Getting Started with Network Automation and Scripting

Table of Contents

1. Understanding Network Automation

   • 1.1 What is Network Automation?
   • 1.2 Why Automate Networks?
   • 1.3 Automation vs. Orchestration

2. Core Concepts and Terminology

   • 2.1 APIs (REST, NETCONF, RESTCONF)
   • 2.2 Idempotency
   • 2.3 Declarative vs. Imperative Configuration
   • 2.4 Infrastructure as Code (IaC)

3. Essential Tools and Technologies

   • 3.1 Programming Languages: Python
   • 3.2 Libraries: Netmiko, NAPALM, Paramiko
   • 3.3 Configuration Management: Ansible
   • 3.4 Version Control: Git
   • 3.5 Text Editors/IDEs: VS Code

4. Setting Up Your Automation Environment

   • 4.1 Installing Python
   • 4.2 Virtual Environments
   • 4.3 Installing Libraries (Netmiko, Ansible)
   • 4.4 Setting Up a Lab Environment

5. Basic Scripting for Networks

   • 5.1 Connecting to Devices via SSH
   • 5.2 Sending Commands and Parsing Output
   • 5.3 Introduction to Idempotent Scripts

6. Practical Examples

   • 6.1 Backup Device Configurations
   • 6.2 Deploy a VLAN Across Multiple Switches
   • 6.3 Monitor Device Uptime and Alerts

7. Best Practices

   • 7.1 Version Control Your Code
   • 7.2 Test in a Lab First
   • 7.3 Secure Credentials
   • 7.4 Document Your Workflows

8. Challenges and How to Overcome Them

   • 8.1 Legacy Devices Without APIs
   • 8.2 Skill Gaps
   • 8.3 Fear of Breaking Things

9. Conclusion

10. References

1. Understanding Network Automation

1.1 What is Network Automation?

Network automation is the use of software tools, scripts, and frameworks to automate repetitive, manual tasks in network management. This includes tasks like device configuration, monitoring, troubleshooting, and compliance checks. Instead of logging into each device via SSH to run commands, automation lets you define workflows that execute these tasks programmatically—saving time and reducing human error.

1.2 Why Automate Networks?

• Efficiency: Automate repetitive tasks (e.g., backup configurations) to free up time for strategic work.
• Consistency: Enforce standardized configurations across devices, reducing “configuration drift.”
• Scalability: Manage hundreds of devices as easily as a single one.
• Reliability: Minimize human error (e.g., typos in CLI commands).
• Agility: Deploy changes (e.g., new VLANs) across the network in minutes instead of hours.

1.3 Automation vs. Orchestration

While often used interchangeably, automation focuses on individual tasks (e.g., “back up a router’s config”), while orchestration coordinates multiple automated tasks to achieve a larger goal (e.g., “provision a new branch office network by deploying VLANs, updating firewalls, and configuring QoS”).

2. Core Concepts and Terminology

2.1 APIs (REST, NETCONF, RESTCONF)

APIs (Application Programming Interfaces) allow scripts/tools to communicate with network devices.

• REST (Representational State Transfer): A popular API style using HTTP/HTTPS. Devices expose data (e.g., interface stats) as JSON/XML, which scripts can query or modify.
• NETCONF: A protocol designed for network device configuration. It uses XML for data encoding and SSH for transport, enabling atomic (all-or-nothing) configuration changes.
• RESTCONF: Combines REST’s simplicity with NETCONF’s network-specific features, using JSON/XML over HTTP.

2.2 Idempotency

A critical concept: An idempotent script produces the same result whether run once or multiple times. For example, a script that “ensures VLAN 100 exists” will not create duplicates if run twice. This prevents accidental changes and simplifies debugging.

2.3 Declarative vs. Imperative Configuration

• Declarative: Define the “desired state” (e.g., “VLAN 100 should exist with name ‘GUEST’”), and the tool handles how to achieve it (e.g., Ansible, NETCONF).
• Imperative: Define the steps to reach a state (e.g., “Log into Switch A, run ‘vlan 100’, then ‘name GUEST’”). More error-prone for large-scale changes.

2.4 Infrastructure as Code (IaC)

Treat network configurations as code (e.g., YAML/JSON files) stored in version control (Git). This allows you to track changes, roll back to previous versions, and collaborate with teams—just like software code.

3. Essential Tools and Technologies

3.1 Programming Languages: Python

Python is the de facto language for network automation due to its readability, extensive libraries, and broad community support. Most network vendors (Cisco, Juniper, Arista) provide Python SDKs, and tools like Ansible are built on Python.

3.2 Libraries for Network Automation

• Paramiko: A low-level SSH library for connecting to devices (basic but flexible).
• Netmiko: Built on Paramiko, with pre-built support for 40+ network vendors (Cisco IOS, Juniper Junos, Arista EOS). Simplifies tasks like handling device prompts or enable mode.
• NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support): A library that abstracts vendor-specific CLI/API differences. Write one script to configure both Cisco and Juniper devices.

