Ansible for Network Engineers: Complete Guide

2026年8月25日 LOG admin

Network automation is no longer optional in modern IT environments, and Ansible remains the most accessible entry point for engineers managing Cisco, Juniper or Arista fleets. This complete guide from NetOpsHub takes you from zero to productive: why Ansible's agentless architecture fits network devices, how to gather facts with ios_facts, how to build a configuration backup workflow with ios_config, how to protect credentials with Ansible Vault, and the best practices - dynamic inventory, group variables, error handling and NAPALM integration - that separate a lab toy from a production automation platform.

Why Ansible for Network Automation

Ansible needs no agents on the devices: it uses SSH for Unix/Linux systems and NETCONF/REST APIs for network devices. Playbooks are human-readable YAML that double as living documentation of your network configuration, with native modules for all major vendors and idempotent operations that are safe to rerun.

Installation and Prerequisites

pip install ansible
ansible --version

Your First Playbook: Gathering Facts

---
- name: Gather Network Facts
  hosts: all
  gather_facts: false
  connection: network_cli
  vars:
    ansible_network_os: ios
  tasks:
    - name: Get device facts
      ios_facts:
        gather_subset: all
    - name: Display hostname
      debug:
        var: ansible_hostname

Pair it with an inventory file:

[switches]
192.168.1.1
192.168.1.2
[all:vars]
ansible_user=admin
ansible_ssh_pass=your_password
ansible_become_pass=enable_password
ansible_connection=network_cli
ansible_network_os=ios

Always dry-run first with ansible-playbook gather_facts.yml --check.

Real-World Example: Configuration Backup

---
- name: Network Configuration Backup
  hosts: all
  gather_facts: false
  connection: network_cli
  vars:
    backup_dir: /path/to/backups
  tasks:
    - name: Create backup directory
      file:
        path: "{{ backup_dir }}"
        state: directory
        mode: '0755'
    - name: Fetch running config
      ios_config:
        backup: yes
        backup_options:
          filename: "{{ inventory_hostname }}-{{ ansible_date_time.date }}.cfg"
          dir_path: "{{ backup_dir }}"

Securing Secrets with Ansible Vault

ansible-vault create group_vars/all/vault.yml
ansible-vault edit group_vars/all/vault.yml

Store ansible_ssh_pass and ansible_become_pass inside the encrypted vault and reference them as variables - never hardcode passwords in playbooks.

Best Practices for Production Automation

Dynamic inventory - use cloud inventory plugins (e.g. amazon.aws.aws_ec2) for dynamic environments.
Organized group variables - split group_vars/all into vault.yml (secrets) and global.yml, with per-group files for switches and routers.
Error handling - register task output and branch on failure with when: conditions instead of letting one failure abort the whole run.
Vendor modules - use ios_interface, ios_vlan, ios_bgp, ios_acl and ios_command for their respective jobs.

Troubleshooting Common Issues

Test SSH with ansible all -m ping; use -vvv for verbose output; raise ansible_timeout=60 in inventory for slow devices; ensure the enable password is set with ansible_become: yes and ansible_become_method: enable.

NAPALM Integration

For vendor-agnostic operational data, NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) works with any Ansible-supported device:

- name: Get operational data with NAPALM
  napalm_get_facts:
    hostname: "{{ inventory_hostname }}"
    username: "{{ ansible_user }}"
    password: "{{ ansible_ssh_pass }}"
    driver: "eos"
    register: napalm_facts

Start small - a backup playbook is the perfect first production automation - then iterate toward CI/CD pipelines that run --check in the test stage and full playbooks in the deploy stage.