Ansible, Terraform and Secure ZTP

What it is

Configuration management tools apply the same configuration to many devices, and zero touch provisioning brings a new device online without manual work.

Ansible and Terraform describe the wanted state in text files. ZTP lets a new device fetch its software and configuration by itself. Secure ZTP adds checks, so that neither the device nor the server is a fake.

How it works

Each tool has a different strength, so learn what each is for.

Ansible

Ansible is agentless. It runs on a control node and connects to devices over SSH or an API, so nothing is installed on the device. It works in a push model.

The main parts are:

• Inventory: the list of devices, in groups.
• Playbook: a YAML file of plays, each with tasks.
• Module: the code that does one job, such as sending configuration.
• Variables: values that change between devices.

Ansible modules aim to be idempotent. Running the same task twice gives the same result, and the second run reports no change.

- name: Configure NTP on routers
  hosts: routers
  gather_facts: false
  connection: ansible.netcommon.network_cli
  tasks:
    - name: Set the NTP server
      cisco.ios.ios_config:
        lines:
          - ntp server 192.0.2.123

This playbook connects to every device in the group routers over the CLI, and makes sure the NTP line is present. Collections such as cisco.ios and cisco.iosxr hold the modules for each platform. The inventory also names the network OS of each device.

ansible-playbook -i inventory.ini ntp.yml

Terraform

Terraform is an infrastructure as code tool. You describe the wanted end state in files written in HCL, and Terraform works out the steps to reach it.

It uses providers, which are plug ins for a platform or service. It keeps a state file that records what it has built, and it compares that file with your description to find the differences.

terraform init
terraform plan
terraform apply

• terraform init downloads the providers.
• terraform plan shows what would change, and changes nothing.
• terraform apply makes the changes.

A resource block names a type and a label, and sets its arguments, in the form resource "TYPE" "NAME" followed by the settings. Terraform is declarative, and it is strongest at creating and tracking infrastructure over time.

Comparing Ansible and Terraform

Secure ZTP

Zero touch provisioning lets a factory fresh device configure itself. It boots, learns where to go, and downloads its image and configuration.

Plain ZTP trusts the network that it finds. Secure ZTP, defined in RFC 8572, checks both sides.

The device proves its identity with a certificate installed at the factory. The server proves that it is the real one, and the information it sends is signed.

The steps are:

• The device gets an address and the location of a bootstrap server, often from DHCP.
• It connects over HTTPS, and shows its identity certificate.
• The server returns signed bootstrap information, with the image and the configuration, or a redirect to another server.
• The device checks the signature against a trust anchor, and an ownership voucher proves who owns it.
• It installs the image and applies the configuration.

Support varies by platform and release, and IOS XR documents both ZTP and a secure version. The result is a device that is configured by an authorised source only, even when the network that it boots on is not trusted.