A read-only Ansible playbook that turns ios_facts and parsed show output into a JSON, Markdown and HTML network inventory. CDP on a shared management segment showed 10 to 12 neighbors per device until the management interface was filtered out.
A nightly Ansible audit for IOS XE: read-only facts and compliance into a dated Markdown and HTML report, with a systemd user timer. A fake unreachable device still produced a report that said 6 of 7 reached, named it, and exited 2.
An Ansible IOS XE upgrade workflow: pre-check snapshot, HTTP staging with MD5 verify and boot order, post-check diff, and rollback, rehearsed on six devices. MD5 failed on a bad hash as it should. No version change: one build, and the lab image refused a reload.
One services and hardening standard pushed to six IOS XE devices with Ansible. Check mode passed a TACACS line sent before aaa new-model and a v3 priv line one switch could not parse. Five idempotency fixes, real SNMPv3 tests, and a read-only check.
A dry run with --check --diff on three IOS XE routers, the real run, and a second check. Resource modules show commands but no diff, diff_against waits for the real run, and two lines check mode called changed were rejected by the router as invalid input.
An edge ACL from one data model, pushed with ios_acls. The first version forgot BGP and the branch peer went down three minutes later. The fix with replaced, hit counts from real traffic, and what overridden would have deleted.
Every access port gets a two MAC limit, restrict mode and aging from one data model. A test host then tries four MAC addresses, three get dropped because the original MAC holds a slot, and the check playbook catches the violations.
The root bridge was an access switch nobody picked. One data model now sets the root, portfast with BPDU guard and LACP uplinks, and a check playbook catches a wrong root or a missing bundle member, even while the far end still shows it bundled.
Parse CDP and LLDP neighbors on every device, normalize the names, compare the links with an intended list and render a Markdown report plus a Mermaid drawing. A shut port shows up as a missing link in both protocols, then clears after the fix.
One router at a time with serial: 1, a parsed health check after each, and a block/rescue rollback that stops the rollout. A hello timer change fails and rolls back on the first router, a cost change rolls clean, and a 1 second settle time produces a false pass.
OSPF and eBGP on five IOS XE routers from one vars file, with a parsed pre-check and post-check on every run. A change that bounces every adjacency, the cli_parse retry bug that broke the first wait loop, and the route flap the checks could not see.
Three jobs on six IOS XE devices with ansible.utils.cli_parse: a down-interface report, a version and uptime inventory, and a custom TTP template that turns show ntp associations into a compliance rule. Every device passed the config check and failed the sync check.