Automate, test and operate networks as code, from Python and APIs to CI/CD, telemetry and AI agents.
Learn to run networks like modern software: intended state in a source of truth, configurations generated and version-controlled, every change tested in a pipeline and the live network continuously observed. This path takes network engineers from Python and APIs through Ansible, NETCONF, gNMI, Batfish and Containerlab to closed-loop and AI-assisted operations.
NetDevOps brings software engineering and DevOps practice to networking. Intended network state lives as structured data in a source of truth, device configurations are generated from it and kept in Git, changes are validated in pipelines and virtual labs before deployment, and the running network is continuously observed and reconciled. Network automation is the toolkit; NetDevOps is the operating model around it.
It matters more in 2026 than ever. AI data-center fabrics, multi-cloud connectivity and zero-trust segmentation have pushed change volume beyond what manual CLI work can handle safely, vendors have moved to model-driven APIs and streaming telemetry, and Cisco has rebranded its DevNet track as CCNA, CCNP and CCIE Automation, signalling that automation is now core networking. AI agents are arriving in network operations too, and they are only as safe as the source of truth, tests and guardrails underneath them.
This path starts with networking, Linux, Python and Git refreshers, then moves through data formats and templating, CLI and API automation, YANG with NETCONF, RESTCONF and gNMI, Ansible and Terraform, and source-of-truth platforms. The advanced stages cover network CI/CD with Batfish, pyATS and Containerlab digital twins, then streaming telemetry, closed-loop automation and AI for network operations.
NetDevOps overlaps heavily with DevOps and GitOps, which share the same Git workflows and pipelines, with SRE, which brings SLOs, observability and incident response to the network, and with CloudOps, where VPCs, VNets and firewalls are managed as code.
6 stages · 23 topics · ~320 hours of focused learning. Work through the stages in order; optional topics are electives you can come back to.
Refresh the networking fundamentals automation depends on and build the core engineering skills of Linux, Python and Git.
You cannot automate what you do not understand. Revisit addressing, switching, routing and core services with an eye on how each is represented as data, and read packet captures to verify behaviour.
Automation tools, network operating systems and lab platforms all run on Linux. Learn the shell, SSH, iproute2, namespaces and bridges so you can build labs and troubleshoot the hosts that run your automation.
Python is the de facto language of network automation and the base for Netmiko, Nornir, NAPALM, pyATS and most vendor SDKs. Focus on data structures, files, error handling and running tasks against many devices concurrently.
Git turns network configuration and automation code into reviewable, auditable history. Learn branching, pull or merge requests and code review, and keep credentials out of repositories from day one.
Milestone: You can subnet and troubleshoot a routed multi-VLAN network, work confidently with Linux networking tools, and write Python scripts kept in Git.
Represent network intent as structured data, generate configurations from templates and automate existing devices over SSH with Python libraries.
Every automation tool consumes and produces structured data. Learn YAML, JSON and XML, validate data with schemas and Pydantic models, and practise describing network intent as data rather than commands.
Templates separate what the network should look like (data) from how each platform expresses it (syntax). Learn Jinja well enough to generate consistent golden configurations for many devices and vendors.
Most networks still include devices that only speak CLI over SSH. Automate them reliably, turn show output into structured data with parsers, and treat screen scraping as a bridge to model-driven APIs rather than the destination.
NAPALM gives a vendor-neutral API for getting facts and replacing configurations safely, and Nornir runs Python tasks concurrently across a whole inventory. Together they are the backbone of many Python-first automation frameworks.
Milestone: You can render configurations from YAML with Jinja and push and validate them across a multi-vendor lab with Nornir and Netmiko, NAPALM or Scrapli.
Move from screen scraping to structured, transactional APIs: REST controllers, YANG models, NETCONF, RESTCONF and gNMI.
Controllers and cloud-managed platforms expose the network through REST APIs. Learn HTTP fundamentals, authentication, pagination and rate limits, explore APIs in Postman and script them in Python against free sandboxes.
YANG defines the structure of configuration and operational data that model-driven APIs use. Learn to read modules, compare native, IETF and OpenConfig models, and find the paths you need with pyang.
