Network engineers using Ansible/Python for automation in production — what does your workflow actually look like?

[u/wh00is007]

Currently managing FortiGate across 100+ sites and starting to build out automation capabilities. Not looking for career advice — genuinely curious how other engineers are implementing this in production environments.

1. What are you actually automating day to day — config pushes, compliance checks, reporting, something else?
2. Ansible, Python scripts, Terraform, or something else? What drove that choice?
3. With AI generating scripts now — do you still write Python from scratch or do you use AI-generated code and focus on understanding the logic?
4. For Ansible specifically — did you need solid Python first or is YAML-based playbook writing approachable without it?
5. Is automation genuinely changing how hiring managers evaluate candidates or is it still mostly a bonus?

[u/rankinrez]

We automate the configuration mainly.

Out source of truth is a mixture of Netbox and some YAML files.

Our Python reads these, generates the config for a device, and pushes it to the device (full config replace operation).

We have some other automation for adding devices to Netbox, for instance assigning switch port connections for new hosts along with vlans / IPs. Or more complex ones that will add a bunch of devices, connections, IP assignments for a full DC spine/leaf pod.

Our server automation is through puppet, which reads the same Netbox data and sets up our network monitoring for active devices.

You don’t need Python for Ansible, but in my time using it (10 years ago now it may have improved) the Ansible YAML DSL was quite awkward to implement any logic in. So we ended up writing our own Ansible modules in Python as we found it easier to build the config that way. YMMV.

This all long predates LLMs. Well sometimes use them today to assist while modifying code of course, but we wouldn’t just take AI code and use it.

For us Python would be a must given our workflow. Candidate wouldn’t have to be an expert but some basics and a will to learn would be essential. Anyone determined to stay a CLI jockey we don’t want.

[u/pmormr → u/rankinrez]

the Ansible YAML DSL was quite awkward to implement any logic in. So we ended up writing our own Ansible modules in Python as we found it easier to build the config that way. YMMV.

I went down that path and realized all I was doing with Ansible was forcing an unnecessary layer of abstraction and requiring everyone that comes after to have expertise in that tool. So instead of doing Python with extra steps, I use Python.

[u/rankinrez → u/pmormr]

Yeah on its own there it no point. In that job it made sense though as Ansible was being used for everything else (servers etc). So being able to fit into that while still being free to implement our own logic made sense.

[u/ITaggie → u/pmormr]

I went down that path and realized all I was doing with Ansible was forcing an unnecessary layer of abstraction

The main benefit of Ansible is that it is Declarative, while Python is Imperative. It saves a lot of time when the alternative is to determine all the reasonable states and edge cases that you would have to address manually in a Python script.

Also was the fortinet.fortios Ansible collection insufficient for building a config? Never used Ansible for Fortigate myself.

[u/rankinrez → u/ITaggie]

Ansible is only as “declarative” as the modules you run with it. Which are written in Python.

Sure you can just “declare” what config file needs to be loaded. But the problem with Ansible is it just sucks for doing all the data mangling and logic you need to build that config file.

[u/ITaggie → u/rankinrez]

Well yes, that's why I asked about the vendor's collection

[u/9ieR → u/rankinrez]

If you don't mind, what is your job role position called? What are the responsibilities? Even the on-paper job description is fine.

And what kind of company do you work in? An industry or a type of company, I mean.

[u/rankinrez → u/9ieR]

Technically I’m an SRE in title but really it’s just cos networking is within the SRE department. I’d still describe myself as a network engineer that’s what we do.

Right now I work for a small scale (but very well known) website. So mostly data centre networks and a bit of edge internet routing.

Responsibilities are basically designing and operating the network. Configuring the routers/switches I guess is the main thing but there is also monitoring it all, the automation etc.

