Cisco netauto

Cisco Network Automation (API/SDN) Scripts

Write Python scripts for API-driven Cisco network automation. Follow these standards:

Supported APIs

RESTCONF (IOS-XE)

• Base URL: https://{device}/restconf/data/
• YANG models: Cisco-IOS-XE-native, ietf-interfaces, ietf-routing
• Use for: interface config, routing, ACLs, system settings
• Content-Type: application/yang-data+json

NETCONF (IOS-XE / NX-OS)

• Port 830, SSH subsystem
• Use ncclient library
• Operations: get, get-config, edit-config, commit
• Filter with XPATH or subtree XML

DNA Center

• Token auth: POST /dna/system/api/v1/auth/token
• Device inventory: GET /dna/intent/api/v1/network-device
• Command runner: POST /dna/intent/api/v1/network-device-poller/cli/read-request
• Template deployment, path trace, client health

Meraki Dashboard API

• Base URL: https://api.meraki.com/api/v1/
• API key via header: X-Cisco-Meraki-API-Key
• Organizations, networks, devices, SSIDs, VLANs

Libraries to Use

• requests for REST APIs (RESTCONF, DNA Center, Meraki)
• ncclient for NETCONF
• xmltodict for XML parsing
• meraki (official SDK) for Meraki
• dnacentersdk for DNA Center
• yang-suite references for YANG model exploration
• urllib3 (disable warnings for lab self-signed certs)

Script Patterns

RESTCONF Example Structure

import requests
import urllib3
urllib3.disable_warnings()

BASE_URL = "https://{host}/restconf/data"
HEADERS = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json"
}

def get_interfaces(host, auth):
    url = f"https://{host}/restconf/data/ietf-interfaces:interfaces"
    resp = requests.get(url, headers=HEADERS, auth=auth, verify=False)
    resp.raise_for_status()
    return resp.json()

NETCONF Example Structure

from ncclient import manager

def get_running_config(host, username, password):
    with manager.connect(
        host=host, port=830,
        username=username, password=password,
        hostkey_verify=False
    ) as m:
        config = m.get_config(source="running")
        return config.xml

Best Practices

• Always handle rate limiting (especially Meraki: 10 req/sec)
• Use session objects for connection reuse
• Implement retry logic with exponential backoff
• Verify API call success with status codes
• Support --dry-run flag that shows payload without sending
• For lab environments, disable TLS verification with verify=False but log a warning
• For production, use proper certificate validation

Security Requirements

• NEVER hardcode API keys, tokens, or passwords
• Use environment variables or .env files (gitignored)
• Rotate tokens appropriately (DNA Center tokens expire)
• Log API calls but mask credentials in output