CloudLabBox
Try the free demo

Network automation lab 13 of 27

Ansible in depth: Vault, resource modules, NETCONF and RESTCONF modules, compliance

Take the team's Ansible project further: encrypt the credentials with Ansible Vault, configure interfaces, addresses and OSPF from structured host data with resource modules, manage the IOS XE router over NETCONF and RESTCONF, and enforce a configuration-compliance policy with automatic remediation.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then Network Automation - CCNA and CCNP Automation guided labs, then 13 - Ansible in depth - Vault resource modules NETCONF and RESTCONF modules compliance

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
4 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

The Ansible project from lab 12 has grown up. The security team wants the device password out of plain-text files; the network team wants interfaces and routing described as structured data instead of CLI lines; the IOS XE router should be managed through its APIs; and the auditors want a compliance report with automatic fixes: every router must use NTP server 10.10.20.10, enforce SSH version 2, and refuse Telnet. The project is in ~/lab/ansible, with the inventory, connection variables for three ways of reaching xe1, and host data for r1 and r2 already written.

Host (inventory)AddressConnectionPurpose
r1, r2 (branch)10.10.20.11, .12network_cliresource modules, compliance
xe1 (branch)10.10.20.21network_clicompliance
xe1-nc (xe_netconf)10.10.20.21netconfNETCONF modules
xe1-rc (xe_restconf)10.10.20.21httpapi (RESTCONF)RESTCONF modules

r1 and r2 are cabled Gi0/1 to Gi0/1 but have no addresses or routing yet; the host data says 10.1.12.1/30 and 10.1.12.2/30, loopbacks 10.255.0.1–2 and OSPF area 0. Login netops / NetOps-Lab1.

What you’ll practise

  • Encrypt secrets with Ansible Vault and use them without exposing them
  • Use resource modules (interfaces, l3_interfaces, ospfv2) with the merged, rendered and gathered states and explain replaced, overridden and deleted
  • Configure and read IOS XE with the netconf_config, netconf_get, restconf_get and restconf_config modules
  • Write a compliance playbook that passes or fails each device, then remediate idempotently

The tasks

  1. Put the password in Ansible Vault
  2. Resource modules: rendered and gathered
  3. Interfaces, addresses and OSPF from data
  4. replaced, overridden and deleted (think before you run)
  5. Manage xe1 over NETCONF with Ansible
  6. Manage xe1 over RESTCONF with Ansible
  7. Compliance and remediation

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Ansible in depth - Vault resource modules NETCONF and RESTCONF modules compliance4 nodes and 1 network, 5 links. Every link is listed as text below the diagram.devboxr1r2xe1Mgmteth0Gi0/1Gi0/1Gi1Gi0/0Gi0/0
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • devbox eth0 to Mgmt (network)
  • r1 Gi0/0 to Mgmt (network)
  • r2 Gi0/0 to Mgmt (network)
  • xe1 Gi1 to Mgmt (network)
  • r1 Gi0/1 to r2 Gi0/1
Nodes in Ansible in depth: Vault, resource modules, NETCONF and RESTCONF modules, compliance, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
devboxEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
r1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
r2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
xe1Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial1 vCPU, 4,096 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Network Automation - CCNA and CCNP Automation guided labs.

  3. Open 13 - Ansible in depth - Vault resource modules NETCONF and RESTCONF modules compliance and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network automation labs

All Network automation labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.