Yes. Ansible can push configuration to a Cisco IOS switch over SSH, using the cisco.ios collection and its ios_config module. Once the connection works, you describe the lines you want in a playbook, back up the running configuration before each change, and rerun the same playbook against as many switches as your inventory lists instead of retyping commands in each console session.
This article is a reproducible workflow, not a record of a specific lab test. The switch model, IOS or IOS XE release, Ansible version and topology shown below are illustrative. Check each of them against your own equipment before you run anything on a device you care about.
As an Amazon Associate I earn from qualifying purchases.
What Ansible does on an IOS switch, and what it does not
Ansible does not install anything on the switch. It logs in over SSH, runs IOS CLI commands on your behalf, and reports what changed. For IOS, Ansible’s documented connection method is ansible.netcommon.network_cli, with the platform identified as cisco.ios.ios. If your user account lands in user EXEC mode, you can tell Ansible to elevate to enable mode with ansible_become: true and ansible_become_method: enable.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →That means the switch must already be reachable and SSH-capable. Automation does not replace the initial bootstrap, so you still set the management address and enable SSH yourself.
#1 Best Overall
- COMPATIBLE RACKMOUNT KIT: This rack mount kit is designed for Cisco rack mount 3560CX, 2960CX, 3560, 2960 series switches and Cisco 9200CX Compact Switch, ensuring a perfect fit for your networking setup.
- DURABLE AND LIGHTWEIGHT: This universal rack mount kit offers durability without adding bulk and weighs just 0.78 lbs, making it ideal for home labs and enterprise data environments.
- SECURE MOUNTING HARDWARE: This catalyst rack mount kit comes with screws to securely fasten your switch to the rackmount bracket—ensuring reliable and stable installation.
- EASY INSTALLATION: This universal rack mount kit for Cisco switches is easy to install, offering a hassle-free solution for mounting your Cisco switch securely and professionally in your rack setup.
- COMPLETE 2-BRACKET KIT: This rack mount kit includes 2 metal brackets and the necessary screws, giving you the hardware needed to securely mount compatible Cisco compact switches in a standard rack setup.
Lab options for CCNA practice
You do not need physical hardware to study for CCNA. Cisco’s certification preparation page recommends hands-on practice and describes virtual labs as requiring no hardware. Its wording: “Practice networking, IoT, cybersecurity skills, and more in a virtual lab—no hardware needed.” (Cisco, “Prepare to Get Cisco Certified,” accessed 2026-10-07.)
Virtual labs are the cheap route, but they do not all behave the same way with an automation tool. The table compares the options on the points that matter for this workflow.
| Option | Hardware needed | Cisco’s stated position | Ansible and IOS fit established in the cited sources |
|---|---|---|---|
| Cisco Packet Tracer | None; software only | Named by Cisco as a practice option for CCNA candidates | Not stated in the cited Cisco pages. Confirm SSH and enable-mode behavior in your Packet Tracer version before building a playbook around it. |
| Cisco Modeling Labs (CML) | None physical; software that runs on your own computer or server | Named by Cisco as a virtual lab option | The cisco.ios.ios_config documentation states it was tested against Cisco IOS XE 17.3 on CML. That is a documentation test statement, not a guarantee for every release. |
| Physical Cisco switch | A real switch, a management connection, and a console or SSH path | Not required for CCNA study, according to Cisco’s guidance | Depends on the IOS release and the collection version. Check the platform guide for your release. |
Cisco Press also lists the CCNA 200-301 Official Cert Guide Library as an optional companion for switch configuration scenarios and Network Simulator Lite exercises. It is a study book, not an Ansible guide. The Enterprise Networking, Security, and Automation Labs and Study Guide (CCNAv7) by Allan Johnson, published September 17, 2020, includes Packet Tracer activity instructions. It is tied to the CCNAv7 curriculum, so confirm it matches the exam version you are studying for.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePrerequisites on the switch and the workstation
- SSH enabled on the switch. In the lab, a minimal set is a hostname, a domain name, an RSA key, SSH version 2, a privilege 15 user, and VTY lines that accept SSH.
- A workstation with Python and Ansible installed, and the collections installed with
ansible-galaxy collection install cisco.ios ansible.netcommon. - Your management address and the enable secret known to you, not stored in plain text in the repository.
A minimal switch-side bootstrap looks like this. Substitute your own names, addresses and key size:
Rank #2
- 2801 has 15.1(4)M IOS!
hostname sw1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret <your-password>
line vty 0 4
transport input ssh
login localSet up the connection
Inventory
Group your switches so one playbook can target them. The example below uses a documentation address range and a single switch named sw1:
all:
children:
ios_switches:
hosts:
sw1:
ansible_host: 192.0.2.11
vars:
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: cisco.ios.ios
ansible_user: admin
ansible_become: true
ansible_become_method: enableCredentials
Ansible’s IOS guidance favors SSH-key authentication where possible. If you use password authentication, encrypt the password with Ansible Vault rather than leaving it in the inventory. One way to create an encrypted value for the connection password:
ansible-vault encrypt_string 'your-ssh-password' --name 'ansible_password'Paste the output into the vars block, and do the same for ansible_become_password if your enable secret differs from the login password. Run playbooks with --ask-vault-pass.
