Recognize the capabilities of configuration management mechanisms such as Ansible and Terraform

What configuration management means

A configuration management tool is software that takes a description of how devices should be configured and makes reality match that description, across many devices at once. The description lives in text files that can be stored in a version-control system such as Git, which is where the phrase infrastructure as code (IaC) comes from: the network’s configuration is treated like software source code, with history, reviews, and rollback.

Two vocabulary pairs come up constantly:

• Push versus pull. In a push model, a central server connects to the devices and sends them their configuration. In a pull model, a small program (an agent) installed on each device periodically contacts the server and asks “what should I look like?”, then applies any changes itself.
• Agent-based versus agentless. Agent-based tools require that agent software be installed on every managed device. Agentless tools need nothing installed on the device; they use protocols the device already supports, such as SSH or an API. Agentless is far better suited to network devices, because you generally cannot install third-party software on a switch.

A third idea, procedural versus declarative, distinguishes tools that say how (run these steps in this order) from tools that say what (here is the end state; you figure out the steps). Ansible playbooks are largely procedural in structure (a list of tasks), although many of its modules behave declaratively. Terraform is fully declarative.

Ansible

Ansible is an open-source automation tool, now owned by Red Hat, written in Python. It is by far the most common configuration management tool used with Cisco network devices, and the exam expects you to know its defining characteristics.

Ansible’s main file types:

A tiny inventory file:

[switches]
sw1 ansible_host=10.1.1.11
sw2 ansible_host=10.1.1.12

[switches:vars]
ansible_network_os=cisco.ios.ios
ansible_connection=ansible.netcommon.network_cli
ansible_user=admin

A tiny playbook that configures NTP and a syslog server on every switch in the group:

---
- name: Standardize NTP and syslog on access switches
  hosts: switches
  gather_facts: false

  tasks:
    - name: Configure NTP server
      cisco.ios.ios_config:
        lines:
          - ntp server 10.1.1.100

    - name: Configure syslog destination
      cisco.ios.ios_config:
        lines:
          - logging host 10.1.1.200
          - logging trap informational

    - name: Save the running configuration
      cisco.ios.ios_config:
        save_when: modified

You run it with ansible-playbook -i inventory.ini ntp-syslog.yml. Ansible connects to each host over SSH, checks whether the lines already exist, adds any that are missing, and reports ok (no change needed) or changed for each task. Running it a second time reports ok everywhere, which is idempotency in action.

Terraform

Terraform, made by HashiCorp, is primarily an infrastructure provisioning tool rather than a device-configuration tool. It is used to create and manage resources in cloud platforms (AWS, Azure, Google Cloud), virtualization systems (VMware), and controller-based network products (Cisco ACI, Catalyst Center, Meraki, SD-WAN, Intersight, and others). Its defining characteristics:

The Terraform workflow has three main commands:

1. terraform init downloads the providers referenced in the code.
2. terraform plan compares the code with the state file and the real platform and prints exactly what it would create, change, or destroy, without doing it.
3. terraform apply executes the plan (after asking for confirmation). terraform destroy removes everything the code created.

A tiny example that creates a network in a Meraki organization:

terraform {
  required_providers {
    meraki = {
      source = "cisco-open/meraki"
    }
  }
}

provider "meraki" {
  meraki_dashboard_api_key = var.api_key
}

resource "meraki_networks" "branch12" {
  organization_id = "123456"
  name            = "Branch-12"
  product_types   = ["switch", "wireless"]
  time_zone       = "America/Chicago"
}

The words in this example illustrate HCL syntax: a provider block, a resource block with a type and a local name, and key = value arguments (note the equals sign, unlike YAML’s colon).

Ansible versus Terraform

In practice the two are often combined: Terraform builds the virtual machines, cloud networks, or controller objects, and Ansible then configures the operating systems and devices inside them.

Puppet and Chef (brief mention)

Older CCNA versions named Puppet and Chef; the v1.1 blueprint says “such as Ansible and Terraform,” so recognize the others at a high level.