DEV Community: Justin Cooksey

Using Ansible to set standards across Cisco SMB Switches

Justin Cooksey — Tue, 08 Jul 2025 06:00:00 +0000

I covered some of the base configuration in a previous article on how Netbox and Ansible work together. This time I'm covering working with the Ansible Community Cisco SMB collection to manage Cisco Small and Medium Business switches in the ranges SG300, SG500, SG350, SG550, CBS350 and C1300.

The source of truth in this environment is Netbox IPAM. As before Netbox is being used for Ansibles inventory via the Netbox Namespace collection.

Setting the Standard

New switches will get a standard configuration by first adding them in to Netbox and then creating the configuration using Netbox Configuration Rendering. This playbook is used to bring current switches to a standard, enforcing that standard and/or applying any new changes to the standards. Setting standards such as keeping them all on a set timezone as well as the same time, domain name servers, and security methods controlling access and password policies.

To make it easier to explain I'm splitting these in to different tasks. They could all be run as one task, but this way is easier to explain what each part is trying to achieve.

Start of the Playbook

Setting the stage for the rest of the playbook. 1. No need to spend time getting device facts, so gather_facts run so its set to false 2. Selecting only the switches from inventory by setting hosts as device_roles_switch. This will pick only the switches from Netbox device list based on each device in Netbox having the Device Role field correctly set. 3. Loading variables/secrets to be used for SSH connections as well as the Netbox API from an Ansible Vault file secrets.yml 4. Setting other default variables for running the playbook

- name: Standard Switch Configuration
  gather_facts: false
  hosts: device_roles_switch

- vars_files:
    - ~/ansible/vaults/secrets.yml

  vars:
    ansible_network_os: community.ciscosmb.ciscosmb
    ansible_connection: network_cli
    ansible_become: true
    ansible_become_method: enable

  tasks:

Basic TCP/IP Network Settings

Setting the basic network network settings. This will allow for changing the domain name servers across the board if that has to happen at some future point. 1. Setting the IP address of name servers (DNS) using ip name-server. 2. Setting the default domain name to be used on name lookups using ip domain name.

    - name: Set Base Network (DNS)
      community.ciscosmb.command:
        commands:
          - configure terminal
          - ip name-server 192.168.1.2 192.168.2.2
          - ip domain name domainname.local
          - exit

Setting and Syncing Time and Date

While it's potentially a good idea to simply set all devices to a set timezone, such as UTC and then, I thought Id include the other option of using a local timezone and even incorporating daylight savings changes. With this setup the switch logs will always be on the local time of those looking at them, assuming we aren't talking timezone spanning businesses. 1. Set the timezone code and its difference from UTC 2. Set the daylight savings start and end points 3. Set the NTP servers to sync time from. 4. Ensure the source is set to use those NTP servers

    - name: Set Time Settings (Timezone & SNTP)
      community.ciscosmb.command:
        commands:
          - configure terminal
          - clock timezone AEST +10
          - clock summer-time AEDT recurring first sun oct 02:00 first sun apr 03:00
          - sntp server 192.168.1.3 poll
          - sntp server 192.168.2.3 poll
          - clock source sntp
          - exit

Securing

We only need the one secure method of access, and SSH is it. 1. Disabling Telnet, HTTP and HTTPS access

    - name: Disable HTTP(S) and Telnet
      community.ciscosmb.command:
        commands:
          - configure terminal
          - no ip http server
          - no ip http secure-server
          - no ip telnet server
          - exit

Set password security limits, but disabling ageing of the password being enforced by the switch

    - name: Set Password Security
      community.ciscosmb.command:
        commands:
          - configure terminal
          - passwords aging 0
          - passwords complexity min-length 12
          - exit

Completed

Finally we can clearly add more in if there are other standard that need to be kept. Otherwise we write the config to the switch.

    - name: Write Config Changes
      community.ciscosmb.command:
        commands:
          - wr mem

Conclusion

Not the most complicated playbook, but a useful one to get and keep everything at a set standard. Among other options, if you want to collect logs centrally another addition would be to set a syslog server to collect all logs from each device centrally.

