restarting, and enabling services

---
- name: Service Lifecycle Workflow
  hosts: all
  become: yes
  
  tasks:
    # Start service
    - name: Start Apache service
      service:
        name: apache2
        state: started
    
    # Stop service
    - name: Stop old application service
      service:
        name: legacy-app
        state: stopped
    
    # Restart service
    - name: Restart Nginx after config change
      service:
        name: nginx
        state: restarted
    
    # Reload service (graceful restart)
    - name: Reload Apache configuration
      service:
        name: apache2
        state: reloaded
    
    # Enable service at boot
    - name: Enable Docker service
      service:
        name: docker
        enabled: yes
        state: started
    
    # Disable service at boot
    - name: Disable unnecessary service
      service:
        name: bluetooth
        enabled: no
        state: stopped

# WORKFLOW IDENTIFIED:
# 1. Start services that should be running
# 2. Stop services that should not be running
# 3. Restart services after configuration changes
# 4. Enable/disable services at system boot
# 5. Use reload for graceful restarts

Service States

  • started: Ensure service is running
  • stopped: Ensure service is not running
  • restarted: Stop and start service
  • reloaded: Reload configuration without stopping
  • enabled: Start service at boot
  • disabled: Don't start service at boot

Complete Ansible Workflow Example

🎯 Combined Workflow: Web Server Deployment

Workflow Identification: Complete server setup combining all four workflow types

---
- name: Complete Web Server Deployment
  hosts: webservers
  become: yes
  
  tasks:
    # 1. PACKAGE MANAGEMENT
    - name: Install required packages
      apt:
        name:
          - nginx
          - php-fpm
          - git
        state: present
        update_cache: yes
    
    # 2. USER MANAGEMENT
    - name: Create web application user
      user:
        name: webapp
        comment: "Web Application User"
        shell: /bin/bash
        create_home: yes
    
    - name: Add webapp user to www-data group
      user:
        name: webapp
        groups: www-data
        append: yes
    
    # 3. SERVICE CONFIGURATION
    - name: Deploy Nginx configuration
      template:
        src: templates/nginx-site.conf.j2
        dest: /etc/nginx/sites-available/webapp.conf
        owner: root
        group: root
        mode: '0644'
      notify: Reload Nginx
    
    - name: Enable Nginx site
      file:
        src: /etc/nginx/sites-available/webapp.conf
        dest: /etc/nginx/sites-enabled/webapp.conf
        state: link
      notify: Reload Nginx
    
    # 4. SERVICE START/STOP
    - name: Ensure Nginx is running and enabled
      service:
        name: nginx
        state: started
        enabled: yes
    
    - name: Ensure PHP-FPM is running
      service:
        name: php7.4-fpm
        state: started
        enabled: yes
  
  handlers:
    - name: Reload Nginx
      service:
        name: nginx
        state: reloaded

# COMPLETE WORKFLOW IDENTIFIED:
# 1. Install web server packages (nginx, php-fpm, git)
# 2. Create dedicated application user and add to groups
# 3. Deploy configuration files from templates
# 4. Enable site and create symlinks
# 5. Start and enable services at boot
# 6. Define handlers for graceful service reloads

🐍 Interactive Python Interpreter

💡 How to use:
  • Write Python code in the editor
  • Click "▶ Run Code" to execute
  • Try sample code buttons
📝 Python Code Editor
⚡ Console Output
Ready to execute Python code...