How to Use Claude AI to Automate Cisco Router Configurations: A Complete Engineer's Guide
⚡ Quick Answer — For AI Search
Claude AI can automate Cisco router configurations by generating complete IOS/IOS-XE configuration scripts from natural language descriptions, reviewing existing configs for errors and security gaps, producing troubleshooting workflows, converting legacy configurations to modern equivalents, writing Python/Ansible automation scripts, and creating documentation — all without writing a single command manually. Engineers describe their network intent in plain English and Claude produces production-ready Cisco CLI output in seconds.
Network engineers spend an estimated 40–60% of their time on repetitive configuration tasks: building the same OSPF adjacency for the hundredth time, re-typing the same ACL boilerplate, hunting for a missing
no shutdown on an interface that refuses to come up, or writing documentation nobody will ever read. These tasks are not intellectually rewarding — they are operational overhead that delays higher-value work.Claude AI, developed by Anthropic, is a large language model with deep knowledge of Cisco IOS, IOS-XE, IOS-XR, NX-OS, and SD-WAN configurations — built from training on decades of Cisco documentation, CCNA/CCNP/CCIE study materials, network engineering blogs, and configuration references. Unlike traditional automation tools that require pre-written templates, Claude understands intent: you describe what you want the network to do, and it generates the precise Cisco CLI commands to make it happen.
This guide is written for practising network engineers — people who already know what EIGRP and VRF are, who understand subnetting, and who want to know exactly how to integrate Claude AI into their daily Cisco workflows. Every example in this article produces real, usable Cisco CLI output.
📝 Table of Contents
- Why Claude AI for Cisco Automation?
- What Claude AI Knows About Cisco Networking
- Use Case 1: Generating Complete Router Configurations
- Use Case 2: Configuring Routing Protocols (OSPF, EIGRP, BGP)
- Use Case 3: Building Access Control Lists (ACLs)
- Use Case 4: VPN and Tunnel Configuration
- Use Case 5: SD-WAN Policy and Template Generation
- Use Case 6: Configuration Review and Security Auditing
- Use Case 7: Troubleshooting and Root Cause Analysis
- Use Case 8: Writing Python and Netmiko Automation Scripts
- Use Case 9: Generating Ansible Playbooks for Cisco Devices
- Use Case 10: Configuration Documentation and Change Records
- How to Prompt Claude AI Effectively for Cisco Configs
- Limitations and What to Verify Before Deployment
- Claude AI vs Traditional Network Automation Tools
- Final Verdict: The Future of AI-Assisted Network Engineering
1. Why Claude AI for Cisco Automation?
Traditional Cisco automation relies on tools like Ansible, Netmiko, NAPALM, and NSO — all of which require significant upfront investment in template creation, variable management, and playbook development. These tools are powerful, but they require the engineer to already know exactly what configuration to apply. They automate the execution of configurations — not the creation of them.
Claude AI addresses the creation phase. It understands networking intent expressed in natural language and translates it into production-ready Cisco CLI. This creates a fundamentally new workflow:
Traditional Workflow
1. Understand the requirement → 2. Look up Cisco documentation → 3. Write configuration manually → 4. Review for errors → 5. Test in lab → 6. Deploy → 7. Write documentation
AI-Augmented Workflow
1. Describe requirement to Claude → 2. Review and validate generated config → 3. Test in lab → 4. Deploy → 5. Ask Claude to document it
Steps 2 through 5 of the traditional workflow collapse into a single step. Engineers who have integrated Claude AI into their workflow report reducing configuration generation time by 60–80% for routine tasks — not by removing engineering judgment, but by removing the mechanical typing and documentation lookup work.
💡 Key Principle
Claude AI is not a replacement for Cisco expertise — it is an accelerant. You still need to understand what the generated configuration does, verify it against your network's specific requirements, and test it before deploying in production. The engineer's role shifts from typing commands to reviewing, validating, and making architectural decisions.
