Chapter 7 Tactical Playbooks

Network Modules Moving beyond running IOS commands through the ios_command module, a different Ansible module, ios_config, with its own unique syntax, will be introduced. The modules are similar however ios_config is intended to be used to configure the device with configuration, or privileged EXEC level commands, while ios_command is typically reserved for running show commands which are non- privileged.

Process

The NDLC process remains the same for making changes to the network:  Create work items in TFS.  Create a working branch from the master branch for every change.  Develop and test code.  Commit often.  Comment code where applicable.  Execute playbook.  Perform pull requests to merge approved code changes into the master branch.

Now that there could potentially be an impact to the network because of changes, the incorporation of more traditional network administration personas to evaluate the required Cisco commands is needed. How and where commands should be executed and in what order as well as the impact, if any, of the change to the network needs to be assessed. Other considerations such as outage planning for impactful changes (change window, possible fail-overs, notifications to impacted users and services, change management and approvals) as well as all test plans are required. Updates to out of repository information (NMS, diagrams, legacy documentation) as well as evidence of the new automated documentation and testing that will be performed, should be included in the approval process. Some CLI validation may be required as part of an automated change.

Orchestrate the playbook to gather information about the pre-change state of the network, execute the changes, then recollect the new post-change state of the network.

Gather Information

Here, execute some of the pre-canned network reconnaissance code or craft new, playbook-specific, information gathering code that runs before changing anything. Output these files for use in validating the change or roll back if you must back out of a change.

Execute Check Mode with Verbosity The most powerful aspect of Ansible is the ability to run playbooks in check mode. Since changes are being made to the network, which always holds a potentially negative impact, the playbook can be executed in check mode with verbosity to identify what is changing, in what order, and on what devices.