Python Libraries for Network Automation solve the problem of manually configuring hundreds of network devices one command at a time, which is slow and error-prone. For the 200-901 exam, you need to understand three specific libraries—Paramiko, Netmiko, and NAPALM—and how each builds upon the previous one to make network automation simpler and more powerful.
Jump to a section
A simple way to picture Python Libraries for Network Automation (Paramiko, Netmiko, NAPALM)
A hotel master key system is a concrete structure that controls access to rooms. The front desk manager has a single key that opens every room, while a guest's key opens only their assigned room for the duration of their stay. This system is designed so the manager can perform maintenance or respond to emergencies across the entire building without carrying a heavy ring of individual room keys. Each guest key is temporary and specific, and the manager's key is permanent and authoritative.
The manager's master key represents Paramiko, a low-level Python library that gives you direct, raw control over an SSH connection to a network device. You can send any command and receive the raw output, like the manager can open any door and see exactly what is inside. Netmiko is like a smart key card system built on top of that master key. It knows the type of lock on each door (the operating system of the network device, like Cisco IOS or Juniper JunOS) and automatically handles the check-in process (logging in) and the response format, so you do not have to manually deal with different lock mechanisms. NAPALM is the hotel's central automation platform. It does not just open doors; it can read the configuration of every room (get the current state), or set the configuration of multiple rooms at once (apply a standardised configuration) by using the key card system. If the manager wants to ensure all rooms have a new minibar policy, NAPALM can check each room's current system and apply the change consistently, without the manager walking to each door.
Network automation is the practise of using software to configure, manage, and monitor network devices like routers, switches, and firewalls. Before automation, an engineer would connect to each device individually, often using a terminal program like PuTTY, and type commands one by one. This is called the Command Line Interface (CLI) method. It works for a handful of devices, but for a network with hundreds of devices, it is slow and human errors are common.
Python libraries provide pre-written code that saves you from writing everything from scratch. They are like toolkits. For network automation, the three key libraries are Paramiko, Netmiko, and NAPALM, and they form a hierarchy of abstraction.
Paramiko is the lowest-level library. It provides a pure Python implementation of the SSH (Secure Shell) protocol. SSH is the secure way to connect to a remote device over a network. Think of Paramiko as the raw plumbing. You use it to open an SSH connection to a device, send a text command, and read the text response. It is powerful but requires you to handle many details manually. For example, you have to wait for the device to be ready before sending the next command, and you have to interpret the output yourself. Writing a script with Paramiko is like having the master key to the hotel but needing to know exactly how each door lock works.
Netmiko is a library built on top of Paramiko. It was created by Kirk Byers to simplify the process. Netmiko adds a layer of intelligence. It knows the command prompts and login sequences for dozens of different network operating systems, such as Cisco IOS, Cisco NX-OS, Juniper JunOS, Arista EOS, and many more. When you use Netmiko, you create a connection object and specify the device type (e.g., 'cisco_ios'). Netmiko then handles the handshake: it sends the username and password when prompted, waits for the command prompt before sending a command, and returns the output in a structured way. This reduces the amount of code you need to write by roughly 80 percent. It is like a key card that automatically works with different types of locks.
NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) is a higher-level library that builds on both Paramiko and Netmiko. NAPALM's goal is to provide a vendor-agnostic way to interact with network devices. This means you can write one piece of Python code that can get the current configuration or deploy a new configuration to a Cisco router, a Juniper switch, or an Arista switch, without changing the code. NAPALM achieves this through methods like get_config() to retrieve the running configuration and load_replace_candidate() to stage a new configuration. It also has a commit() method to apply the change and a rollback() method to revert if something goes wrong. This is especially valuable in large environments where you have devices from multiple vendors. NAPALM uses Netmiko under the hood for SSH connections, so you get the benefit of both libraries.
To summarise, each library serves a different purpose:
Paramiko: direct, low-level SSH control. Use it when you need to do something very specific that other libraries do not support.
Netmiko: simplified SSH for network devices with built-in knowledge of different vendor prompts. Use it for day-to-day configuration tasks on a mix of devices.
NAPALM: high-level, vendor-agnostic methods for comparing, deploying, and rolling back configurations. Use it when you need to manage many devices from different vendors using a consistent API.
Understanding when to use each library is a key skill the DevNet Associate exam tests.
Install the Libraries
You install Paramiko, Netmiko, and NAPALM using pip, the Python package installer. This step matters because you cannot use any library until it is installed in your Python environment. For the exam, know the command 'pip install netmiko' installs Netmiko and its dependencies, including Paramiko.
Import the Library Classes
In your Python script, you import the necessary classes. For example, 'from netmiko import ConnectHandler'. This step is critical because it makes the library functions available in your code. The exam tests which import statement is correct for each library.