2. What Claude AI Knows About Cisco Networking
Claude has been trained on comprehensive Cisco documentation, certification study materials (CCNA through CCIE), network engineering forums, and configuration references. Its knowledge spans the following Cisco technologies:
| Category | Technologies & Features | IOS Coverage |
|---|---|---|
| Routing Protocols | OSPF (single/multi-area), EIGRP, BGP (iBGP/eBGP), RIP, IS-IS, Static Routes, PBR, Route Maps | IOS / IOS-XE / IOS-XR / NX-OS |
| Switching | VLANs, STP/RSTP/MST, VTP, Trunking (802.1Q), EtherChannel/LACP, Port Security, DAI, DHCP Snooping | IOS / IOS-XE / NX-OS |
| Security | Standard/Extended/Named ACLs, Zone-Based Firewall, AAA/RADIUS/TACACS+, 802.1X, MACsec, SSH/SSL hardening, CoPP | IOS / IOS-XE |
| VPN / Tunnels | IPsec Site-to-Site, GRE, DMVPN (Phase 1/2/3), FlexVPN, SSL VPN, MPLS/VRF, L2TPv3, VXLAN | IOS / IOS-XE / IOS-XR |
| QoS | MQC (Class-maps, Policy-maps, Service-policies), DSCP/CoS marking, Traffic Shaping, Policing, CBWFQ, LLQ, WRED | IOS / IOS-XE |
| SD-WAN | Catalyst SD-WAN policies, OMP, vManage templates, Data policies, Control policies, App-Aware Routing | IOS-XE SD-WAN |
| Management & Automation | SNMP, NetFlow, Syslog, NETCONF/YANG, gRPC, EEM (Event Manager), Tcl scripting, Python on-box (IOS-XE) | IOS-XE / IOS-XR / NX-OS |
| High Availability | HSRP, VRRP, GLBP, BFD, IP SLA, NSF/SSO, Stateful Switchover, VSS, StackWise | IOS / IOS-XE |
3. Use Case 1: Generating Complete Router Configurations
The most powerful basic use case is asking Claude to generate a complete, production-ready router configuration from a description of what you need. This eliminates blank-page syndrome and produces a solid starting point in seconds.
💬 Prompt Example
Generate a complete Cisco IOS-XE configuration for a branch office router with the following requirements:
- Hostname: BR-NYC-01
- WAN interface: GigabitEthernet0/0 — IP 203.0.113.1/30 (ISP link)
- LAN interface: GigabitEthernet0/1 — IP 10.20.10.1/24
- Default route toward the ISP (203.0.113.2)
- NAT overload on the WAN interface for the LAN subnet
- SSH v2 only, disable Telnet
- SNMP v3 read-only with username "monitoring" and auth SHA / priv AES128
- NTP server: 10.0.0.1
- Syslog to 10.0.0.50
- Disable CDP globally, enable only on LAN interface
- Basic hardening: disable unused services (finger, http server, bootp)
Claude AI Output (representative):
hostname BR-NYC-01
!
no ip finger
no ip http server
no ip http secure-server
no ip bootp server
no cdp run
!
username admin privilege 15 secret 0 <SET-STRONG-PASSWORD>
!
aaa new-model
aaa authentication login default local
aaa authorization exec default local
!
interface GigabitEthernet0/0
description WAN-ISP-Link
ip address 203.0.113.1 255.255.255.252
ip nat outside
no shutdown
!
interface GigabitEthernet0/1
description LAN-Branch
ip address 10.20.10.1 255.255.255.0
ip nat inside
cdp enable
no shutdown
!
ip route 0.0.0.0 0.0.0.0 203.0.113.2
!
ip access-list standard NAT-ACL
permit 10.20.10.0 0.0.0.255
!
ip nat inside source list NAT-ACL interface GigabitEthernet0/0 overload
!
snmp-server group SNMPV3GROUP v3 priv
snmp-server user monitoring SNMPV3GROUP v3 auth sha <AUTH-PASSWORD> priv aes 128 <PRIV-PASSWORD>
!
ntp server 10.0.0.1
logging host 10.0.0.50
!
line vty 0 4
login local
transport input ssh
!
