◀ Back to work
Network AutomationOpen source

Network Config Script

PythonNetmikoCisco IOSBGPOSPFEIGRPMPLSDMVPNIPSec

Executive Summary

Problem

Router, firewall, and tunnel configuration was manual and interactive - slow across fleets, prone to copy-paste errors, and backups never happened reliably.

Approach

A Netmiko-driven Python collection that drives SSH to many devices: automated config backups, fleet-wide protocol configuration (BGP, OSPF, EIGRP, MP-BGP, MPLS, DMVPN, IPSec), and interface changes from scripts or a single config file.

Outcome

One-pass backups and configuration across a fleet; consistent BGP/MPLS/DMVPN tunnel builds; interactive scripts that remove manual SSH sessions.

Architecture

loadconnectconfigureverify

Components

netmikodevice-inventoryconfig-templatesinteractive-mode

Trust

  • SSH-driven, no agents
  • prompted safety checks
  • idempotent config files

Threat Model (STRIDE)

SThreatMitigation
TBad config pushed to fleetconfig-file validation + dry-run
RConfig drift / undocumented stateautomated per-device backups
ICredentials in plaintextnetmiko handles auth via env/external
EAccidental privilege changesscoped commands + review
SImpersonated devicehost-key verification
DSession floods to devicesthrottled connection handling

Environment

Language
Python + Netmiko
Platforms
Cisco IOS routers / ASA firewalls
Transport
SSH via Netmiko
Protocols
BGP / OSPF / EIGRP / MPLS / DMVPN / IPSec-IKEv2

Implementation

  1. Phase 0 — device inventory & auth
  2. Phase 1 — backup + show scripts
  3. Phase 2 — routing protocol suites
  4. Phase 3 — tunnels & MPLS
  5. Phase 4 — config-file fleet deploys

netmiko_fleet.py

code
from netmiko import ConnectHandler

device = {"device_type": "cisco_ios", "host": host, "username": user, "password": passwd}
with ConnectHandler(**device) as conn:
    conn.send_config_set(config_lines)
    print(conn.send_command("show ip interface brief"))

Detection & MITRE

Config backups + post-change verification commands at scale.

n/a — IT/network automation (defense-in-depth posture)

Lessons Learned

  • What worked

    Backups first - every run starts from a known-good snapshot.

  • What backfired

    Protocol-specific quirks (e.g., DMVPN phases) needed per-platform tweaks.

  • What I'd repeat

    Interactive-only mode at first, then file-based fleet deploys.

Future Improvements

  • Pre/post-change diffs
  • Device inventory parser
  • Git-backed config store