Define Device Connection Parameters
You create a dictionary containing the device IP address, username, password, and device type. For example: device = {'device_type': 'cisco_ios', 'host': '192.168.1.1', 'username': 'admin', 'password': 'secret'}. This step is essential because it tells Netmiko how to connect and what prompt behaviour to expect.
Establish the SSH Connection
You create a connection object by calling net_connect = ConnectHandler(**device). This is the moment the library actually opens the SSH session to the network device. If the credentials or device type are wrong, this step will fail. Understanding this step is key for troubleshooting exam questions.
Send Configuration Commands
You use methods like send_command() for a single show command, or send_config_set() for a list of configuration commands. For example: output = net_connect.send_command('show ip interface brief'). This is where the real work of automation happens. The exam will test your knowledge of which method to use for configuration versus show commands.
Close the Connection
You call net_connect.disconnect() to close the SSH session. This is a best practise to free up network resources. The exam may check if you remember to close connections in a script, especially in larger automation scripts.
Imagine you are a network engineer at a large retail company that has 150 branch offices, each with a Cisco router and a Juniper switch. The company is rolling out a new network security policy that requires a new access control list (ACL) on every router. The ACL is a list of rules that controls which traffic is allowed or blocked.
Before automation, you would need to physically travel to each branch, or use a terminal server to manually SSH into every router and paste the configuration. That is 150 separate sessions. If you make a typo in one, that branch could lose connectivity, causing the store's point-of-sale systems to go offline. It is tedious and risky.
With Python and Netmiko, you can write a script that connects to each router in sequence. The script uses a list of device IP addresses and login credentials. It loops through each router, connects via SSH, enters configuration mode, and applies the new ACL. If there is an error, you catch it in the script and log it to a file, so you know exactly which branch failed. This process takes a few minutes to run, not hours or days.
Now imagine a more complex task: you need to standardise the SNMP (Simple Network Management Protocol) community strings across all devices. SNMP is used for monitoring. You need to check the current setting, compare it to the desired setting, and update it if it is different. This is where NAPALM shines. You can write a script that uses NAPALM's get_config() method to retrieve the current running configuration of each device. Then you use a diff function to compare the current config to your desired config. NAPALM's load_replace_candidate() method stages the new configuration, and commit() applies it. Because NAPALM is vendor-agnostic, the same script works for both Cisco and Juniper devices. The script can also generate a report showing which devices were already compliant and which were updated.
In a real business, this means:
Faster deployment of security patches and policy changes.
Fewer human errors that cause outages.
Consistent configuration across all devices, which is critical for audit compliance.
The ability to react quickly to network incidents, because you can push a fix to 150 devices in seconds.
Automation also frees up the engineer to work on more strategic tasks, like network design and capacity planning, rather than spending all day typing commands.
The Cisco DevNet Associate (200-901) exam tests your understanding of these Python libraries from a conceptual and practical standpoint. You need to know what each library does, how they relate to each other, and when to use each one. The exam will not ask you to write a full script from memory, but it will expect you to read code snippets and identify what the code does.
Specific exam topics you must know:
Paramiko: the lowest-level SSH library. It uses the paramiko.SSHClient() class to establish a connection. You will see code that calls client.connect() and client.exec_command(). Know that exec_command() runs a single command and returns separate files for stdin, stdout, and stderr. The exam may ask you to identify that Paramiko requires you to handle the channel and output parsing yourself.
Netmiko: built on top of Paramiko. It uses the ConnectHandler class imported from netmiko. You will see device parameters passed as a dictionary with keys like 'device_type', 'host', 'username', 'password'. Know that the device_type string (e.g., 'cisco_ios', 'juniper_junos') is critical because Netmiko uses it to know the exact prompt format and login sequence. Methods you must know: send_command() for sending one command, send_config_set() for sending a list of configuration commands, and send_config_from_file() to load config from a file.
NAPALM: the highest-level library. Key methods include get_config(), load_replace_candidate(), load_merge_candidate(), commit(), and rollback(). Understand that NAPALM is vendor-agnostic and works by abstracting the configuration differences behind a common API. Know that NAPALM uses Netmiko under the hood for SSH connections.
Common exam traps:
The exam may present a code snippet using Paramiko and ask what is missing. The answer is often that the code does not handle the prompt or does not wait for the device to be ready. Netmiko automates that.
They may show a script that uses send_command() but uses a connection object that was created incorrectly. The trap is forgetting to specify the device_type in the connection dictionary.
They may ask which library provides the ability to rollback a configuration change. The answer is NAPALM, because it has the rollback() method.
They may compare the three libraries and ask which one requires the most manual code. Answer: Paramiko.