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
end
✅ What just happened: Claude generated a complete, syntactically correct, hardened Cisco IOS-XE configuration in approximately 2 seconds. Note how it structured the NAT configuration, placed CDP disable globally then re-enabled it on the LAN interface, and added AAA scaffolding alongside SSH. A manual effort for the same config would typically take 15–25 minutes including documentation lookup.
4. Use Case 2: Configuring Routing Protocols (OSPF, EIGRP, BGP)
Routing protocol configuration is where Claude demonstrates particular depth — it understands not just the commands but the design intent behind them, and produces configurations with appropriate parameters rather than bare-minimum examples.
💬 OSPF Multi-Area Prompt
Configure OSPF on a Cisco IOS-XE router with these requirements:
- Process ID 1, Router ID 10.255.255.1
- Backbone area (Area 0): Loopback0 (10.255.255.1/32) and GigabitEthernet0/0 (10.1.0.1/30)
- Area 10 (stub area): GigabitEthernet0/1 (10.10.1.1/24)
- Passive interface on all LAN-facing interfaces
- MD5 authentication on Area 0 interfaces, key "ospf-auth-key1"
- BFD on GigabitEthernet0/0 for fast failure detection
- Set reference bandwidth to 10Gbps
router ospf 1
router-id 10.255.255.1
auto-cost reference-bandwidth 10000
passive-interface default
no passive-interface GigabitEthernet0/0
area 10 stub
!
interface Loopback0
ip address 10.255.255.1 255.255.255.255
ip ospf 1 area 0
!
interface GigabitEthernet0/0
ip address 10.1.0.1 255.255.255.252
ip ospf 1 area 0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 ospf-auth-key1
ip ospf network point-to-point
bfd interval 300 min_rx 300 multiplier 3
ip ospf bfd
!
interface GigabitEthernet0/1
ip address 10.10.1.1 255.255.255.0
ip ospf 1 area 10
!
Claude automatically set the interface as point-to-point (appropriate for a /30 link), applied passive-interface default with selective enablement, and included BFD parameters within acceptable ranges. These are design decisions that junior engineers frequently miss.
💬 eBGP Prompt
Configure eBGP on a Cisco IOS-XE edge router:
- Local AS: 65001
- Peer 1: 203.0.113.2 (ISP-A, AS 64512) — GigabitEthernet0/0
- Peer 2: 198.51.100.2 (ISP-B, AS 64513) — GigabitEthernet0/1
- Advertise prefix 10.100.0.0/16 to both peers
- Prefer ISP-A with local-preference 200, ISP-B with local-preference 100
- Apply AS-path prepending (3x) when advertising to ISP-B (make ISP-A preferred for inbound)
- Maximum BGP prefixes from each ISP: 500 (warning at 80%)
- Set BGP timers: keepalive 10s, holdtime 30s
- Enable soft reconfiguration inbound on both peers
ip prefix-list ADVERTISE-PREFIX seq 5 permit 10.100.0.0/16
!
route-map SET-LOCAL-PREF-ISPA permit 10
set local-preference 200
!
route-map SET-LOCAL-PREF-ISPB permit 10
set local-preference 100
!
route-map PREPEND-TO-ISPB permit 10
match ip address prefix-list ADVERTISE-PREFIX
set as-path prepend 65001 65001 65001
!
router bgp 65001
bgp timers 10 30
neighbor 203.0.113.2 remote-as 64512
neighbor 203.0.113.2 description ISP-A
neighbor 203.0.113.2 soft-reconfiguration inbound
neighbor 203.0.113.2 maximum-prefix 500 80
neighbor 203.0.113.2 route-map SET-LOCAL-PREF-ISPA in
neighbor 203.0.113.2 route-map ALLOW-OUT out
neighbor 198.51.100.2 remote-as 64513
neighbor 198.51.100.2 description ISP-B
neighbor 198.51.100.2 soft-reconfiguration inbound
neighbor 198.51.100.2 maximum-prefix 500 80
neighbor 198.51.100.2 route-map SET-LOCAL-PREF-ISPB in
neighbor 198.51.100.2 route-map PREPEND-TO-ISPB out
!
ip bgp-community new-format
!
route-map ALLOW-OUT permit 10
match ip address prefix-list ADVERTISE-PREFIX
5. Use Case 3: Building Access Control Lists (ACLs)
ACL creation is one of the most error-prone manual tasks in network engineering — a single misplaced wildcard mask or wrong sequence number can block production traffic. Claude generates correctly ordered, commented, named ACLs with proper wildcard math every time.
