Network Automation with Python and Paramiko

What it is

Network automation means letting tools and programs configure, check and maintain network devices instead of an engineer typing commands device by device. Network programming is writing those programs, and at HCIA level the language is Python.

Paramiko is a Python library that implements the SSHv2 protocol. A Python script uses it to log in to a VRP device over SSH, send commands and read the output.

How it works

Introduction to network programming and automation

Manual operation has clear limits as networks grow:

• Slow: the same change has to be typed on hundreds of devices.
• Error-prone: a mistyped command on one device can cause an outage.
• Hard to check: collecting and comparing output from many devices by hand takes hours.

Automation does repeated jobs quickly and the same way every time: bulk configuration, scheduled backups, inspections, and collecting display output for reports. Tools range from your own scripts, to automation tools, to platforms such as iMaster NCE that use NETCONF and APIs.

Overview of programming languages

Compiled programs usually run faster. Interpreted languages are quicker to write, test and change, which suits automation scripts.

Introduction to Python

Python is a high-level, interpreted, dynamically typed language. Its design favors readable code, and it has a large standard library and many third-party libraries, such as Paramiko.

• Execution: the interpreter first compiles a .py source file into bytecode, and the Python Virtual Machine (PVM) then runs the bytecode.
• Indentation defines code blocks; four spaces per level is the convention. Wrong indentation is a syntax error.
• Comments start with #.
• Common data types: int, float, bool, str, list, tuple, dict and set. Lists are mutable; tuples are not.
• Reuse: def defines a function, and import loads a module such as paramiko or time.

Introduction to Paramiko APIs

On network devices, invoke_shell() is the usual choice. It keeps one shell open, so commands like system-view and interface commands run in sequence, just as an engineer types them.

Device side: enable SSH on VRP

[Huawei] stelnet server enable
[Huawei] aaa
[Huawei-aaa] local-user python password irreversible-cipher Example@123
[Huawei-aaa] local-user python service-type ssh
[Huawei-aaa] local-user python privilege level 3
[Huawei-aaa] quit
[Huawei] user-interface vty 0 4
[Huawei-ui-vty0-4] authentication-mode aaa
[Huawei-ui-vty0-4] protocol inbound ssh
[Huawei-ui-vty0-4] quit
[Huawei] ssh user python authentication-type password
[Huawei] ssh user python service-type stelnet

Example for network programming using Paramiko

The script logs in to a router at 192.168.56.100 and configures LoopBack0.

import paramiko
import time

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(hostname='192.168.56.100', port=22, username='python', password='Example@123')

cli = ssh.invoke_shell()
cli.send('screen-length 0 temporary\n')
cli.send('system-view\n')
cli.send('interface LoopBack0\n')
cli.send('ip address 1.1.1.1 255.255.255.255\n')
cli.send('return\n')
cli.send('display ip interface brief\n')
time.sleep(2)

print(cli.recv(65535).decode())
ssh.close()

screen-length 0 temporary turns off output paging for the session, so long output is not cut off at a ---- More ---- prompt. time.sleep(2) gives the device time to answer before recv() reads the buffer, and decode() turns the received bytes into a string.

A worked example

An engineer runs a script against 50 routers, but it fails on the first one with an error saying the server is not found in known hosts. The script never set a host key policy, so Paramiko used its default RejectPolicy for the unknown key.

Adding set_missing_host_key_policy(paramiko.AutoAddPolicy()) fixes the login. The output still stops after one page, so the engineer also sends screen-length 0 temporary first.

How the exam asks about this

• "Which Paramiko method opens an interactive shell on the remote device?" → invoke_shell().
• "Which statement about Python is true?" → It is an interpreted language whose code is compiled to bytecode and run by the Python Virtual Machine.
• "What must be configured on the VRP device before a Paramiko script can log in?" → The STelnet (SSH) server, an AAA local user with the SSH service type, and VTY lines that accept SSH with AAA authentication.