They may ask what a specific Python import statement does. For example, 'from netmiko import ConnectHandler' imports the ConnectHandler class from the Netmiko library.
They may show a NAPALM script and ask what method is used to stage a new configuration but not apply it. Answer: load_replace_candidate() or load_merge_candidate().
They may present a scenario where you need to connect to a device type that is not in Netmiko's list and ask what you should do. Answer: you may need to define a custom device type or fall back to using Paramiko directly.
Key definitions to memorise:
SSH: Secure Shell, a network protocol for secure remote access.
CLI: Command Line Interface, text-based interface to a device.
Vendor-agnostic: works across devices from different manufacturers without code changes.
Abstraction: hiding the complex details of different vendors behind a simple, common set of commands.
diff: a comparison of two sets of data, showing the differences.
rollback: reverting to a previous configuration state.
Study tip: Practise by reading and understanding small scripts that use each library. Do not just memorise the methods; understand what each step does in context.
Paramiko is the raw SSH library that requires you to manually handle device prompts and output parsing.
Netmiko simplifies SSH connections to network devices by automatically handling login sequences for over 30 device types.
NAPALM provides a vendor-agnostic API for comparing, staging, and rolling back network device configurations.
The three libraries form a hierarchy: Paramiko is the base, Netmiko adds device-type awareness, and NAPALM adds high-level configuration management methods.
Use Paramiko when you need low-level SSH control that Netmiko does not support, such as handling non-standard prompts.
Use NAPALM when you need to manage configurations across multiple vendors with a single codebase, especially for compliance and change management.
These come up on the exam all the time. Here's how to tell them apart.
Paramiko
Direct SSH client usage; you handle channel and output.
No built-in knowledge of device prompts.
Lower-level, more control but more code.
Netmiko
Simplified connection with device_type parameter.
Automatically handles login and prompt detection.
Higher-level, less code for common tasks.
Netmiko
Focuses on sending commands via SSH.
No built-in methods for configuration diff or rollback.
Requires vendor-specific command knowledge in the user's code.
NAPALM
Focuses on configuration management and state comparison.
Provides get_config(), commit(), and rollback() methods.
Vendor-agnostic; one method works across different vendors.
send_command()
Used for show/operational commands.
Returns the output as a string.
Does not enter configuration mode.
send_config_set()
Used for configuration commands.
Enters configuration mode automatically.
Can take a list of commands and commits them sequentially.
Mistake
Netmiko is the only library you need for network automation because it handles everything.
Correct
Netmiko is excellent for SSH-based command execution, but it does not provide high-level methods for comparing configurations, staging changes, or rolling back. NAPALM provides those features.
Beginners often think that if one library works for most tasks, it must cover all tasks. They do not understand the abstraction layers.
Mistake
Paramiko is obsolete because Netmiko exists.
Correct
Paramiko is the foundation that Netmiko and NAPALM are built upon. It is not obsolete; it is the engine. You might need it directly if you need to do something unusual that the higher libraries do not support.
People assume newer libraries replace older ones completely, but in Python, libraries often build upon each other in layers.
Mistake
NAPALM can connect to any network device without any configuration.
Correct
NAPALM supports many vendors, but not every device. It requires an underlying driver for each device type. If a driver does not exist, you cannot use NAPALM with that device without custom development.
The term 'vendor-agnostic' is often misunderstood to mean 'universal'. NAPALM is vendor-agnostic within the set of devices it supports, but that set is not exhaustive.
Mistake
Using these libraries automatically makes your network secure.
Correct
These libraries only automate the process of sending commands. Security still depends on proper credentials, encrypted connections (SSH), and correct configuration. If the script has a bug, it can cause outages or security holes.
Automation is often seen as a magic solution. Beginners forget that the automation tool is only as safe and correct as the code written.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, you do not need to write a full script from scratch. The exam tests your ability to read and understand code snippets and know what each method does.
send_command() is used for show commands (e.g., show running-config) and returns the output. send_config_set() is used for configuration commands and enters configuration mode automatically.
No, NAPALM supports a specific list of devices. You need a NAPALM driver for your device type. If a driver does not exist, you cannot use NAPALM directly.
You would use Paramiko if you need to connect to a device with a non-standard login prompt or if you need to implement a custom protocol that Netmiko does not handle.
It means that one set of Python code can work across devices from different vendors (like Cisco and Juniper) without needing to know the specifics of each vendor's CLI syntax.
Paramiko is strictly SSH. Netmiko also uses SSH under the hood. NAPALM can use SSH (via Netmiko) or other protocols like NETCONF depending on the driver.
You've finished Python Libraries for Network Automation (Paramiko, Netmiko, NAPALM). Continue through the 200-901 study guide to build a complete picture of the exam.
Done with this chapter?