Python for Network Engineers

1. Why Python for Network Engineering?

Network engineers have traditionally managed devices one at a time — logging in via SSH or console, typing commands, reading output, and repeating the process across dozens or hundreds of devices. This manual approach is slow, error-prone, and does not scale. Python has become the dominant scripting language for network automation because it is readable, powerful, and supported by a rich ecosystem of networking libraries that handle SSH connections, vendor abstraction, data parsing, and API interaction out of the box.

The shift toward network automation aligns with the network automation and controller-based networking trends that are now core topics in the CCNA curriculum. Understanding Python fundamentals and key networking libraries is an expected baseline skill for modern network engineers.

1.1 Python vs Other Automation Options

Related pages: Network Automation Overview | Ansible Overview | Controller-Based Networking | Northbound & Southbound APIs | JSON, XML & YANG | NETCONF & RESTCONF | Netmiko Show Commands Lab | NAPALM Multi-Vendor Lab | NETCONF with Python (ncclient) Lab | Jinja2 Config Generation Lab

2. Python Networking Library Landscape

The Python ecosystem for networking is rich and layered. Libraries exist at every level — from raw SSH transport up to high-level vendor-agnostic abstraction. Understanding which library solves which problem prevents reinventing the wheel.

3. Netmiko – SSH Automation for Network Devices

Netmiko (developed by Kirk Byers) is the most widely used Python library for SSH-based network automation. It solves the frustrating problem that raw Paramiko SSH sessions require manual handling of every router's unique prompt behaviour, pagination, error messages, and timing. Netmiko abstracts all of this — you specify the device type and Netmiko handles the rest.

3.1 What Netmiko Does Automatically

3.2 Netmiko Supported Device Types (Selected)

3.3 Core Netmiko Methods

4. Simple Show-Command Script with Netmiko

The following scripts demonstrate practical Netmiko patterns — from the simplest single-device connection to a multi-device loop that collects interface information across a fleet.

4.1 Script 1 – Connect and Run a Single Show Command

#!/usr/bin/env python3
"""
Script 1: Connect to a Cisco IOS device via SSH and retrieve
the output of 'show version'.
"""

from netmiko import ConnectHandler

# Device connection dictionary
device = {
    "device_type": "cisco_ios",
    "host":        "192.168.1.1",
    "username":    "admin",
    "password":    "cisco123",
    "secret":      "enable123",    # Enable password
}

# Establish connection
connection = ConnectHandler(**device)

# Enter enable mode (if not already in it)
connection.enable()

# Send the show command and capture output
output = connection.send_command("show version")

# Print the raw output
print(output)

# Clean up the SSH session
connection.disconnect()
print("Connection closed.")

4.2 Script 2 – Multi-Device Loop with show ip interface brief

#!/usr/bin/env python3
"""
Script 2: Connect to multiple Cisco IOS devices, run
'show ip interface brief', and print per-device results.
"""

from netmiko import ConnectHandler

# List of devices to automate
devices = [
    {"device_type": "cisco_ios", "host": "10.0.0.1",
     "username": "admin", "password": "cisco123", "secret": "enable123"},
    {"device_type": "cisco_ios", "host": "10.0.0.2",
     "username": "admin", "password": "cisco123", "secret": "enable123"},
    {"device_type": "cisco_ios", "host": "10.0.0.3",
     "username": "admin", "password": "cisco123", "secret": "enable123"},
]

command = "show ip interface brief"

# Iterate over every device
for device in devices:
    print(f"\n{'='*60}")
    print(f"Connecting to {device['host']}...")

    try:
        conn = ConnectHandler(**device)
        conn.enable()
        hostname = conn.find_prompt().replace("#", "")  # Extract hostname
        output   = conn.send_command(command)
        conn.disconnect()

        print(f"Hostname: {hostname}")
        print(output)

    except Exception as e:
        print(f"ERROR connecting to {device['host']}: {e}")

print("\nAll devices processed.")

4.3 Script 3 – Structured Output with TextFSM Parsing

#!/usr/bin/env python3
"""
Script 3: Run 'show ip interface brief' and use TextFSM
(via use_textfsm=True) to get structured data as a list
of Python dictionaries instead of raw string output.
Requires: pip install netmiko ntc_templates
"""

from netmiko import ConnectHandler
import json

device = {
    "device_type": "cisco_ios",
    "host":        "192.168.1.1",
    "username":    "admin",
    "password":    "cisco123",
    "secret":      "enable123",
}

conn = ConnectHandler(**device)
conn.enable()

# use_textfsm=True triggers TextFSM parsing via NTC-Templates
interfaces = conn.send_command(
    "show ip interface brief",
    use_textfsm=True
)

conn.disconnect()

# 'interfaces' is now a list of dicts — one per interface
print(f"Found {len(interfaces)} interfaces:\n")
for intf in interfaces:
    print(f"  Interface: {intf['intf']:<20} "
          f"IP: {intf['ipaddr']:<16} "
          f"Status: {intf['status']:<10} "
          f"Protocol: {intf['proto']}")