💬 ACL Prompt
Create a named extended ACL called BRANCH-INTERNET-POLICY for application on inbound traffic on the LAN-facing interface with these rules:
- Block all traffic from the 192.168.99.0/24 management VLAN to the internet (any)
- Allow DNS (UDP/TCP 53) from 10.20.0.0/22 to any
- Allow HTTP/HTTPS (80, 443) from 10.20.0.0/22 to any
- Allow SMTP outbound (TCP 25) only from 10.20.1.10/32 (mail server)
- Block all other traffic from 10.20.0.0/22 to outside
- Permit established TCP return traffic
- Log all denied packets
ip access-list extended BRANCH-INTERNET-POLICY
remark Block Management VLAN from internet access
10 deny ip 192.168.99.0 0.0.0.255 any log
remark Allow established TCP return traffic
20 permit tcp any any established
remark Allow DNS from branch subnets
30 permit udp 10.20.0.0 0.0.3.255 any eq 53
40 permit tcp 10.20.0.0 0.0.3.255 any eq 53
remark Allow HTTP and HTTPS from branch subnets
50 permit tcp 10.20.0.0 0.0.3.255 any eq 80
60 permit tcp 10.20.0.0 0.0.3.255 any eq 443
remark Allow SMTP only from mail server
70 permit tcp host 10.20.1.10 any eq 25
remark Block all other traffic from branch — log denials
80 deny ip 10.20.0.0 0.0.3.255 any log
remark Implicit deny (logged for visibility)
90 deny ip any any log
6. Use Case 4: VPN and Tunnel Configuration
IPsec VPN and DMVPN configurations are notoriously complex — with multiple interacting components (ISAKMP/IKE policy, transform sets, crypto maps, GRE/mGRE tunnels, NHRP) that must be precisely coordinated. Claude generates complete, phase-matched VPN configurations for both sides of a tunnel.
💬 DMVPN Phase 3 Prompt
Generate a complete DMVPN Phase 3 configuration using IKEv2 with the following:
Hub router:
- Hostname: HUB-DC-01, public IP on Gi0/0: 1.2.3.4
- Tunnel0 address: 172.16.0.1/24, tunnel network key: 12345678
- mGRE multipoint tunnel
- NHRP network ID: 100, NHRP authentication key: nhrp-secret
- OSPF Area 0 on the tunnel interface
Spoke router:
- Hostname: SPOKE-NYC-01, public IP on Gi0/0: 5.6.7.8
- Tunnel0 address: 172.16.0.2/24
- NHRP NHS pointing to Hub (1.2.3.4, tunnel 172.16.0.1)
- IKEv2 with AES-256-GCM, SHA-256, DH group 14, PSK "VPNkey@2025!"
- IPsec transform: ESP AES-256-GCM with integrity SHA-256
HUB-DC-01 Configuration:
crypto ikev2 proposal DMVPN-PROP
encryption aes-cbc-256
integrity sha256
group 14
!
crypto ikev2 policy DMVPN-POL
proposal DMVPN-PROP
!
crypto ikev2 keyring DMVPN-KEYS
peer ANY-SPOKE
address 0.0.0.0 0.0.0.0
pre-shared-key VPNkey@2025!
!
crypto ikev2 profile DMVPN-PROFILE
match identity remote address 0.0.0.0
authentication remote pre-share
authentication local pre-share
keyring local DMVPN-KEYS
!
crypto ipsec transform-set DMVPN-TS esp-aes 256 esp-sha256-hmac
mode transport
!
crypto ipsec profile DMVPN-IPSEC
set transform-set DMVPN-TS
set ikev2-profile DMVPN-PROFILE
!
interface Tunnel0
ip address 172.16.0.1 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
ip nhrp authentication nhrp-secret
ip nhrp map multicast dynamic
ip nhrp network-id 100
ip nhrp redirect
ip ospf 1 area 0
ip ospf network point-to-multipoint
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 12345678
tunnel protection ipsec profile DMVPN-IPSEC
SPOKE-NYC-01 Configuration:
crypto ikev2 proposal DMVPN-PROP
encryption aes-cbc-256
integrity sha256
group 14
!
crypto ikev2 policy DMVPN-POL
proposal DMVPN-PROP
!
crypto ikev2 keyring DMVPN-KEYS
peer HUB
address 1.2.3.4
pre-shared-key VPNkey@2025!
