Image by: Jakub Zerdzicki

Introduction

In modern network administration, managing complex environments with diverse devices such as Cisco switches and Fortinet firewalls can be daunting, especially when deploying configuration changes consistently across multiple platforms. Automation offers an effective way to streamline these tasks, reduce human error, and enhance operational efficiency. Ansible, a powerful open-source automation tool, is widely adopted for network automation due to its simplicity and flexibility. This guide walks network administrators through practical steps to automate network management by leveraging Ansible playbooks. We will explore setting up network inventories tailored for multi-vendor environments, crafting playbooks to manage VLAN configurations, and securing sensitive device credentials using Ansible Vault. By integrating these components, you will gain the confidence to automate simultaneous deployments across Cisco and Fortinet gear effectively.

Setting up Ansible network inventories for multi-vendor environments

Before diving into automation, organizing your network inventory correctly is crucial. Ansible uses inventory files to define the devices it manages. For complex environments with Cisco switches and Fortinet firewalls, a structured inventory helps separate device types and enables targeted playbook executions.

A typical inventory can be defined in YAML format to clearly categorize hosts:

all:
  children:
    cisco_switches:
      hosts:
        switch1.example.com:
        switch2.example.com:
    fortinet_firewalls:
      hosts:
        firewall1.example.com:
        firewall2.example.com:

Grouping devices this way allows you to apply specific role-based configurations or playbooks only to the intended device group. Furthermore, including variables such as connection parameters (e.g., ansible_network_os, ansible_user) at group or host level facilitates smooth interaction with devices through Ansible modules tailored to each vendor.

Writing playbooks for VLAN management on Cisco switches and Fortinet firewalls

One common network task is creating or modifying VLANs across switches and corresponding firewall interfaces to maintain consistent segmentation. Ansible playbooks enable automation of these changes in a coherent, repeatable manner.

For Cisco switches, the cisco.ios.ios_vlan module can be used:

- name: Configure VLANs on Cisco switches
  hosts: cisco_switches
  gather_facts: no
  tasks:
    - name: Create VLAN 10
      cisco.ios.ios_vlan:
        vlan_id: 10
        name: "Engineering"
        state: present

For Fortinet firewalls, VLANs are typically configured within interfaces or VLAN sub-interfaces. The fortinet.fortios.fortios_interface module manages these configurations:

- name: Configure VLAN interfaces on Fortinet firewalls
  hosts: fortinet_firewalls
  gather_facts: no
  tasks:
    - name: Create VLAN interface for VLAN 10
      fortinet.fortios.fortios_interface:
        vdom: "root"
        interface:
          name: "vlan10"
          type: "vlan"
          vlanid: 10
          interface: "internal"
          ip: "192.168.10.1/24"
          allowaccess: "ping"

By combining these playbooks within a single run targeted at all devices (using inventory groups), administrators can deploy VLAN updates simultaneously, maintaining consistency and reducing deployment windows.

Securing device credentials with Ansible Vault

A critical aspect of automation is ensuring sensitive credentials like device usernames and passwords remain secure. Ansible Vault provides a built-in solution to encrypt these secrets, preventing accidental exposure in source control or logs.

To create an encrypted file to store credentials, the command is:

ansible-vault create credentials.yml

Within this file, store variables such as:

cisco_user: admin
cisco_pass: CiscoPassword123
fortinet_user: admin
fortinet_pass: FortinetPassword123

In your playbooks or inventory, reference these variables instead of plaintext values. When running playbooks, provide the vault password or password file to decrypt secrets on the fly:

ansible-playbook playbook.yml --ask-vault-pass

This approach enhances security without compromising automation convenience, making credential management both secure and seamless.

Integrating inventories, playbooks, and vaulted credentials in practice

After setting up inventories, playbooks, and securing credentials, integrating these components into a unified workflow is essential. Below is a summarized workflow:

This synergy between inventory, playbook logic, and security enables network administrators to confidently automate complex environments, saving time while mitigating configuration drift risks.

Conclusion

Automating configuration changes across diverse network devices like Cisco switches and Fortinet firewalls is not only possible but highly efficient with Ansible. By strategically organizing network inventories, writing modular playbooks tailored to vendor-specific needs—such as VLAN management—and safeguarding credentials via Ansible Vault, network administrators can streamline operations without compromising security. This practical guide highlighted the step-by-step approach to building an automation workflow that accommodates multiple device types while maintaining clarity and control. Adopting these automation practices reduces manual errors, shortens deployment times, and helps maintain consistent network policies. Ultimately, leveraging Ansible for simultaneous multi-vendor network automation empowers administrators to focus more on strategic network improvements rather than repetitive configuration tasks.