Back up before you change anything
Built-in backup in ios_config
The cisco.ios.ios_config module supports a backup before the change is applied. Put the backup in its own play so you can run it alone, and keep the output somewhere under version control or on a separate disk.
Standalone backup with cli_backup
The ansible.netcommon.cli_backup module provides a platform-agnostic way to back up text configuration over network_cli. Its documentation identifies it as part of collection version 8.6.2, and it is not included in ansible-core. Check what you have installed with ansible-galaxy collection list ansible.netcommon, and install or upgrade the collection if the module is missing.
A backup is a precaution, not a recovery plan. Until you have restored a saved file to a lab switch at least once, you have evidence that the backup was written, not that it restores cleanly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply a small, readable change
Lines and parents
Start with one interface or one setting. The playbook below sets a description on GigabitEthernet0/1. The parents line names the interface section, and lines holds the commands that belong under it:
Free tools Windows power users keep installed
One-click scans. No signup required.
- name: Configure IOS switch access ports
hosts: ios_switches
gather_facts: false
tasks:
- name: Back up running configuration
cisco.ios.ios_config:
backup: true
backup_options:
dir_path: ./backups
- name: Set uplink description
cisco.ios.ios_config:
parents: interface GigabitEthernet0/1
lines:
- description Lab uplink to coreWrite full command names. The module documentation warns that abbreviated commands such as desc are not idempotent, which means the module may not recognize the existing config and may keep reapplying the change. Keep indentation consistent with the IOS hierarchy, because indentation under parents decides where the lines land.
Rank #4
- UNIVERSAL CISCO SWITCH RACK KIT: Our rack mount kit compatible with Cisco 3850, 9200, 3650, 9300, and C2960X switches. Offers a secure, professional mount with models like RACK-KIT-T1, C3850-RACK-KIT and RCKMNT-1RU-2KX.
- ROBUST AND HIGH-QUALITY BUILD: This durable universal rack mount kit resists corrosion and supports Cisco gear in demanding IT environments and crafted from premium metal with a silver finish.
- LIGHTWEIGHT YET STURDY DESIGN: This network switch mounting hardware kit perfect for stable, secure mounting in network racks without adding extra weight. Weighs just 0.12 kg, offering strength without bulk.
- ALL-INCLUSIVE MOUNTING KIT: This catalyst rack mount kit includes left and right brackets plus hardware for quick and secure 19-inch rack installation—ideal for organized, pro-level Cisco setups.
- 100% CUSTOMER SATISFACTION: We back our universal rack mount kit for cisco switches kit with full support. Not satisfied? Contact us—we’ll resolve your issue quickly to ensure complete satisfaction.
Templates
For larger changes, keep the config in a Jinja2 template and render it with a lookup. Pass the rendered text to content:
- name: Apply templated configuration
cisco.ios.ios_config:
content: "{{ lookup('ansible.builtin.template', 'templates/sw1.j2') }}"The module documentation describes passing a Jinja2 template through src as deprecated, so use the lookup pattern for new playbooks.
Check the result
- Run the playbook once against one switch:
ansible-playbook -i inventory.yml site.yml --limit sw1 --ask-vault-pass --diff. - Confirm the backup file exists in
./backupsand that it contains the pre-change configuration. - On the switch, run
show running-config interface GigabitEthernet0/1and confirm the description appears under the correct interface. - Run the same playbook again. A correct, idempotent run should report no changes.
- Save the configuration only when you mean to. Set the module’s save option deliberately, or run
write memoryon the switch yourself, and check the currentcisco.iosdocumentation for the option that matches your release.
Failure modes to expect
- Authentication fails before any change. Confirm that plain SSH to the switch works from the workstation first, then check the vault-encrypted values.
- Enable elevation fails. Your enable secret differs from the login password, or
ansible_become_passwordis missing. - The change lands in the wrong section. The indentation or the
parentsline does not match the IOS hierarchy. - Every run reports changes. An abbreviated command or a line the switch rewrites in its own format is causing the mismatch. Compare the playbook line with the output of
show running-config. - cli_backup is missing. The
ansible.netcommoncollection is absent or older than the version that includes the module. - The task runs on a release you have not verified. The documented test on IOS XE 17.3 with CML is the only version statement cited here. Check your own release before relying on the playbook.
Bottom line
The workflow works in principle on a Cisco IOS switch: SSH connection through ansible.netcommon.network_cli, the cisco.ios collection, a backup before every change, and small playbooks that you can reread and rerun. Use a virtual lab for CCNA practice if you do not own hardware, and verify your specific IOS release and Ansible collection versions before you trust a playbook.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
