NAPALM – Network Automation with Python

1. What is NAPALM?

NAPALM stands for Network Automation and Programmability Abstraction Layer with Multivendor support. It is an open-source Python library that provides a unified API to interact with network devices from multiple vendors — Cisco IOS, Cisco IOS-XE, Cisco NX-OS, Arista EOS, Juniper JunOS, and more — using the same Python code regardless of the underlying vendor or operating system.

Without NAPALM, a network engineer would need to write completely separate automation scripts for each vendor — one script for Cisco, another for Arista, another for Juniper. NAPALM eliminates this duplication by providing a single consistent set of methods that work across all supported platforms.

Related pages: Network Automation Overview | Python for Networking | Python Scripts | Netmiko | Ansible Overview | NETCONF & RESTCONF | REST API Overview | SSH Overview

2. Why Use NAPALM? The Multi-Vendor Problem

Enterprise networks rarely run a single vendor. A typical network might have Cisco IOS routers, Arista switches in the data centre, and Juniper firewalls at the perimeter. Managing all of these with vendor-specific scripts creates a maintenance nightmare. NAPALM solves this with a driver model — each vendor has a driver that translates NAPALM's generic methods into vendor-specific commands or API calls behind the scenes.

3. Supported Drivers (Platforms)

NAPALM uses drivers to communicate with different platforms. Each driver knows how to connect to its target OS and translate NAPALM method calls into the correct vendor commands or API calls. You specify the driver when opening a connection.

  NAPALM Driver Architecture:

  Your Python Script
        |
        | napalm.get_network_driver('ios')
        ↓
  ┌─────────────────────────────────────────┐
  │           NAPALM Abstraction Layer       │
  │  get_facts() / get_interfaces() /        │
  │  load_merge_candidate() / commit() ...   │
  └───────────┬────────────┬────────────────┘
              |            |
     ┌────────▼───┐   ┌────▼──────┐   ┌─────────────┐
     │  IOS driver │   │ EOS driver│   │ JunOS driver │
     │  (Netmiko)  │   │ (eAPI)    │   │ (NETCONF)    │
     └────────┬───┘   └────┬──────┘   └──────┬───────┘
              |             |                  |
         Cisco IOS      Arista EOS        Juniper JunOS
            

Related pages: NETCONF & RESTCONF | REST API Overview | JSON, XML & YANG

4. Installation and Opening a Connection

NAPALM is installed with pip. Once installed, every interaction follows the same three-step pattern: get the driver → open the connection → call methods → close.

# ── Step 1: Install NAPALM ───────────────────────────────────────────────
pip install napalm

# ── Step 2: Import and select the driver ─────────────────────────────────
import napalm

driver = napalm.get_network_driver('ios')   # returns the IOS driver class

# ── Step 3: Create a device object ───────────────────────────────────────
device = driver(
    hostname='192.168.1.1',
    username='admin',
    password='cisco123',
    optional_args={
        'port': 22,                 # SSH port (default: 22)
        'secret': 'enable_secret',  # enable secret if required
        'global_delay_factor': 2    # slow devices need more time
    }
)

# ── Step 4: Open the connection ───────────────────────────────────────────
device.open()

# ── Step 5: Do your work (call getters, push config, etc.) ───────────────
# ... (see next sections)

# ── Step 6: Always close the connection ──────────────────────────────────
device.close()

Using a Context Manager (Recommended)

Using Python's with statement ensures the connection is always closed cleanly — even if an exception occurs — and is the recommended pattern for production scripts.

import napalm

driver = napalm.get_network_driver('ios')

with driver(hostname='192.168.1.1', username='admin', password='cisco123') as device:
    facts = device.get_facts()
    print(facts)
# Connection is automatically closed when the 'with' block exits

5. NAPALM Getters — Reading Device State

Getters are NAPALM methods that retrieve operational data from a device and return it as a structured Python dictionary — no manual CLI parsing required. Every getter returns the same dictionary structure regardless of which vendor driver is being used.

