Transforming Network Management with Infrastructure as Code: Best Practices and Cloud Integration

In the era of cloud-first strategies and agile IT environments, Infrastructure as Code (IaC) has become an essential practice for network engineers. IaC simplifies the process of provisioning, managing, and automating network infrastructure, eliminating manual configurations and minimizing errors. This blog will dive into how IaC applies to networking, with specific use cases involving AWS, Cisco 8000v, and Palo Alto Firewalls. If you want this same setup using Microsoft Azure, comment below!

What is Infrastructure as Code (IaC)?

Infrastructure as Code involves defining and managing infrastructure (like virtual machines, networks, and firewalls) using machine-readable configuration files rather than physical hardware or manual processes. These files, often written in languages like YAML, JSON, or HCL (HashiCorp Configuration Language), allow teams to:

• Automate deployment and scaling.

• Enable consistent, repeatable configurations.

• Integrate with DevOps workflows.

Why Use IaC for Networking?

Networking is a critical yet complex part of cloud deployments. Traditionally, configuring network gear required manual intervention, CLI commands, and on-site work. With IaC, you can:

• Automatically deploy and configure routers, switches, and firewalls.

• Reduce downtime by automating failover and updates.

• Enhance scalability by provisioning network resources dynamically.

• Enable hybrid environments with consistent configurations across on-premises and cloud networks.

IaC Tools for AWS Networking

Several tools support IaC for AWS networking. The most notable include:

• AWS CloudFormation: A native AWS tool for defining cloud resources, including networking components like VPCs, subnets, and route tables.

• Terraform: A multi-cloud tool by HashiCorp, enabling you to provision AWS resources alongside other platforms.

• Ansible: Simplifies network automation with playbooks for managing Cisco and Palo Alto devices.

Case Study 1: Automating Cisco 8000v in AWS

Overview

The Cisco 8000v Router is a virtualized version of Cisco’s high-performance routers, ideal for hybrid and cloud-native environments. Using IaC, you can deploy Cisco 8000v in AWS for tasks like WAN optimization, traffic engineering, and secure connectivity.

Part 1: Deploying Cisco 8000v in AWS with Terraform

Terraform Configuration

Here’s a sample Terraform script to deploy the Cisco 8000v instance:

# Variables
variable "region" {
  default = "us-east-1"
}

variable "ami_id" {
  default = "ami-0a12345b678cdefgh" # Replace with Cisco 8000v AMI from AWS Marketplace
}

variable "instance_type" {
  default = "c5.xlarge"
}

variable "vpc_cidr" {
  default = "10.0.0.0/16"
}

# AWS Provider
provider "aws" {
  region = var.region
}

# VPC and Subnet
resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
}

resource "aws_subnet" "main" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

# Security Group for Cisco 8000v
resource "aws_security_group" "cisco_8000v" {
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 179
    to_port     = 179
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # For BGP
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Cisco 8000v Instance
resource "aws_instance" "cisco_8000v" {
  ami           = var.ami_id
  instance_type = var.instance_type
  subnet_id     = aws_subnet.main.id
  security_groups = [aws_security_group.cisco_8000v.name]

  tags = {
    Name = "Cisco8000v"
  }
}

Steps to Deploy

1. Save the script as main.tf.

2. Run the following Terraform commands:

   terraform init
   terraform plan
   terraform apply

This will launch the Cisco 8000v instance in AWS.

Part 2: Cisco 8000v Configuration

Basic Configuration

Once the instance is up, SSH into the Cisco 8000v router and configure the basic settings.

# Enter global configuration mode

configure terminal

# Set hostname

hostname Cisco8000v

# Enable SSH access

username admin privilege 15 secret your_password

ip domain-name example.com

crypto key generate rsa modulus 2048

ip ssh version 2

# Configure management interface (AWS assigns private IP automatically)

interface GigabitEthernet1

 description Management Interface

 ip address dhcp

 no shutdown

# Configure a LAN interface

interface GigabitEthernet2

 description LAN Interface

 ip address 10.0.1.1 255.255.255.0

 no shutdown

# Default route to AWS gateway

ip route 0.0.0.0 0.0.0.0 dhcp

# Save configuration

end

write memory

Dynamic Routing with OSPF

If you want to enable OSPF for dynamic routing:

configure terminal

router ospf 1

 network 10.0.1.0 0.0.0.255 area 0

exit

write memory

Dynamic Routing with BGP

For BGP, configure it to communicate with a peer:

configure terminal

router bgp 65001

 bgp router-id 10.0.1.1

 neighbor 10.0.2.1 remote-as 65002

 network 10.0.1.0 mask 255.255.255.0

exit

write memory

Part 3: Automating Configuration with Ansible

To automate configurations like OSPF or BGP, you can use Ansible playbooks. Here’s an example for pushing OSPF:

Ansible Playbook for OSPF

Save this playbook as configure_ospf.yml:

- name: Configure OSPF on Cisco 8000v

  hosts: cisco_routers

  gather_facts: no

  tasks:

    - name: Configure OSPF

      ios_config:

        lines:

          - router ospf 1

          - network 10.0.1.0 0.0.0.255 area 0

        provider:

          host: "{{ inventory_hostname }}"

          username: admin

          password: your_password

          auth_pass: your_password

          transport: ssh

Run it with:

ansible-playbook -i inventory configure_ospf.yml

Case Study 2: Automating Palo Alto Firewalls in AWS

Overview

Palo Alto Networks’ VM-Series firewalls offer robust security for cloud workloads. Automating their deployment ensures consistent security policies across your hybrid or multi-cloud environment.

