Python Network Automation

Python network automation refers to using the Python programming language to interact with network devices programmatically. Instead of typing commands one by one into a terminal, you write scripts that connect to devices, execute commands, and process the output. This is part of the broader DevOps and NetOps movement, where infrastructure is managed as code.

For the CCNA 200-301 exam, objective 6.5 specifically covers: "Interpret basic Python scripts using the following:

Python is the de facto language for network automation because of its readability, extensive library support, and large community. Key libraries include: - paramiko: Low-level SSH implementation. You handle authentication, channel, and command execution manually. - netmiko: Built on paramiko, it simplifies SSH connections to network devices. It handles SSH negotiation, authentication, and command execution with a consistent interface across vendors. - requests: Used for REST API calls (e.g., to Cisco DNA Center, Meraki, or NX-API). - json: Parses JSON data, commonly returned by APIs. - re: Regular expressions for parsing unstructured text output.

At the packet/frame level, Python scripts typically use SSH (TCP port 22) to connect to a device's management IP. The script opens a socket, performs SSH key exchange, authenticates, and opens a shell channel. Commands are sent as strings over the encrypted channel, and the device's response (usually text) is read back. For example, a netmiko script sends "show ip interface brief" and captures the output as a string.

For API-based automation, the script sends HTTP/HTTPS requests (e.g., GET, POST) to the device's REST API endpoint. The device responds with structured data (JSON or XML). This is more efficient than screen-scraping because the data is machine-readable.

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'host': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco123',
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

This script imports the ConnectHandler class, defines device parameters in a dictionary, establishes an SSH connection, sends a command, prints the output, and closes the connection. The send_command() method waits for the device prompt before returning.

Raw text output from show commands is often messy. To extract specific data, you can use string methods or regular expressions. For example, to get the IP address of an interface:

import re
output = connection.send_command('show ip interface brief')
match = re.search(r'GigabitEthernet0/1\s+(\S+)', output)
if match:
    ip = match.group(1)
    print(ip)

Alternatively, use textfsm (not in CCNA scope but useful) or structured output from APIs.

import requests
url = "https://192.168.1.1/api/interface"
headers = {"Accept": "application/json"}
response = requests.get(url, auth=("admin", "cisco123"), verify=False)
data = response.json()
print(data)

Note: verify=False disables SSL certificate verification (common in lab environments). In production, use proper certificates.

While Python is the automation tool, you still need to verify device connectivity and configuration manually. Use: - show ip ssh: Verify SSH server status. - show ip interface brief: Check interface IPs. - show running-config | include username: Confirm user accounts. - debug ip ssh: Troubleshoot SSH connections (use with caution).

Python automation relies on underlying protocols like SSH (for secure CLI access), SNMP (for monitoring), and NETCONF/RESTCONF (for model-driven programmability). The CCNA exam expects you to understand that Python can leverage these protocols via libraries. For example, pysnmp is a Python library for SNMP, but it's not covered in CCNA; focus on SSH and HTTP-based APIs.

In enterprise networks, Python automation is used for numerous tasks. One common scenario is bulk configuration changes. Imagine you need to update the NTP server on 200 switches. Manually SSHing to each device and typing ntp server 10.10.10.1 would take hours and risk typos. A Python script using netmiko can loop over a list of device IPs, connect, enter config mode, apply the command, and save the config. The script can also verify the change by sending show ntp status and logging any failures.

Another scenario is compliance auditing. A network engineer must ensure all devices have the same ACL applied. Instead of manually checking each device, a script can connect to every device, run show access-lists, and compare the output to a baseline. If a device is missing an entry, the script can log it or even apply the missing ACL automatically. This is often part of a Continuous Compliance pipeline.

A third scenario is backup automation. Every night, a Python script connects to all network devices, runs show running-config, and saves the output to a file named with the device hostname and date. This provides a historical record and aids in disaster recovery. The script can also check for changes by comparing the new backup with the previous one using difflib.

Performance considerations: SSH sessions are resource-intensive. For large networks (thousands of devices), use threading or asynchronous libraries (e.g., asyncio, netmiko's ConnectHandler is not thread-safe, so use a connection pool). Also, be mindful of SSH rate limiting on devices. Misconfigured scripts can lock out administrators by failing authentication repeatedly. Always include error handling and logging. A common mistake is not handling NetMikoTimeoutException for unreachable devices, causing the script to hang. Also, forgetting to set secret for enable mode can leave the device in user exec mode, causing commands to fail silently.