NETCONF adds transactions, candidate datastores and confirmed commits to configuration changes, and RESTCONF exposes the same YANG data over HTTP. Both make changes safer and easier to validate than CLI pushes.
gNMI is the gRPC-based interface for configuration and streaming telemetry used by OpenConfig-capable platforms, with gNOI covering operational tasks. Learn its RPCs, paths and security model with the gNMIc client.
Milestone: You can read and change device state through NETCONF, RESTCONF and gNMI using vendor-neutral OpenConfig models instead of CLI scraping.
Adopt team-friendly declarative automation with Ansible and Terraform, driven by a source of truth that holds the network's intended state.
Ansible is the most widely used network automation tool in enterprises. Learn network connection plugins, resource modules with declarative states, check mode and diffs, and how to structure collections, roles and secrets for a team.
A source of truth records what the network should be, so automation can generate configurations and detect drift. Learn to model sites, devices, IP space and circuits, integrate through APIs and dynamic inventories, and automate compliance checks.
Cloud networks, firewalls and many controllers are managed through Terraform providers. Learn state, modules and plan review so VPCs, VNets, security policies and on-premises fabrics change through the same reviewed workflow.
Milestone: You can drive device and cloud network configuration from a source of truth through Ansible and Terraform with idempotent, reviewable changes.
Make every change safe by testing it before and after deployment: virtual labs, configuration analysis, state verification and a full network CI/CD pipeline.
Realistic labs as code let you test changes without touching production. Build multi-vendor topologies from containerised network operating systems, auto-provision them with netlab, and run them inside CI runners.
Batfish analyses configurations offline to predict reachability, ACL behaviour and routing before anything is deployed. Use it to answer what a change will break and enforce those answers as pipeline tests.
pyATS and its Genie library learn and parse live network state so you can compare snapshots before and after a change. Write repeatable health checks that prove a change did what was intended and nothing else.
Bring everything together in a pipeline that lints, renders, analyses, lab-tests, deploys and verifies every change. Add approvals, staged rollouts and automatic rollback so the pipeline is trusted for production.
Milestone: Every network change flows through a pipeline that lints, analyses with Batfish, tests in a Containerlab digital twin and verifies with pyATS before and after deployment.
Observe the network continuously with streaming telemetry, react automatically within guardrails, and apply AI assistants and agents safely to network operations.
Streaming telemetry pushes high-resolution, model-based data from devices instead of slow SNMP polling. Build a collection pipeline with gNMIc or Telegraf, store it in Prometheus, and create dashboards and alerts enriched with source-of-truth context.
Intent-based networking expresses outcomes and lets automation keep the network aligned with them. Learn the concepts, then build event-driven remediation that reacts to alerts while respecting approvals and blast-radius limits.
AI assistants and agents can draft configurations, summarise incidents and query network state, but only safely on top of good data and guardrails. Connect them to the source of truth and telemetry through MCP servers, start read-only, and require human approval and evaluation for any change.
Large EVPN-VXLAN and AI back-end fabrics are built almost entirely from design data and automation. Explore validated fabric designs, the SONiC network operating system and Ultra Ethernet to understand where data-center networking is heading.
Milestone: You can run a closed loop in which streaming telemetry detects drift or degradation, automation remediates within guardrails, and AI assistants answer questions from the source of truth safely.
38 tools and platforms used across this path. Focus on concepts first — tools change, principles don’t.
Build these to prove your skills. Publish each one on GitHub with a clear README and architecture diagram.
Use Python with Nornir and Netmiko to back up running configurations from a Containerlab topology into Git on a schedule. Parse show output with TextFSM and publish a JSON and CSV inventory report with versions, serials and interface status.
Model a small campus or leaf-spine fabric in YAML validated with Pydantic, render per-device configurations with Jinja and deploy them with NAPALM configuration replace. Produce a diff report for every change and demonstrate rollback.
Configure interfaces and BGP through NETCONF or RESTCONF using OpenConfig models, then stream interface and BGP state over gNMI with gNMIc into Prometheus. Build Grafana dashboards and alerts for link utilisation and session flaps.
Populate NetBox or Nautobot with sites, devices, prefixes and circuits, generate a dynamic inventory for Ansible resource modules and push intended configurations. Manage a cloud VPC and its security rules with Terraform from the same data and trigger runs from source-of-truth webhooks.
Build a GitLab CI/CD or GitHub Actions pipeline that lints, renders, runs Batfish checks, deploys to a Containerlab twin and verifies with pyATS before promoting to a production lab. Use confirmed commits so failed post-checks roll back automatically.