# Pretty-print the full structured data as JSON
print("\nFull structured output:")
print(json.dumps(interfaces, indent=2))

4.4 Script 4 – Push Configuration Changes

#!/usr/bin/env python3
"""
Script 4: Push a list of configuration commands to a device.
Adds a loopback interface, sets a description, and saves.
"""

from netmiko import ConnectHandler

device = {
    "device_type": "cisco_ios",
    "host":        "192.168.1.1",
    "username":    "admin",
    "password":    "cisco123",
    "secret":      "enable123",
}

# Configuration commands to apply
config_commands = [
    "interface Loopback99",
    "description Managed by Python Automation",
    "ip address 10.99.99.1 255.255.255.255",
    "no shutdown",
]

conn = ConnectHandler(**device)
conn.enable()

# send_config_set enters config mode, applies all commands, exits
output = conn.send_config_set(config_commands)
print("Configuration output:")
print(output)

# Save the running configuration
save_output = conn.save_config()
print("\nSave output:")
print(save_output)

conn.disconnect()
print("Configuration applied and saved.")

5. NAPALM – Network Automation and Programmability Abstraction Layer with Multivendor support

NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) is a Python library that provides a unified, vendor-neutral API for interacting with network devices. Where Netmiko gives you SSH access with vendor-aware prompt handling, NAPALM goes further — it defines a common set of methods that work identically across different vendor platforms, returning structured Python data regardless of vendor.

The key value proposition: you write your automation code once using NAPALM's standard API, and it works against a Cisco IOS router, an Arista EOS switch, and a Juniper router without changing a single line of business logic — only the driver parameter changes.

5.1 NAPALM Supported Drivers

5.2 NAPALM Core Get Methods

NAPALM's getter methods provide structured data in Python dictionaries — no parsing required. Every getter works the same way on every supported platform:

5.3 NAPALM Configuration Management

6. Simple NAPALM Scripts

6.1 Script 5 – Collect Facts with NAPALM

#!/usr/bin/env python3
"""
Script 5: Use NAPALM to collect structured device facts from
a Cisco IOS device. The same code works for Arista EOS or
Juniper JunOS by changing only the driver name.
Requires: pip install napalm
"""

import napalm
import json

# Select the correct driver for the vendor
driver = napalm.get_network_driver("ios")   # Change to "eos" or "junos" etc.

# Connect to the device
device = driver(
    hostname  = "192.168.1.1",
    username  = "admin",
    password  = "cisco123",
    optional_args = {"secret": "enable123"},  # IOS enable password
)

device.open()

# Collect structured facts — same method on every vendor
facts = device.get_facts()
print("=== Device Facts ===")
print(json.dumps(facts, indent=2))

# Collect interface IP addresses
interfaces_ip = device.get_interfaces_ip()
print("\n=== Interface IP Addresses ===")
print(json.dumps(interfaces_ip, indent=2))

device.close()
print("\nConnection closed.")

6.2 Script 6 – Preview Config Changes with NAPALM Diff

#!/usr/bin/env python3
"""
Script 6: Use NAPALM's compare_config() to preview what will
change on the device before committing — a safe change
management workflow.
"""

import napalm

driver = napalm.get_network_driver("ios")

device = driver(
    hostname      = "192.168.1.1",
    username      = "admin",
    password      = "cisco123",
    optional_args = {"secret": "enable123"},
)

device.open()

# New configuration snippet to merge in
new_config = """
interface Loopback100
 description Managed by NAPALM
 ip address 10.100.100.1 255.255.255.255
 no shutdown
"""

# Load as a merge candidate (non-destructive — adds to existing config)
device.load_merge_candidate(config=new_config)

# Review the diff BEFORE committing
diff = device.compare_config()
if diff:
    print("=== Configuration Diff (+ = add, - = remove) ===")
    print(diff)

    # Only commit if the diff looks correct
    confirm = input("\nCommit this change? (yes/no): ")
    if confirm.lower() == "yes":
        device.commit_config()
        print("Configuration committed.")
    else:
        device.discard_config()
        print("Changes discarded — device unchanged.")
else:
    print("No changes detected — device already in desired state.")
    device.discard_config()

device.close()

6.3 Script 7 – Multi-Vendor Inventory Script

#!/usr/bin/env python3
"""
Script 7: Collect hostname, model, and OS version from a
mixed-vendor fleet (Cisco IOS + Arista EOS) using the same
NAPALM get_facts() call — vendor-agnostic code.
"""

import napalm
import json

# Mixed-vendor device inventory
inventory = [
    {"driver": "ios",  "host": "10.0.0.1",
     "username": "admin", "password": "cisco123",
     "optional_args": {"secret": "enable123"}},
    {"driver": "ios",  "host": "10.0.0.2",
     "username": "admin", "password": "cisco123",
     "optional_args": {"secret": "enable123"}},
    {"driver": "eos",  "host": "10.0.0.3",
     "username": "admin", "password": "arista123",
     "optional_args": {}},
]

results = []

for entry in inventory:
    driver_name = entry.pop("driver")   # Extract driver name
    drv = napalm.get_network_driver(driver_name)
    dev = drv(**entry)

    try:
        dev.open()
        facts = dev.get_facts()
        results.append({
            "host":     entry["host"],
            "vendor":   facts["vendor"],
            "hostname": facts["hostname"],
            "model":    facts["model"],
            "os_version": facts["os_version"],
        })
        dev.close()
    except Exception as e:
        results.append({"host": entry["host"], "error": str(e)})

