Ansible for Network Engineers

A network configured by hand has no authoritative description of itself, and everything expensive follows from that: the drift nobody can see, the change that cannot be repeated, the outage that takes four hours to restore because the only person who knew the design has left. This book is about closing that gap. Its central claim is one sentence — make the description of the network the thing that configures the network. Ansible is the vehicle; the techniques are what will still matter in ten years.

WHO THIS IS FOR. Network engineers with no Ansible experience, and network automation engineers who want the parts nobody teaches. You are assumed to know networking. You are not assumed to know Python, YAML, Git, or what a playbook is. It is Cisco-centred by design (IOS-XE, NX-OS and IOS-XR) with Juniper Junos and Fortinet FortiOS appearing where the contrast teaches something worth knowing, which is mostly about commit models rather than syntax.

WHAT IS INSIDE. Part I covers why manual configuration is expensive in terms you can put in front of a manager, what automation does not fix, and a working lab. Part II is Ansible itself: inventory, playbooks, variables and precedence, loops and handlers, roles, and error handling. Part III is where it becomes network automation — connection plugins, credentials without secrets in Git, the Cisco collections, and a full chapter on resource modules and their seven states, which is the difference between a change and an outage. Part IV builds a source of truth and templates that generate a complete device, with drift detection falling out of the same model for free. Part V is operational work: backups you can actually diff and restore from, documentation generated from the network rather than maintained beside it, a nine-step software upgrade that stops at the first device that comes back degraded, and the snapshot-and-compare discipline that belongs around every change. Part VI is three complete projects taken from a stated requirement to a validated rollout: campus 802.1X across 1,600 ports without anybody losing access, a BGP and EVPN data centre fabric with WAN routing policy rendered for three platforms, and a security consolidation across four vendors. Part VII covers running all of it as a team — Git workflow, testing that runs in under a minute with no device, CI/CD with a human at the gate, Ansible Automation Platform, credential separation, and how a practice survives the person who started it. Five appendices give a quick reference, a module cross-reference across five platforms, a lab build guide, a glossary, and the complete repository layout.

NO QUIZZES, EXERCISES. Every sub-section ends with a hands-on exercise containing the complete source code inline: the task, the constraints, a full working solution, the command that verifies it, and an explanation of why it works. Twenty-three stretch exercises have hints and no solution, because the answer depends on your network. Several are designed to find problems no amount of reading will — the restore drill that discovers your backup predates the automation account, the credential rotation that reveals a secret stored in four places, and the independent-run test where a colleague sits at the keyboard and you are not allowed to touch it.

WHAT MAKES THIS DIFFERENT. It tells you what will break: the overridden state deletes what you omit, deleted with no arguments removes every resource of its type, configure replace can cut off your own management access, and a reload has no undo. Each one is demonstrated together with the guard that makes it safe. It shows the failures, not just the successes — a rollout halting on the canary, a deny probe catching a firewall rule that applied cleanly and did nothing, a compliance score of 92 per cent on a model that could not build a working switch. And it is honest about where your time goes: in each of the three projects in Part VI, the automation is roughly a fifth of the effort, and the rest is identifying endpoints nobody inventoried and persuading owners to justify what they own. That is not a failure of automation — it is what automation reveals.

SPECIFICATIONS. 513 pages across 7 parts, 34 chapters and 5 appendices. 50 exercises with complete runnable code plus 23 stretch exercises. 41 original diagrams. Targets ansible-core 2.21 and Python 3.12 or newer. Covers Cisco IOS-XE, NX-OS and IOS-XR, Juniper Junos and Fortinet FortiOS.

A companion volume to Python for Network Engineers.

Network automation does not replace network engineering. It demands more of it, in writing, where somebody else can read it.