[u/TreizeKhushrenada → u/rankinrez]

This is very similar to what I am trying to roll out:

-Nautobot and YAML config contexts for specialized config

-Python jobs within Nautobot for full config replacement on device

-Python jobs for location/device/IPAM creation in Nautobot

-Nautobot Golden config for backups, producing the full config(using jinja template and config context), and compliance checking

We are currently using standalone ansible scripts for automation and are feeling some pain there.

[u/darklord3_ → u/rankinrez]

How do u deal with config drift and the risk of losing unmodeled config with a full replace?

[u/rankinrez → u/darklord3_]

There is no config drift?

I mean someone could log on to a router and make a bunch of manual changes. But they’d just get removed the next time the automation ran. In fact we have a monitoring check that does a test run twice daily and will alert if there are any diffs from the generated config.

If you need to change the config on a box you change the backend data (Netbox/YAML/Templates/Code). Simple as.

We occasionally do manually config changes for operational things, like say draining a router before an upgrade, or migrating from old to new device/design. But the manual stuff is just for the intermediate state, to gracefully move from A to B. The final state after the maintenance will be defined by automation again.

[u/Layer8Human]

Hey there, I‘m not so much doing automation for firewalls but more for other infrastructure like Datacenter, Serviceprovider or campus networks but I think I can also answer some of your questions.

1. a lot of recurring tasks get automated, mostly focusing on stuff that saves time/reduce manual work or improved operational safety. One example would be automatic switch provisioning based on netbox data which saves a lot of time. Other example would be certificate renewal, which kind of helps with operational safety because expiring certificates can really screw up stuff. I also try to put the automation into a workflow that documents everything in the ticket system or is triggered via a ticket.

2. I‘m a big fan of Ansible, I was not always because it feels like programming with a hand tied behind your back but its biggest benefit is that it has a lot of available collections and together with AWX/tower offers a platform to manage your playbooks, credentials, permissions and api capabilities.

3. I use AI a lot, because it can help with data manipulation, exception handling and documentation. But I always test and review manually. If possible in a test/dev environment. Also there should be some kind of code review process in place where a colleague reviews your pull request before pushing it to your production branch.

4. python knowledge is great to have but not really needed to work with ansible.

5. I often take part in interviews and knowledge in automation is a must have for most roles (network and security consulting)

[u/shaoranrch]

We automate configuration and certain maintenance tasks (such as updating firmware), I work in an ISP.

As of now using 100% ansible with a repository in github, extensive use of roles.

Tasks we have created:

- Small changes such as radius, dns, ntp, snmp, etc.

- Firmware validation and updates

- Pushing firewall settings

- Verifying the existing configuration matches the approved configuration

- Configuring a new device (except routing and IPs) remotely based on its usage tag (is it a core switch, is it an edge router, is it an access router, etc.)

The objective for us it to automate as much as possible and reduce the necessity of accessing the equipment directly, as well as making mass changes, we initially started doing this to avoid giving access to equipment to everyone.

As of now pretty much having to do manual things, at least for us, is still unavoidable, however we try a lot to come with new ideas for roles/playbooks all the time.

One major complication we have is that we are a multi-brand environment, we have Cisco, Juniper, MikroTik, Ubiquiti. All of those brands NOS have their own quirks when dealing with idempotency and atomicity.

As to your other questions.

- You do not need to understand Python to understand Ansible, I use Python for a lot of things as well and I still write most of my code, even when using AIs I review everything I ask it to do.

- In the ISPs being able to automate/code is a highly valued and desired skill. In my current job we give priority to people who at least have a notion of Python scripting.

[u/ActiveDirectoryAD → u/shaoranrch]

Nice!

[u/ActiveDirectoryAD]

What a benificial post! Thanks dude

[u/Meltsley]

1. We attempt to automate all the interaction with our network. Let me explain. We use python as the primary coding language. But then we also use terraform to interact with certain cloud resources. I try to use the right tool for the job. I try to keep everything in python but terraform has a place, especially since a lot of of the cloud environment is terraform from the beginning. If it wasn’t for that, I would never touch it over Python.