3.3 Configuration Management: Ansible

Ansible is an open-source automation platform that uses playbooks (YAML files) to define declarative workflows. It’s agentless (no software installed on devices) and integrates with most network vendors via modules (e.g., ios_config for Cisco IOS).

3.4 Version Control: Git

Git (and platforms like GitHub/GitLab) tracks changes to scripts, playbooks, and configuration files. Use it to:

• Collaborate with teammates.
• Roll back to working versions if a script breaks.
• Document changes with commit messages.

3.5 Text Editors/IDEs: VS Code

A code editor with extensions for Python, Ansible, and network automation (e.g., “Python” by Microsoft, “Ansible” by Red Hat). Features like syntax highlighting and IntelliSense speed up scripting.

4. Setting Up Your Automation Environment

4.1 Installing Python

Download Python from python.org (3.8+ recommended). Verify installation with:

python --version  # or python3 --version  

4.2 Virtual Environments

Isolate project dependencies using Python’s built-in venv to avoid conflicts:

# Create a virtual environment  
python -m venv my_automation_env  

# Activate it (Linux/macOS)  
source my_automation_env/bin/activate  

# Activate it (Windows)  
my_automation_env\Scripts\activate  

Your terminal prompt will now show (my_automation_env) to indicate the environment is active.

4.3 Installing Libraries

Use pip (Python’s package manager) to install tools:

# Install Netmiko  
pip install netmiko  

# Install NAPALM  
pip install napalm  

# Install Ansible (Linux/macOS; for Windows, use WSL)  
pip install ansible  

4.4 Setting Up a Lab Environment

Practice safely with a lab! Options include:

• GNS3/EVE-NG: Emulate physical devices (Cisco IOS, Juniper Junos) on your PC.
• Cisco DevNet Sandboxes: Free, cloud-based labs with real devices (e.g., Cisco IOS XE Sandbox).
• Docker Containers: Lightweight options like FRRouting for routing.

5. Basic Scripting for Networks

5.1 Connecting to Devices via SSH

Let’s start with a simple Python script to connect to a Cisco IOS device using Netmiko:

from netmiko import ConnectHandler  

# Define device details  
device = {  
    "device_type": "cisco_ios",  
    "ip": "192.168.1.1",  # Replace with your device IP  
    "username": "admin",  # Replace with your username  
    "password": "password",  # Replace with your password  
    "secret": "enablepass",  # Enable password (if required)  
}  

# Connect to the device  
with ConnectHandler(**device) as conn:  
    conn.enable()  # Enter enable mode  
    output = conn.send_command("show ip interface brief")  # Run a command  

# Print the output  
print(output)  

Explanation:

• ConnectHandler handles SSH setup and device-specific logic (e.g., Cisco’s “enable” mode).
• The with statement ensures the connection closes automatically after use.

5.2 Parsing Output

Raw CLI output is unstructured. Use Genie Parsers (built into NAPALM) to convert it into structured data (JSON):

from netmiko import ConnectHandler  
from genie.libs.parser.iosxe.show_ip import ShowIpInterfaceBrief  

device = {  
    "device_type": "cisco_ios",  
    "ip": "192.168.1.1",  
    "username": "admin",  
    "password": "password",  
}  

with ConnectHandler(**device) as conn:  
    output = conn.send_command("show ip interface brief")  
    parsed_output = ShowIpInterfaceBrief.parse(output)  # Parse with Genie  

print(parsed_output)  # Output: List of dictionaries with interface details  

Now you can filter data (e.g., parsed_output[0]['intf'] for the first interface name).

5.3 Introduction to Idempotent Scripts

Avoid accidental changes with idempotency. For example, this script ensures VLAN 100 exists:

from netmiko import ConnectHandler  

device = {  
    "device_type": "cisco_ios",  
    "ip": "192.168.1.1",  
    "username": "admin",  
    "password": "password",  
}  

with ConnectHandler(**device) as conn:  
    # Check if VLAN 100 already exists  
    output = conn.send_command("show vlan brief | include 100")  
    if "100" not in output:  
        # Create VLAN if missing  
        config_commands = [  
            "vlan 100",  
            "name GUEST",  
        ]  
        output = conn.send_config_set(config_commands)  
        print("VLAN 100 created.")  
    else:  
        print("VLAN 100 already exists.")  

