Chapter 2 Why Automate the Network?
For diagrams, tables, or exact code formatting, .
In fact, any information represented in a data model can be transformed into dynamic documentation files. This allows for desired information about any device on the network to be automatically generated at build time, and available through TFS. The history for these documentation files is included as source and version controls. When adding or removing code, the resulting documentation updates are automatically performed reflecting the changes.
Standards
Corporate standards are very hard to maintain over time as networks evolve and transform. Often the pressures of projects and deliverables of day-to-day work demands leads to standards being overlooked, put off, or ignored. Natural configuration drift can occur over time as network devices and IP addresses come and go. If network devices continue to operate, misconfigurations or poor standards may go unnoticed. When identified, these cosmetic corrections may be deemed a low priority.
Ansible’s dynamic templating guarantees a standardized configuration for every device. Complete configuration coverage is achievable and every line of code in the running-configuration can be derived from a template. Having accomplished full idempotency between the source of truth and the device configuration guarantees intent-based standards are uniformly applied. Scale is not a problem with this approach nor is the human error factor. When new standards arise, or changes to existing standards are required, only the centralized templates and data models are updated. These changes are pushed through the automation engine delivering the new standards to the network.
Golden Configuration
Sometimes referred to in Windows operating system administration as a “desired state configuration” a golden configuration has many names. Using Jinja2 templates and YAML data models, a golden configuration for each device in the network is achieved using software development methodologies. Logic within the templates is used to intelligently generate device configuration commands. These configurations are applied at scale to all devices included in the Ansible hosts.ini inventory file.
The master branch represents the golden configuration for the network. Automated builds package the various artifacts from the master branch and provide a version number for that iteration of the network. When changes are required, however minor, working branches are created for code to be developed and tested. Frequent Git commits during development are used to check changes into the working branch. A pull request is used to merge these accumulated changes into the master branch, which is then deployed into production updating the standardized, golden configuration, at scale.
Security Some of the largest security breaches occur because telnet is open on a port with a public facing IP address. Security standards and best practices can now be hard-coded into templates guaranteeing enforcement of policies. Often complex configurations are required on interfaces at the access layer to address security risks. Consider the access layer and all the following security standards that should be implemented:
Spanning-tree toolkit commands.
o Bridge Protocol Data Unit (BPDU) controls.