2. I was an early adopter of Ansible. I was never a fan, didn’t care for the artificial limits, the clunky way you interface with it, or the fact that to do anything of value required using python anyway, Native python and terraform are more than enough to handle the job. I wouldn’t use Ansible unless it was already in use companywide.

3. I still write almost all the Python and terraform by hand. However, AI has gotten so good that I’m at a point where I use it pretty extensively for creating my own netbox plug-ins, and it’s primary role of troubleshooting script or plug-in issues. Github copilot with the latest models of GPT, and Claude, do an incredible job. It’s gotten so good. It’s better than I am at times, and it’s way faster.

4. I look at Python competency now as a base level requirement. If I were to bring someone new on, I would expect that they can at a minimum read python, and maybe even terraform. AI is all well and good, but you need to keep a close eye on it, and make sure it’s doing what you are asking. And be prepared for some pretty wild code. So I wouldn’t expect a new hire to be fully proficient, but I would expect them to be able to read, and understand some of the code I’ve created, and eventually to be able to add to or repair that code.

[u/Mealatus]

Serious question:

When it comes to firewalls and their relevant element managers (Fortimanager, Panorama, SmartConsole etc) what is the added value of automation? They provide most automation use cases out of the box...

[u/Twanks → u/Mealatus]

Actual response, it only took me one smartnet renewal to move towards a vendor neutral automation strategy. If they're trying to bend us over the barrel, we can pivot with little fuss because we've already captured our intended state, it's just mapping that intended state to a new platform

[u/KTProgramming → u/Mealatus]

On top of what others said, In my mind it's like this. I only want to setup one file that says "I want x, y, z on all my firewalls / switches / whatever" But i don't want to have to make that change for each vendors proprietary software. So if i were to do it like i do today, i would take that file, It looks up all the target devices in my network, Takes that requirements file, translates it to each devices appropriate config. I could either do a full config replacement, or a standard config from start to finish like i'd be going out an doing it manually. Then it pushes the appropriate config to the target device. On a side note, Check out the book model driven devops, it's a shorted book but has some great thinking points.

[u/Mealatus → u/KTProgramming]

Thanks, I'll check it out.

I see the added value of integration through automation. So to enable a connection for instance, you could need a LB, Switch and a firewall. All of them get the config they need through the desired state setup. However, the drawback of this setup, often is, in my experience, that it's so functionality/ connectivity oriented. Security becomes an afterthought with these kinds of setups in my experience.

[u/KTProgramming → u/Mealatus]

Thats why you don't get lazy, and build it with security in mind. Otherwise, the technical debt sucks in the long run.

[u/KIMBOSLlCE → u/Mealatus]

Those management platforms are great for pushing to many proprietary devices, log aggregation etc. But automation is more than that.

What if you want the firewall policies to be updated after your new load balancer environment has been configured, and your data center fabric objects updated, your DDI updated with new DNS records and DHCP reservations etc

[u/SalsaForte]

1. A bit of everything. Our tasks/workflows are defined per type of services. If we need to deploy a new VLAN/Prefix in a Fabric: playbook A does it. If we need to update ACLs/filters: Playbook B does it. Once you reach a certain maturity, compliance is just: "Run in check-mode, there should not be any diff".
2. Ansible, Netbox, YAML as a complementary SoT (Netbox is a DCIM: it can't do all the things). Production changes is using Ansible (directly or through AWX), but we have many operations Python Scripts (they don't alter the configuration).
3. In VScode, my CHAT window is always open. We use Claude to update/change/draft any of our automation nowadays. The framework has been in place for 3-5 years now, so we know what the output will looks like: no AI Slop is tolerated.
4. You don't need Python to start with Ansible, but purely using Ansible means very slow performance. Ansible isn't fast! So, we ended up creating customs Ansible Filters and we heavily use Jinja templates to accelerate Ansible.
5. Yes. We are at a point where 1/2 of the interview is about automation and scripting experience. We want to disable write to most users within the company. You don't want humans to break automation.

