Automation

Ansible Resource Modules and the State Key

The layer that changes a device, in full — a resource module manages one feature as structured data, and the state key sets the blast radius: merged adds, replaced rewrites listed items, and overridden makes the whole feature match and deletes anything you left out. Read state back with gathered; convert offline with rendered/parsed.

Building a Telemetry Collector Stack

Model-driven telemetry gets data off the box — this is where it lands. Build the TIG pipeline (Telegraf → InfluxDB → Grafana), match the Telegraf input to the subscription direction (cisco_telemetry_mdt for dial-out, gnmi for dial-in), and bound growth with bucket retention and low cardinality.

Multivendor Configuration with NAPALM

The safe way to change config across vendors — stage a candidate, review the diff, then commit_config or discard_config; choose additive load_merge_candidate or declarative load_replace_candidate; and undo a bad change with rollback() or commit-confirm.

Scaling Network Automation with Concurrency

A loop that logs into devices one at a time doesn't scale — fan the work out with a ThreadPoolExecutor because it's I/O-bound, isolate per-device failures with submit/as_completed, and bound writes with canary-then-batch so concurrency never multiplies the blast radius.

Structuring an Ansible Project for Network Automation

The layer beneath the resource modules — set the connection with ansible_connection and ansible_network_os, attach details to groups, resolve group_vars/host_vars precedence, and keep secrets in Ansible Vault so one playbook drives every environment.

Managing Terraform State in Practice

The file that bites teams in production — where state lives, how a remote backend's locking stops two applies colliding, importing brownfield devices with the import block, fixing state with state mv/rm instead of a text editor, and reading a scheduled plan as a drift alert.

Turning CLI Output into Structured Data

Stop slicing show output by hand — parse it into data you index by field name with TextFSM/ntc-templates, Genie, or NAPALM getters, and prefer YANG-modelled data over RESTCONF/NETCONF/gNMI when the device can skip the parsing entirely.

Idempotency in Network Automation

The property that decides whether an approach is safe — why declarative tools converge and procedural scripts don't, what changed=0 and an empty plan prove, which HTTP methods you can retry, and how to build idempotency into your own code.

Rendering Device Configuration with Jinja2

The "render" step of the source-of-truth loop, in detail — separate structure from data, keep stray whitespace out of CLI config, fail loud on a missing variable, and render the same template from Python or Ansible.

Choosing between NETCONF, RESTCONF, and gNMI

Three interfaces, one YANG model — pick on transport and transactional guarantees, not on what you can configure: NETCONF's candidate/commit, RESTCONF's stateless simplicity, and gNMI's streaming telemetry.

Evaluating the Accuracy of AI Recommendations

An LLM can be fluent, confident, and wrong — judge a single recommendation by grounding, validation, and pyATS diff, and measure an AI feature over time against a ground-truth evaluation set.

Building a Conversational Agent with LLMs

Ask the network questions in plain language — the tool-calling loop at an agent's core, reusing your MCP tools, and the read-only-by-default, confirm-before-change guardrails that keep it safe.

Building an MCP Server with FastMCP

Give an AI agent a safe, typed interface to the network — expose read-only tools and a data resource with FastMCP, run it over stdio or HTTP, and keep writes behind human approval.

Security Risks in AI-Based Network Automation

The OWASP LLM risks that matter when an agent can touch the network — prompt injection, excessive agency, improper output handling — four questions to size up any design, and the read-by-default, write-by-approval rule.

Benefits and Risks of AI-Assisted Network Automation

Where AI coding assistants pay off, the three risks that matter — data privacy, IP ownership, and code validation — and a review → lint → dry-run → simulate → test workflow that keeps a human in the loop.

Secure Coding Practices for Network Automation

Harden the code itself — validate input with schemas and allowlists, pass arguments instead of building shell strings, scope credentials to least privilege, keep secrets out of Git, and pin and scan dependencies.

Obtaining and Deploying CA-Signed TLS Certificates

Make TLS trust real instead of disabling it — generate a CSR with a SAN, enrol an IOS XE trustpoint, verify the chain, and automate renewal before certificates silently expire.

Change Validation with pyATS

Prove a change worked, not just that commands were sent — snapshot operational state with pyats learn, diff before against after, and gate the pipeline with AEtest.

Diagnosing Failures from Logs and Output

Read to the first error, not the last line — a repeatable method plus the signatures (401 vs. timeout, 429, RESTCONF 409, TLS) that map straight to a fix.

A Logging Strategy: Syslog and Webhooks

What to log, at what severity, and where — syslog for the durable record, webhooks for real-time alerts, and per-handler routing that pages humans only for what matters.

Model-Driven Telemetry

Stream YANG-modeled operational state instead of polling — sensor path, subscription, cadence, and a working IOS XE dial-out subscription into a Telegraf collector.

Generating YAML and JSON from a YANG Model

Walk a YANG schema top-down to build a valid RESTCONF body — container → object, list → array, and the module-prefix rules that keep it off a 400.

Driving Automation from a Source of Truth

NetBox/Nautobot for infrastructure data, Git for config — and the pull → render → deploy → verify loop that reconciles drift.

Running Automation Tooling with Docker Compose

Read and write a Compose file — services, networks, volumes — and wait for readiness with healthchecks, not just start order.

Network Simulation with Cisco Modeling Labs

Test changes against virtual Cisco topologies before production — drive CML from Python with virl2_client and version the topology in Git.

Building a GitLab CI/CD Pipeline

A four-stage network pipeline — build, prevalidate, deploy, postvalidate — with manual gates, protected environments, and runner tags.

Diagnosing a Failing GitLab CI/CD Pipeline

Read the log to the first error and classify it: missing dependency, version clash, failed test, or a stuck runner.

Version Control with Git

The three areas, branching and merging, conflicts, cherry-pick, and reset vs. revert for shared history.

Network Automation with Ansible

Configure Cisco IOS XE with idempotent resource modules.

Network Automation with Terraform

Declarative, stateful IaC for Cisco IOS XE — plan, apply, and drift detection.

Network Automation with RESTCONF

Drive YANG-modeled data over HTTP (RFC 8040) with curl and Python requests.

Network Automation with Python

Netmiko, NAPALM, and ncclient — push and read config, structure CLI output, and scale with concurrency.

Selecting the Right Automation Approach

Match the requirement to IaC, low-code/no-code, or custom Python — with a decision heuristic and worked scenarios.

Consuming REST APIs at Scale

Persistent auth, pagination, 429 backoff, idempotent retries, webhooks, and ETag caching against Cisco controllers.