Ansible Network Automation for Cisco IOS — A Practical Getting-Started Guide

Ansible vs Python for Network Automation

Before choosing Ansible, it's worth understanding where it sits relative to other tools. Python libraries like Netmiko provide SSH transport for sending raw CLI commands. NAPALM adds a multi-vendor abstraction layer and getter methods. Ansible sits a level above — it orchestrates tasks, manages state, and integrates with your wider infrastructure tooling (CI/CD, secrets managers, ticketing systems).

How to Automate Cisco IOS with Ansible — 6 Steps

Inventory File Example

Below is a working INI-format inventory for a typical three-tier Cisco estate. Store credentials in Ansible Vault, not in plain text.

[core_switches]
core-sw-01 ansible_host=10.0.1.1
core-sw-02 ansible_host=10.0.1.2

[distribution_switches]
dist-sw-01 ansible_host=10.0.2.1
dist-sw-02 ansible_host=10.0.2.2

[access_switches]
access-sw-01 ansible_host=10.0.3.1
access-sw-02 ansible_host=10.0.3.2
access-sw-03 ansible_host=10.0.3.3

[cisco_ios:children]
core_switches
distribution_switches
access_switches

[cisco_ios:vars]
ansible_network_os=cisco.ios.ios
ansible_connection=network_cli
ansible_user=netadmin
ansible_password={{ vault_ssh_password }}
ansible_become=yes
ansible_become_method=enable
ansible_become_password={{ vault_enable_password }}

Backup Playbook — Full Example

This playbook connects to all Cisco IOS devices, runs show running-config, and saves the output to a timestamped file per device. It's a solid first automation to run in production.

---
- name: Backup Cisco IOS running configurations
  hosts: cisco_ios
  gather_facts: false
  vars:
    backup_dir: "/opt/network-backups/{{ ansible_date_time.date }}"

  tasks:
    - name: Create backup directory
      file:
        path: "{{ backup_dir }}"
        state: directory
        mode: '0755'
      delegate_to: localhost
      run_once: true

    - name: Collect running configuration
      cisco.ios.ios_command:
        commands:
          - show running-config
      register: config_output

    - name: Save config to file
      copy:
        content: "{{ config_output.stdout[0] }}"
        dest: "{{ backup_dir }}/{{ inventory_hostname }}_running-config.txt"
      delegate_to: localhost

    - name: Log backup completion
      debug:
        msg: "Backup complete for {{ inventory_hostname }} — saved to {{ backup_dir }}"

ios_config Task Example

Use ios_config to push configuration changes. The module tracks what has changed and only applies lines not already present in the running config.

- name: Apply NTP and logging baseline
  cisco.ios.ios_config:
    lines:
      - ntp server 10.0.0.10 prefer
      - ntp server 10.0.0.11
      - logging host 10.0.0.20
      - logging buffered 16384
      - logging console critical
      - service timestamps log datetime msec
    save_when: modified  # only write to NVRAM if changes were made

- name: Apply interface description (loop example)
  cisco.ios.ios_config:
    parents: "interface {{ item.name }}"
    lines:
      - "description {{ item.description }}"
  loop:
    - { name: GigabitEthernet0/1, description: "Uplink to Core-SW-01" }
    - { name: GigabitEthernet0/2, description: "Uplink to Core-SW-02" }

Frequently Asked Questions