Getter Examples — Real Python Code

import napalm

driver = napalm.get_network_driver('ios')

with driver(hostname='10.0.0.1', username='admin', password='cisco123') as device:

    # ── get_facts() ───────────────────────────────────────────────────────
    facts = device.get_facts()
    print(facts)
    # Output (dictionary):
    # {
    #   'hostname': 'R1',
    #   'fqdn': 'R1.lab.local',
    #   'vendor': 'Cisco',
    #   'model': 'CSR1000V',
    #   'os_version': 'Version 16.9.3',
    #   'serial_number': 'ABC123DEF456',
    #   'uptime': 86400,
    #   'interface_list': ['GigabitEthernet1', 'GigabitEthernet2', 'Loopback0']
    # }

    # ── get_interfaces_ip() ───────────────────────────────────────────────
    ip_info = device.get_interfaces_ip()
    print(ip_info)
    # Output:
    # {
    #   'GigabitEthernet1': {
    #     'ipv4': {'192.168.1.1': {'prefix_length': 24}}
    #   },
    #   'Loopback0': {
    #     'ipv4': {'10.0.0.1': {'prefix_length': 32}}
    #   }
    # }

    # ── get_bgp_neighbors() ───────────────────────────────────────────────
    bgp = device.get_bgp_neighbors()
    for peer_ip, peer_data in bgp['global']['peers'].items():
        state = peer_data['description']
        is_up = peer_data['is_up']
        print(f"Peer {peer_ip} — Up: {is_up}")

Related pages: Python Scripts for Networking | show ip interface brief | show ip route | ARP Table | BGP Overview

6. Configuration Management — Replace vs Merge

NAPALM provides two methods for pushing configuration changes to a device. Understanding the difference between replace and merge is critical — choosing the wrong one can cause unintended config changes or even outages.

  Merge (safe, additive):                Replace (destructive, absolute):

  Running config:  A, B, C              Running config:  A, B, C
  Candidate:       D, E                 Candidate:       A, D, E
                   ↓                                     ↓
  Result:          A, B, C, D, E        Result:          A, D, E
                                        (B and C are REMOVED)
            

Config Push Workflow — Always Diff Before Commit

import napalm

driver = napalm.get_network_driver('ios')

with driver(hostname='10.0.0.1', username='admin', password='cisco123') as device:

    # ── Load a merge candidate from a file ────────────────────────────────
    device.load_merge_candidate(filename='ntp_config.txt')
    # Contents of ntp_config.txt:
    # ntp server 10.10.10.1
    # ntp server 10.10.10.2

    # ── Always compare BEFORE committing ─────────────────────────────────
    diff = device.compare_config()
    if diff:
        print("Pending changes:")
        print(diff)
        # Output shows unified diff — lines starting with + are additions,
        # lines starting with - are removals (like 'git diff')

        # ── Commit only if the diff looks correct ─────────────────────────
        confirm = input("Commit these changes? (yes/no): ")
        if confirm.lower() == 'yes':
            device.commit_config()
            print("Configuration committed successfully.")
        else:
            device.discard_config()   # Roll back the candidate — nothing applied
            print("Changes discarded.")
    else:
        print("No changes detected — device already has this configuration.")
        device.discard_config()

import napalm

driver = napalm.get_network_driver('ios')

with driver(hostname='10.0.0.1', username='admin', password='cisco123') as device:

    # ── Load a REPLACE candidate (full config file) ───────────────────────
    device.load_replace_candidate(filename='golden_config_R1.txt')

    diff = device.compare_config()
    print("Replace diff (lines to be REMOVED start with -, ADDED with +):")
    print(diff)

    # ── Rollback if something goes wrong post-commit ──────────────────────
    device.commit_config()
    # If the device becomes unreachable after commit:
    # device.rollback()   # Restores the previous running config

7. Compliance Validation with NAPALM

NAPALM's validation feature lets you define the expected state of a device in a YAML file and then automatically compare it against the device's actual state. It returns a compliance report — ideal for post-change verification, audits, and continuous compliance checking in a CI/CD pipeline.