6. Practical Examples

6.1 Backup Device Configurations

Automate config backups to avoid data loss. This script backs up multiple devices:

from netmiko import ConnectHandler  
from datetime import datetime  

# List of devices to back up  
devices = [  
    {  
        "device_type": "cisco_ios",  
        "ip": "192.168.1.1",  
        "username": "admin",  
        "password": "password",  
    },  
    {  
        "device_type": "cisco_ios",  
        "ip": "192.168.1.2",  
        "username": "admin",  
        "password": "password",  
    },  
]  

# Timestamp for backup filenames  
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")  

for device in devices:  
    try:  
        with ConnectHandler(**device) as conn:  
            conn.enable()  
            config = conn.send_command("show running-config")  
            # Save to file: <device_ip>_<timestamp>.txt  
            filename = f"{device['ip']}_{timestamp}.txt"  
            with open(filename, "w") as f:  
                f.write(config)  
            print(f"Backup saved for {device['ip']} as {filename}")  
    except Exception as e:  
        print(f"Failed to back up {device['ip']}: {str(e)}")  

6.2 Deploy a VLAN Across Multiple Switches with Ansible

Ansible simplifies multi-device deployments. Create an Ansible playbook (deploy_vlan.yml) to deploy VLAN 100:

---  
- name: Deploy VLAN 100 to switches  
  hosts: switches  # Defined in your Ansible inventory  
  gather_facts: no  
  connection: network_cli  

  tasks:  
    - name: Ensure VLAN 100 exists  
      ios_config:  
        lines:  
          - vlan 100  
          - name GUEST  
        parents: global_config  
      register: result  

    - name: Print result  
      debug:  
        var: result  

Inventory File (inventory.ini):

[switches]  
switch1 ansible_host=192.168.1.1 ansible_user=admin ansible_password=password  
switch2 ansible_host=192.168.1.2 ansible_user=admin ansible_password=password  

Run the playbook:

ansible-playbook -i inventory.ini deploy_vlan.yml  

Ansible automatically checks if the VLAN exists (idempotent!) and only makes changes if needed.

6.3 Monitor Device Uptime and Send Alerts

Use SNMP or REST APIs to monitor devices. This script checks uptime and sends an email alert if a device is down:

from netmiko import ConnectHandler  
import smtplib  
from email.message import EmailMessage  

def send_alert(device_ip):  
    msg = EmailMessage()  
    msg.set_content(f"ALERT: Device {device_ip} is unreachable!")  
    msg["Subject"] = "Network Device Down"  
    msg["From"] = "[email protected]"  
    msg["To"] = "[email protected]"  

    with smtplib.SMTP_SSL("smtp.example.com", 465) as server:  
        server.login("[email protected]", "email_password")  
        server.send_message(msg)  

device = {  
    "device_type": "cisco_ios",  
    "ip": "192.168.1.1",  
    "username": "admin",  
    "password": "password",  
    "timeout": 10,  # Fail fast if unreachable  
}  

try:  
    with ConnectHandler(**device) as conn:  
        uptime = conn.send_command("show version | include uptime")  
        print(f"{device['ip']} uptime: {uptime}")  
except Exception as e:  
    print(f"Error: {str(e)}")  
    send_alert(device["ip"])  

7. Best Practices

7.1 Version Control Your Code

Store scripts/playbooks in Git to track changes and collaborate:

git init  
git add backup_script.py  
git commit -m "Initial commit: Config backup script"  

7.2 Test in a Lab First

Never run untested scripts in production! Use GNS3/EVE-NG or DevNet sandboxes to validate workflows.

7.3 Secure Credentials

Never hardcode passwords! Use:

• Ansible Vault: Encrypt sensitive data in playbooks.
• Environment Variables: Store credentials in os.environ (Python) or ~/.bashrc.
• Secret Managers: Tools like HashiCorp Vault for enterprise environments.

7.4 Document Your Workflows

Add comments to scripts and maintain a README.md explaining:

• Purpose of the script.
• Required dependencies.
• How to run/modify it.

8. Challenges and How to Overcome Them

8.1 Legacy Devices Without APIs

Many older devices lack NETCONF/RESTCONF. Workarounds:

• Use CLI scraping (with Netmiko) as a temporary solution.
• Prioritize upgrading critical devices to API-enabled firmware.

8.2 Skill Gaps

Learn gradually:

• Start with small scripts (e.g., backups) before complex workflows.
• Use free resources: Cisco DevNet Learning Labs, Ansible Documentation, and YouTube tutorials (e.g., David Bombal).

8.3 Fear of Breaking Things

Mitigate risk with:

• Rollback Plans: Always have a way to revert changes (e.g., backup configs).
• Dry Runs: Use Ansible’s --check flag to test playbooks without making changes.

9. Conclusion

Network automation is no longer optional—it’s a necessity for modern networks. By starting with Python, Ansible, and foundational concepts like idempotency, you can automate repetitive tasks, reduce errors, and focus on strategic work.

Remember: Progress, not perfection. Start small (e.g., a backup script), test rigorously, and build your skills over time. The network automation community is vast and supportive—leverage forums like r/networkautomation and Stack Overflow to learn and troubleshoot.

10. References

• Python Official Documentation
• Netmiko Documentation
• Ansible Documentation
• Cisco DevNet
• GNS3
• Network Automation with Python (Book by Jason Edelman, et al.)
• NAPALM Documentation