11.1 Python Fundamentals for Cisco Wireless Network Automation

11.1 Python Fundamentals for Cisco Wireless Automation

Python is useful in WLCOR because wireless operations expose structured interfaces: Catalyst 9800 supports model-driven APIs, and Catalyst Center provides intent APIs across inventory and Assurance. The exam emphasis is not clever syntax. It is the ability to read, transform, validate, and act on network data safely.

Build a small, testable workflow

A maintainable script has four stages:

1. Input: read device addresses, intended state, and secrets from approved sources.
2. Transport: create an HTTPS, NETCONF, or SSH session with authentication and timeouts.
3. Logic: parse structured data, compare current and desired state, and decide whether a change is needed.
4. Verification: query again, check operational state, and record a useful result without leaking secrets.

Use functions with clear inputs and return values. Catch the specific exceptions you expect, such as a request timeout, HTTP authentication failure, XML parse error, or NETCONF RPC error. A broad exception that prints “failed” hides the evidence needed to troubleshoot.

Secure RESTCONF session

Store secrets outside the program. In a workstation lab, environment variables are a simple mechanism; an enterprise workflow should use its secret manager. Trust the controller certificate through the organization’s CA bundle.

import os
import requests

BASE_URL = os.environ['WLC_URL'].rstrip('/')
USERNAME = os.environ['WLC_USERNAME']
PASSWORD = os.environ['WLC_PASSWORD']
CA_BUNDLE = os.environ.get('NETWORK_CA_BUNDLE', '/etc/ssl/certs/ca-certificates.crt')

session = requests.Session()
session.auth = (USERNAME, PASSWORD)
session.verify = CA_BUNDLE
session.headers.update({
    'Accept': 'application/yang-data+json',
    'Content-Type': 'application/yang-data+json',
})

response = session.get(
    f'{BASE_URL}/restconf/data/Cisco-IOS-XE-wireless-client-oper:client-oper-data',
    timeout=(5, 30),
)
response.raise_for_status()
payload = response.json()
print(payload.keys())

Certificate validation confirms that the automation client reached the intended controller and that the TLS identity chains to a trusted authority. Setting verification to false removes that protection and permits a man-in-the-middle to capture credentials or alter configuration. If a lab uses a private CA, distribute that CA; do not normalize warning suppression.

Timeouts should distinguish connection establishment from response read time. The raise-for-status call converts an HTTP failure into an exception instead of allowing the script to process an error page as device data.

Catalyst Center authentication

Catalyst Center’s token endpoint accepts authenticated credentials and returns a token. Subsequent intent API requests use the X-Auth-Token header. The same TLS and secret-handling rules apply.

import os
import requests

center = os.environ['CATALYST_CENTER_URL'].rstrip('/')
ca_bundle = os.environ['NETWORK_CA_BUNDLE']

with requests.Session() as session:
    session.verify = ca_bundle
    token_reply = session.post(
        f'{center}/dna/system/api/v1/auth/token',
        auth=(os.environ['CATALYST_CENTER_USERNAME'],
              os.environ['CATALYST_CENTER_PASSWORD']),
        timeout=(5, 30),
    )
    token_reply.raise_for_status()
    token = token_reply.json()['Token']

    inventory = session.get(
        f'{center}/dna/intent/api/v1/network-device',
        headers={'X-Auth-Token': token},
        timeout=(5, 30),
    )
    inventory.raise_for_status()
    devices = inventory.json().get('response', [])

Do not print tokens. Limit their lifetime and privileges according to platform capabilities, and handle HTTP 401/403 separately from transport failures.

NETCONF with host-key verification

NETCONF normally uses SSH on TCP 830. SSH server identity is established by the host key, not by the username/password alone.

import os
from ncclient import manager

with manager.connect(
    host=os.environ['WLC_HOST'],
    port=830,
    username=os.environ['WLC_USERNAME'],
    password=os.environ['WLC_PASSWORD'],
    hostkey_verify=True,
    device_params={'name': 'iosxe'},
    timeout=30,
) as connection:
    print('\n'.join(connection.server_capabilities))

Provision the controller’s host key in the account’s trusted known-hosts mechanism before running unattended automation. Disabling host-key verification may help isolate a throwaway lab problem, but it is not required by ncclient and should not appear as the recommended configuration.

Idempotency and validation

Suppose a script must disable SSID broadcast. First GET the modeled WLAN, verify that the expected resource exists, and compare the current value. Send a PATCH only when a change is needed. Preserve a sanitized before-state, validate the proposed payload against the YANG model, and GET the resource again after the change. For large jobs, rate-limit requests and report partial failures by device and operation.

Parsing should be defensive. Use optional access only when absence is expected; otherwise fail with a clear message. Convert units and types deliberately. For example, an RSSI value should be treated as a signed number, not sorted as a string. Never assume that a top-level key exists because one software release returned it.

Operational safeguards

• Use a read-only account for collection and a separately controlled account for changes.
• Scope API permissions and network reachability.
• Log timestamps, target, operation, result, and request correlation identifiers—but not passwords, cookies, tokens, or full sensitive payloads.
• Test data transformations offline, then in a lab, then on a canary target.
• Make rollback criteria explicit and remember that a configuration delta can disrupt service.
• Pin and review Python dependencies; certificate validation does not protect a compromised package.

Safe automation is repeatable evidence: a trusted connection, a validated change, and a verified outcome.