Ansible for Cisco: Network Automation with IOS, NX-OS, and ASA
By Luca Berton · Published 2024-01-01 · Category: installation
Automate Cisco network devices with Ansible. Configure IOS routers and switches, NX-OS data center switches, ASA firewalls. Backup configs, deploy VLANs, manage ACLs, and automate compliance checks.
Why Ansible for Cisco Network Automation?
Network engineers manage hundreds or thousands of Cisco devices — routers, switches, firewalls, wireless controllers. Manual CLI configuration is slow, error-prone, and doesn't scale. A single misconfigured ACL can take down production traffic.
Ansible automates Cisco devices without installing agents. It connects via SSH (network_cli) or API (httpapi for NX-OS) and executes changes idempotently. One playbook can configure VLANs across 500 switches in minutes.
Collections
Inventory for Network Devices
Configuration Backup
Automated Daily Backups
VLAN Management
Interface Configuration
ACL Management
OSPF Routing
NX-OS Data Center Configuration
ASA Firewall Configuration
Compliance Checking
FAQ
How does Ansible connect to Cisco devices?
Ansible uses ansible.netcommon.network_cli (SSH) for IOS, NX-OS, and ASA devices. NX-OS also supports ansible.netcommon.httpapi for REST API access. No agent is installed on the network device — Ansible sends CLI commands over SSH just like a human would.
Can Ansible roll back network changes?
Use cisco.ios.ios_config with backup: true before changes, then restore from backup if needed. For NX-OS, use checkpoints: cisco.nxos.nxos_config with checkpoint_file. Best practice: always save a backup before applying changes with state: replaced or state: overridden.
Is Ansible safe for production network changes?
Use --check --diff mode to preview changes without applying them. Use serial: 1 for rolling updates across switches. Implement a "canary" pattern: apply to one device, verify, then roll out to the rest. Back up configs before every change.
What about Cisco DNA Center and Meraki?
The cisco.dnac collection automates Cisco DNA Center (now Catalyst Center) — provisions, monitors, and manages campus networks. The cisco.meraki collection manages cloud-managed Meraki devices via their API. Both work well with Ansible for hybrid environments.
Conclusion
Ansible automates every layer of Cisco networking — IOS routers and switches, NX-OS data center fabrics, ASA firewalls, and cloud-managed Meraki devices. Start with configuration backups and compliance checks (lowest risk), then move to VLAN management, interface configuration, and routing protocols. The resource module approach (ios_vlans, ios_acls, ios_l3_interfaces) provides idempotent, structured configuration management that's safer and more maintainable than raw CLI commands.
Related Articles • Ansible for IoT and Edge Computing • UFW Allow Port with Ansible • Ansible SIEM SOC Security Operations • AAP 2.6 Automation Mesh • Ansible Dynamic Inventory Complete Guide
Category: installation