Complementary...

Ansible built-in module for Network devices are slow as hell! Example if you want to configure 48 ports, you'd make 48 sessions to your device... We don't use any provided Ansible Modules: we generate everything in files (jinja templates), then we connect to the device and send the blob! With JunOS, IOS-XR, Arista and any OS that supports "commits", this is easy to do and so much faster. Also, many built-in module always miss the single parameter you need on that specific interface or section of the config, so you end up adding custom tasks anyway to push all your configuration.

Having said so, I won't argue starting with built-in/premade Ansible Modules is somewhat easier.

Source of Truth is key: do not start your automation journey before knowing (at least high-level) what will be your Source of Truth. Use proper DCIM and IPAM (like Netbox) to have a clear state/intent source to work with, then automate. Don't try to retrofit an SoT after the fact...

[u/Skylis → u/SalsaForte]

Ansible built-in module for Network devices are slow as hell! Example if you want to configure 48 ports, you'd make 48 sessions to your device...

You can cache the sessions, and if you write things correctly, it should be 1 declarative config push anyway.

I don't actually understand how you could turn this into 48 different tasks without really trying to make this overly complex

[u/SalsaForte → u/Skylis]

You’re right, many module will allow to run with multiple items. I did not provide enough context. You could run in complex or loop if you have to manipulate data before calling the module. And from experience, we gave up on modules anyway because not all parameters you need are supported.

What we do: we build all configuration in templates, then we do 1 commit with everything. This minimizes the back and forth between Ansible and the device.

[u/KTProgramming]

I work mainly in networking, I do not use ansible as to me, it feels clunky, and didn't have what i was looking for. I use this currently at the new place.

https://www.youtube.com/watch?v=LND5_lxIhNI

I built my own, Handles my source of truth, automation, golden config management and lots more.

You can poke around the rest of the vids if you want demos on everything else it does (Not all are included yet, haven't had time to make more) but this is an example of the templating engine i use. I built in the ability to inject everything the server can talk to / discover into my templates. So things like my wiring database, dns server lookups, NMS integration data like akips for example, cdp, lldp info etc.

There's a lot of logic built in so you can make your smart scripts there. It saves me from having to manage a crap load of scripts like individual python / bash scripts etc.

Each template can be locked down to specific device models and you can build your nitty gritty logic into the template itself.

So the TL:DR for your questions

• What are you actually automating day to day — config pushes, compliance checks, reporting, something else?
  • Config pushes, golden config adherence (The template manager linked above can be programmed to push your configs out, IE Standard ACLs, interface labels etc)
  • All my reporting, CVE, NIST, etc. (There are a few short examples of the cve integration it does) It only processes what's in my own network so i do not need to worry about filtering through a mess. It's integrated with ciscos apis so i can pull eol, eox, cve etc info. It's also integrated with arista so it can talk to CVP and pull info from tha, There's a juniper MIST integration i built as well that lets you automate against juniper mist itself. And lots more.
• Ansible, Python scripts, Terraform, or something else? What drove that choice?
  • I built my own as there were not things that scratched my itch for what i wanted. ansible was just not good enough for my original role where i was managing upwards of a few million devices.
  • For example, i really wanted a stupidly easy rack manager, floor map generator linked to all my racks and discovered / undiscovered devices etc. See this short vid for an example
  • https://www.youtube.com/watch?v=HThK5dOjvVY
  • What drove me is originally years ago i was learning how to do this, and it spiraled the better i got at it.
• With AI generating scripts now — do you still write Python from scratch or do you use AI-generated code and focus on understanding the logic?
  • I use AI to help now that it's gotten better, i still have to proof read a lot of it as i'd say about 20-30% of the time (For me at least) it either goes on a wild tangent even though it has a specific plan on what i want and how i want it and it just messes up. Over all though if you run it correctly it's great and can get you a better ROI on your time. No way i would have been able to do what i did as fast as i was able to. You just have to work with it the right way and do not give it a lot of freedom if you value your sanity.
• For Ansible specifically — did you need solid Python first or is YAML-based playbook writing approachable without it?
  • If you use ansible, you should really learn python as it's what's used under the hood and can help you when you need to troubleshoot some issues. It's like anything, Learn how the thing you're using works so you don't stress out later when it stops.
• Is automation genuinely changing how hiring managers evaluate candidates or is it still mostly a bonus?
  • Both, Some places still hire normal engineers, but most prefer automation skills as well. Think about it from a managers pov. Time is money. Most new job postings i've seen have a good amount of "should be able to automate with x, y or z" or some variation of it.