!
crypto ikev2 profile DMVPN-PROFILE
match identity remote address 1.2.3.4 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local DMVPN-KEYS
!
crypto ipsec transform-set DMVPN-TS esp-aes 256 esp-sha256-hmac
mode transport
!
crypto ipsec profile DMVPN-IPSEC
set transform-set DMVPN-TS
set ikev2-profile DMVPN-PROFILE
!
interface Tunnel0
ip address 172.16.0.2 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
ip nhrp authentication nhrp-secret
ip nhrp map 172.16.0.1 1.2.3.4
ip nhrp map multicast 1.2.3.4
ip nhrp network-id 100
ip nhrp nhs 172.16.0.1
ip nhrp shortcut
ip ospf 1 area 0
ip ospf network point-to-multipoint
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 12345678
tunnel protection ipsec profile DMVPN-IPSEC
7. Use Case 5: SD-WAN Policy and Template Assistance
Cisco Catalyst SD-WAN policy creation is notoriously complex — with Data Policies, Control Policies, Feature Templates, and Device Templates that can overwhelm even experienced engineers. Claude can help design and explain SD-WAN policies, generate Cisco IOS-XE SD-WAN edge configurations, and troubleshoot OMP/vSmart policy issues.
💬 SD-WAN Edge Config Prompt
Generate the Cisco IOS-XE SD-WAN configuration for a cEdge router (Catalyst 8300):
- Site ID: 100, System IP: 10.255.100.1
- WAN transport 1: GigabitEthernet0/0 — MPLS color, IP from DHCP
- WAN transport 2: GigabitEthernet0/1 — biz-internet color, IP 203.0.113.10/30
- LAN: GigabitEthernet0/2 — VPN 10, IP 10.100.1.1/24
- Restrict MPLS interface (MPLS-only, no fallback to internet)
- IPsec encapsulation on both transports
- OMP graceful-restart enabled
system
system-ip 10.255.100.1
site-id 100
!
sdwan
omp
graceful-restart
!
interface GigabitEthernet0/0
description WAN-MPLS
ip address dhcp
no shutdown
sdwan
tunnel-interface
color mpls restrict
encapsulation ipsec
allow-service all
!
interface GigabitEthernet0/1
description WAN-Internet
ip address 203.0.113.10 255.255.255.252
no shutdown
sdwan
tunnel-interface
color biz-internet
encapsulation ipsec
allow-service all
!
vpn 10
interface GigabitEthernet0/2
description LAN-Branch-VPN10
ip address 10.100.1.1 255.255.255.0
no shutdown
8. Use Case 6: Configuration Review and Security Auditing
Paste an existing router configuration into Claude and ask it to identify security weaknesses, misconfigurations, and best-practice violations. This is one of the highest-ROI use cases — particularly for inherited infrastructure or pre-change audits.
💬 Security Audit Prompt
Review this Cisco router configuration for security vulnerabilities, misconfigurations, and deviations from Cisco hardening best practices (CIS Benchmark). For each issue found:
1. Describe the risk
2. Provide the corrected configuration command(s)
3. Rate the severity: Critical / High / Medium / Low
[PASTE YOUR CONFIGURATION HERE]
Claude will typically identify and categorise issues such as:
| Severity | Common Finding | Fix |
|---|---|---|
| 🔴 Critical | enable password (MD5-weak) instead of enable secret | Replace with: enable secret <strong-password> |
| 🟠 High | Telnet enabled on VTY lines (transport input all) | line vty 0 15 / transport input ssh |
| 🟡 High | CDP running on WAN-facing interface (information leakage) | interface gi0/0 / no cdp enable |
| 🟢 Medium | NTP without authentication (susceptible to spoofing) | ntp authenticate / ntp trusted-key / ntp authentication-key |
| ⚪ Low | No exec-timeout on VTY lines (idle sessions remain open) | line vty 0 15 / exec-timeout 5 0 |
9. Use Case 7: Troubleshooting and Root Cause Analysis
Paste show command output directly into Claude and describe the symptom. Claude will analyse the output, identify the likely root cause, and provide the fix with step-by-step verification commands.
