OSPF and eBGP on five IOS XE routers from one vars file, with a parsed pre-check and post-check on every run. Includes a change that bounces every adjacency, the cli_parse retry bug that broke my first wait loop, and the route flap the checks couldn't see.
Three jobs on six IOS XE devices with ansible.utils.cli_parse: a down-interface report, a version and uptime inventory, and a custom TTP template that turns show ntp associations into a compliance rule. Every device passed the config check and failed the sync check.
Five compliance rules checked on six IOS XE devices against group_vars intent, using gathered resource modules and one running config. Injected drift is found, a fix playbook removes it with check mode first, and the recheck passes all 30 rows.
One YAML data model drives VLANs, trunks, access and voice ports and SVIs on three IOS XE switches with the cisco.ios resource modules. Check mode command lists, a changed=0 rerun, an ip routing idempotency trap, and real show vlan, trunk and ping output.
Network device groups, five network devices with a vaulted RADIUS secret, and an endpoint identity group with static MACs on ISE 3.5, all with cisco.ise 3.3.0. Includes the SDK schema mismatch that breaks network_device and a drift test.
Three read only states of the cisco.ios resource modules on IOS XE 17.18: gathered pulls live state into YAML, rendered turns YAML into CLI with no device, parsed reads a saved config. Plus the stale backup and leftover secondary address they caught.
Object groups, an inbound ACL and NAT on an ASAv 9.24, built with cisco.asa 7.0.0 and tested with real traffic. Includes the first login password change that stalls Ansible, a no shutdown that is never idempotent, and what overridden would have deleted.
Nine failures I caused on purpose against an IOS XE router, with the exact error Ansible printed, what it actually meant, and the change that fixed it. Two of them surprised me: a show tech that fails even with a long timeout, and a wrong vault password that still works.
ios_config can save a running config in one task. Getting a Git history you can actually read takes three more: strip the header lines, stage, and commit only when there is a real change. Real runs against six IOS XE devices, including an out-of-band change caught and rolled back.
One Jinja2 template, six IOS XE devices, real output. The first render failed on five of six hosts, diff_against showed a wall of fake removals, and the useful review came from a different place.
I ran the same ios_l3_interfaces data through merged, replaced, overridden and deleted on an IOS XE 17.18 router and captured the exact commands each state sent. One of them would have removed the management IP. Another quietly turned off ICMP redirects and unreachables.
The hub for the PingLabz Ansible series: 25 hands-on posts on one lab network, covering IOS XE, NX-OS, ASA and ISE automation with real runs, real failures and the fixes.