As part of our Automating Cisco at Scale series, we explore how automating Cisco Catalyst Center with Ansible brings infrastructure-as-code practices to enterprise campus orchestration. Having previously established the groundwork with the Red Hat and Cisco partnership and examined Cisco Meraki, we now address the realities of campus scaling. Eliminating manual configuration errors requires a fundamental operational shift: treating your controller-managed campus network infrastructure as code. In today’s IT landscape, this transition is no longer optional – it is necessary for long-term consistency and speed.
Historically, network engineers automated campus networks through the command-line interface (CLI) – SSHing into devices, parsing raw text with regular expressions, and pushing structured configuration scripts. When Cisco introduced DNA Center (now Cisco Catalyst Center), the operational focus shifted from individual device management to centralized, controller-led, intent-based networking through a user interface or REST APIs.
As enterprise networks scale, managing complex Cisco Catalyst environments through manual operations or custom, brittle API scripts is no longer sustainable. To help network engineers treat infrastructure as code, Cisco and Red Hat have delivered the cisco.catalystcenter Ansible Collection.
Available through Red Hat Ansible Automation Hub, this validated collection provides a robust, enterprise-grade framework of modules, roles, and playbooks that interact directly with Cisco Catalyst Center through its APIs.
High-Value Enterprise Use Cases and Playbook Blueprints
The collection features more than 70 operational and configuration use cases, covered in more than 300 playbooks. The most impactful implementations solve high-friction enterprise problems.
Day 0/1: Zero-Touch Discovery and Provisioning
Manual onboarding of branch devices is a significant bottleneck. Using the Cisco Validated Playbooks (CVP) and roles provided, you can automate the Plug and Play (PnP) onboarding process. Playbooks can programmatically design site hierarchies, allocate global and site-specific IP address pools, and assign device credentials. You can enforce standardized network settings – such as SNMP, telemetry, logging, and wireless profiles – uniformly across the enterprise before a device even connects.
Example: The pnp_workflow_manager module automates the insertion of serial numbers into the controller’s inventory database and immediately binds devices to the correct site layout.
---
- hosts: localhost
gather_facts: false
tasks:
- name: Import and Provision Bare-Metal Switch via Plug-and-Play
cisco.catalystcenter.pnp_workflow_manager:
state: present
configlist:
- device_infolist:
- serialNumber: "FOX2345X67Y"
hostname: "BR01-ASW-02"
platformId: "C9300-48UXM"
authorize: true
siteName: "Global/North America/Austin Office/Floor 2"
Day 2: SD-Access (SDA) Fabric Orchestration
Managing an SDA fabric requires precise configuration. The collection allows you to orchestrate the fabric entirely through code. Use cases include:
- LAN automation: Automating underlay network deployments.
- Fabric management: Programmatically managing SDA fabric sites, zones, and IP/SDA transits.
- Virtual networks: Automating L2 VLANs and L3 Anycast Gateways, as well as seamlessly onboarding hosts and fabric devices.
- Policy enforcement: Managing SDA extranet policies and application policies as code.
Example: Instead of modifying configurations line by line across 500 switches, engineering teams can use Ansible to enforce global compliance tags. These tags trigger policies, dynamic network profiling, or group-based access-control policies within Catalyst Center.
---
- hosts: localhost
gather_facts: false
tasks:
- name: Standardize PCI-Compliance Tags Across Controller Infrastructure
cisco.catalystcenter.tag:
state: present
name: "PCI-DSS-Zone"
description: "Applies Zero-Trust microsegmentation for POS terminals"
register: tag_output
- name: Output Operation Telemetry
ansible.builtin.debug:
var: tag_output.id
Day N: Software Image Management (SWIM) and Assurance
Day N maintenance is critical for security and resilience. The collection transforms highly disruptive tasks into automated, scalable workflows:
- SWIM automation: Automate the entire OS upgrade process. Playbooks can upload images, tag “golden” images by device family, and distribute and activate the images across the network.
- Compliance and backups: Automatically check device compliance against Catalyst Center templates, remediate drift, and trigger scheduled configuration backups and restores.
- Network assurance: Integrate automated troubleshooting by querying Catalyst Center for Device Health Score KPIs and ICAP settings, and execute Path Traces to identify routing or physical-layer issues.
Example: The collection features hundreds of _info modules that extract system telemetry without raw command scraping. The following playbook fetches analytics on authentication health across an entire environment:
---
- hosts: localhost
gather_facts: false
tasks:
- name: Collect Global AAA Service Analytics and Trend Data
cisco.catalystcenter.aaa_services_summary_analytics:
startTime: "1717804800000" # Epoch milliseconds timestamp
endTime: "1717891200000"
register: aaa_analytics
- name: Assert Authentication Failure Rates are Below Thresholds
ansible.builtin.assert:
that:
- aaa_analytics.failedRequests | int < 50
fail_msg: "AAA anomalies detected! Check Catalyst Center Assurance dashboard."
Configuration Generation and “State” Extraction
One of the most unique features of this collection is its Config Generator Roles, such as inventory_config_generator and sda_fabric_virtual_networks_config_generator. These roles allow platform engineers to query Catalyst Center and dynamically extract the current configuration state into structured data. This data can then be checked into a Git repository, enabling true GitOps workflows in which the Git repository remains the synchronized single source of truth for dynamic reporting and documentation.
Engineering Benefits: Automating Cisco Catalyst Center with Ansible
Integrating the cisco.catalystcenter collection with Red Hat Ansible Automation Platform (AAP) in your CI/CD or platform-engineering pipeline provides fundamental technical advantages over legacy scripting practices:
- Eliminate “screen scraping”: Legacy CLI automation depends on regular-expression tools such as TextFSM to convert CLI output into objects. If a Cisco IOS XE update changes a single whitespace character in show command output, your parser can break. This collection works exclusively with JSON structures natively supported by Catalyst Center APIs.
- Adopt true infrastructure as code (IaC): Networks can be defined statefully in YAML files stored in a Git repository. A pull request that changes a site name or assigns a new configuration profile can trigger an AAP workflow, pushing changes reliably to production.
- Synchronize multiple domains: Modern enterprise environments use platforms such as NetBox or ServiceNow as a single source of truth (SSoT). With Ansible, you can build unified workflows that fetch a newly allocated IP prefix from NetBox, register it as an enterprise IP pool through cisco.catalystcenter.ip_pool, and update a ServiceNow change ticket – all within a single orchestration run.
- Abstract scale: A single Ansible task targeting the collection can execute a global policy update across thousands of downstream endpoints. The operator relies on Catalyst Center to handle the underlying concurrency, queuing, and edge-execution safety.
Ready to Build?
To start building, install the collection through Ansible Automation Hub and explore the Cisco Validated Playbooks repository on GitHub.
Want to learn more? Explore Ansible for Catalyst Center on the Cisco Networking App Marketplace to see how automating Cisco Catalyst Center with Ansible can streamline configuration, compliance, and operations at scale.
