Advanced Network Automation with Cisco and Python

Manual CLI changes across dozens or hundreds of Cisco devices are slow, inconsistent, and hard to audit. This course helps IT Directors and Team Leads move experienced network engineers from ad hoc scripts to governed, repeatable automation built on Python and Nornir.

Role fit: This is professional-level training for network engineers with three to five years of automation and CI/CD experience. It is not a Python primer, so assign it to practitioners who already script and use version control.

Time investment: Plan for about 33 hours across 31 skills. Most skills run about an hour, so a learner can finish one or two per week alongside project work.

Risk and change management: The training puts safety first. Engineers start with show commands and lab work, then use out-of-band management. They schedule live changes in maintenance windows and put controls in place before automating BGP policy, ACL, or QoS changes. The capstone builds a Jenkins NetDevOps pipeline that tests changes on a test network and requires administrator approval before production. It also flags a real gotcha: aggregated Nornir results can mask a critical failure as a successful build.

Scope: Topics include credential management, templating, pytest and pyATS validation, intent-based golden-config checks, NETCONF, RESTCONF, gNMI, and VXLAN, DMVPN, and MPLS L3VPN deployments.

The first skill is free and walks learners through building their own lab with EVE-NG or Cisco DevNet Sandboxes, so teams can practice without touching production.

How this training helps your network team succeed in the real world

Troubleshooting by hand works for eight devices. At 80, 800, or 8,000 devices it stops working. IT teams complete this training to replace repetitive show-command checks with reusable Python and Nornir tools. These tools run concurrently across the entire inventory and turn hours of manual work into a single script run.

• Faster fault isolation: Engineers build tools such as a MAC address hunter, an IP conflict detector, and an OSPF checker. The OSPF checker flags area, subnet mask, and hello/dead timer mismatches that break adjacencies, so Team Leads get answers in minutes instead of device-by-device hunts.
• Safer change management: The course teaches a cautious progression. Teams start with read-only show commands, then move to lab configuration, and only then make production changes during maintenance windows with controls in place. Out-of-band management keeps automation independent of production connectivity.
• Drift detection against a golden config: Teams template OSPF, ACL, and NTP configurations. They then use pyATS and Genie to learn network state and detect deviations from the desired state, which supports audit readiness.
• Gated NetDevOps pipelines: Changes are tested on a test topology through Jenkins, approved by an administrator, and only then pushed to production. Engineers also learn real gotchas, such as aggregated Nornir results that can hide a critical failure behind a later success.

The course also includes a Flask web front-end so engineers can make scripts accessible to the rest of the team, which spreads automation value beyond the people who wrote it.

Knowledge

• How the Nornir architecture works, including inventory inheritance across defaults, groups, and hosts files, the data key, and concurrent task execution
• Why out-of-band management, staged lab-to-production progression, and maintenance windows reduce risk when automating live changes such as BGP policy, ACLs, or QoS
• How structured data, templates, and YANG models (open and native) underpin NETCONF, RESTCONF, and gNMI automation, including gNMI streaming
• How Scrapli, NAPALM, Pytest, and pyATS/Genie fit into a testing and validation toolkit
• How Nornir aggregates results, and why a later success can mask an earlier failure in a NetDevOps pipeline

Ability

• Build a network automation lab with VS Code Remote SSH, EVE-NG, or Cisco DevNet Sandboxes
• Write reusable troubleshooting scripts for MAC address hunting, IP conflict detection, BGP routing validation, reachability testing, and OSPF mismatch detection (area, subnet mask, and hello/dead timers)
• Capture network state with pyATS, then compare it against a templated golden configuration for intent-based drift detection
• Automate DMVPN, VXLAN, data center fabric, and MPLS Layer 3 VPN deployments
• Debug automation with ipdb and handle exceptions so failures surface reliably
• Run a Jenkins-based pipeline that tests changes on a test network, requires approval, and promotes them to production, with a Flask front end for the wider team