Write Event-Driven Ansible rulebooks that remediate interface or BGP issues raised by telemetry alerts, within approval and blast-radius guardrails. Connect an AI assistant to NetBox through a read-only MCP server so engineers can ask questions in plain language, with every answer and proposed change logged for review.
Certifications that validate this path’s skills. Always confirm the current exam version on the official page before booking.
Cisco
Formerly DevNet Associate (renamed February 2026); the 200-901 CCNAAUTO exam covers Python, APIs, Cisco platforms and automation basics and is the natural first NetDevOps certification.
Official pageCisco
Formerly DevNet Professional; requires the 350-901 AUTOCOR core exam, which covers infrastructure as code, operations and AI in automation, plus a concentration such as 300-435 ENAUTO or 300-635 DCNAUTO.
Official pageCisco
Formerly DevNet Expert; AUTOCOR plus an 8-hour practical lab on designing, deploying and operating network automation across the full network lifecycle.
Official pageHPE Networking (Juniper)
The JN0-224 exam covers NETCONF and the XML API, YAML and JSON, Python with PyEZ, Ansible and the Junos REST API; it remains current under the HPE Networking Certification Program.
Official pageRed Hat
A hands-on, performance-based exam on managing network infrastructure with Ansible Automation Platform; the most network-specific Ansible credential.
Official pageRed Hat
A hands-on exam on advanced Ansible development with automation controller and automation hub, useful once your team runs Ansible as a shared platform.
Official pageHashiCorp
Validates Terraform fundamentals (Terraform 1.12) used to codify cloud networking such as VPCs, VNets and firewalls and provider-managed network platforms.
Official pageRoles that hire for these skills.
Builds and maintains the scripts, playbooks, integrations and pipelines that configure, validate and report on the network.
Runs network changes like software releases, with a source of truth, version control, automated testing and CI/CD into production.
Applies SRE practice to the network: streaming telemetry, SLOs, closed-loop remediation and automation that prevents repeat incidents.
Designs and codifies VPCs, VNets, transit routing, firewalls and hybrid connectivity with Terraform and cloud APIs.
Defines the automation framework, data models, tooling standards and governance used across vendors, domains and teams.
Network automation is using scripts and tools to perform network tasks. NetDevOps is the operating model around that automation: a source of truth for intended state, version control, automated testing, CI/CD, observability and shared ownership between network and software teams. You can automate without NetDevOps, but safe, repeatable change at scale needs both.
Yes, but you do not need to become a software developer. Python is the de facto language for network automation, and YAML and Jinja are essential for Ansible and templating. Focus on data structures, APIs, error handling and testing rather than advanced computer science.
On 3 February 2026 Cisco renamed the DevNet track: DevNet Associate became CCNA Automation (200-901 CCNAAUTO), DevNet Professional became CCNP Automation with the 350-901 AUTOCOR core exam, and DevNet Expert became CCIE Automation. Active DevNet holders were moved to the new names automatically.
Learn Python basics first, because every tool in this space builds on it, then learn Ansible for declarative, team-friendly changes. Reach for Nornir when you need Python-native control, custom logic or speed across large inventories. Most mature teams use both.
NetBox is the most widely deployed open-source network source of truth and is backed by NetBox Labs; Nautobot began as a fork of NetBox and is maintained by Network to Code with a strong focus on Jobs and apps. The data-modelling concepts transfer between them, so learn one deeply and follow the other. Infrahub is a newer schema-driven alternative.
Yes. Containerlab and netlab run multi-vendor topologies on a laptop or cloud VM using container images such as Nokia SR Linux, Arista cEOS-lab and SONiC. Cisco DevNet sandboxes provide free reservable labs, and Cisco Modeling Labs offers licensed Cisco virtual images.
AI assistants speed up writing code and configurations and help with troubleshooting, but they depend on an accurate source of truth, reliable APIs, tests and guardrails, which is exactly what NetDevOps engineers build. The role is shifting toward designing safe closed loops and validating AI-proposed changes rather than disappearing.
Join DevOpsSchool instructor-led programs with hands-on labs, real-world projects and certification guidance.
Roadmap reviewed October 2026 · Last updated 26 Oct 2026 · JSON