Network Automation with Ansible: A Complete Guide for Engineers

Complete 2026 guide to network automation with Ansible: installation, inventory, playbooks, vendor modules (cisco.ios, cisco.nxos, arista.eos, junipernetworks.junos, fortinet.fortios), AWX/Tower, and NetBox integration. The de facto standard for 85% of NetEng teams.

Why Use Ansible for Networking?

• Agentless: uses SSH / NETCONF / REST API
• YAML is readable by non-programmers
• Idempotent: multiple runs produce the same result
• Official modules maintained by vendors
• Large community (200,000+ playbooks on Galaxy)
• Free and open source

Installation

• pip install ansible
• ansible-galaxy collection install cisco.ios cisco.nxos arista.eos junipernetworks.junos fortinet.fortios
• Verification: ansible --version

Inventory (inventory.yml)

• all:
• children:
• access_switches:
• hosts:
• sw-paris-01:
• ansible_host: 10.0.0.11
• ansible_network_os: cisco.ios.ios
• ansible_user: admin
• ansible_password: "{{ vault_password }}"
• core_switches:
• hosts:
• core-01: ...

Simple playbook: back up configurations

• - name: Back up running-config
• hosts: all
• gather_facts: false
• tasks:
• - name: Retrieve running-config
• cisco.ios.ios_command:
• commands: show running-config
• register: config
• - name: Save to file
• copy:
• content: "{{ config.stdout[0] }}"
• dest: "./backups/{{ inventory_hostname }}.cfg"

Playbook: deploy a VLAN across 100 switches

• - name: Create VLAN 10 DATA on access switches
• hosts: access_switches
• tasks:
• - cisco.ios.ios_vlans:
• config:
• - vlan_id: 10
• name: DATA
• state: active
• state: merged

Key Vendor Modules

• cisco.ios: IOS/IOS-XE
• cisco.nxos: NX-OS
• cisco.meraki: Meraki Dashboard API
• cisco.aci: ACI
• arista.eos: Arista
• junipernetworks.junos: Junos (NETCONF)
• fortinet.fortios: FortiGate/FortiSwitch
• paloaltonetworks.panos: Palo Alto
• community.network: basic multi-vendor capabilities

Variables and Jinja2 Templates

• vars/vlans.yml: dictionary of VLANs to deploy
• Templates: generate configurations from data
• Usage: more maintainable than hard-coded configurations

Ansible Vault

Encrypt passwords stored in Git:

• ansible-vault encrypt vars/secrets.yml
• Usage: ansible-playbook site.yml --ask-vault-pass
• CI/CD integration: secret variables in GitLab CI

AWX / Ansible Tower

• Web interface for playbooks
• RBAC: teams and projects
• Scheduling: scheduled runs
• Inventory synchronization from NetBox
• AWX is open source; Tower is Red Hat's commercial offering

NetBox Integration

• ansible-inventory --list -i netbox.yml: dynamic inventory from NetBox
• NetBox is the source of truth; Ansible is the execution engine
• Workflow: update NetBox → automatically push the configuration through Ansible

Network CI/CD (GitLab)

• 1. An engineer updates YAML in Git
• 2. GitLab CI: ansible-lint + syntax check
• 3. Staging deployment (test switches)
• 4. Manual approval
• 5. Production deployment
• 6. Rollback upon failure

Best Practices

• Always ensure idempotence: test multiple runs
• check_mode (--check): dry run
• Tag tasks for selective execution
• Use collections instead of standalone modules, as they are better maintained
• Testing: Molecule framework

Limitations

• No state file, unlike Terraform
• Complex state management
• Slower performance with large inventories due to limited parallelization
• Solution: use Nornir (Python framework) for more than 500 devices

Order from OPTINOC

Ansible network training, AWX/Tower and NetBox deployment, and GitLab CI/CD. Quote within 48 hours.