6.5 Configuration Management Tools

Why These Tools Are Tested

The CCNA v1.1 names three configuration management tools you must compare: Ansible, Terraform, and (to a lesser degree) Puppet/Chef. You will not write playbooks on the exam, but you must know each tool's agent model, language, and ideal use case.

Ansible

Ansible (developed by Red Hat / IBM) is the most popular tool for network device configuration.

Ansible Components

Example Playbook (Network)

---
- name: Configure VLANs on access switches
  hosts: access_switches
  gather_facts: no
  tasks:
    - name: Create VLAN 10
      cisco.ios.ios_vlans:
        config:
          - vlan_id: 10
            name: SALES
        state: merged
    - name: Set access port
      cisco.ios.ios_config:
        parents: interface GigabitEthernet0/1
        lines:
          - switchport mode access
          - switchport access vlan 10

Because Ansible is agentless and YAML-driven, it suits routers/switches that cannot run a custom agent — a frequent exam fact.

Terraform

Terraform (by HashiCorp) is an infrastructure-as-code tool for provisioning resources — creating the infrastructure rather than tweaking an existing box.

Terraform Workflow

1. Write the .tf files in HCL.
2. Plan — terraform plan shows exactly what will change.
3. Apply — terraform apply makes the changes.
4. Destroy — terraform destroy tears the resources down.

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags = { Name = "Production-VPC" }
}
resource "aws_subnet" "web" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

Run terraform apply twice with no config change and it reports "No changes" — that is idempotency plus the state file at work.

Ansible vs. Terraform

When to Use Each

Puppet, Chef, and SaltStack

Trap: Puppet and Chef need an agent installed on each managed node, so they are awkward for switches/routers that cannot run one — that is exactly why Ansible dominates networking.

On the Exam: Ansible = agentless, SSH, YAML, push, Day-2 config. Terraform = declarative, HCL, state file, Day-0 provisioning. Both are idempotent and agentless; Puppet/Chef are agent-based.

Idempotency: The Concept That Ties Them Together

The single most important property shared by all these tools is idempotency — running the same definition any number of times leaves the system in the same final state. If a playbook says VLAN 10 should exist and it already does, Ansible reports "ok" and changes nothing; only if VLAN 10 is missing does it report "changed" and create it. Terraform behaves the same way through its state file, applying only the delta between desired and actual.

This is why automation is safe to re-run on a schedule to enforce the baseline and crush configuration drift — you never have to worry that re-running will duplicate VLANs, stack ACL lines, or otherwise compound. Contrast that with a naive script that blindly types vlan 10 every run; that script is not idempotent and is exactly what automation tooling is designed to replace.

Day-0 vs. Day-2: A Decision Framework

The exam often frames tool selection around lifecycle phases. Day-0 is the moment infrastructure is born — provisioning a brand-new VPC, spinning up virtual machines, carving out subnets and security groups that did not exist a minute ago. That creation-from-nothing job belongs to Terraform, whose declarative model and state file are built to track resources it created. Day-1 is initial configuration, and Day-2 is ongoing operations — pushing VLANs, updating ACLs, deploying routing changes to devices that already exist.

That recurring configuration job belongs to Ansible, whose agentless SSH model and rich library of Cisco modules make it the network engineer's daily driver.

In the real world the two are complementary, not competitors: a team commonly uses Terraform to stand up the cloud network and then hands off to Ansible to configure the operating systems and network functions running inside it. When a CCNA question asks which tool fits a scenario, decode whether the task creates infrastructure (Terraform) or configures existing devices (Ansible), and whether an agent is required (only Puppet and Chef need one).