Validation File (YAML)

# validation.yml — defines expected device state
---
- get_facts:
    hostname: R1
    vendor: Cisco
    os_version:
      _mode: contains
      _value: "16.9"

- get_interfaces:
    GigabitEthernet1:
      is_up: true
      is_enabled: true
    GigabitEthernet2:
      is_up: true

- get_bgp_neighbors:
    global:
      peers:
        10.0.0.2:
          is_up: true
          remote_as: 65002

Running the Compliance Check

import napalm

driver = napalm.get_network_driver('ios')

with driver(hostname='10.0.0.1', username='admin', password='cisco123') as device:

    # Run compliance report against the validation YAML file
    report = device.compliance_report('validation.yml')

    # Print results
    import json
    print(json.dumps(report, indent=2))

    # Check overall pass/fail
    if report['complies']:
        print("✅ Device is COMPLIANT with the validation policy.")
    else:
        print("❌ Device is NON-COMPLIANT — review the report above.")

# Example output structure:
# {
#   "complies": false,
#   "get_facts": {
#     "complies": true,
#     "skipped": []
#   },
#   "get_bgp_neighbors": {
#     "complies": false,
#     "skipped": [],
#     "extra": [],
#     "missing": ["10.0.0.2"]
#   }
# }

Related pages: Network Baseline | JSON, XML & YANG | Python Scripts

8. Multi-Device Automation — Inventory Loop

The real power of NAPALM comes when you run it against multiple devices at once. By combining NAPALM with a simple Python inventory list (or an external inventory tool like Nornir or Ansible), you can collect facts, audit configs, or push changes across your entire network in seconds.

Example — Collect Facts from All Devices

import napalm
import json

# Define your device inventory
inventory = [
    {'host': '10.0.0.1', 'driver': 'ios',   'username': 'admin', 'password': 'cisco123'},
    {'host': '10.0.0.2', 'driver': 'eos',   'username': 'admin', 'password': 'arista123'},
    {'host': '10.0.0.3', 'driver': 'junos', 'username': 'admin', 'password': 'juniper123'},
]

results = {}

for device_info in inventory:
    driver_class = napalm.get_network_driver(device_info['driver'])
    try:
        with driver_class(
            hostname=device_info['host'],
            username=device_info['username'],
            password=device_info['password']
        ) as device:
            facts = device.get_facts()
            results[device_info['host']] = {
                'hostname': facts['hostname'],
                'vendor':   facts['vendor'],
                'model':    facts['model'],
                'version':  facts['os_version'],
                'uptime':   facts['uptime'],
                'status':   'success'
            }
    except Exception as e:
        results[device_info['host']] = {'status': 'failed', 'error': str(e)}

# Print structured results
print(json.dumps(results, indent=2))

Example — Push NTP Config to All IOS Devices

import napalm

ios_devices = [
    {'host': '10.0.0.1', 'username': 'admin', 'password': 'cisco123'},
    {'host': '10.0.0.2', 'username': 'admin', 'password': 'cisco123'},
]

ntp_config = """
ntp server 10.10.10.1 prefer
ntp server 10.10.10.2
"""

driver = napalm.get_network_driver('ios')

for dev in ios_devices:
    with driver(hostname=dev['host'], username=dev['username'], password=dev['password']) as device:
        device.load_merge_candidate(config=ntp_config)
        diff = device.compare_config()
        if diff:
            device.commit_config()
            print(f"[{dev['host']}] ✅ NTP config applied.")
        else:
            device.discard_config()
            print(f"[{dev['host']}] ℹ️  Already configured — no changes needed.")

Related pages: Ansible Overview | Postman & Ansible | NTP Overview | NTP Sync | NAPALM Multi-Vendor Lab

9. NAPALM vs Other Network Automation Tools

Related pages: Network Automation Overview | Ansible Overview | NETCONF & RESTCONF | REST API Overview | Northbound & Southbound APIs | Controller-Based Networking

10. Common NAPALM Errors and Fixes

Related pages: SSH | SSH vs Telnet Security | AAA Overview | Debug Commands | Troubleshooting Methodology

11. Key Points Summary

Practice Quiz – NAPALM