Ansible for Network Engineers: The Complete Hands-On Guide

This is the hub for the PingLabz Ansible series. It follows one lab network across 25 posts, built and broken in my home lab, with real playbook runs, real failures and the fixes. Each article stands on its own, but if you read them in order, the same inventory, vault and data model carry all the way through.

The series is written for network engineers who already know the CLI and want automation they can trust on production gear. That means idempotent runs, dry runs before every change, secrets in a vault, and a second run that reports changed=0.

The lab behind the series

Everything is built in my home lab on Cisco gear, with versions stated in every post:

The network has three sites, HQ, BR1 and BR2, managed out of band on 10.66.10.0/24. Device names follow site-role#: hq-core1, hq-edge1, br1-edge1, br1-acc1 and so on.

Start here

1. Ansible Network Lab Setup: Control Node, Collections and a First Playbook on IOS XE. Install it in a venv, build the first inventory and vault, and fix the two errors every first run hits: the missing ansible_network_os and the privilege escalation for config mode.
2. Ansible Inventory for Network Engineers: Groups, group_vars and host_vars by Site and Role. Model the network on two axes, find out why a site variable silently beat a role variable, and see why ansible_group_priority didn't fix it.
3. Ansible Resource Module States on IOS XE: merged vs replaced vs overridden vs deleted. The exact commands each state sends, including the overridden run that would have removed the management IP.
4. Jinja2 Templates for IOS XE Configs with Ansible: Render, Review, Push. Render per-device configs from the inventory, review the real change set, and see why diff_against misleads with a partial template.
5. Back Up IOS XE Configs to Git with Ansible (and Get Diffs Worth Reading). Commit running configs only when they change, strip the noisy header lines, and use the history to catch drift.
6. Ansible Network Troubleshooting: 9 Real Failures on IOS XE and How I Fixed Them. Connection types, timeouts, a show tech that trips the error regex, confirm prompts, enable and vault mistakes, and libssh host keys.
7. Ansible for Cisco ASA: Object Groups, ACLs and NAT Without Locking Yourself Out. asa_ogs, asa_acls and object NAT on ASAv 9.24, a no shutdown that is never idempotent, and the overridden run that would delete the management ACL.
8. Ansible Gathered, Rendered and Parsed on Cisco IOS XE: Read State Without Changing Anything. Read live interface state into YAML with gathered, turn YAML into CLI with no device using rendered, and parse old backups offline, plus the VRF line that breaks parsed.
9. Ansible for Cisco ISE: Network Devices, Device Groups and Endpoints with cisco.ise. Network device groups, network devices with a vaulted RADIUS secret, and an endpoint identity group on ISE 3.5, plus the SDK schema mismatch that breaks network_device.
10. Ansible Resource Modules on IOS XE: VLANs, Trunks and SVIs from One Data Model. VLANs, trunks, access and voice ports and SVIs on three switches from one YAML file, with check mode command lists, a changed=0 rerun and the ip routing idempotency trap.
11. Ansible Compliance Checks on IOS XE: Find Drift, Fix It, Prove It. Five rules checked on six devices against inventory intent, a Markdown report, a fix playbook with check mode first, and a recheck that passes all 30 rows.
12. Parsing IOS CLI Output with Ansible: cli_parse, TextFSM and TTP. Down interfaces split by cause, a version and uptime inventory, and a custom TTP template that turns show ntp associations into a compliance rule.
13. OSPF and BGP with Ansible Resource Modules, Checked Before and After. One vars file, parsed pre and post checks, and a change that bounces every adjacency.
14. Rolling Network Changes with Ansible: serial, Post-Checks and Automatic Rollback. One router at a time, a health check after each, and an automatic rollback that stops the rollout.
15. Build a CDP and LLDP Neighbor Map with Ansible on Cisco IOS XE. CDP and LLDP parsed on every device, compared with the intended links, rendered as a Markdown report and Mermaid diagram.
16. STP Root, Portfast and LACP EtherChannel with Ansible on Cisco IOS XE. Root bridge placement, portfast with BPDU guard and LACP uplinks from one data model, with a check that catches a wrong root or a missing member.
17. Port Security on Access Ports with Ansible on Cisco IOS XE. A two MAC limit in restrict mode on every access port, a real four MAC test, and a check that fails on any violation.
18. IOS XE ACLs with the Ansible ios_acls Resource Module. An edge ACL from one data model, a missing BGP line that dropped a peer, the fix with replaced, and hit counts from real traffic.
19. Ansible Check Mode and Diff on IOS XE: What a Dry Run Misses. Dry runs with --check --diff, and two lines check mode passed that the router rejected.
20. Standardize and Harden IOS XE Services with Ansible: NTP, Syslog, SNMPv3, AAA. One services and hardening standard for NTP, syslog, SNMPv3, banners and TACACS+ AAA, made idempotent and checked read-only.
21. An IOS XE Upgrade Workflow with Ansible: Pre-checks, Staging, MD5 and Post-checks. Pre-checks, staging with MD5, post-check diff and rollback, rehearsed in my home lab.
22. A Nightly Network Audit Report with Ansible: Facts, Compliance and a Dated HTML Page. Read-only facts and compliance from every device into a dated HTML and Markdown report, run from a systemd timer.
23. Build a Network Inventory from Ansible Facts and Parsed CLI Output. Facts and parsed show output into a JSON, Markdown and HTML inventory: interfaces, neighbors, OSPF and BGP.
24. A Git Pipeline for Network Configs: Lint, Check-Mode Diff, Then Deploy. Configs in Git, a pre-receive CI gate with yamllint, ansible-lint and check mode, then deploy.
25. Run Ansible Network Playbooks from Semaphore UI: Templates, Vault Keys and Schedules. Semaphore UI on the control node: Git repo, vault key, templates, a schedule and real failed runs.

Related reading on PingLabz

• Ansible vs Puppet vs Chef (and Terraform) for Network Automation covers when Ansible is the right tool at all.
• Jinja2 Templates for Network Configs is the templating background for the template articles.
• Netmiko Tutorial for Cisco and Nornir and NAPALM are the Python side of the same problems.
• JSON vs XML vs YAML for Network Engineers is a primer if YAML is new to you.
• FMC REST API: Change FTD Rules and Deploy with curl and Python is API automation on a security platform.