Ansible Playbook Example: Backup Cisco and Arista Switch

At Red Hat Tech Day Netherlands 2026 in Bunnik, Fred van Zwieten and Ismail Dhaoui demoed the new Automation Portal in AAP 2.7, a self-service template gallery where operators click "Start" without touching the underlying playbook. One of the templates shown was Network - Backup Switch Configs, which pulls running configs from Cisco and Arista switches and commits them to Git. Here's a runnable version of that playbook.

Playbook

---
- name: Network - Backup Switch Configs
  hosts: network_switches
  gather_facts: false
  connection: ansible.netcommon.network_cli

  vars:
    backup_dir: "{{ playbook_dir }}/backups/{{ inventory_hostname }}"
    git_repo_dir: "{{ playbook_dir }}/backups"
    git_repo_url: "git@git.example.com:network/switch-configs.git"
    git_branch: "main"

  tasks:
    - name: Backup running-config for Cisco IOS switches
      cisco.ios.ios_config:
        backup: true
        backup_options:
          filename: "{{ inventory_hostname }}.cfg"
          dir_path: "{{ backup_dir }}"
      when: ansible_network_os == "cisco.ios.ios"
      register: ios_backup

    - name: Backup running-config for Arista EOS switches
      arista.eos.eos_config:
        backup: true
        backup_options:
          filename: "{{ inventory_hostname }}.cfg"
          dir_path: "{{ backup_dir }}"
      when: ansible_network_os == "arista.eos.eos"
      register: eos_backup

    - name: Add timestamp header to backup file
      ansible.builtin.lineinfile:
        path: "{{ backup_dir }}/{{ inventory_hostname }}.cfg"
        line: "! Backed up by Ansible on {{ '%Y-%m-%d %H:%M:%S' | strftime }}"
        insertbefore: BOF
      when: ios_backup.changed or eos_backup.changed

- name: Commit switch configs to Git
  hosts: localhost
  gather_facts: false
  vars:
    git_repo_dir: "{{ playbook_dir }}/backups"
    git_branch: "main"

  tasks:
    - name: Stage and commit config changes
      ansible.builtin.shell: |
        cd {{ git_repo_dir }}
        git add .
        git diff --cached --quiet || git commit -m "Automated backup: {{ '%Y-%m-%d %H:%M' | strftime }}"
        git push origin {{ git_branch }}
      args:
        executable: /bin/bash
      register: git_result
      changed_when: "'nothing to commit' not in git_result.stdout"

What it does

The first play targets a network_switches group and runs vendor-specific config modules — cisco.ios.ios_config for IOS devices and arista.eos.eos_config for EOS devices — gated by the ansible_network_os inventory variable. Each module's backup_options writes the running-config to a per-host file. A lineinfile task stamps the file with a backup timestamp for auditability.

The second play runs on localhost and treats the backup directory as a Git working copy: it stages any changed files, commits only if something actually changed (avoiding empty commits), and pushes to the remote. This is exactly the kind of two-stage flow — fetch-from-device, then commit-to-git — that a self-service template like Network - Backup Switch Configs wraps behind a single "Start" button in AAP 2.7's Automation Portal, so an operator doesn't need to know which collections or credentials are involved.

Notes / Gotchas

Requires the cisco.ios and arista.eos collections installed on the execution environment, plus ansible.netcommon for network_cli.
Set ansible_network_os per-host in inventory (cisco.ios.ios or arista.eos.eos) so the when conditions route correctly.
The Git remote must already exist and be reachable with the credentials/SSH key available to the execution environment — AAP typically injects this via a credential attached to the job template.
git add . inside a shell task is fine for a dedicated backup repo, but scope it with -- paths if the directory holds anything else.
Run this on a schedule (cron-style schedule in AAP, or a crontab entry for ad hoc Ansible) so drift gets caught between maintenance windows.

Wrapped in a job template, this same playbook is what powers a one-click "back up my switches" button — the automation doesn't change, only how easily someone can trigger it.

Ansible Playbook Example: Backup Cisco and Arista Switch Configs to Git

Playbook

What it does

Notes / Gotchas

References

Ansible Playbook Example: Backup Cisco and Arista Switch Configs to Git

Playbook

What it does

Notes / Gotchas

Related Articles

References