# Print summary table
print(f"\n{'Host':<15} {'Vendor':<10} {'Hostname':<20} "
      f"{'Model':<20} {'OS Version'}")
print("-" * 85)
for r in results:
    if "error" in r:
        print(f"{r['host']:<15} ERROR: {r['error']}")
    else:
        print(f"{r['host']:<15} {r['vendor']:<10} {r['hostname']:<20} "
              f"{r['model']:<20} {r['os_version']}")

7. Netmiko vs NAPALM – When to Use Each

8. Output Parsing – TextFSM and NTC-Templates

A critical challenge in SSH-based automation is converting the unstructured text output of CLI show commands into structured data (lists, dictionaries) that Python can process programmatically. Two primary approaches exist:

9. Python Environment Setup for Network Automation

Before running any of the scripts on this page, you need a properly configured Python environment. Here is the recommended setup:

9.1 Install Python and Create a Virtual Environment

# Verify Python 3.8+ is installed
python3 --version

# Create a virtual environment (keeps project dependencies isolated)
python3 -m venv netauto-env

# Activate the virtual environment
# On macOS/Linux:
source netauto-env/bin/activate

# On Windows:
netauto-env\Scripts\activate

# Your prompt changes to show (netauto-env) when active

9.2 Install Networking Libraries

# Install Netmiko and TextFSM support (NTC-Templates)
pip install netmiko ntc_templates

# Install NAPALM (includes IOS, NX-OS, EOS, JunOS drivers)
pip install napalm

# Install requests (for REST API interaction)
pip install requests

# Install nornir (automation framework — optional)
pip install nornir nornir-netmiko nornir-napalm

# Freeze current versions to requirements.txt for reproducibility
pip freeze > requirements.txt

# Reinstall from requirements.txt on another system:
pip install -r requirements.txt

9.3 Best Practices for Credentials

Never hard-code credentials directly in scripts. Use one of these approaches:

10. Error Handling in Network Scripts

Network devices are unreliable — SSH timeouts, authentication failures, and command errors are normal. Production automation scripts must handle errors gracefully so that one failed device does not crash the entire script.

#!/usr/bin/env python3
"""
Script 8: Robust multi-device script with proper error handling,
logging, and result collection.
"""

from netmiko import ConnectHandler
from netmiko.exceptions import (
    NetMikoTimeoutException,
    NetMikoAuthenticationException,
)
import logging
import json
from datetime import datetime

# Configure logging to file and console
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(message)s",
    handlers=[
        logging.FileHandler(f"netauto_{datetime.now().strftime('%Y%m%d_%H%M')}.log"),
        logging.StreamHandler()
    ]
)

devices = [
    {"device_type": "cisco_ios", "host": "10.0.0.1",
     "username": "admin", "password": "cisco123", "secret": "enable123"},
    {"device_type": "cisco_ios", "host": "10.0.0.2",
     "username": "admin", "password": "wrongpass", "secret": "enable123"},
    {"device_type": "cisco_ios", "host": "10.0.99.99",   # Unreachable
     "username": "admin", "password": "cisco123", "secret": "enable123"},
]

results = {}

for device in devices:
    host = device["host"]
    logging.info(f"Connecting to {host}")

    try:
        conn = ConnectHandler(**device)
        conn.enable()
        hostname = conn.find_prompt().replace("#", "")
        output   = conn.send_command("show ip interface brief")
        conn.disconnect()

        results[host] = {"status": "success", "hostname": hostname,
                         "output": output}
        logging.info(f"{host} ({hostname}) — SUCCESS")

    except NetMikoTimeoutException:
        results[host] = {"status": "timeout"}
        logging.error(f"{host} — TIMEOUT (device unreachable)")

    except NetMikoAuthenticationException:
        results[host] = {"status": "auth_failed"}
        logging.error(f"{host} — AUTHENTICATION FAILED")

    except Exception as e:
        results[host] = {"status": "error", "message": str(e)}
        logging.error(f"{host} — ERROR: {e}")

# Summary
print(f"\n{'='*50}")
print("SUMMARY")
print(f"{'='*50}")
for host, result in results.items():
    print(f"{host:<15} {result['status']}")

# Save full results to JSON
with open("results.json", "w") as f:
    json.dump(results, f, indent=2)
print("\nResults saved to results.json")

11. Python for Networking Quick-Reference Summary

Test Your Knowledge – Python for Networking Quiz