A 4-hour, hands-on IOS XE automation workshop. Deploy, validate, and automate Cisco IOS XE device configuration using Network as Code (NaC), Terraform, and GitLab CI/CD — no raw HCL required.
- Lab guide: https://netascode.github.io/nac-iosxe-learning-lab/
- Origin: Originally delivered as LTRXAR-2008 at Cisco Live US 2026 (Las Vegas); now maintained here as the canonical NaC IOS XE learning path. (The session-catalog link requires a Cisco Live account to load.)
For presenters running this lab live in a dCloud environment (Cisco Live, TechAdvantage, customer workshops, internal enablement, etc.), share two links with attendees:
- Lab pod (dCloud):
<insert per-event dCloud reservation share URL>— spins up the four IOS XE devices, ISP router, GitLab, and the Ubuntu / Windows jumpboxes attendees work from. - Lab guide:
<insert deployed lab-guide URL — typically the "Lab guide (web)" link above, or a mirror hosted on your delivery infrastructure>— the step-by-step content each attendee reads alongside the pod.
Attendees can arrange the two URLs however their setup allows — two monitors, split screen on one, laptop plus tablet, whatever works. Duplicate the block above per session if the event runs the lab more than once with different pod reservations.
This workshop teaches you how to manage IOS XE devices declaratively — describe the desired network state in YAML and let the automation stack figure out how to get there. You will:
- Write declarative IOS XE configurations in Network as Code YAML format
- Apply the three-tier configuration hierarchy: global → device group → device
- Deploy configurations to live IOS XE devices using the Network as Code Terraform module
- Use variables and templates (
model,file,cli) for reusable, scalable intent files - Run pre-deployment schema validation with
nac-validateto catch errors before they hit a device - Run post-deployment automated tests with
nac-testand Robot Framework to verify what actually landed - Build and trigger a GitLab CI/CD pipeline that runs validate → plan → deploy → test automatically
- Implement a GitOps merge-request workflow with branch protection and plan-as-comment review
Protocol internals (NETCONF/RESTCONF), raw Terraform HCL authoring, custom provider or module development, network design, or production-grade secret/state management.
| Layer | Technology |
|---|---|
| Configuration language | YAML (Network as Code data model) |
| Infrastructure engine | Terraform |
| IOS XE Terraform module | terraform-iosxe-nac-iosxe |
| IOS XE Terraform provider | terraform-provider-iosxe |
| Device transport | NETCONF (RFC 6241) over SSH |
| Schema validation | nac-validate |
| Post-deployment testing | nac-test + Robot Framework + Pabot |
| CI/CD platform | GitLab CI/CD |
| Lab infrastructure | Cisco Modeling Labs (CML) — Catalyst 9000v / Catalyst 8000v |
| Lab workstation | Windows 10 VM (VS Code, WSL Ubuntu, Solar-PuTTY) |
| # | Task | Concept |
|---|---|---|
| 01 | SSH to network devices | Verify connectivity, understand NETCONF |
| 02 | Edit YAML files with VS Code | Project structure, intent files |
| 03 | Global configuration | Banner on all devices — the top of the hierarchy |
| 04 | Device group configuration | ACL on access switches only |
| 05 | Single device configuration | Loopback0 on core only |
| 06 | Variables | Dynamic hostname substitution |
| 10 | Schema validation (nac-validate) |
Catch misconfigurations pre-deploy |
| 12 | Cleanup (terraform destroy) |
State separation before CI/CD |
| 13 | Run a CI/CD pipeline | GitLab validate → plan → deploy → notify |
| # | Task | Concept |
|---|---|---|
| 07 | Templates type model |
VLANs via reusable YAML templates |
| 08 | Templates type file |
BGP via Jinja2 .tftpl with loops |
| 09 | Templates type cli |
Raw CLI injection for unsupported features |
| 11 | Post-checks with nac-test |
Robot Framework tests rendered from intent YAML |
| 14 | Extend CI/CD pipeline | Add integration + idempotency test stages |
| 15 | Merge request workflow | Branch protection, plan-as-comment, GitOps |
Engineers and architects who want to adopt Infrastructure as Code for network operations — whether you are new to Terraform and YAML or already use CI/CD pipelines daily. The lab is designed to be accessible to all experience levels, with step-by-step instructions, verification commands, and troubleshooting callouts throughout.
Network as Code (NaC) is Cisco's open-source Terraform-based automation framework. You express intended device state in human-readable YAML; the NaC Terraform module translates that intent into YANG-modeled configuration and pushes it over NETCONF. The same methodology covers IOS XE, NX-OS, IOS XR, ACI, Catalyst SD-WAN, Meraki, Catalyst Center, and ISE — this lab focuses on IOS XE.
The key abstraction: you never write resource blocks or wire Terraform dependencies. You write YAML that looks like the device's intended state, and the module handles the rest.
- Andrea Testino — Principal Software Engineer, CCIE #56739 · LinkedIn · atestini@cisco.com
- Christopher Hart — Sr. Software Consulting Engineering Technical Leader · LinkedIn · chart2@cisco.com
Additional thanks to Asier Arlegui (LinkedIn) and Balu Novak-Bohak for the original inspiration behind this lab (Cisco Live Amsterdam 2025).