Automating Cisco IOS Upgrades with Ansible

Managing firmware lifecycle on network infrastructure can be incredibly tedious. In this tutorial, we will use Ansible to automate this process.

1. Setting up the Ansible Environment

First, ensure you have the required Ansible collections installed on your control node.

Inventory File

Let's define our switches in inventory.yaml:

2. Writing the Upgrade Playbook

Our playbook needs to check the current version, upload the new binary, and reload the switch if necessary.

Let's run the playbook in check mode first to see what would happen:

$ ansible-playbook -i inventory.yaml upgrade.yaml --check
PLAY [Upgrade Cisco IOS] *******************************************************
TASK [Gather facts] ************************************************************
ok: [switch-01]
ok: [switch-02]
TASK [Copy firmware image via SCP] **********************************************
skipping: [switch-01]
changed: [switch-02]
PLAY RECAP *********************************************************************
switch-01                  : ok=1    changed=0    unreachable=0    failed=0
switch-02                  : ok=2    changed=1    unreachable=0    failed=0

Notice how switch-01 was skipped because it already has the correct version!

Enterprise Scaling of Ansible Playbooks

As network automation scales from basic ad-hoc scripts to enterprise-wide infrastructure-as-code, consider these best practices:

1. Ansible Vault: Encrypt sensitive credentials, API tokens, and private SSH keys using Ansible Vault to prevent sensitive information from being committed to Git repositories in plain text.
2. Version-Controlled Inventories: Maintain dynamic inventories within Git, utilizing pull requests and peer review to audit network change proposals before they are executed.
3. Dry-Run Validation: Always execute your playbooks in --check (dry-run) mode within staging environments to verify intended configurations and prevent accidental modifications in production.

This structured automation pipeline ensures repeatable, compliant, and error-free network administration across your entire global switch and router fleet.