💬 Troubleshooting Prompt Examples
"My OSPF neighbour on Gi0/1 is stuck in EXSTART state. Here is the output of 'show ip ospf neighbor' and 'show ip ospf interface Gi0/1'. What is wrong?"
"BGP session keeps dropping every 90 seconds. Here is the 'show bgp neighbors' output. What is causing the hold timer to expire?"
"Traffic from VLAN 20 cannot reach VLAN 30 despite the SVIs being configured. Here is 'show ip interface brief', 'show vlan brief', and 'show ip route'. What is missing?"
"My IPsec tunnel shows as UP but traffic is not passing. Here is 'show crypto ipsec sa' and 'show crypto isakmp sa'. Diagnose the problem."
🔍 Troubleshooting Power
Claude can interpret complex show output — including BGP state machines, OSPF LSA analysis, IPsec SA mismatch, STP topology issues, and QoS queue depth problems — and provide structured root-cause analysis that would normally require 30–60 minutes of investigation and documentation searching. It also generates the next-step verification commands so you can confirm the fix worked.
10. Use Case 8: Writing Python and Netmiko Automation Scripts
Claude can generate complete Python scripts using Netmiko, Paramiko, NAPALM, or the Cisco IOS-XE REST API to automate configuration deployment, data collection, and compliance checking across large router fleets.
💬 Python Script Prompt
Write a Python script using Netmiko that:
1. Reads a list of Cisco IOS-XE router IPs and credentials from a CSV file (devices.csv)
2. Connects to each router via SSH
3. Collects: hostname, IOS version, interface status (show ip interface brief), and BGP summary
4. Saves results to a timestamped JSON file per device
5. Handles SSH timeout and authentication errors gracefully with retry logic (3 attempts)
6. Prints a summary table to stdout when complete
Include requirements.txt content and a sample devices.csv format.
Claude's Python Output (representative):
import csv, json, time, datetime
from netmiko import ConnectHandler, NetmikoTimeoutException, NetmikoAuthenticationException
from tabulate import tabulate
def collect_device_data(device_info, retries=3):
for attempt in range(retries):
try:
connection = ConnectHandler(**device_info)
hostname = connection.send_command("show run | include hostname")
version = connection.send_command("show version | include Version")
interfaces = connection.send_command("show ip interface brief")
bgp_summary = connection.send_command("show bgp summary")
connection.disconnect()
return {
"hostname": hostname,
"ios_version": version,
"interfaces": interfaces,
"bgp_summary": bgp_summary,
"status": "success"
}
except NetmikoAuthenticationException:
return {"status": "auth_failed", "ip": device_info["host"]}
except NetmikoTimeoutException:
if attempt < retries - 1:
time.sleep(5)
else:
return {"status": "timeout", "ip": device_info["host"]}
def main():
results = []
timestamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S")
with open("devices.csv") as f:
reader = csv.DictReader(f)
for row in reader:
device = {"device_type": "cisco_xe", "host": row["ip"],
"username": row["username"], "password": row["password"]}
data = collect_device_data(device)
with open(f"{row['ip']}-{timestamp}.json", "w") as out:
json.dump(data, out, indent=2)
results.append([row["ip"], data.get("status"), data.get("hostname","N/A")])
print(tabulate(results, headers=["IP","Status","Hostname"]))
if __name__ == "__main__":
main()
Claude would also provide the requirements.txt (netmiko, tabulate) and a sample CSV format. It generates complete, runnable code — not pseudocode or skeleton stubs.
