Network Programibility with Python and Ansible

A network configured by hand has no authoritative description of itself, and everything expensive follows from that: the drift nobody can see, the change that cannot be repeated, the outage that takes four hours to restore because the only person who knew the design has left. This book is about closing that gap. Its central claim is one sentence — make the description of the network the thing that configures the network. Ansible is the vehicle; the techniques are what will still matter in ten years.

WHO THIS IS FOR. Network engineers with no Ansible experience, and network automation engineers who want the parts nobody teaches. You are assumed to know networking. You are not assumed to know Python, YAML, Git, or what a playbook is. It is Cisco-centred by design (IOS-XE, NX-OS and IOS-XR) with Juniper Junos and Fortinet FortiOS appearing where the contrast teaches something worth knowing, which is mostly about commit models rather than syntax.

WHAT IS INSIDE. Part I covers why manual configuration is expensive in terms you can put in front of a manager, what automation does not fix, and a working lab. Part II is Ansible itself: inventory, playbooks, variables and precedence, loops and handlers, roles, and error handling. Part III is where it becomes network automation — connection plugins, credentials without secrets in Git, the Cisco collections, and a full chapter on resource modules and their seven states, which is the difference between a change and an outage. Part IV builds a source of truth and templates that generate a complete device, with drift detection falling out of the same model for free. Part V is operational work: backups you can actually diff and restore from, documentation generated from the network rather than maintained beside it, a nine-step software upgrade that stops at the first device that comes back degraded, and the snapshot-and-compare discipline that belongs around every change. Part VI is three complete projects taken from a stated requirement to a validated rollout: campus 802.1X across 1,600 ports without anybody losing access, a BGP and EVPN data centre fabric with WAN routing policy rendered for three platforms, and a security consolidation across four vendors. Part VII covers running all of it as a team — Git workflow, testing that runs in under a minute with no device, CI/CD with a human at the gate, Ansible Automation Platform, credential separation, and how a practice survives the person who started it. Five appendices give a quick reference, a module cross-reference across five platforms, a lab build guide, a glossary, and the complete repository layout.

NO QUIZZES, EXERCISES. Every sub-section ends with a hands-on exercise containing the complete source code inline: the task, the constraints, a full working solution, the command that verifies it, and an explanation of why it works. Twenty-three stretch exercises have hints and no solution, because the answer depends on your network. Several are designed to find problems no amount of reading will — the restore drill that discovers your backup predates the automation account, the credential rotation that reveals a secret stored in four places, and the independent-run test where a colleague sits at the keyboard and you are not allowed to touch it.

WHAT MAKES THIS DIFFERENT. It tells you what will break: the overridden state deletes what you omit, deleted with no arguments removes every resource of its type, configure replace can cut off your own management access, and a reload has no undo. Each one is demonstrated together with the guard that makes it safe. It shows the failures, not just the successes — a rollout halting on the canary, a deny probe catching a firewall rule that applied cleanly and did nothing, a compliance score of 92 per cent on a model that could not build a working switch. And it is honest about where your time goes: in each of the three projects in Part VI, the automation is roughly a fifth of the effort, and the rest is identifying endpoints nobody inventoried and persuading owners to justify what they own. That is not a failure of automation — it is what automation reveals.

SPECIFICATIONS. 513 pages across 7 parts, 34 chapters and 5 appendices. 50 exercises with complete runnable code plus 23 stretch exercises. 41 original diagrams. Targets ansible-core 2.21 and Python 3.12 or newer. Covers Cisco IOS-XE, NX-OS and IOS-XR, Juniper Junos and Fortinet FortiOS.

A companion volume to Python for Network Engineers.

Network automation does not replace network engineering. It demands more of it, in writing, where somebody else can read it.

You already know which parts of your job a computer should be doing.

The interface audit across three hundred switches. The pre-change capture nobody has time for. The inventory spreadsheet another team swears is the source of truth. You have thought "I should learn Python" more than once, opened a tutorial, found yourself sorting a list of fruit, and closed it again.

This book never does that. Every example is network data — show output, interface tables, inventories, IP plans — from the first variable to the concurrency chapter that reaches four hundred devices without waiting four hundred times.

Who this is for

Network engineers who have never programmed. If you can read a running configuration and you know what SSH is, you have the prerequisites. There is no computer science here, and no assumption that you have written code before.

What you will be able to do

•      Install and configure Python properly on Windows, macOS or Linux, including virtual environments and pip — explained, not copy-pasted

•      Read, reshape and write network data: variables, lists, dictionaries, loops, functions, files, CSV, JSON and YAML

•      Connect to devices with Paramiko and Netmiko, parse output with TextFSM instead of fragile regex, and handle the failures that appear at three hundred devices but never at three

•      Ask the same question of Cisco, Juniper and Arista through NAPALM, and reach for Nornir when a for loop stops being enough

•      Talk to controllers and platforms over REST and RESTCONF, and to devices over NETCONF with ncclient

•      Generate configuration from Jinja2 templates, keep a golden configuration, and detect drift before an auditor does

•      Automate the work that never touches a device: inventory reconciliation, IP address maths with ipaddress, Excel reporting with openpyxl, credentials pulled from KeePass

•      Use AI properly — the Claude and OpenAI APIs, a model running on your own machine, and the prompt patterns that produce network scripts worth keeping rather than confident nonsense

•      Put your scripts under version control and test them, so your automation does not become the next outage

What is in the book

•      632 pages, seventeen chapters in five parts, plus three appendices

•      Part I — Getting Set Up. Why Python belongs in your toolkit, installing it on every platform, and the editor, virtual environment and lab you will work in

•      Part II — The Python You Actually Need. Variables, collections, conditionals and loops, functions and modules, files and structured data, and parsing device output

•      Part III — Talking to the Network. SSH with Paramiko and Netmiko, REST and RESTCONF and NETCONF, then NAPALM and Nornir at scale, with concurrency, retries and credential handling done properly

•      Part IV — Templates and Real Use Cases. Jinja2 configuration generation, golden configs and drift detection, and the off-box automation that needs no lab at all

•      Part V — AI and Where to Go Next. AI APIs and local models, prompt patterns for network scripting, version control, testing and where to take it from here

How it is written

Every listing is complete and runnable. Nothing is left as an exercise unless it is meant to be, and the code is commented for someone who has never programmed — but only where something is new, so the listings never turn into noise.

Each chapter ends with Hands-On Practice, and every one of those exercises has a worked solution in Appendix A. There are no quiz questions: this is a course, not a certification guide.

Examples are Cisco-first, with Juniper and Fortinet shown wherever the difference actually matters.

The book also ships with a glossary, a quick reference for Netmiko, NAPALM, Nornir and Jinja2, a full index, and a clickable table of contents in the PDF.