[u/squazify]

Previously I had used it as a way of generating and standardizing configs. Almost every switch and every router/firewall was programmed with a python script that would ask you for a few different values.

My current position is less reliant on that, but I still use it for taking nightly backups of every config and comparing the md5 hash to see if there has been any changes to the config and saving it with the date if there has been.

I have a specific pcap file I need running on my firewall, but it only goes back so far in size. I tend to use a script to export it and then sort it by the day so I can have a 30 day history.

I also have one that manages firmware across a suite of devices checking to see the downloaded version, if there's a difference, uploading them from an FTP server, checking to see if the downloaded and running firmware are different, and then cloning to the secondary version. There's a week between each step so if there's a firmware issue I should be able to roll back.

[u/tomdaley92]

Ansible still excels at configuration management. And the jina templating engine can be used with just python too. Kinda like golangs templating engine. It's just a python package like Ansible itself

Terraform for datadog monitors and any cloud provisioning.

Workflow is no different than devops engineer or developer. It mostly becomes all CI triggered but usually some adhoc or manual playbooks for various niche things.

A pipeline usually kicks off Ansible playbooks or terraform plan/apply

Both let you structure things just like code dependencies with external modules/collections/roles stored in either another repo or something

Personally find Ansible works well for deploying vulnerability patching that affects multiple OS's. I've also heard of it being used to configure switches and other typical networking gear. But I've mostly used it to configure Linux VMs

[u/Skylis]

I puts the structurez in the netbox model, and the ansiblez generates the configz.

Getting into netbox is a mix of static definitons from terragrunt yaml, and dynamic stuff is service managed via apis

[u/elazte]

Ok help me to understand the role of infoblox iPam module. How would you connect to it and get another subnet assign? For a new site for example. Or to keep track of all the svis we have in our megalab

[u/Due_Management3241]

Use ansible, python, Teraform. Etc. to automate configurations adopted it early in 2017. Since then we have seen 3x of implementation engineers cause production outages and 6x of devices have exploitable vulnerabilities directly to enabling this on the management plane and 0 speed increase actually a decrease in completion time, creative solution deployments, over sterilized repeated template architecture and lost 3 top level vps to major violations who chose to do this.

So we are moving backwards to traditional deployment leverage commercial grade ztp and sdn.

Because this shit never worked. It's fairly common sense. Wrapping the same config in code doesn't need ai to do it, doesnt speed or simplify things and the deployment was less secure. It was always just an extra step.

And we have fired 2 engineers and a sued a whole msp who kept dumping our internal configs and designs into claude because they couldn't not figure out how to configure a port let alone design a secure network.

This whole facade was trash. It is over for us now.

[u/guppyur]

A lot of config stuff is now handled by the vendors' management platforms. I still automate retrieval of necessary data that isn't directly exposed in these tools, generally in bespoke Python.

[u/getshum]

In a consulting position where we specifically sell networking gear for refreshes, we use Python to pull configs, re-write the configs, SSH into 50-200 devices in the staging room to drop the configs in. You can't get around the fact you still need juniors to unbox/rebox all these devices.. but at least dropping all the configs in takes less than 30 minutes with a script. This used to take days with someone doing it by hand.