11. Use Case 9: Generating Ansible Playbooks for Cisco Devices
Claude generates complete Ansible playbooks using the cisco.ios collection, including properly structured inventory files, variable management, and idempotent task design.
💬 Ansible Playbook Prompt
Write an Ansible playbook using the cisco.ios collection that:
- Applies NTP servers (10.0.0.1, 10.0.0.2) to all routers in the "branch_routers" group
- Configures syslog to 10.0.0.50 with severity debugging
- Ensures SSH v2 is enabled and Telnet is disabled on all VTY lines
- Saves the configuration after changes
- Uses separate variable files (group_vars/branch_routers.yml)
- Includes a verify task that checks SSH is accepting connections
Include the inventory file structure and group_vars file.
---
- name: Cisco Branch Router Baseline Configuration
hosts: branch_routers
gather_facts: false
connection: network_cli
tasks:
- name: Configure NTP servers
cisco.ios.ios_ntp_global:
config:
servers:
- server: "{{ ntp_server_primary }}"
- server: "{{ ntp_server_secondary }}"
state: merged
- name: Configure syslog server
cisco.ios.ios_logging_global:
config:
hosts:
- hostname: "{{ syslog_server }}"
trap: debugging
state: merged
- name: Enforce SSH v2 only on VTY lines
cisco.ios.ios_config:
lines:
- transport input ssh
- login local
parents: line vty 0 15
- name: Enable SSH version 2
cisco.ios.ios_config:
lines:
- ip ssh version 2
- name: Save running configuration
cisco.ios.ios_config:
save_when: modified
- name: Verify SSH connectivity
wait_for:
host: "{{ inventory_hostname }}"
port: 22
timeout: 10
12. Use Case 10: Configuration Documentation and Change Records
Documentation is perpetually underwritten and overdue in every network team. Claude can convert raw Cisco configurations into structured, human-readable documentation that non-engineers can understand — and produce formal change records for ITIL/ITSM processes.
💬 Documentation Prompts
"Analyse this router configuration and produce a structured network design document explaining: the routing topology, WAN connectivity, security controls, management configuration, and any notable design decisions. Write it for a non-technical IT manager."
"Generate an ITIL-compliant change record for adding this OSPF configuration to a production router. Include: change summary, technical steps, rollback procedure, risk level, and test verification commands."
"Create an IP address and interface reference table from this running configuration."
"Convert this IOS-XE configuration to a Jinja2 template with variables for hostname, IPs, and credentials."
📋 Documentation Value
Network teams that use Claude for documentation report writing time reductions of 70–90%. A task that previously took 2–3 hours of manual documentation writing — interpreting the configuration, writing change records, building IP tables, creating rollback procedures — takes 5–10 minutes when Claude drafts the first version from the raw configuration. Engineers then review and adjust, rather than writing from scratch.
13. How to Prompt Claude AI Effectively for Cisco Configurations
The quality of Claude's output is directly proportional to the specificity of your prompt. These prompting principles consistently produce better, more accurate Cisco configurations:
✅ Effective Prompting Principles
- Specify the IOS version: "Cisco IOS-XE 17.x", "NX-OS 9.x", or "IOS-XR" — commands differ between platforms.
- Provide exact IP addresses and subnet masks: Claude performs correct wildcard math but needs your specific addressing.
- State the physical topology: "Point-to-point link", "hub-and-spoke DMVPN", "multi-area OSPF" — topology drives design decisions.
- Specify authentication methods: Pre-shared key vs certificates, MD5 vs SHA, ISAKMP policy numbers.
- Request both ends of a tunnel: "Generate configs for both the hub and spoke router."
- Ask for inline comments: "Add remark statements explaining each section." This produces self-documenting configs.
- Ask for verification commands: "Include the show commands to verify this configuration is working correctly."
- Provide constraints: "The router has 4GB RAM — optimise accordingly" or "The ISP requires only one BGP community."
❌ Weak Prompt vs Strong Prompt
Weak: "Configure BGP on my router."
Why it fails: Claude does not know your AS number, peers, subnets, or policy requirements — it will generate a generic skeleton that needs significant editing.
