Automation and Assurance in Network Design
Domain 4 - Automation and Assurance in Network Design tests how you design a network that can be provisioned programmatically and observed continuously: model-driven interfaces, day-0 and day-N tooling, telemetry, and assurance platforms.
Design for automation
Standardize before automating: consistent hostnames, interface descriptions, addressing, and VLAN numbering, expressed as templates. Prefer model-driven interfaces - NETCONF (RFC 6241), RESTCONF, gNMI - driven by YANG models over CLI scraping. Workflows should be idempotent and intent-based, backed by a source of truth such as Catalyst Center inventory, NSO, or a Git repository. Day-0 onboarding uses Plug and Play or ZTP with DHCP option 43, DNS resolution, or cloud redirection. Day-N uses templates with variables plus compliance checks that detect and remediate drift. CI/CD pipelines (Git, Ansible or Python, pyATS tests, staged rings) let change be validated before it reaches every site.
Assurance
Streaming telemetry (dial-out gNMI or NETCONF, often 10-30 second cadence) supersedes five-minute SNMP polling for fast detection. Complement it with syslog, NetFlow/IPFIX, IP SLA probes, and platform assurance that rolls health scores and path trace per client and application. In SD-WAN, cflowd and AppQoE quantify application experience. Baseline normal behavior first; otherwise alerts have no reference.
Prerequisites worth designing in
A dedicated management VRF or out-of-band network, working NTP and DNS, AAA with role-based access, PKI certificates for controllers, awareness of API rate limits, and controller HA such as a three-node cluster.
Worked example
200 branch switches must be onboarded and kept compliant. Design: PnP onboarding through Catalyst Center with DHCP option 43 pointing at the controller; one site template with variables for management IP, hostname, and VLANs; a daily compliance run against the golden config; streaming telemetry every 30 seconds plus syslog to the SIEM; alerts on PoE budget, uplink errors, and configuration drift. Because every device is built from the same template, a drift alert is meaningful rather than noise.
Traps
- Automating an inconsistent design, which multiplies the inconsistency.
- Screen-scraping CLI instead of using YANG-modeled APIs.
- Skipping NTP and DNS, which breaks certificate validation and controller joins.
- Assuming assurance data is only for dashboards, not for closed-loop remediation.