Your First Ansible Playbook for Cisco
A playbook is a YAML file describing the state you want — Ansible connects to each device over SSH and makes it so. Here is a complete, working playbook that configures NTP and a banner on Cisco switches, explained line by line.
The inventory — which devices
[switches] sw1 ansible_host=192.168.1.11 sw2 ansible_host=192.168.1.12 [switches:vars] ansible_network_os=cisco.ios.ios ansible_connection=ansible.netcommon.network_cli ansible_user=admin
The inventory lists targets and how to reach them. Group variables apply to every device in [switches] — set the password via an encrypted vault or environment variable, never in plain text.
The playbook, line by line
---
- name: Baseline switch config
hosts: switches
gather_facts: no
tasks:
- name: Configure NTP server
cisco.ios.ios_config:
lines:
- ntp server 192.168.1.1
- name: Set login banner
cisco.ios.ios_banner:
banner: login
text: Authorized access only
state: presenthosts: switches targets the inventory group; each task calls a module (ios_config, ios_banner) that knows how to talk IOS. YAML indentation is meaning — two spaces, no tabs (YAML rules).
Run it — and why nothing breaks the second time
ansible-playbook -i inventory site.yml
Ansible reports changed on the first run and ok on the second — that is idempotency: modules check current state and only act on drift. Run the same playbook on 2 or 200 switches; the effort is identical. That is the entire case for network automation.
Where to go next
Add --check for a dry run, keep playbooks in Git, and template configs with variables per site. Concepts and architecture live in Ansible for networking; pair with Python for logic Ansible cannot express.
Frequently asked questions
What is an Ansible playbook?
A YAML file describing the desired state of your devices as a list of tasks. Ansible connects (over SSH for network gear), compares state, and applies only what differs.
What does idempotent mean in Ansible?
Running the same playbook twice is safe — tasks that already match the desired state report ok instead of changed, so playbooks converge instead of blindly re-applying config.
Does Ansible need an agent on Cisco devices?
No — Ansible is agentless. For Cisco IOS it connects over SSH using the network_cli connection and the cisco.ios modules.
How do I test a playbook safely?
Use --check mode for a dry run, target a lab device first, and keep playbooks in Git so every change is reviewed and reversible.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.