Network Automation Fundamentals

Network automation is the practise of using software to manage and control network devices such as routers, switches, and firewalls without requiring a human to log in and type commands one at a time. To understand this, imagine you manage a fleet of 500 delivery trucks. If you had to walk to each truck, turn a key, and give verbal directions every morning, you'd need a massive team and you'd make lots of mistakes. Instead, you install a central computer that sends a standardised set of instructions to every truck simultaneously. That is network automation.

To make this work, we need three key components: data models, protocols, and tools. Let us start with data models. A data model is like a blueprint or a form. It defines exactly what information can be sent and what format it must be in. The most important data model in networking is YANG (Yet Another Next Generation — yes, the name really is a joke). YANG is a language used to define the configuration and state data of a network device. It is vendor-neutral, meaning Cisco, Juniper, and Huawei devices can all understand YANG models if they support them. Think of YANG as the standardised order form for a fast-food restaurant: it says you can specify a burger type, a drink size, and sides, but you cannot specify a pizza. This prevents confusion.

Next, we have protocols — the language and mechanics for sending that YANG data. Two critical protocols are NETCONF and RESTCONF. NETCONF (Network Configuration Protocol) is like sending a certified letter. It is a connection-oriented protocol that uses XML (eXtensible Markup Language) for data encoding. When a network administrator wants to change a router's IP address, they use NETCONF to open a secure SSH session, send an XML document containing the YANG-modeled change, and the router acknowledges receipt and applies the change. NETCONF is transactional: either the whole change happens or none of it does, preventing half-broken configurations.

RESTCONF is a lighter, web-based alternative. It uses HTTP methods like GET, POST, PUT, and DELETE — the same methods your web browser uses to load a website. Instead of XML only, RESTCONF can use JSON (JavaScript Object Notation), which is more lightweight and easier for web developers to use. RESTCONF is like sending a text message vs. a certified letter: faster and simpler, but less robust for complex transactional changes. For the 350-501 exam, you need to remember that NETCONF supports both configuration and state data retrieval, while RESTCONF is better for simple, web-based interactions.

Now, tools. The most common automation tools are Ansible (by Red Hat), SaltStack, and Cisco's own Network Services Orchestrator (NSO). Ansible is especially popular because it is agentless — you do not install software on the routers. Instead, you run a playbook (a set of instructions) from a central machine, and Ansible uses SSH or NETCONF/RESTCONF to talk to the devices. A typical Ansible playbook might look like a YAML file that reads a YANG model and pushes it to a device.

Together, these components replace the old manual method where an engineer would type 'configure terminal' and painstakingly type each command. Automation reduces configuration errors from 30% to near zero in large networks, it speeds up rollout times from days to minutes, and it enforces consistency — every router gets the same configuration, no typo can sneak in. For the exam, you must know the difference between 'push' and 'pull' automation models. In push (e.g., Ansible), the controller sends configuration to devices. In pull (e.g., Salt in masterless mode), devices fetch their config from a central server. The exam loves to test which tool uses which model.

Consider a real scenario: a large internet service provider (ISP) like TalkTalk or Virgin Media needs to upgrade the security settings on 10,000 customer-facing routers across the UK because a new vulnerability was discovered. In the past, a team of 50 engineers would log in via SSH one by one, type the same 20 commands, and hope they did not make a typo. This would take two weeks, and mistakes were common.

Today, using network automation, a single senior engineer can do this in 15 minutes. Here is the step-by-step process: The engineer first creates a YANG data model that defines the new security settings — for example, enabling TCP MD5 authentication on all BGP sessions. They write this YANG model in a file. Then, they write an Ansible playbook that targets all 10,000 devices, specifying that the playbook should use the NETCONF protocol to push the YANG model to each device.

The engineer runs the playbook from a central Linux server. Ansible establishes NETCONF over SSH sessions to each router in parallel (or in batches to avoid overwhelming the network). Each receives the XML-encoded YANG configuration. The router's operating system (like IOS XR or NX-OS) validates the data against its own YANG schema; if it matches, it applies the change. The router then sends back a confirmation message. If any device fails — say because a router is offline or its model doesn't support that YANG feature — Ansible logs that error and the engineer can investigate later.

In the next step, the engineer uses RESTCONF to query the live state of a sample of routers to verify the changes took effect. They can use a simple Python script with the 'requests' library to send a GET request to a RESTCONF endpoint, such as 'https://router-ip/restconf/data/Cisco-IOS-XE-native:native/ip/route'. The response comes back as JSON, and the script parses it to confirm the routes are correct.

This automation eliminates human error, ensures every router is configured identically, and provides a full audit trail — every change is logged by the automation tool. The 350-501 exam expects you to understand that this is the 'day-to-day' reality for service provider network engineers and that automation tools like Ansible are used to enforce infrastructure as code (IaC), where the network configuration is treated as version-controlled code, just like software. The exam will ask you to identify which protocol (NETCONF vs RESTCONF) is best for a transactional change (NETCONF) versus a simple read (RESTCONF).