Development on Fedora 41

Justin Cooksey — Mon, 20 Jan 2025 05:00:00 +0000

So, moving to Linux ...

I've been using MacOS for a few years now for my own development environment, and always enjoyed using something different from the required work Windows systems. MacOS, and Apple hardware, have always been pretty on point in my oppinion. However, for a while now, I'd wanted to jump back in to Linux as my primary OS. I have already been moving away from commercial applications, getting rid of my Adobe account and migrating to using Darktable along with other subscription based applications (not all). This is my inital experience migrating from developing on Windows and MacOS to developing on Linux, or in particular Fedora 41.

Most of my development work is in Python, although work means I do a fair share of PowerShell, so the initial focus is around Python and getting my normal tools up and running.

Visual Studio Code

Visual Studio Code (VSCode) does come as a FlatPak via the Software app in Fedora 41, and its a pretty recent version (as of time of writting) at 1.96.1 with the latest being 1.96.4. However I opted to install directly off the VSCode web site and use the rpm download. This installed without any issues and the Fedora Software app does show it as installed after using this method. I had no issues at all on first run and syning in the Extenxsion I use by sing Setting Sync to replicate what I have on my MacOS machine.

Shell

I haven't yet explored and/or moved to ZSH at this time. I know that along with Oh My Zsh it makes for a pretty useful Shell, but at this point I'm sticking with the default bash and will look at options little later on.

Python

Fedora 41 came with Python 3.13.1, which at the time of writing is the latest release version of Python. Sometimes though we need to be able to run our code against other, older versions of Python. Enter pyenv ...

pyenv

If you havent used pyenv before the Real Python site has a great article on Managing Multiple Python Versions With pyenv

pyenv took a little bit longer to get operational. This was because the default install of Fedora 41 does not install development packages, so I had to do a little research and test and research again before I got it all working. First off was to install the development-tools group of packages after which I still had some missing libraries to add in as well. The final result is as follows:

sudo dnf install @development-tools
sudo dnf install python3-tkinter python3-xlib bzip2-devel ncurses-devel libffi-devel readline-devel tk-devel libsqlite3x-devel

This has now allowed me to install and use other versions of Python on my Fedora 41 based laptop. Which means I can now update this web site with this article ...

Cisco DHCP Pool conversion to Windows Server DHCP

Justin Cooksey — Sun, 13 Oct 2024 05:00:00 +0000

Well it was bound to happen! Three years now after being asked to migrate DHCP from Windows DHCP server to Cisco Routers, and automating that convertion, it's finally going back the other way.

This time the PowerShell script will read through the file (an exported Cisco Router configuration) and build the Scopes in the Windows DHCP Role. The script will need to be run on the server becoming the DHCP server for those new scopes. The user would need to have administrator privilege to allow the DHCP settings to be made.

The script follows these steps:

Reads through the configuration file and, using Regular Expressions, finds all DHCP Pools (Scopes), Static Assignments and Exclusions.
Creates all the Scopes, along with all options found under that Pool in the router configuration file.
Processes the Exclusions into each Scope
Process all static assignments

Still a little bit in the works at the time of this posting, but testing across multiple configurations has found it working well. The Code Repository can be found on GitHub

Some DHCP Options are being handled as follows.

Code	Cisco Config	Option Description
3	default-router	Default Gateway
6	dns-server	Domain Nameservers
15	domain-name	Domain Name
42	option 42 ip	NTP Servers
43	option 43 hex	Vendor Specific Option, usually WAP Controller IP
51	lease	Lease time
66	next-server	TFTP Server
66	option 66 ip	TFTP Server
67	bootfile	Boot filename
67	option 67 ascii	Boot filename

