Five compliance rules checked on six IOS XE devices against group_vars intent, using gathered resource modules and one running config. Injected drift is found, a fix playbook removes it with check mode first, and the recheck passes all 30 rows.
One YAML data model drives VLANs, trunks, access and voice ports and SVIs on three IOS XE switches with the cisco.ios resource modules. Check mode command lists, a changed=0 rerun, the ip routing line that reported a change every run, and real show output.
Network device groups, five network devices with a vaulted RADIUS secret, and an endpoint identity group with static MACs on ISE 3.5, all with cisco.ise 3.3.0. Includes the SDK schema mismatch that breaks network_device, the fix, and a GUI drift test.
Three read-only states of the cisco.ios resource modules on IOS XE 17.18: gathered pulls live state into YAML, rendered turns YAML into CLI with no device, parsed reads a saved config. Plus the stale backup and leftover secondary address they caught.
Object groups, an inbound ACL and NAT on an ASAv 9.24, built with cisco.asa 7.0.0 and tested with real traffic. Includes the first-login password change that stalls Ansible, a no shutdown that is never idempotent, and what overridden would have deleted.
Nine failures caused on purpose against an IOS XE router, with the exact error Ansible printed, what it meant, and the change that fixed it. Includes a show tech that fails even with a long timeout and a wrong vault password file that still works.
ios_config saves a running config in one task. A Git history you can read takes three more: strip the header lines, stage, and commit only when there is a real change. Real runs against six IOS XE devices, including an out-of-band change caught and rolled back.
One Jinja2 template, six IOS XE devices, real output. The first render failed on five of six hosts, diff_against showed about fifty fake removals, and the useful review came from the ios_config updates list in check mode.
The same ios_l3_interfaces data run through merged, replaced, overridden and deleted on an IOS XE 17.18 router, with the exact commands each state sent. One would have removed the management IP. Another turned off ICMP redirects and unreachables.
The PingLabz Ansible series in reading order: 25 posts on one three-site network covering IOS XE, ASA and ISE, from the first playbook and inventory through resource modules, compliance, routing changes, hardening, upgrades and CI.
Six Cisco devices, three sites, two axes. Build a site-and-role Ansible inventory with group_vars and host_vars, catch a site variable silently beating a role variable, and see why ansible_group_priority could not fix it.
Install ansible-core and the Cisco collections in a venv, build a three-router inventory with a vault, and run a first playbook on IOS XE 17.18. Real runs, including the two failures every first attempt hits, and the idempotent second run.