Steps to Automate Deployment

1. Provision Palo Alto VM-Series in AWS:

   • Define the firewall instances and associated ENIs (Elastic Network Interfaces) in Terraform.

   • Example Terraform snippet:

     resource "aws_instance" "palo_alto_fw" {

       ami           = "ami-xyz123" # Replace with Palo Alto AMI

       instance_type = "c5.xlarge"

       network_interface {

         device_index = 0

         subnet_id    = aws_subnet.public.id

       }

     }

2. Terraform Provider Setup

   To manage the Palo Alto Firewall via Terraform, you’ll use the panos provider. Add the provider configuration to your Terraform file:

   provider "panos" {

     hostname = var.paloalto_ip

     username = var.paloalto_username

     password = var.paloalto_password

   }

3. Variables Definition

   Define variables for reusable configurations:

   variable "paloalto_ip" {}

   variable "paloalto_username" {}

   variable "paloalto_password" {}

   variable "trust_subnet" {

     default = "192.168.1.0/24"

   }

   variable "untrust_subnet" {

     default = "0.0.0.0/0"

   }

4. Base Network Configuration

   Create interfaces and zones for trusted and untrusted networks:

   resource "panos_panorama_template_stack" "example" {

     name = "MyTemplateStack"

   }

   resource "panos_interface" "ethernet1" {

     name    = "ethernet1/1"

     zone    = "trust"

     ip      = "192.168.1.1/24"

     enable  = true

     comment = "Trusted Interface"

   }

   resource "panos_interface" "ethernet2" {

     name    = "ethernet1/2"

     zone    = "untrust"

     ip      = "203.0.113.1/24"

     enable  = true

     comment = "Untrusted Interface"

   }

5. Security Policy Configuration

   Define a policy to allow outbound traffic from the trust zone:

   resource "panos_security_rule" "allow_trust_to_untrust" {

     name       = "Allow-Trust-to-Untrust"

     description = "Allow outbound traffic from trust to untrust"

     from_zone  = "trust"

     to_zone    = "untrust"

     source     = ["192.168.1.0/24"]

     destination = ["0.0.0.0/0"]

     application = ["any"]

     service     = ["any"]

     action      = "allow"

     log_setting = "default"

   }

6. NAT Rule Configuration

   Configure a NAT rule to translate internal IPs to the public IP for outbound traffic:

   resource "panos_nat_rule" "trust_to_untrust_nat" {

     name         = "Trust-to-Untrust-NAT"

     source_zone  = "trust"

     destination_zone = "untrust"

     source       = ["192.168.1.0/24"]

     destination  = ["0.0.0.0/0"]

     service      = "any"

     translated_address_type = "dynamic-ip-and-port"

     translated_address = ["203.0.113.1"]

   }

7. Deploy the Configuration

   Once the Terraform configuration file is complete, run the following commands to deploy the configuration:

   terraform init

   terraform plan

   terraform apply

8. Verify the Configuration

   Log in to the Palo Alto web interface or CLI and confirm the interfaces, security rules, and NAT configurations are correctly applied.

9. Integrate with CI/CD:

   • Integrate your IaC pipelines with tools like Jenkins or GitLab for automatic deployments during application rollouts.

Best Practices for IaC in Networking

1. Version Control Configurations:

   • Use Git or other version control systems to track changes in IaC files.

2. Modularize Code:

   • Create reusable modules for common network components, such as VPCs, subnets, or security groups.

3. Implement Testing and Validation:

   • Use tools like Terratest or InSpec to validate configurations before deployment.

4. Maintain Documentation:

   • Keep IaC files well-documented for easier collaboration and troubleshooting.

Learning Resources

If you’re new to IaC or want to dive deeper into automating networking with AWS, Cisco, and Palo Alto:

• AWS:

  • AWS CloudFormation

  • AWS Networking Fundamentals

• Cisco:

  • Cisco DevNet

  • Cisco 8000v Documentation

• Palo Alto:

  • Palo Alto VM-Series

  • Panorama Automation Guide

Conclusion

By leveraging IaC, network engineers can bring the same level of agility and scalability to networking as seen in cloud-native application development. Tools like Terraform, Ansible, and CloudFormation make it easier to deploy and manage network devices like Cisco 8000v routers and Palo Alto firewalls in AWS. As organizations adopt hybrid and multi-cloud architectures, the ability to automate networking with IaC will be a critical skill for engineers looking to stay ahead in the field.

Ready to embrace IaC for your networking needs? Start small, experiment with automation tools, and watch as your network operations become faster, more efficient, and less error-prone.