Reliable Network Backups & Restore with Ansible: Idempotent, Vendor-Neutral, — with AI/ML Diff Severity#

Rohit Thakur, Principal Engineer, Ansible Networking (Red Hat)

• Why: Network backup/restore is unglamorous but critical network-automation plumbing, and this goes deep into the operational pitfalls (device-native paths, transfer methods, idempotency across IOS/IOS-XR/NX-OS) that matter if you run Cisco gear. Caveat: the speaker is the Red Hat Ansible Networking content lead, so this is contributor-led but also adjacent to product marketing for Ansible Validated Content — evaluate the patterns, not the pitch.
• What: A battle-tested backup/restore workflow for Cisco IOS/IOS-XR/NX-OS with Ansible, plus a lightweight rules/ML approach to score the severity of config diffs (VLAN, ACL, BGP, interface changes) so review and rollback can be prioritized by risk (from abstract only).
• How: Concrete mechanics: absolute on-device paths (bootflash:/, disk0:, /misc/config) because network OSes don't expand ~; SFTP/SCP via internal file servers; canonicalizing configs and SHA-256 hashing so backups only write on change; a single role interface across the three Cisco OSes; restore as stage → replace/merge → post-verify by hash. Diff severity uses feature extraction plus rules, with optional scikit-learn, running offline — no cloud dependency.
• Where applicable: Cisco-heavy estates specifically (the path and OS details are vendor-specific by design), but the idempotent-backup, hash-verified-restore, and diff-risk-ranking patterns are broadly applicable. The ML severity scoring is the speculative part — expect rules to do most of the work — but the idea of ranking network config diffs by blast radius is worth stealing.