Using Ansible for Automated Network Testing

The problem with making changes to any decent-sized network, which is running a routing protocol such as OSPF, is that in order to fully verify the change you will need to log into every device in the network and verify that your change has worked. This post shows how Ansible can be used to perform basic tests on Cisco IOS devices.

In this short example, I’ll start off with a basic lab network consisting of 4 routers running IOS and a Linux host with Ansible installed. I haven’t shown how Ansible is configured to log into each router – there’s plenty of examples on the net showing how to do that.

Before starting, manually check that the Ansible host can ssh into each IOS device by running a simple test command using the raw module from Ansible to verify that it can log into each device:

Now create the Ansible playbook to perform the tests required. In the playbook below, I will perform the following tests on the routers belonging to the group “labrouters”:

  • Test that each target router can ping it’s local gateway, 172.16.1.1
  • Verify that there is a route to 192.168.1.0/24 in the routing table
  • Ping the host address 192.168.1.5
  • Verify that the default 0.0.0.0/0 exists in the routing table
  • Ping the Google DNS server at 8.8.8.8

Here is the example playbook:

Running the playbook is just a simple command:

Ansible runs all of the checks, against all of the routers, in parallel and reports the results in a section for each test. If a test fails, then Ansible will report the failure, and stop running tests. As a test, I’ve removed the default route from r4 and re-run the playbook against r4:

The message from the failed test is a bit cryptic, but you get the idea.

From this quick example you should be able to see how Ansible can be used to run a multitude of tests against a number of network devices in a very scalable manner. These kind of tests are invaluable in a large network when complex changes are being made to a distributed control plane where a small change to a single device can affect the whole network. The tests are typically run both before and after changes are made to verify that the network is operating properly in both cases.

Additional playbooks can be created to test almost any network function that you can think of. It is certainly much easier to get Ansible to do the tasks in parallel than to manually log into each device, run the commands, and check the results by hand.

Permanent link to this article: https://www.crypt.gen.nz/2017/11/26/using-ansible-for-automated-network-testing/

Leave a Reply

Your email address will not be published.