Cisco IOS Ansible Playbook: Standard + Unique Configs

Moving switch configuration to code starts with separating what is identical across the fleet from what is unique per device — and that split maps perfectly onto Ansible's role structure. This tutorial (from GetLabsDone) builds a two-role playbook for Cisco IOS: a cisco_standard role applying banner, DNS, NTP, enable secret and local user to every device, and a cisco_unique role consuming host_vars for per-device hostname and VLANs. The result is a repeatable, template-driven way to deploy new switches and migrate production gear to infrastructure-as-code.

Role Layout

roles/
├── cisco_standard/
│   ├── defaults/main.yml    # common config variables
│   └── tasks/main.yml
└── cisco_unique/
    └── tasks/main.yml
host_vars/production/cal/cal-hq-acc-sw-04.yml
inventories/production/cal/inventory.ini
playbooks/cisco_switch_playbook.yml

Standard Configuration Variables

# roles/cisco_standard/defaults/main.yml
std_config:
  ios_banner:
    - banner: |
        Welcome to GetLabsDone Network
        Unauthorized access is strictly prohibited.
  dns:
    - fqdn: getlabsdone.local
      dns_1: 8.8.8.8
      dns_2: 4.2.2.2
  ntp:
    - server1: time.google.com
      server2: time1.google.com
      logging: true
  en_password:
    - password: gld_pass
  local_user:
    - name: gldadmin
      password: testpass

Standard Tasks — Use the Right Module

- name: configure the login banner
  cisco.ios.ios_banner:
    banner: login
    text: "{{ item.banner }}"
  with_items: "{{ std_config.ios_banner }}"

- name: configure DNS on the system
  cisco.ios.ios_system:
    lookup_enabled: yes
    domain_name: "{{ item.fqdn }}"
    name_servers: ["{{ item.dns_1 }}", "{{ item.dns_2 }}"]
  with_items: "{{ std_config.dns }}"

- name: setup NTP across the board
  cisco.ios.ios_ntp_global:
    config:
      servers:
        - server: "{{ item.server1 }}"
        - server: "{{ item.server2 }}"
      logging: "{{ item.logging }}"
    state: replaced
  with_items: "{{ std_config.ntp }}"

Prefer purpose-built modules (ios_banner, ios_system, ios_ntp_global) and fall back to ios_config only when no module exists. Use no_log: true for anything containing passwords.

Unique Configuration via host_vars

Store per-device data in host_vars/<env>/<site>/<hostname>.yml — hostname, VLANs, interfaces, ACLs. When migrating a production switch, convert its running config to YAML and drop it in host_vars.

Inventory

[cal]
cal-hq-acc-sw04 ansible_host=10.1.11.7
[cal:vars]
env=production
site=cal
ansible_ssh_user=[SSH_USERNAME]
ansible_ssh_pass=[SSH_PASSWORD]
ansible_network_os=ios
ansible_connection=network_cli
ansible_become_method=enable
ansible_become=yes
ansible_become_password=[ENABLE_PASSWORD]

Playbook and Device Prerequisites

ansible-playbook cisco_switch_playbook.yml -i inventories/production/cal/inventory.ini

Before automating, the device needs: SSH enabled, a local account or RADIUS login, and an IP + default gateway reachable from the Ansible host. Run the playbook once and the switch gains its banner, DNS, NTP, hostname and VLANs in a single, auditable change set.

Start from zero with our Ansible network automation 101 tutorial, and see input-drop troubleshooting on IOS XR for the operations side of the same platforms.

原文链接：https://getlabsdone.com/how-to-get-started-with-cisco-ios-ansible-playbook/