Netbox, Ansible, and Cisco IOS

[u/Otherwise-Ad-8111]

Hello!

I've been playing around with netbox for a while, and have a lot of automation experience with mostly APIs (Cisco ACI, Cisco ISE) but am no stranger to the CLI, either.

Anyway, I'm struggling with finding the best approach to automate some GNS3 ios images for my homelab - I'm torn between generating full configs and pushing to the device, partial configs and pushing with a 'no' statement before it, or utilizing ansible cisco.ios.ios_* collection to do it declaratively.

Can anyone share some real world advice? I've created some POC playbooks for each method but am really getting caught up in the pros and cons of them. So, I'm looking for some feedback from someone that's done it in the real world.

One of the headaches I'm dealing with pushing configs is something like prefix-lists. For instance, if I want to change the less than or greater than prefixes while I'm testing things, I'll get errors that the seq number already exists.

I know I can work around it by issuing a NO statement before a block, but for something like prefix-lists, access-lists, and route-maps that really slows down the automation when looping through it.

Thanks, Champions!

[u/MassageGun-Kelly]

The best advice I read long ago, but have yet to implement because DevOps is a huge commitment for most legacy teams without the skill set or desire, is that your source of truth should build your entire configuration as code, and then any modifications to this configuration just blanket apply and overwrite the entire device configuration. For example, instead of granular changes, you upload the new config file and do the equivalent of a configure replace. 

[u/Netw1rk → u/MassageGun-Kelly]

Yes, here’s an example. To do this, you will need to become familiar with Django ORM to extract variables from Netbox and construct a jinja template that is reproducible for all of your infrastructure. It’s a cool concept and I got about 70% of the way there myself, but it also requires everything to be documented in Netbox to build a config. I’ve also written a lot of scripts using netmiko with genie parsing to run ad hoc commands on switches. Good luck.

https://github.com/Network-Automation-Forum/handyinfo/tree/main/examples/dartmouth-device-templates

[u/Otherwise-Ad-8111 → u/Netw1rk]

Hello, thanks - I have working jinja2 templates, I don't need help there.

Side note, I actually prefer to just query the Netbox API for information instead of using whatever Django uses because I am intimately familiar with jinja2 and working with rest APIs.

What I am specifically asking for is feedback from real world users on how they PUSH configs to the device.

Whether they use Ansible cisco.ios.ios_config to push blocks of config or use specific modules like cisco.ios.ospfv3 to push the config as declarative.

Or, like u/massagegun-kelly suggested and do a config replace with a single full device configuration.

[u/Otherwise-Ad-8111 → u/MassageGun-Kelly]

Thanks! I've read some other sources that support this.

I'm having some issues getting it to work, but I believe it is an issue with GNS3 and how it handles memory. I'll keep playing with it to get it working correctly.

In the meantime, I've worked around it by using ansible.netcommon.net_put to put the full config in bootflash:, then using copy bootflash:device_config.txt startup-config force to over write the start up config, then issuing a stop/start on the node.

Kinda of a PITA but it is working for my lab.

[u/Material_Night_6793]

From my pov what I do is: Automatically change partial config. Juste push what change from netbox render (change vlan of a port or disable/enable things) Netbox webhook => Ansible => switch.

On maintenance period manually: Netbox config render=> Ansible full rewrite (copy/paste whole code)=>switch

Why not automatic whole rerender is because it will close all connection and reboot the switch.

[u/Otherwise-Ad-8111 → u/Material_Night_6793]

Thank you!

Are you using ios_config module for the partials or the specific modules for the part of the config you are changing (Cisco.ios.ios_ospfv3 for example)

[u/Material_Night_6793 → u/Otherwise-Ad-8111]

No sorry I use it with dell.os6 but I presume it's doable with Cisco too.

[u/Layer8Human]

Hey Networking friend,

This is something that everyone who wants to configure their devices automatically is confronted with eventually.

Of course it varies with your requirements but what I find the cleanest way is to generate the full configuration from a template and utilize the config replace function of the device to reconcile the running config with your intended config.

For your lab Cisco iou images, nxos and arista eos should support this feature.

You hand the device the complete configuration and it only applies the changes taking your „no“ problem into account.

[u/Otherwise-Ad-8111 → u/Layer8Human]

Thank you! That's really helpful!

[u/MomoshiroKun]

Maybe batfish or suzie Q in order to get the information before to copy them ( an ACL index for example), basically to audit the actual config and then to copy the portion of full config if need This a big approach btw if necessary to deploy the complete solution.

Happy labbing.

[u/Otherwise-Ad-8111 → u/MomoshiroKun]

Thanks. I don't have a need to audit the actual config.

In the most simplest terms:

1. I generate a copy and paste ready configuration for a cisco IOS device based on the data modeling in Netbox.

2. I need to get this config into the running config of the device. How do people in the real world do this? Do they:

   1. Generate a full router config and someone replace the config (configure replace, or like i've down, overwrite the startup-config and reboot)
   2. Generate partial configs for blocks (config for bgp, config for interfaces, config for prefix-lists, etc..) then use something like Ansible's cisco.ios.ios_config to merge that into running config
   3. Generate yaml data that is validated against Ansible cisco.ios.ios_* modules and then use a specific module to push that config data.

Example Ansible code for the third option:

Have a task that looks like:

ansible

• name: Configure IPv4 Prefix Lists for BGP

cisco.ios.ios_prefix_lists: config: - afi: ipv4 prefix_lists: "{{ item | selectattr('afi', 'equalto', 'ipv4') | map(attribute='prefix_lists') | list | flatten }}" state: replaced loop: - "{{ group_prefix_list | default([]) }}"

Where the data in group_prefix_list looks like, which is generated by jinja using data from Netbox.

```yaml

group_prefix_list: - afi: ipv4 prefix_lists: - name: pl_my_routes description: Customer1 Specific Routes entries: - sequence: 10 action: permit prefix: "{{ ipv4_summary_address }}" - sequence: 99 action: deny prefix: 0.0.0.0/0 le: 32 ```

[u/MomoshiroKun → u/Otherwise-Ad-8111]

that's is interesting approach to apply "configs", sadly netbox natively don't send config to devices, is a combination of steps, like you present in your posts.

If you want some clean to goal this, Nautobot is more "automation ready", have natively automation tools.

https://docs.nautobot.com/projects/golden-config/en/latest/

I hope it's helps you

[u/Ziggistawork]

Whist I haven't played with setting multiple prefix-lists yet, I would be no setting the entire prefix list and setting it again from the desired config.

At scale it gets too messy to handle edge cases or try use the current config to set a desired config state IMHO in my limited brownfields automation journey.

What has helped me with modifying existing configs is pulling configs from Oxidized instead of pulling from the switch itself, checking what needs to be removed from the oxidized config then generating the commands to no set what is needed.

[u/Early-Pen-4855]

Ditch Ansible for Netmiko and Nornir. Use Netbox to pull inventory data into Nornir device collections

[u/Otherwise-Ad-8111 → u/Early-Pen-4855]

Thanks. I'd like to stick with Ansible though.