The root bridge was an access switch nobody picked. One data model now sets the root, portfast with BPDU guard and LACP uplinks, and a check playbook catches a wrong root or a missing bundle member.
Parse CDP and LLDP neighbors on every device, normalize the names, compare the links with an intended list and render a Markdown report plus a Mermaid drawing. A shut port shows up as a missing link, then clears after the fix.
One router at a time with serial: 1, a parsed health check after each, and a block/rescue rollback that stops the rollout. A hello timer change fails and rolls back on the first router, a cost change rolls clean, and a 1 second settle time produces a false pass.
OSPF and eBGP on five IOS XE routers from one vars file, with a parsed pre-check and post-check on every run. Includes a change that bounces every adjacency, the cli_parse retry bug that broke my first wait loop, and the route flap the checks couldn't see.
Three jobs on six IOS XE devices with ansible.utils.cli_parse: a down-interface report, a version and uptime inventory, and a custom TTP template that turns show ntp associations into a compliance rule. Every device passed the config check and failed the sync check.
Five compliance rules checked on six IOS XE devices against group_vars intent, using gathered resource modules and one running config. Injected drift is found, a fix playbook removes it with check mode first, and the recheck passes all 30 rows.
One YAML data model drives VLANs, trunks, access and voice ports and SVIs on three IOS XE switches with the cisco.ios resource modules. Check mode command lists, a changed=0 rerun, an ip routing idempotency trap, and real show vlan, trunk and ping output.
Network device groups, five network devices with a vaulted RADIUS secret, and an endpoint identity group with static MACs on ISE 3.5, all with cisco.ise 3.3.0. Includes the SDK schema mismatch that breaks network_device and a drift test.
Three read only states of the cisco.ios resource modules on IOS XE 17.18: gathered pulls live state into YAML, rendered turns YAML into CLI with no device, parsed reads a saved config. Plus the stale backup and leftover secondary address they caught.
Object groups, an inbound ACL and NAT on an ASAv 9.24, built with cisco.asa 7.0.0 and tested with real traffic. Includes the first login password change that stalls Ansible, a no shutdown that is never idempotent, and what overridden would have deleted.
Nine failures I caused on purpose against an IOS XE router, with the exact error Ansible printed, what it actually meant, and the change that fixed it. Two of them surprised me: a show tech that fails even with a long timeout, and a wrong vault password that still works.
ios_config can save a running config in one task. Getting a Git history you can actually read takes three more: strip the header lines, stage, and commit only when there is a real change. Real runs against six IOS XE devices, including an out-of-band change caught and rolled back.