Automation, Scripting, and Configuration Management
Programmatic interfaces
NETCONF runs over SSH on port 830 and uses YANG-modelled XML; RESTCONF exposes YANG data over HTTP(S) with JSON or XML; gNMI suits streaming telemetry. Model-driven interfaces return structured data, which is why they beat screen-scraping CLI output with regular expressions. SNMP remains useful for monitoring but is a poor choice for configuration.
Scripting and tooling
Python libraries such as Netmiko or NAPALM handle device sessions, prompt detection and timeouts; raw Paramiko is lower level and leaves prompt handling to you. Jinja2 templates render configuration from variables so that a single source of truth drives every device. Ansible is procedural-ordered but pushes idempotent modules - the ios_config module with parents and intended lines only changes what differs. Terraform is declarative, compares desired state to prior state, and plans before applying.
Change safety in automation
Store inputs in Git, review diffs, and always have a dry run. Use --check or a commit-confirmed/candidate configuration so an unreachable device rolls back automatically. Validate afterwards with assertions on BGP neighbour counts, interface status and route tables, not just exit codes. Never hardcode credentials - use a vault or environment injection, and log which task changed which device.
Worked example
An Ansible playbook renders an interface description and is run twice. The first run reports changed=1; the second reports changed=0 because the module compared the intended line to the running config. That is idempotency. If you had used a raw CLI command, the device would report a change both times, and any config diff would be polluted by cosmetic churn.
Traps that cost marks
Parsing CLI with brittle regexes instead of using YANG data, storing secrets in plaintext inventories, forgetting that candidate configs need an explicit commit, and trusting a zero exit code without verifying the resulting routing or state.