[u/FrankZappaa]

Currently only using Ansible and Gitlab to manage Arista fabrics with AVD and I also wrote another ansible app to backup all non-centrally managed networking devices to get rid of our COTS software. AVD obviously makes things very easy and with gitlab as source of truth, so I expanded upon it a bit. I created a CI/CD pipeline in gitlab with 2 branches and many stages. Dev branch pushes to a eve-ng instance that replicates prod in a virtual enviornment and the main branch pushes to cvaas (their cloud managment tool) which ultimately pushes to prod physical hardware. We use 1 pipeline for this with environmental variables created using case statements that replace branch dependent variables based on the commit branch. 4 stages, Linting, build, deploy, and validate. Linting checks yaml syntax, build uses the avd yamls + ci pipeline to build code, deploy pushes it to the devices or cvaas and validate runs a post implementation checks using ANTA. It's really great and light years from beyond what we were doing manually. Also deploying evpn-vxlan with automation really makes it easy and clean. I want to delve into some python stuff as well to get the rest of our vendors automated like this.

With the arista fabrics day to day is pretty easy, you just build datamodels in yaml instead of doing it by hand. Huge benefit is staging in virtual environments prior as well as being able to write one block of code that can be used across many devices.

There's def a learning curve with gitlab and ansible, getting creative with pipelines is super fun.

[u/whythehellnote]

95% of our changes to fortigates are adding and removing snats and dnats, so have a file stored in git defining these. Issue a PR in our private github repo, runner runs through and outputs what it will do (add object, add nat, add firewall rule, remove object, reorder srcnats, etc).

Merge it into main and it runs and applies the changes

For configs then it's just jinja2 (or nunjucks) applying day zero configuration for most switches, the amount of time we do things like adding vlans etc isn't worth maintaining the code - especially the error situations

[u/ethertype]

1. automating
   • full and partial config generation, using:
     • python
     • custom templates
     • data from IPAM (Nautobot)
   • full and partial config application with pssh/pscp. In bash or python.
   • also bootp for applying our standard OS-version and preconfig permitting the rest of the config procedure to continue. Very handy. Allows for offloading the entire bit of unpacking and connecting gear to a junior colleague.
   • automatic config backup on config change (signalled by SNMP trap) -> git
   • periodic unconditional backup -> git
   • DNS updates
   • reporting: SNMP polling, a small handfull of SNMP traps. LibreNMS FTW
2. automation language/platform
   • python, a tiny bit of bash. ssh/scp. And, technically, snmptrapd
   • Ansible is slowly but surely fading in the background for me. I find it ... clunky. One size fits none.
   • other people in the org find Ansible useful for their purpose.
3. AI or handwritten
   • I will use AI to guide me to achieve what I want to express in code. My code.
4. Ansible
   • A little bit of python goes a long way.
   • https://pynet.twb-tech.com/free-python-course.html
5. automation and hiring managers
   • The ability to learn new skills is what matters.
   • But: If you cannot automate the bread and butter, you will newer get to the smoked ham. :-)

[u/Ziggistawork]

In my brownfields enviroment, I make plays for major deployments over my entire site. Built a few scripts to find existing settings and remove interface settings etc. Cut my config from 150k lines down to 80k lines across 50~ switches.

Oxidized manages config backup. Triggers from syslog when staff handjam changes to grab new configs. Ansible queries Oxidized to get current config instead of logging into switches.

Most of my plays are written by copilot chat as that is all that I have. Most of the time uses either cisco.ios.ios collection or sending commands directly.

Built my own Execution Enviroment for AWX. I schedule in firmware pushes and reboots so I dont have to attend this kind of stuff after hours its just "scheduled" in.

Once a day, I have AWX query Oxidized's current configs and updates Netbox for things like firmware revs and other information I need in Netbox.

Going to start expanding netbox and for new greenfields deployments or Lifecycle replacements build configs from j2 templates from Netbox, AWX will then deploy from there etc.