Example Cisco Config

ip dhcp excluded-address 10.10.0.1 10.10.1.0
ip dhcp excluded-address 10.10.3.220 10.10.3.223
ip dhcp excluded-address 192.168.0.1 192.168.0.9
!
ip dhcp pool PoolNumber1
 network 10.10.0.0 255.255.248.0
 update dns both override
 dns-server 10.10.255.1 10.10.255.2 
 domain-name domainname.local
 option 42 ip 10.10.249.11 10.10.248.11 
 default-router 10.10.0.1 
 lease 8
!
ip dhcp pool PoolNumber2
 network 192.168.0.0 255.255.255.0
 dns-server 192.168.0.10
 option 43 hex f108.0afe.0064
 default-router 192.168.0.1
!
ip dhcp pool Device1
 host 10.10.1.30 255.255.248.0
 client-identifier 01b7.37eb.1f1a.0a
 default-router 10.10.0.1 
!
ip dhcp pool Device2
 host 192.168.0.44 255.255.255.0
 client-identifier 0132.c19f.b7f3.3b

This script makes use of the IPv4Calc Module

Netbox and Ansible for for Small to Mid Business Networks

Justin Cooksey — Sat, 31 Aug 2024 04:00:00 +0000

Ansible and Netbox are not just for the high end data centre systems. They can also be used on networks using small to medium business switches and routers such as the Cisco SMB Product range.

Initial Auditing and OnBoarding

Initally I started with brand new empty Netbox. In which I manually created a base setup adding in each:

Site
Patch
Device model in use
Prefix, to begin with just the management subnets

Then creating a yaml file host listing to beging with, I ran an Ansible Playbook that then went through that list of devices pulling base device information:

IP Address (Management)
Hostname
Model
Serial number
Firmware (This was not initally used)

This was then to record in to Netbox as new devices as well as exported to CSV. After I had the devices in Netbox I could do some base housekeeping and put them in the right sites, patches and rack locations.

Netbox, the Source of Truth

Once the devices were in and housekeeping done Netbox then became the Source of Truth for both our engineers and technicians and also for Ansible. I could remove the hosts yaml file an dpointing AQnsible at Netbox for its inventory I could now allow playbooks to be run against a site and other locations or across the whole group.

Minimum config

One of the frist tasks was to ensure I had all devices, configured to a standard. I hoped that they have been, but over time, without continued audits and checks, things can become a little out. So using Ansible I was able to ensure some defaults are set, such has:

Disabling of access methods, such as HTTP, Telnet and also HTTPS
NTP time servers and synchronised time
Name Servers
Monitoring service setting (SNMP)

Backup config

Another task for Ansible was to get regular configuration backups for all devices. Running an Ansible Playbook on a daily schedule (Cron) to pull the current configuration and store it on the local file system of the Ansible server. This was then replicated off site over secure protocols.

- name: Gather Facts
  gather_facts: no
  hosts: device_roles_switch
  vars:
    output_path: "{{ lookup('env', 'HOME') }}/backups/"

  tasks:
    ## Create backup folder for today
    - name: Get date stamp for filename creation
      set_fact: date="{{lookup('pipe','date +%Y%m%d')}}"
      run_once: true

    # Get Switch Config
    - name: Get Config
      community.ciscosmb.facts:
        gather_subset:
          - config

    - name: Save Config
      copy:
        content: "{{ ansible_net_config }}"
        dest: "{{ output_path }}{{ inventory_hostname }}-{{ date }}.txt"

Finding Trunks and Devices

Another task was find all the trunks between switches & patches and docuemnt them correctly in Netbox. Running an Ansible Playbook to use LLDP from gather facts to then determine th elinks between device, that could then be documented as Netbox cables. Once that was done I also used the Netbox Topology Views plugin to visualise the network.

Once that was done I could also use MAC address searches to determine what ports IP Phones, DAPs and WAPs were connected to among other devices. Since a standard brand of those was used throughout it was only a matter of searching for the manufacturer portion of the MAC address.

