Configuring Ansible and Ascender network connections
Automating a Linux host in Ansible takes little more than an inventory entry, but network devices need extra setup. In this short tutorial, Greg Sowell explains why: Ansible normally copies Python or PowerShell modules to a remote host and runs them there, while most switches and routers cannot execute Python at all. Network automation therefore uses local execution, where Ascender issues CLI or API commands from the Ascender server itself, much as an engineer would over SSH.
The video walks through the two variables that make this work. The ansible_connection variable tells Ansible how to talk to the endpoint, with network_cli covering the vast majority of gear such as Arista EOS and Cisco IOS, NX-OS, IOS XE and IOS XR, and netconf or httpapi available for other endpoints. The ansible_network_os variable then names the device platform, and ansible_host supplies an IP address when a name will not resolve.
Using a lab inventory of virtualized Nexus switches and a CSR 1000v, Greg shows where these variables live in Ascender and argues for setting them on a group per device type rather than on each host. Hosts added to the group, including those mapped in from a dynamic inventory or CMDB, inherit the connection details automatically, while host-level variables still override the group when needed.
Key takeaways
- Most network devices cannot run Python modules, so Ansible uses local execution and sends CLI or API commands from the Ascender server.
- The ansible_connection variable, usually network_cli, tells Ansible how to communicate with a network endpoint; netconf and httpapi are alternatives.
- The ansible_network_os variable names the platform, such as ios, nxos or eos, so Ansible knows which command language the device speaks.
- ansible_host is a magic variable that supplies an IP address when the inventory name is not a resolvable fully qualified domain name.
- Setting connection variables on a per-platform group keeps hosts clean and lets dynamically imported hosts inherit them automatically.
- Variables closer to the host generally take precedence, so a host-level ansible_network_os overrides the value set on its group.
Questions this video answers
How do I connect Ansible to network devices like Cisco or Arista switches?
Set ansible_connection to network_cli so Ansible issues CLI commands over SSH from the control node instead of copying Python modules to the device. Then set ansible_network_os to the platform, such as ios, nxos or eos, and use ansible_host for the IP address if the hostname does not resolve.
What is the difference between local and remote execution in Ansible?
Remote execution copies module code to a Linux or Windows host, runs it there and cleans up afterward. Local execution runs from the Ansible or Ascender server and pushes commands to the endpoint over SSH or an API, which is how network devices and cloud services like AWS and Azure are automated.
Should Ansible network connection variables go on hosts or groups?
Greg recommends a group per device type with ansible_connection and ansible_network_os set at the group level. New hosts, including those pulled from a dynamic inventory or CMDB, inherit the settings automatically, and an individual host can still override them because host variables take higher precedence.
About this video
Networking device connections in Ansible can be a little obtuse at first, or at least they were for me! Here's a quick tutorial on connecting to various network elements with ease.
About Ascender: Ascender transforms your IT operations by automating routine tasks so you can focus on innovation and growth, ensuring system reliability and compliance, simplifying your work and enabling reproducibility and scale across your infrastructure.
This video is part of the Ascender Pro playlist. Browse every CIQ video by product and topic.
Transcript
hey everybody I'm Greg Sowell and welcome to another ciq tutorial I say tutorial because I'm not necessarily going to demo anything I'm going to show you some stuff moving around but today I really want to kind of give you an idea of how to get started automated against Network elements so I know it's very simple to automate against a Linux host because you just put their information in there and go right you don't even have to think about it but networking actually requires a little bit of extra work and so I kind of wanted to explain that very quickly short and sweet video so
I'm going to start by looking at my screen over here that's my Ascender we're going to get to that in just a second so there are a couple of execution types inside advanceable you've got local and you've got remote right and so traditionally what we're accustomed to is remote execution right and so that's going to be going against your Linux host your Windows host things like that and essentially what it does is uh Ascender will take you know the modules the Python scripts or you know in the case of Windows it'll take those Powershell scripts it actually copies it over to that host executes
it you know remotely almost said locally executes it remotely on say that Linux host and then it deletes those Python scripts when it's done right so that it's actually remote execution and so remote is from the perspective of the Ascender server right it's pushing that stuff over and and it's executing it over there well a lot of your network elements don't have the ability well I would say probably most of them don't have the ability to actually execute say Python scripts directly on them and even if they could the python versioning might you know be different and so it' be kind of a little bit
uh Troublesome to keep track of so for the most part you're going to be doing what's called local execution so local as in again from the perspective of Ascender local being it's going to fire off commands over to that remote system uh essentially the same way you from the CLI right it's just going to kind of remote into that thing generally over SSH or perhaps an API an API is another example of local execution right so if you are making changes to Something in Azure AWS it's actually going to be connecting to that API so it's considered local execution right it's not like copying
View full transcriptHide full transcript
files over there and executing them in the cloud it's really just going to be performing that from the Ascender server itself so our Network elements are going to be doing local execution now why is that important to know because you actually have to tell it to do that so there is an analore connection variable that you need to modify for your uh networking devices right and so it's really essentially going to tell it how to communicate with those remote resources you have Network CLI NETCOM HTTP API right it just depends on the endpoint you're connecting to on what you need to do and honestly if
