Netmiko in depth: connecting to many vendors, sending commands and config

What Netmiko solves

Raw SSH libraries give you a byte stream. Network CLIs, however, have prompts that change, "--More--" paging, configuration modes and slow responses. Netmiko is an open-source Python library built on the Paramiko SSH library that deals with all of this for you. You choose a device_type and Netmiko knows how to log in, disable paging, enter config mode and detect when a command has finished.

Install it in a virtual environment with pip install netmiko. Common device types include cisco_ios, cisco_xe, cisco_nxos, arista_eos, juniper_junos and linux. If you are unsure, SSHDetect can guess the type, but naming it explicitly is faster and more reliable.

Connecting and running show commands

Keep credentials out of the script. Read them from environment variables or prompt with getpass. Use the connection as a context manager so it always disconnects.

import os
from getpass import getpass
from netmiko import ConnectHandler

device = {
    "device_type": "cisco_ios",
    "host": "192.168.10.11",
    "username": os.environ.get("NET_USER") or input("Username: "),
    "password": os.environ.get("NET_PASS") or getpass("Password: "),
}

with ConnectHandler(**device) as conn:
    print(conn.find_prompt())
    output = conn.send_command("show ip interface brief")
    print(output)
    parsed = conn.send_command("show version", use_textfsm=True)
    print(type(parsed))

With use_textfsm=True, Netmiko uses the ntc-templates collection (installed with Netmiko 4 and later) to return a list of dictionaries instead of text, when a template exists for that command and platform. If not, you get plain text back, so check the type before using it.

Sending configuration

send_config_set() enters configuration mode, sends a list of lines and exits again. send_config_from_file() does the same from a text file, which pairs well with Jinja2 templates. On Cisco IOS, save_config() writes the running configuration to startup.

import os
from netmiko import ConnectHandler

commands = [
    "vlan 30",
    " name GUEST",
    "interface GigabitEthernet1/0/10",
    " switchport access vlan 30",
]

with ConnectHandler(device_type="cisco_ios", host="192.168.10.11",
                    username=os.environ["NET_USER"],
                    password=os.environ["NET_PASS"]) as conn:
    before = conn.send_command("show vlan brief")
    result = conn.send_config_set(commands)
    print(result)
    after = conn.send_command("show vlan brief")
    if "GUEST" in after:
        conn.save_config()
    else:
        print("VLAN not found after change, not saving")

Tip: slow commands such as show tech-support may exceed the default wait. Pass read_timeout=120 to send_command() rather than adding sleeps.

Scaling up and staying safe

• Many devices: loop over an inventory and catch NetmikoTimeoutException and NetmikoAuthenticationException per device. For tens or hundreds of devices, run in parallel with Nornir or concurrent.futures.
• Jump hosts: Netmiko can use an SSH config file (ssh_config_file) to reach devices through a bastion.
• Host keys: in production, verify SSH host keys rather than accepting any key, so you do not send credentials to an impostor.
• Least privilege: use a dedicated automation account with only the privilege level it needs, and log its actions with AAA (authentication, authorisation and accounting).
• Change control: test in a lab, get approval, and run changes in a maintenance window with a rollback plan.