Ansible Network Automation: Inventory, Facts and Backup

Ansible remains the fastest way to standardize configuration across a multi-vendor fleet, but the first playbook is where most people stumble: connection settings, privilege escalation and inventory design. This guide walks through the official Ansible network examples — a working inventory for Arista EOS, Cisco IOS and VyOS, the network_cli connection model, facts gathering and automatic running-config backups — so you can go from zero to a working playbook in one sitting.

Multi-Vendor Inventory with Group Variables

[all:vars]
ansible_connection=ansible.netcommon.network_cli
ansible_user=ansible

[switches:children]
eos
ios
vyos

[eos]
veos01 ansible_host=veos-01.example.net

[eos:vars]
ansible_become=yes
ansible_become_method=enable
ansible_network_os=arista.eos.eos

[ios:vars]
ansible_become=yes
ansible_become_method=enable
ansible_network_os=cisco.ios.ios

[vyos:vars]
ansible_network_os=vyos.vyos.vyos

ansible_connection: ansible.netcommon.network_cli is the key line: without it Ansible tries to run Python on the switch, which fails. ansible_become_method: enable mirrors the IOS/EOS enable mode for privilege escalation.

Example 1: Collect Facts and Back Up Configs

Network-specific facts modules (arista.eos.eos_facts, cisco.ios.ios_facts, vyos.vyos.vyos_facts) gather system information for the rest of the playbook, using credentials from the inventory:

- name: Gather facts
  hosts: switches
  gather_facts: no
  tasks:
    - name: Collect facts from network devices
      arista.eos.eos_facts:
      when: ansible_network_os == 'arista.eos.eos'

Example 2: Get Running Configuration with Automatic Backup

eos_config and vyos_config modules support a backup: option that writes a full running-config copy to the backup folder before any change — an instant rollback safety net:

- name: Backup running config
  arista.eos.eos_config:
    backup: yes
  register: backup_output

Secrets Handling and Jump Hosts

Never store passwords in plain text: encrypt them with Ansible Vault (ansible_ssh_pass: !vault | ...). If your control node cannot reach devices directly, use the proxy command pattern documented in the Ansible network debug guide. For a deeper multi-vendor workflow, see our Ansible and Jinja2 multi-vendor automation guide and how to automate network design in NVIDIA Air with Ansible and Git.

原文链接：https://docs.ansible.com/projects/ansible/latest/network/user_guide/network_best_practices_2.5.html