DevNet Professional cheat sheet

Data models: YANG describes configuration and state; YANG modules map to a tree of nodes; NETCONF/RESTCONF encode those trees as XML or JSON.

Encoding vs transport: NETCONF runs over SSH (port 830) and uses XML; RESTCONF runs over HTTPS and accepts XML or JSON; gNMI runs over gRPC and uses protobuf.

Idempotency rule: an automation task is idempotent when re-running it converges to the same end state without duplicate side effects; declarative tools (Terraform, Ansible modules with desired state) aim for this.

Imperative vs declarative: imperative scripts specify the sequence of CLI commands; declarative models specify the intended end state and let the platform compute the steps.

Model-driven telemetry: push-based streaming (gNMI, NETCONF notifications) replaces periodic SNMP polling; subscriptions define path, sample interval, and encoding.

YANG node types: container (no value, holds children), list (repeatable entries keyed by a leaf), leaf (single value), leaf-list (array of values), choice/case for alternatives.

NETCONF operations: , , (merge, replace, create, delete, remove), , /, with candidate datastore.

API styles: REST uses HTTP verbs (GET/POST/PUT/PATCH/DELETE) and status codes (200, 201, 204, 400, 401, 404, 409); RPC-style APIs expose named methods over HTTP POST.

Python libraries by protocol: ncclient for NETCONF, requests for RESTCONF/HTTP, gnmi/gnmic for gNMI, netmiko/paramiko for SSH CLI, pysnmp for SNMP.

Cisco DNA Center: Intent API at /dna/intent/api/v1/...; authentication via POST /dna/system/api/v1/auth/token returning an X-Auth-Token header used on subsequent calls.

DNA Center key resources: network-device (inventory), site, template (configuration templates), task (async job status), client-health, interface, flow-analysis.

Cisco Meraki Dashboard API: base https://api.meraki.com/api/v1, header X-Cisco-Meraki-API-Key; organizations -> networks -> devices hierarchy; per-organization rate limit (commonly 5 calls/sec).

Cisco SD-WAN (vManage): REST API under /dataservice/...; authenticate via /j_security_check to obtain JSESSIONID cookie; /dataservice/device for inventory, /dataservice/template for feature/device templates.

Cisco ACI (APIC): REST API with aaaLogin to get a token (APIC-Cookie); object model uses classes such as fvTenant, fvBD, fvAEPg, fvRsBDToOut; queries use query-target-filter and rsp-subtree.

Cisco NX-OS/NX-API: JSON-RPC over HTTP/HTTPS (cli_ascii or cli_conf) and REST-style endpoints; Nexus Dashboard Fabric Controller manages fabric-wide intent.

Cisco IOS XE: RESTCONF (ip http secure-server, restconf enabled), NETCONF-YANG (netconf-yang), and Guest Shell for on-box Python; model paths start with /restconf/data/ietf-interfaces:interfaces.

Cisco Webex/Intersight: Webex REST uses Bearer token from OAuth; Intersight uses signed requests (HMAC) with API key ID and secret; both expose pagination via top/skip or page parameters.

Rate limiting and pagination: Cisco cloud APIs commonly return 429 with Retry-After; list endpoints paginate (Meraki perPage/startingAfter, DNA Center offset/limit) - always loop until page is empty.

Git basics: commit (local snapshot), branch (divergent line), merge vs rebase, pull request (review gate), tag (release marker); remote tracking via origin.

CI vs CD: continuous integration builds and tests every merge; continuous delivery keeps artifacts deployable; continuous deployment auto-releases to production.

Pipeline stages: lint -> unit test -> build artifact -> integration test (against lab devices) -> deploy -> post-deploy verification; gates fail the pipeline on non-zero exit code.

Testing pyramid for network automation: unit tests mock device APIs (unittest.mock, responses, pytest fixtures); integration tests hit virtual devices (CML, DevNet sandbox); end-to-end tests assert reachability/state.

Infrastructure as Code tools: Ansible (agentless, YAML playbooks, idempotent modules), Terraform (HCL, state file, plan/apply), both can drive network devices via providers/modules.

Configuration templating: Jinja2 uses {{ variable }}, {% for %}, {% if %}, and filters (| default, | upper); templates plus a data source (YAML/JSON inventory) generate device configs.

Secrets handling: never commit credentials; use environment variables, vault (HashiCorp Vault, Ansible Vault), or CI secret stores; .gitignore excludes state files and .env.

Containerization: Dockerfile builds an image; docker build/run; docker-compose for multi-service labs; containers give reproducible test environments for pipeline runners.

Pipeline as code: Jenkinsfile (declarative pipeline), GitLab .gitlab-ci.yml, GitHub Actions workflow YAML; each defines triggers (push, PR, schedule) and jobs with steps.

Source of truth: a system (NetBox, NSO, Infoblox) holding intended state; automation reads from it and reconciles device state; drift = difference between intended and actual.

NetBox API: REST under /api/, token auth (Authorization: Token ); objects include dcim/devices, ipam/ip-addresses, ipam/prefixes, tenancy, virtualization.

Cisco NSO: model-driven with NEDs per platform; services (service packages) map a service model to device config; commit applies a transaction with rollback.

Change management: automation should produce a diff/plan, require approval, apply atomically, and support rollback; NETCONF candidate datastore plus confirmed-commit provides auto-revert on failure.

Operational workflows: backup configs (scheduled), compliance checks (golden config diff), software image management (pre/post checks, staged upgrade), and inventory reconciliation.

Monitoring integration: streaming telemetry to a collector (Telegraf, Pipeline) feeding time-series DB (Prometheus, InfluxDB) and dashboards (Grafana); alerting on thresholds.

Failure handling: retries with exponential backoff for transient API errors (5xx, 429); fail-fast for 4xx client errors; log correlation IDs; alert on pipeline failure.

Scalability: parallelize device operations with concurrency limits (thread pools, asyncio semaphores); batch API calls; avoid per-device serial loops on large inventories.

Security operations: least-privilege API accounts, TLS verification on, secrets rotated, audit logs retained; RBAC in DNA Center/NSO/Meraki controls who can change what.