A Beginner’s Guide to Ansible Roles for Network Automation

 Understanding Ansible Roles: The Smart Way to Organize Your Automation

When your automation projects start growing, keeping playbooks clean and reusable becomes essential. That’s where Ansible roles step in—providing a structured, scalable way to organize your automation logic.

An Ansible role bundles together everything your playbook needs, such as:

• Variables
• Tasks
• Templates
• Files
• Handlers
• Custom modules

This modular approach not only keeps your work tidy but also makes it effortless to reuse and maintain automation across multiple projects.

Creating an Ansible Role

Ansible offers a built‑in utility called ansible-galaxy to generate a ready‑to-use role structure. This creates a fully structured directory containing all folders required for your role.

Key Directories You’ll Use Most in Network Automation

While a role contains multiple folders, a few are especially important for network engineers:

1. defaults/

This folder holds baseline default values for your variables. If your playbook does not pass a variable, Ansible uses the value defined here.

2. tasks/

The heart of any role.
All reusable task logic lives here—allowing you to write shorter playbooks and maintain your automation in one central place.

3. templates/

Used to store Jinja2 templates that your tasks render dynamically during execution.

4. vars/

This is where you define variables used within tasks or templates.
Defaults can be kept in the defaults/ directory, but if a variable has no fallback value, it must be defined here for the role to work properly.

Why Use Roles?

Ansible roles bring clarity, modularity, and reusability to your automation workflows. Whether you're building network configs or managing large infrastructure deployments, roles ensure consistency while drastically reducing repetitive work.

Why Service Graphs Matter in Cisco ACI

Service graphs in Cisco ACI simplify network and security integration by offering several key benefits:

• Traffic Redirection Made Easy: Direct traffic to L4-L7 devices without complex designs.
• Automated VLAN Management: No manual VLAN assignments needed.
• Seamless vNIC Connectivity: Virtual NICs are automatically connected.
• Reusable Templates: Configure once, reuse multiple times.
• Logical & Application-Centric View: Gain clarity and better visibility of services.
• Shared Device Model: Efficiently share devices across departments.
• Health & Performance Insights: Collect health scores and statistics from devices.
• Dynamic Updates: ACLs and pools update automatically with endpoint discovery.

However, in Service Policy Mode:

• The model leans heavily on automation.
• Managing numerous configuration parameters can be overwhelming for frequent changes.

Bottom Line:
Service graphs offer a streamlined, application-focused approach compared to traditional designs—but choose wisely based on your operational needs.

Cisco ACI Service Graph Management Models Explained

Cisco ACI provides three distinct approaches to manage service graphs, each offering different levels of control and integration:

1. Network Policy Mode (Unmanaged)
   In this mode, ACI configures only the network aspects of the service graph within the fabric. No configuration changes are pushed to the L4-L7 device, making it suitable when device policies are managed externally.

2. Service Policy Mode (Managed)
   Here, ACI not only handles the fabric configuration but also manages VLAN settings on the L4-L7 device. The APIC administrator can directly input device-specific configurations through the APIC interface, ensuring centralized control.

3. Service Manager Mode
   This model allows the firewall or load balancer administrator to define L4-L7 policies. ACI takes care of the fabric and VLAN configurations, while the APIC administrator links these policies with the network policy, enabling a collaborative approach.

Choosing the Right Cisco ACI Service Graph Mode

When designing with Cisco ACI, selecting the right service graph mode depends on your operational needs:

• Dynamic Configuration Needs?
  If firewalls and load balancers must be configured dynamically through APIC, choose Service Policy Mode. If a separate administrator handles device configuration, opt for Network Policy Mode or Service Manager Mode.

• Frequent Commissioning Like Cloud Services?
  For environments where devices are frequently added or removed, Service Policy Mode or Service Manager Mode works best. If services remain static for long periods, Network Policy Mode or Service Manager Mode is more practical.

• Complex Multi-Leg Designs?
  If your design requires multiple interfaces or DMZ configurations, manual service insertion using EPGs and bridge domains may be more convenient than using a service graph.

Bottom Line:
Your choice should align with automation needs, operational flexibility, and design complexity.

Nexus Dashboard Roles and Permissions

Data Center Foundation

 

What is the role of the control plane in the Cisco Nexus switch?

Top of Form

• Controls switch management.
• Controls access to the console.
• Controls access to the remote console.
• Runs network protocols like OSPF and Spanning Tree.

The network administrator wants to create a Layer 3 isolated segment for the marketing department on a Cisco Nexus 9000 Series switch. It will be under the complete administration of the marketing system administrator. Which option accomplishes this goal?

Top of Form

• Create a VRF instance.
• Create a VLAN.
• Create a subnet for the marketing department in the management VRF instance.
• Create a subnet for the marketing department in the default VRF instance.

Bottom of Form

 

What are three software components of vSphere environment? (Choose three.)

Top of Form

• ESXi hypervisor
• VMware Workstation
• vCenter Server
• Hyper-V Server
• Active Directory Server
• vSphere Web Client

 

Which two characteristics apply to virtual machine virtual disk images? (Choose two.)