Strong: "Configure eBGP on an IOS-XE router. Local AS 65001. Two ISP peers: 203.0.113.2 (AS 64512) and 198.51.100.2 (AS 64513). Advertise 10.100.0.0/16 to both. Prefer ISP-A with local-preference 200. AS-path prepend 3x when advertising to ISP-B. Maximum prefix 500 from each ISP with 80% warning. Keepalive 10s, holdtime 30s."
Why it works: Claude receives all the information needed to generate a complete, correct configuration with route maps, prefix lists, and BGP timers already tuned to your requirements.
14. Limitations and What to Verify Before Deployment
Claude AI is a powerful assistant, but it is not infallible. Network engineers must apply professional judgment and validation before deploying any AI-generated configuration into production.
⚠️ Always Verify Before Production Deployment
- Platform-specific syntax: Test in a lab or GNS3/CML environment — commands valid on IOS-XE 17.x may differ on older IOS platforms.
- Knowledge cutoff: Claude's training has a cutoff date — very recent IOS-XE feature releases or SD-WAN policy constructs from the past year may not be reflected.
- Environment-specific context: Claude does not know your existing topology, running configs on adjacent devices, or ISP-specific requirements — cross-check against your environment.
- Security credential handling: Never enter real passwords or PSKs into Claude prompts — use placeholders and substitute before deployment.
- Complex interdependencies: Multi-system interactions (e.g., AAA integration with ISE, complex redistribution with route filters) may need manual review for subtle ordering issues.
- Always test ACLs: Verify ACL logic with packet-tracer or in a controlled test before applying to production interfaces.
The recommended workflow is: Claude generates → Engineer reviews → Lab validates → Change management approves → Production deploys. The goal is to remove the generation time and documentation burden from the engineer, not to remove engineering oversight.
15. Claude AI vs Traditional Network Automation Tools
| Tool | Primary Strength | Primary Limitation | Works Best With Claude? |
|---|---|---|---|
| Claude AI | Intent → Config translation; troubleshooting; documentation | Cannot connect directly to devices; requires validation | N/A — the AI layer |
| Ansible | Fleet-wide config deployment; idempotency; CI/CD integration | Requires playbook authoring expertise; templates needed upfront | ✅ Claude writes the playbooks |
| Netmiko / Python | Flexible scripting; data collection; custom automation | Requires Python development skills; scripts must be maintained | ✅ Claude writes the scripts |
| Cisco NSO | Multi-vendor orchestration; YANG model-driven; transactional commits | Complex, expensive, significant onboarding time | ✅ Claude explains NSO YANG models and service packages |
| Cisco CML / GNS3 | Lab simulation; topology testing | Requires setup; resource-intensive | ✅ Claude generates configs to load into CML/GNS3 |
| NAPALM | Multi-vendor unified API; configuration diff/replace | Limited to supported platforms; no intent understanding | ✅ Claude generates NAPALM configuration strings |
The most powerful approach is not choosing Claude instead of traditional automation tools — it is using Claude alongside them. Claude generates the content (configs, scripts, playbooks); Ansible/Netmiko/NSO deploys it at scale. Claude is the AI brain that understands intent; traditional tools are the execution engines.
16. Final Verdict: The Future of AI-Assisted Network Engineering
🤖 The Verdict
Claude AI does not replace Cisco-certified network engineers — it makes them dramatically more productive. The engineer who learns to work effectively with Claude AI can outperform one who does not by a factor of 3–5x on routine configuration and documentation tasks. CCNP and CCIE-level knowledge remains essential: you need to understand what Claude generates well enough to review it, validate it, and make the architectural judgments that AI cannot make for you.
The engineers who will struggle in the next decade are not those who use AI tools — they are those who refuse to. As AI-assisted configuration generation, review, and documentation becomes standard practice, the baseline expectation for engineer productivity will rise. Engineers who master prompt engineering for network configurations will find themselves doing more interesting, higher-value work while the AI handles the mechanical aspects of the job.
Start with one use case. Pick the task you find most tedious — ACL creation, DMVPN configs, weekly change records — and try Claude on it today. The productivity gains speak for themselves.
