Network Automation 101 — Ansible Playbook สำหรับ Cisco / FortiGate

# Install ansible-core (lightweight, ไม่รวม community package ทั้งหมด)
pip install ansible-core

# Install Network Collection ที่จำเป็น
ansible-galaxy collection install ansible.netcommon
ansible-galaxy collection install cisco.ios
ansible-galaxy collection install fortinet.fortios

# ตรวจสอบ version
ansible --version
ansible-galaxy collection list | grep -E "cisco|fortinet|netcommon"

network-automation/
├── inventory/
│   ├── hosts.ini
│   └── group_vars/
│       ├── cisco_switches.yml
│       └── fortigate_devices.yml
├── playbooks/
│   ├── backup-config.yml
│   ├── push-vlan.yml
│   └── audit-firmware.yml
└── vault/
    └── secrets.yml   # เข้ารหัสด้วย Ansible Vault

[cisco_switches]
sw-hq-01 ansible_host=192.168.1.11
sw-hq-02 ansible_host=192.168.1.12
sw-branch-01 ansible_host=10.10.1.11
sw-branch-02 ansible_host=10.10.1.12

[fortigate_devices]
fg-hq ansible_host=192.168.1.1
fg-branch-01 ansible_host=10.10.1.1

[cisco_switches:vars]
ansible_network_os=cisco.ios.ios
ansible_connection=network_cli
ansible_user=admin
ansible_password={{ vault_cisco_password }}
ansible_become=yes
ansible_become_method=enable
ansible_become_password={{ vault_cisco_enable }}

[fortigate_devices:vars]
ansible_network_os=fortinet.fortios.fortios
ansible_connection=httpapi
ansible_user=admin
ansible_password={{ vault_fg_password }}
ansible_httpapi_use_ssl=yes
ansible_httpapi_validate_certs=no

# สร้าง Vault (จะถามสร้าง Vault Password)
ansible-vault create vault/secrets.yml

# เนื้อหาใน secrets.yml
vault_cisco_password: "YourCiscoPass"
vault_cisco_enable: "YourEnablePass"
vault_fg_password: "YourFGPass"

# รัน Playbook พร้อม Vault
ansible-playbook playbooks/backup-config.yml -i inventory/hosts.ini --ask-vault-pass

---
- name: Backup Cisco IOS Running Config
  hosts: cisco_switches
  gather_facts: false

  tasks:
    - name: Get running config
      cisco.ios.ios_command:
        commands:
          - show running-config
      register: config_output

    - name: Save config to local file
      ansible.builtin.copy:
        content: "{{ config_output.stdout[0] }}"
        dest: "./backups/{{ inventory_hostname }}_{{ ansible_date_time.date }}.cfg"
      delegate_to: localhost

    - name: Show backup status
      ansible.builtin.debug:
        msg: "Backup completed: {{ inventory_hostname }}"

mkdir -p backups
ansible-playbook playbooks/backup-config.yml \
  -i inventory/hosts.ini \
  --ask-vault-pass

---
- name: Push VLAN Configuration to Cisco Switches
  hosts: cisco_switches
  gather_facts: false

  vars:
    vlans_to_add:
      - { id: 100, name: "MGMT" }
      - { id: 200, name: "USERS" }
      - { id: 300, name: "SERVERS" }
      - { id: 400, name: "VOIP" }

  tasks:
    - name: Create VLANs
      cisco.ios.ios_vlans:
        config:
          - vlan_id: "{{ item.id }}"
            name: "{{ item.name }}"
            state: active
        state: merged
      loop: "{{ vlans_to_add }}"

    - name: Verify VLANs exist
      cisco.ios.ios_command:
        commands:
          - show vlan brief
      register: vlan_output

    - name: Display VLAN table
      ansible.builtin.debug:
        var: vlan_output.stdout_lines

---
- name: Audit FortiGate Firmware Version
  hosts: fortigate_devices
  gather_facts: false

  vars:
    minimum_firmware: "7.4.3"

  tasks:
    - name: Get system status
      fortinet.fortios.fortios_monitor_fact:
        selector: "system_status"
      register: fg_status

    - name: Extract firmware version
      ansible.builtin.set_fact:
        current_firmware: "{{ fg_status.meta.version }}"

    - name: Display firmware version
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }}: Firmware {{ current_firmware }}"

    - name: Flag devices with outdated firmware
      ansible.builtin.fail:
        msg: >
          OUTDATED FIRMWARE on {{ inventory_hostname }}!
          Current: {{ current_firmware }} | Minimum required: {{ minimum_firmware }}
      when: current_firmware is version(minimum_firmware, '<')
      ignore_errors: true

ansible_ssh_common_args='-o StrictHostKeyChecking=no'

[defaults]
host_key_checking = False

ansible_become=yes
ansible_become_method=enable
ansible_become_password={{ vault_cisco_enable }}

ansible_httpapi_validate_certs=no