Configuration management: Ansible, Puppet, Chef and NETCONF

The problem: configuration drift

Configuration drift is when devices that should be configured the same slowly become different. One engineer adds a test ACL and forgets to remove it. Another fixes a problem at 2 am on one switch only. After a year, no two switches are quite alike, and nobody knows which settings are deliberate. Drift causes strange faults and failed security audits.

Configuration management means writing the wanted configuration down in files, keeping those files in version control (such as Git), and letting a tool apply them to every device. This approach is called infrastructure as code: the network's configuration is treated like program code that is reviewed, tested and versioned.

Templates and variables

Most switches in a company differ only in a few values: hostname, management IP, VLAN names. A template is the shared configuration with placeholders, and variables fill in the values for each device. One template plus a small table of variables can produce the configuration for 500 switches. Ansible uses Jinja2 templates; in Python you can do the same with string.Template or f-strings.

from string import Template

line = Template("vlan $id\n name $name")
for vlan in [{"id": 10, "name": "BILLING"}, {"id": 20, "name": "CCTV"}]:
    print(line.substitute(vlan))

Ansible

Ansible is the most common tool for network automation. It is agentless: nothing has to be installed on the routers and switches. The control node (your Linux machine or a server) connects to each device over SSH and pushes the changes. That suits network devices well, because you usually cannot install extra software on them.

• Inventory: the list of devices, grouped, for example [store_switches].
• Playbook: a YAML file listing plays and tasks: what to do on which hosts.
• Module: the code that does one kind of job, such as cisco.ios.ios_config (send configuration lines) or cisco.ios.ios_vlans (manage VLANs as structured data).
• Idempotent: running the same playbook twice gives the same result; the second run changes nothing if the device is already right.

[store_switches]
sw-pune-01 ansible_host=10.20.1.2
sw-pune-02 ansible_host=10.20.1.3

---
- name: Standard VLANs on store switches
  hosts: store_switches
  gather_facts: false
  connection: ansible.netcommon.network_cli
  vars:
    ansible_network_os: cisco.ios.ios

  tasks:
    - name: Make sure the store VLANs exist
      cisco.ios.ios_vlans:
        config:
          - vlan_id: 10
            name: BILLING
          - vlan_id: 20
            name: CCTV
        state: merged

    - name: Point every switch at the NTP server
      cisco.ios.ios_config:
        lines:
          - ntp server 10.0.0.5

Puppet and Chef

Puppet and Chef came from the server world. Both use an agent, a small program installed on each managed device, which regularly pulls its wanted configuration from a central server and fixes any drift it finds. Only some network platforms support these agents, which is one reason Ansible is more common for networks.

Terraform, briefly

Terraform is a declarative provisioning tool: you describe what should exist (a cloud network, a subnet, a firewall rule) and Terraform creates, changes or deletes things until reality matches. Declarative means you state the end result, not the steps. It is used most for cloud networks; Ansible is used more for configuring devices that already exist.

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

NETCONF, RESTCONF and YANG

Sending CLI lines over SSH works, but the CLI was made for humans. Its output is text that scripts must parse, and the commands differ between vendors. YANG is a data modelling language that describes a device's configuration and state as a clear tree of fields with types, such as interface name (a string) and enabled (true or false).

• NETCONF: a protocol that reads and changes configuration described by YANG models. It carries XML and runs over SSH on TCP port 830. Operations include get-config and edit-config, and it can validate a change and apply it as one transaction.
• RESTCONF: the same YANG models, through a REST API over HTTPS. It uses the normal methods (GET, POST, PUT, PATCH, DELETE) and can send JSON or XML.