Publishing Pelican Created Site

Justin Cooksey — Sun, 30 Jul 2023 09:30:00 +0000

This is the second part (see part 1 here) of my migrating a static web site over to Pelican Static Site Generator, after my inital posting Pelican Static Site Generator

Google Analytics

To transfer over Google Analytics web site code to the Pelican created site was as simple as adding it in to pelicanconf.py as a varible and done. This is all well docmented on the Pelican doumentation.

pelicanconf.py

GOOGLE_ANALYTICS = your_site_code

Hosting and Replacing on Netlify

As the GatsbyJS site was hosted on Netlify which also supports Python and Pelican builds rehosting on Netlify was relatively easy.

First though was getting the source repository ready. Starting with making sure the requirements.txt file exists, as Netfliy build process will be using this to install the required python libraries for the site. I generally keep this up to date as I work, but simply creating it again with the usual command is easy enough:

pip freeze > requirements.txt

Then making sure the publishconf.py file has all the correct settings for the final published site. This was pretty much correct and needed only confirming that it had the correct variables in it for the final site. Overwriting the development variables stored in pelicanconf.py.

A netfliy.toml file in the root of the repo will give Netlify the commands to build the site and location of the built site files to publish:

[build]
command = "pelican content -s publishconf.py"
publish = "output"

also a block to specificy the page (HTML file) to display for a 404 page not found repsonse:

[[redirects]]
from = "/*"
to = "/404.html"
status = 404

Linking in the new repo

After those things are all settled it is just a matter of linking the GitHub repo to the the Netlify site, and Netfliy will do the rest. Building the site and publishing it ready for use.

So is that it?

Well, while I have the Pelican built site now the active builder for the static pages on the site, I still have plenty to work on. Plenty to upgrade including the theme, which is still not quite right, and of course content on the site for other projects and well whatever else is happening in life......

Pelican Static Site Generator

Justin Cooksey — Sun, 18 Jun 2023 10:33:00 +0000

I've been investigating Pelican a static site generator to replace my current GatsbyJS generated site. Im far more at home and familiar with Python and Jinja2, so that was part of my reasoning for taking a look in to it.

So working along the basis of replacing my current GatsbyJS created site and posts with one created by Pelican, the following cover my initial issues and solutions. I've only added brief notes on what was done, without going in to detail as the plugin sites cover correct use in detail.

Table of Contents

Redirect old site paths
Canonical
Sitemap
Social Media Shares
RSS/Atom Feed
Code Highlighting
Conclusion

Redirect old site paths

In investigting moving to a new static site gernerator I also decided to change the sturcure a little. Since not many articles existed at the time of this posting minimal redirects will have to be created.

So how does Pelican handle this on a per article basis?

Enter the pelican-redirect plugin. Installing it is as simple as installling from PyPi

pip install pelican-redirect

Then by adding an additional line in to the metadata of each post

original_url: blog/hacktoberfest-2019.html

Pelican will create an HTML file at the URL location specified that will redirect to the new post location that it will create.

Canonical

In order to add the canonical header entry on articles using the SITEURL variable does not create what you need if RELATIVE_URL = True is set. To get around this and always use a full URL you can copy the SITEURL variable in to CANONICALURL and then use that variable in the base.html template.

pelicanconf.py

SITEURL = "https://jscooksey.github.io/Pelican"
CANONICALURL = SITEURL

base.html

<head>
  <title>{{SITENAME}}</title>
  {% if article %}
    <link rel="canonical" href="{{ CANONICALURL }}/{{ article.url }}" />
  {% endif%}

Sitemap

To produce sitemap files for SEO add the pelican-sitemap plugin:

pip install pelican-sitemap

and then adding a SITEMAP variable to the pelicanconf.py as described in the README of the Repo

Social Media Shares

I also had on my curent site social media sharing links at the bottom of every article, allowing the reader to share the article on there own social media streams.

