Network Automation with Python and Ansible: A Practical Starter
The minimum viable network automation stack for engineers used to CLI configuration. Build the right habits before adopting more complex frameworks.
Why this matters even for small networks
Manual CLI configuration does not survive contact with growth. A network with 20 devices and a network with 200 devices look the same on day one and very different on day 500. Automation is the only sustainable scaling path.
Start with the basics — Ansible for configuration push, Python for everything else. More elaborate frameworks (Nornir, NetBox, Terraform with provider modules) layer on top.
Ansible for configuration push
Ansible is the right starting tool because it is agentless, declarative for most network platforms, and well-supported by the vendors. The cisco.ios, cisco.nxos, arista.eos, and junipernetworks.junos collections cover the major enterprise platforms.
Start by automating the boring stuff: NTP servers, SNMP communities, banners, AAA configuration. These are repeated across every device, they rarely change, and getting them wrong manually is the most common configuration drift source.
Python for the things Ansible cannot do well
Once Ansible covers the steady-state, Python covers the migrations, audits, and one-off changes. Netmiko handles SSH connectivity to network devices in a way that survives the inconsistencies between vendors. NAPALM provides a higher-level abstraction with cross-vendor methods for common operations.
Write Python in a real package with tests. Network automation scripts written as ad-hoc files become unmaintainable within a year.
Source of truth
Without a single source of truth for the intended state of the network, automation produces drift instead of fixing it. NetBox is the de facto standard — an open-source IPAM and DCIM that exposes a clean API. Automation reads from NetBox and writes to devices.
The discipline is that no one changes devices outside the automation. Once enforced, every device's actual configuration matches NetBox's intended configuration. Audit runs against NetBox.
Testing changes safely
Containerlab and EVE-NG let you stand up a virtual replica of your topology and test changes before pushing to production. For Cisco devices, Cisco Modeling Labs (CML) is the commercial equivalent.
Build the test environment once; automate spinning up topology variants for change validation. The investment pays back the first time it catches a misconfiguration before it reaches production.
Where to go next
Once Ansible and Python cover most of the day-to-day, the natural next step is full intent-based networking — Terraform with vendor providers for declarative state management, or Nornir for more complex orchestration than Ansible handles cleanly.
Do not skip ahead. Teams that adopt advanced tooling without mastering the basics produce more chaos, not less.
Reader questions, answered
Should we use Terraform for networking?+
Yes, once the team is comfortable with declarative tooling. The major vendor Terraform providers are credible.
Is Nornir better than Ansible?+
For complex orchestration in Python, yes. For straightforward configuration push, Ansible is easier to start with.
Raza Ahmad is a technology author and IT infrastructure specialist based in Melbourne, Australia. He writes practitioner-grade guides on cloud computing (Azure and AWS), cybersecurity, enterprise networking with Cisco platforms, Linux administration, DevOps, and virtualization. His work focuses on translating complex infrastructure topics into clear, accurate guidance that engineers, system administrators, and IT decision makers can put to work in production environments. Every article published under his byline is fact-checked against current vendor documentation, official standards, and Raza's own hands-on experience operating the technologies he covers.
More from Networking
A Field Guide to BGP Troubleshooting in Modern Enterprise Networks
The diagnostic patterns experienced network engineers use when BGP misbehaves between data centers, clouds, and the internet edge.
CCNA vs CCNP: Which Cisco Certification Should You Pursue?
How to choose between Cisco's associate and professional certifications based on where you are in your career and what you want to do next.
The Complete Cisco Networking Guide for Network Engineers
A structured reference for network engineers working with Cisco IOS, IOS-XE, and NX-OS — covering switching, routing, security, and modern automation.
One email. The technology stories that actually matter for engineers.
A curated digest of the week's most useful tutorials, reviews, and analysis — no clickbait, no AI summaries of someone else's work.
Free. Unsubscribe anytime. See our privacy policy.