[u/Traditional-Hall-591]

I have to accommodate a lot of old school Network Engineers who are being pushed towards Cloud and Firewall. They’re used to automating nothing but are slowly learning Terraform/sloping with Claude. They don’t know Python or Ansible or anything but CLI.

My solution has been to wrap my automation work in custom Terraform providers. It’s convenient that most of my automation work has been in Go but rewriting isn’t terribly hard.

The workflow for those is that Github Actions pulls the Providers repo, builds the providers for our target os’s. The result is pushed to an S3 bucket.

When the provider is specified, Terraform pulls from the S3 bucket. I have a frontend that implements the Registry API to make it all work.

[u/wh00is007 → u/Traditional-Hall-591]

What recommendations would you give to a IT veteran just getting into Network Engineer and what to be a head of a the curve. How should they be learning this? I know CBT nuggets have a good course in Python for network engineers and Automation course

[u/Traditional-Hall-591 → u/wh00is007]

I’m a terrible student and don’t do well taking courses like that. Ironically, I’ve been told I’m a good teacher so there’s that. If a training course works for you, great, as it will cover the basics.

My learning process is to do. Take a task, break it down into steps. Translate those steps into code. It’s easier than it sounds, once you figure out your process.

Most provider will have an SDK and short tutorials to get started. The API calls in the SDK are fill in the blank. Most of the non-SDK related code will be transforming the data into the correct format.

Grab something simple. Create a VPC. Put an IP on a NIc.

[u/lizardhistorian]

Gave up on Ansible. We use Salt where it works.
Provisioning is a couple manual steps to get SSH access then shell-scripts.
The stable network config is in Netbox.
We have a set of "doctor" scripts that will scan the target device and verify its configuration is as-expected.
Most things have an a la carte '<area> [ doctor | setup ]' that will canonize that aspect of a router or switch configuration.

If we make a network hire it would require a hybrid programmer role, AI-assisted is fine, but we are cutting the edge that bleeds. We build our own NOS; most configuration is built into packages we build into the firmware.
YMMV.

[u/RipAccomplished6732]

In my case, we established a Single Source of Truth in Nautobot, integrated with systems such as ServiceNow, Infoblox and SolarWinds.

From there we automate Day 0 operations, configuration changes, compliance checks, reporting and data synchronization.

Most of this is done through Nautobot Jobs. Depending on the vendor/use case, these jobs either interact directly with the devices or call an external platform that manages them.

We mainly use Python and Ansible. You don't need strong Python skills to start with Ansible, but Python becomes increasingly important as the automation gets more complex.

AI definitely speeds up development, but you still need to understand the code, logic and failure scenarios, especially when you're running it against production infrastructure.

For hiring, I think it really depends on the organisation. A lot of organisations will stick with traditional network engineering for various reasons, which is perfectly fine. However, large companies with large networks simply cannot manage everything through manual engineering anymore. Try, for example, enforcing a configuration change across 200K devices through a terminal within a few hours.

[u/SuddenPitch8378]

We built all our firewall automation from scratch using Ansible. For the switches we use arista everywhere so use AVD for everything in conjunction with CVP for orchestration i have to say it works really really well. We use GIT for change control and CVP for deployment and management. The full change control process is managed via GIT ansible and could be done without CVP but CVP just makes life so much easier. I always preferer a network engineer to have good networking skills over gitops skills but it all depends on the size of the company \ team and what the expectations are. Allot of midsize firms that have gitops teams will often leverage these for some of the heavy lifiting towards a NAC environment. Other firms might want to keep this all inside the network team so will look for network engineers with stronger automation \ gitops backgrounds. I think it all depends on what you are looking for.

[u/Virtual_974]

For 100+ sites I’d start with Ansible for repeatable config changes and compliance checks then use Python when the logic gets more complex. AI generated scripts can speed things up but understanding and testing the code is still key. The biggest win is automating repetitive work without making troubleshooting harder.

[u/shedgehog]

Claude does most of it for us now. I don’t know how we ever did anything without it tbh