Top of Form

• They are just regular files that can be copied and moved like any other file.
• The changes that are made in a virtual machine are not saved between hypervisor restarts.
• The images can be replicated on another host system, but only if it is running on the same physical hardware.
• Virtual disk images are contained in two files that have a .vmdk extension in the datastore.
• The virtual images have .vmdk and .vmdd extensions: one is for data, and the other is for virtual machine configuration.

 

Which feature does the VMware hypervisor use to connect virtual machines in the same hypervisor?

Top of Form

• VRF
• virtual router
• virtual center
• virtual switch
• virtual LAN

Bottom of Form

 

Which technique does VXLAN encapsulation use?

Top of Form

• Mac-in-TCP
• Mac-in-UDP
• Mac-in-Mac
• IPsec
• Mac-in-GRE

Bottom of Form

 

In VXLAN unicast Layer 3 packet forwarding, when a virtual machine sends traffic to a local VTEP, what is the destination MAC of the encapsulated packet?

Top of Form

• the MAC address of the distributed IP anycast gateway
• the burned MAC address of the Ethernet port of the local VTEP
• the MAC address of the ESXi NIC adapter
• MAC address FFFF.FFFF.FFFF

Bottom of Form

 

In which two of the following cases will an OSPFv2 graceful restart will work? (Choose two.)

Top of Form

• Cisco Nexus switch reload
• supervisor switchover
• OSFPv2 process failure
• misconfigured OSPF neighbor
• misconfigured OSPF on the switch

What is the function of the datastore?

Top of Form

• It is the physical storage that contains the ESXi operating system.
• It is dedicated storage where only virtual machines are contained.
• It is a logical container that is used by ESXi hypervisors and contains virtual machines and other files that you upload.
• It is local storage that exists on the ESXi machine, but does not contain the ESXi system.
• It is a storage system that virtual machines can access to share files between themselves.

Bottom of Form

 In which situation would you be forced to assign several vNICs to a single virtual machine?

Top of Form

• when trying to achieve better stability if the hypervisor fails
• when more than one virtual machine exists in the virtual environment
• when connecting a single virtual machine to two vSwitches
• when trying to decrease network latency under high-load scenarios
• when connecting the virtual machine to the internet

Bottom of Form

Which statement about VXLAN forwarding is true?

Top of Form

• When the destination MAC address in the original packet header does not belong to the local VTEP, the originating VTEP performs a Layer 2 lookup and bridges the packet to the destination VTEP.
• If the destination MAC address in the original packet header matches the anycast gateway MAC address, VXLAN bridging must occur.
• When building BGP updates for EVPN routes, MP-BGP uses the unicast VTEP address as the next hop.
• When a VTEP switch originates MP-BGP EVPN routes for its locally learned end hosts, it uses the anycast VTEP address as the BGP next hop.

Bottom of Form

Which two options are features of a VMware standard switch? (Choose two.)

Top of Form

• Cisco Discovery Protocol support
• network traffic flow visibility
• access list support
• port channel and virtual guest tagging support
• QoS
• up to 48 network ports for assignment
• STP participation

 

What is the purpose of CoPP?

Top of Form

• It prevents packets that are destined for the control plane from entering the data plane.
• It prevents overloading of the control module CPU by disconnecting denial of service attackers.
• It monitors traffic that is destined for the control plane and limits the traffic flow, which prevents control module CPU overload.
• It monitors the control module usage and alerts the administrator when it is close to overloading.

Bottom of Form

What are two characteristics of the management VRF instance? (Choose two.)

Top of Form

• The management VRF instance is not present by default and must be enabled.
• The management interface, which is called the mgmt0, is always assigned to the management VRF instance.
• The management VRF instance is the default routing context for show commands.
• EIGRP is supported on the management VRF instance.
• You can create static routing rules on the management VRF instance.
• OSPF is supported on the management VRF instance.

 

How do you specify a VRF instance for a service?

Top of Form

• You must create routing rules in the default VRF instance that point to other VRF instances to properly route the command.
• Service commands are VRF-aware and detect the correct VRF instance automatically.
• You must always state the VRF instance at the end of a VRF-aware command or it will fail.
• Because the default VRF instance has access to all other VRF instances, the command always executes in the default VRF instance, which correctly routes the command.
• You must state the VRF instance at the end of a VRF-aware command, otherwise it executes in the default VRF instance.

 

What are three benefits of virtualization? (Choose three.)

Top of Form

• It uses fewer total resources at the same load across several servers.
• It is easier and less disruptive to upgrade physical hardware on the machine.
• It provides better resource management and fewer unused resources.
• There are fewer guest operating system problems with unsupported hardware.
• No licensing is required.
• It is easier to transport virtual machine physical hardware.
• Self-contained virtual disk images can be reproduced in another location.
• The operating system within a virtual machine is completely independent from physical hardware resources.

What would happen if you moved a virtual machine between ESXi hosts in the same group and DPM was not enabled while all other features were enabled?

