Management
Network Programmability and Automation
Covers the shift from traditional device-by-device CLI management to controller-based networking and automation using APIs and configuration management tools.
What you need to know
- Traditional networking configures each device individually via CLI; controller-based networking centralizes control-plane intelligence in a controller (e.g. SDN controller, WLC, DNA Center).
- In an SDN model, the control plane and data plane are separated; the controller pushes forwarding decisions to network devices via southbound APIs (e.g. OpenFlow, NETCONF).
- Northbound APIs let applications interact with the controller (often REST/JSON) to request network changes or retrieve state.
- REST APIs use HTTP methods (GET, POST, PUT, DELETE) and typically exchange data in JSON format; JSON uses key-value pairs, arrays, and nested objects.
- Puppet, Chef, and Ansible are configuration management tools; Ansible is agentless and uses SSH plus YAML playbooks, while Puppet and Chef traditionally require an agent installed on managed nodes.
- Ansible uses a declarative, push-based model from a control node; no persistent agent process runs on managed devices.
- Infrastructure as code treats configuration as version-controlled text (e.g. YAML), enabling repeatable, automated deployment instead of manual CLI changes.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| curl -X GET https://<controller>/api/v1/... -H 'Content-Type: application/json' | exec | Send a REST API GET request to a controller to retrieve JSON data. |
| curl -X POST https://<controller>/api/v1/... -d '{...}' | exec | Send a REST API POST request with a JSON body to create or modify a resource. |
| ansible-playbook <playbook>.yml | exec | Run an Ansible playbook against inventory hosts (agentless, over SSH). |
| restconf | config | Enable the RESTCONF API on an IOS device for programmatic configuration access. |
| netconf-yang | config | Enable the NETCONF-YANG interface on an IOS device. |
| ip http secure-server | config | Enable HTTPS so the device can serve REST/RESTCONF API requests securely. |
| username <user> privilege 15 secret <pw> | config | Create an API/automation account with full privilege for controller or script access. |
Verify it
- show restconf
- show netconf-yang state
- show ip http server status
- show running-config | include http
Common mistakes
- Forgetting to enable ip http secure-server or restconf before testing an API call, resulting in connection refused.
- Sending malformed JSON in a POST body, causing the API request to be rejected.
- Assuming Puppet/Chef are agentless like Ansible when they normally require an agent on the managed node.
- Not creating a privileged local account for API authentication, blocking programmatic access.
- Confusing northbound (application-to-controller) and southbound (controller-to-device) API directions in exam questions.
Practise Network Programmability and Automation in a real CLI
Generated labs, graded against the simulated network state.