netmiko-ssh-automation

Netmiko SSH Automation

Use this skill when writing or reviewing Python automation that connects to network devices with Netmiko. Keep the default path read-only; config changes need a separate change window, peer review, and rollback plan.

When to Use

• Collecting show command output across routers, switches, or firewalls.
• Building a small audit script for interface, routing, or config evidence.
• Adding timeouts and exception handling to network SSH scripts.
• Parsing command output with TextFSM when a template exists.
• Reviewing automation before it touches production devices.

Safety Defaults

• Start with read-only send_command() collection.
• Keep inventory small and explicit; do not sweep whole address ranges.
• Use environment variables, a vault, or getpass; never hardcode credentials.
• Set connection and read timeouts.
• Limit concurrency so older devices are not overloaded.
• Require an explicit operator flag before send_config_set().
• Do not call save_config() until the change has been verified and approved.

Read-Only Connection Pattern

import os
from getpass import getpass
from netmiko import ConnectHandler
from netmiko.exceptions import (
    NetmikoAuthenticationException,
    NetmikoTimeoutException,
    ReadTimeout,
)

device = {
    "device_type": "cisco_ios",
    "host": "192.0.2.10",
    "username": os.environ.get("NETMIKO_USERNAME") or input("Username: "),
    "password": os.environ.get("NETMIKO_PASSWORD") or getpass("Password: "),
    "secret": os.environ.get("NETMIKO_ENABLE_SECRET"),
    "conn_timeout": 10,
    "auth_timeout": 20,
    "banner_timeout": 15,
    "read_timeout_override": 30,
}

try:
    with ConnectHandler(**device) as conn:
        if device.get("secret") and not conn.check_enable_mode():
            conn.enable()
        output = conn.send_command("show ip interface brief", read_timeout=30)
        print(output)
except NetmikoAuthenticationException:
    print("Authentication failed")
except NetmikoTimeoutException:
    print("SSH connection timed out")
except ReadTimeout:
    print("Command read timed out")