Top of Form

• The virtual machine would be unavailable until it restarts on the destination ESXi host.
• The virtual machine would be moved without any interruption in operations of the virtual machine, and the ESXi host would shut down to conserve power.
• The virtual machine on the source host would be isolated, and fault tolerance switchover would be performed.
• The virtual machine would be moved without interruption in the operations of its services.

Bottom of Form

 

What does an overlay network do?

Top of Form

• It uses the physical network and rearranges its address spaces and routing tables to accommodate a virtual environment.
• It uses virtual configurations, such as virtual MAC addresses and virtual IP addresses of physical hardware, to configure overlay interfaces that an overlay network needs.
• It uses physical infrastructure to transport traffic between virtual nodes within the infrastructure.
• Virtual networks exist only within a VMware vSphere ESXi installation and can span several ESXi physical servers.

What happens when you encapsulate traffic in Layer 3 encapsulation?

Top of Form

• It transports packets without changing them over a network.
• It transports packets over a network and changes their source MAC address.
• It takes packets, adds a header to them, and sends them over an IP network.
• It creates a Layer 2 tunnel between local and remote nodes and forwards traffic through the tunnel.
• It creates a virtual overlay within a data center that allows Layer 2 devices to communicate with Layer 3 devices.
• Which statement about the distributed anycast gateway in MP-BGP EVPN is true?
• Top of Form
• All VTEPs will have the same virtual gateway IP address but a different virtual gateway MAC address.
• The distributed anycast gateway prevents transparent host mobility in the VXLAN overlay network.
• With the distributed anycast gateway feature, when an end host moves from one VTEP to another VTEP, the end host must send another ARP request to relearn the new gateway MAC address.
• All VTEPs will have the same virtual gateway IP address and virtual gateway MAC address.
• Bottom of Form

Bottom of Form

 

 

 

Which two options are characteristics of a VDS switch? (Choose two.)

Top of Form

• The VDS switch must be created and managed from the vCenter management server.
• The VDS switch can have virtual machine vNICs assigned to allow virtual machine networking.
• The VDS switch cannot span across several ESXi hypervisors.
• The VDS switch requires vMotion for operation.
• The VDS switch unlike a vSwitch does participate in the STP.
• No uplink ports can be assigned to a VDS.

vSphere DRS is used to load-balance virtual machines across the available hosts to provide optimum performance. Which function is needed for vSphere operation?

Top of Form

• vSphere Fault Tolerance
• vSphere High Availability
• vSphere vMotion
• vSphere DPM

Bottom of Form

 

HSRP Vs VRRP

 

Overview of VRRP and HSRP

Feature	VRRP	HSRP
Standard	Open standard (RFC 5798)	Cisco proprietary
Router Roles	One primary router, multiple backups	One active router, one standby, others in listening state
IP Address Usage	Uses router interface IP or virtual IP	Uses a virtual IP address
Election Criteria	Highest priority or highest IP address	Highest priority or highest IP address
Pre-emption	Enabled by default	Disabled by default
Timers	Advertisements every 1 second	Hello messages every 3 seconds
Tracking Support	Yes	Yes
Load Balancing	Supported	Supported
Multicast Address	224.0.0.18	224.0.0.2 (v1), 224.0.0.102 (v2)
Virtual MAC Format	0000.5E00.01XX (XX = VRID)	0000.0c07.acXX (XX = HSRP group)

Breaking Down the NX-OS Image Filename

Breaking Down the NX-OS Image Filename

Let’s take a closer look at a sample image filename:

nxos64-cs.10.5.1.F.bin

Here’s what each part means:

• nxos64-cs: Indicates a 64-bit NX-OS image for specific platforms (e.g., Nexus 9000-EX, -FX, -GX, -GX2).
• 10: Major release version.
• 5: Minor release version.
• 1: Maintenance release.
• F: Release designation.
• bin: Binary file extension.

This structured naming helps administrators quickly identify the right image for their hardware and software needs.

Understanding Image Prefixes

Cisco NX-OS images come in different formats based on platform architecture:

• 32-bit images: Start with nxos (e.g., nxos.10.1.1.bin)
• 64-bit images: Start with nxos64 (e.g., nxos64.10.1.1.bin)

Starting with Release 10.2(2)F, Cisco introduced two distinct 64-bit image types:

1. nxos64-cs: For Nexus 9000-EX, -FX, -GX, -GX2 modular switches and fixed switches.
2. nxos64-msll: For Nexus 9000-R, -R2 modular switches, Nexus 3600 fixed switches, and Nexus 3500-XL switches.

Release Designations Explained

Cisco uses specific letters to indicate the nature of a release:

• F (Feature Release): Includes new features, platform support, and bug fixes.
• M (Maintenance Release): Focuses on bug fixes and security patches, including PSIRT updates.

Each image ends with a .bin extension, confirming it’s a compressed binary file ready for deployment.

Conclusion

Understanding Cisco NX-OS coding is more than just decoding filenames—it’s about ensuring operational continuity, compatibility, and performance. As your infrastructure grows, especially in mission-critical environments like banking, being fluent in NX-OS versioning and image types will help you make informed decisions and maintain a resilient network.