you're unsure just do a quick Google and you're going to find the results of hey this is how I connect to this thing but for the most part most of the networking elements I've automated against at least use the network CLI uh connection type and so in your inventory somewhere uh generally you're going to put anore connection colon space Network CLI and it's really just telling it hey this is a device you're going to issue CLI commands to right so it's going to be your Arista stuff your iOS your nexxos your iOS XE or XR um so it's the vast majority of equipment that is
Network specific ific you're going to be doing Network CLI now next you have to tell what the network OS is so essentially you're saying what language do I speak to this thing right is it English French Portuguese Spanish right you have to tell it how to communicate to this thing so you have to know what kind of networking device you're going to be connecting to and you'll say uh the analore network OS variable is IOS right or it's NX or it's EOS right you just essentially tell it how to communicate to this thing and then in our sender uh say in the variable section so
this is kind of a screenshot of a single Host this one is I think one of those virtualized CSR 1000s so it is Doing Network CLI you can see analore connection network CLI you can also see analore host right these are all magic variables all the variables you see here right a a magic variable is one that's just known to anible right it's got a very specific purpose so Ascender knows what to do with this thing like to take it and and utilize it right so anable host is uh instead of trying to resolve the name like if I had the name up there
in the name spot as a fully qualified domain name it would just resolve and Bob's your uncle we're done uh instead _ host is specifying the IP address that's going to connect to this host with um again analore connection network CLI right so we're going to be doing CI is commands and then the Network OS iOS now in this one the crr 1000 I'm using is kind of old and so it has some old hashing algorithms that it'll actually um enciphers that it will connect with over SSH so I add a little bit of extra information to make that work most of the hosts you
connect into and operate against this is not a problem but just understand that you can actually do this if you need to so let me pop back over to my Ascender I'm going to go into my inventory toies and so while all this stuff uh is true in a sinder it's also true on the command line I just prefer to do everything inside of a cinder because honestly it makes my life so much easier and it's less to keep track of and I've got enough of that stuff going on so I'll take uh a shortcut whenever I can so I've got all my inventories which are big list of all the hosts I can
potentially operate against I'm going type Network I've got a network lab one here so before in the uh the slide example that was like a rr1000 I've also got some virtualized Nexus hosts so I'm going to come into the host section here I can see all of my Nexus switches I'm going to pop into this one right here and you can see all I have is an analore host right that's that's curious like you would think that you would see the network um OS type specified here as well as the CI well I can put it for each individual host or I can do something
a little bit more flexible and I can actually add it to a group so you can see all these are part of the Nexus group and so if I go into the groups tab instead and I click on Nexus I can see that I've actually configured the uh anore connection and network OS right here for these hosts and so I'm a big proponent of if you are doing networking devices right you have a group for each type of device right whether it's iOS n xos EOS those various things and then you can put those connection variables right here inside of this right it just it
keeps the individual host a little bit cleaner as well as any host that you add to the system add of that group they're automatically going to inherit that stuff and that can be extremely valuable when you are say pulling your inventories from a dynamic inventory Source right you've got some cmdb configuration management database whatever that looks like I mean it it could be like a CSV file that you're importing into the system whatever it happens to be but you're going to map those hosts dynamically into groups and if you already have these connection information on those groups right they're just immediately going to be able
to be connected to right it just it's going to make your life so much simpler so I'm not saying you have to to me it's a good practice on the group itself add those connection specific details now keep in mind any variable I specify here say anible Network OS if I actually specify that on the individual host as well and change it to something else that will override it keep in mind variable presence the closer generally not always but generally the closer you get get to a host uh the higher the Precedence level is right so it does give you the ability to put in
a group big generic sweeping configurations uh or variables I should say and then the individual host can get more granular if you need to so I hope this kind of bridges the gap for connecting to your network devices honestly um this was kind of a weird gotcha for me when I very first got started using anible and this is the vast majority of oddness that I had to get through so really it's going to be the analore connection and the anible network OS those are going to be the two big things that you're going to have to uh think about and uh make sure you
account for well if you have any questions or comments I would love to hear them if there's anything else you'd love to see demos on I'm here and available this is my job so please uh please help me keep feeding my family uh if you want help with any of this stuff please reach out to us so we do do some Services we also sell support on Ascender here right Enterprise class uh automation system we're happy to do all that stuff as much or as little as you would like so thanks uh Happy automating Happy uh Network automating and we'll see you next time
bye
Built for scale. Chosen by the world’s best.
2.75M+
Rocky Linux instances
Being used world wide
90%
Of fortune 100 companies
Use CIQ supported technologies
250k
Avg. monthly downloads
Rocky Linux
9
Enterprise products
Spanning the kernel to the orchestrator
Have questions about your infrastructure?
Talk to a CIQ engineer about Rocky Linux, HPC, and AI infrastructure.