The share-post plugin does this and again is simply installed using pip

pip install pelican-share-post

Then in the article.html template add link to atricle.share_post attribute

<a href="{{article.share_post\['twitter'\]}}">...</a>
<a href="{{article.share_post\['facebook'\]}}">...</a>
<a href="{{article.share_post\['linkedin'\]}}">...</a>

RSS/Atom Feed

Adding in Atom (or RSS) feeds is as easy as changing a few options, as this is built in to Pelcon. Changing a few options in the pelicanconf.py

FEED_MAX_ITEMS = 20
FEED_ALL_ATOM = "feeds/all.atom.xml"
CATEGORY_FEED_ATOM = "feeds/{slug}.atom.xml"
TRANSLATION_FEED_ATOM = None
AUTHOR_FEED_ATOM = None
AUTHOR_FEED_RSS = None

Code Highlighting

Markdown code highlighting is processed ultimately through Pygment which can be personailsed but has some builtin styles. Examples are on the Pygment site here and css files for these can be copied from the repo richleland/pygments-css.

You can copy the CSS file of your choice to your themes static folder (eg static/css/pygment.css ) and then import that in the base.html

@import url(pygment.css);

Markdown code blocks can then be used and refer to the type of code inside them.

Conclusion

This is as far as I've gotten so far in working in Pelican and this Pelican created site is initially hosted on GitHub Pages at the URL https://jscooksey.github.io/Pelican/

I'll as I figure things out further, with the intention this will replace the primary site hosted at my domain.

Windows Server DHCP conversion to Cisco CLI

Justin Cooksey — Wed, 03 Mar 2021 21:00:00 +0000

I recently ran in to an issue where I needed to convert a reasonably large DHCP database from a Windows Server in to a Cisco CLI to allow the Cisco to take over DHCP roles for a subnet. I found nothing that realy automated this task, even using the exported XML file. So knowing that this was the second time I needed the tool, and likely to need it again, even if it was for smaller tasks, I set about coding it in Powershell. It is the scripting system well supported in Windows land.

The current version of the script can be found on my GitHub repository:Convert-WindowsDHCPToCisco

Still ha smany DHCP options that it hasn't been setup to hanle at this point but it does follow the basic ones that most of us use.

Currently handles DHCP Options

Code	Option Description	Cisco Output
3	Default Gateway	default-router
4	Time Server	ignoring
6	Domain Nameserver	dns-server
15	Domain Name	domain-name
42	NTP Servers	option 42 ip
51	Lease time	ignoring
66	TFTP Server	next-server
67	Boot filename	bootfile
81	MS DHCP Name Protection	ignoring
121	Static routes	option 121 hex
161	FTP Server	option 161 ip
162	Path	option 162 ascii
252	Proxy PAC URL	option 252 asicc

DHCP References Used

Hacktoberfest - What a great idea!

Justin Cooksey — Sat, 02 Nov 2019 21:32:56 +0000

While I enjoyed my first involvement with Hacktoberfest this year, I didn't end up completing enough pull request for the month. Partly this was due to a busy workload for the 9-5 job, but also I found that I wanted to find projects I could stay involved with.

Hacktoberfest did its job and got me more involved, more interested in contributing to open source projects on GiHub. I'd already done a first step back in Dec 18 on ollelauribostrom/rebus which is a great repository for your first attempt at a pull request. So I was ready to find some more projects I could help with.

To begin with I tried to just find anything that would get me across the line, but the fist project was really just an open repository to submit any code to help get 4 pull requests. Not really what's intended, and a few of these were (rightly) getting excluded from the competition.

The second one was valid, and gave me a better feeling of accomplishment when submitting the pull request, but that also made me more focussed on finding something that I could not only help with, but that I could have some continued interest in.

I know that in a lot of projects any help is appreciated, and that full support of the whole project is not really required, as long as you can help solve the issue, add the feature..... But I think I spent most of my time searching for that elusive project. One that was not only looking for help but was something that would be longer term than just one pull request.

I'm thinking the only way to find these projects is time, getting involved in open source by helping any project you can, and somewhere along the way one will appear that really takes your focus. Or perhaps, over time, a project you contribute to will become something more to you.

Hacktoberfest is a great idea. It got me contributing, and keen to try again next year, but I hope to keep its intent rolling through the year.

My thanks to DigitalOcean and DEV for the incentive.