Skip to content
Log in Sign up My account

From CLI Engineer to Automation and Cloud: a 6-Month Plan

This is a plan for a working network engineer who is strong on the CLI and wants to move into network automation and cloud roles. It lays out six months of focused skill building, a project for each phase, and how to turn the results into a portfolio. It assumes about 6 to 8 hours a week alongside a full-time job. You do not need to quit anything or to become a software engineer. You need to become the person who writes the script, reviews the pull request and runs the pipeline.

The target

Roles in this space go by names like network automation engineer, network reliability engineer, cloud network engineer or infrastructure engineer. The common thread:

  • You treat the network as code: device inventory, intended configuration and checks live in Git.
  • You use APIs and tools instead of pasting commands.
  • You can design and operate network constructs in at least one public cloud.
  • You still understand routing, switching and troubleshooting. That depth is your advantage over a pure developer.
graph LR
    M1["Month 1<br/>Linux, Git, Python basics"] --> M2["Month 2<br/>Network libraries,<br/>parsing, inventory"]
    M2 --> M3["Month 3<br/>Ansible, templates,<br/>APIs and models"]
    M3 --> M4["Month 4<br/>Cloud networking<br/>and Terraform"]
    M4 --> M5["Month 5<br/>CI/CD, testing,<br/>source of truth"]
    M5 --> M6["Month 6<br/>Capstone, portfolio,<br/>job search"]

Ground rules

  • Build in a lab, never on production first. Use virtual routers (containerlab, EVE-NG, CML or similar) and cloud free tiers or short-lived sessions. The CCNP lab setup page covers practical options.
  • Commit to Git from the first day. Your commit history is the portfolio.
  • Learn by finishing small projects. Tutorials alone do not stick.
  • Write a short README for every project.
  • Use Python 3.10 or later and virtual environments (python -m venv .venv).

Tip

If you already have the CCNP-level knowledge, an automation-focused certification can provide structure for months 2 and 3. See the certification roadmaps for how to fit it in.

Month 1: foundations

Skills

  • Linux command line: files, pipes, grep, sed, ssh, curl, jq, tmux, and editing in a terminal editor.
  • Git: clone, branch, commit, merge, pull request, resolving conflicts.
  • Python basics: variables, lists and dictionaries, loops, functions, files, exceptions, modules, virtual environments, and reading a traceback.
  • Data formats: JSON, YAML and XML, and the difference between them.

Project: device inventory report

Write a script that reads a YAML list of devices and prints a table of hostname, IP, role and site. Extend it to ping each device and mark it reachable or not. Put it in a Git repository with a README.

import subprocess
from pathlib import Path

import yaml  # pip install pyyaml

def reachable(ip: str) -> bool:
    result = subprocess.run(
        ["ping", "-c", "1", "-W", "1", ip],
        capture_output=True,
    )
    return result.returncode == 0

devices = yaml.safe_load(Path("inventory.yml").read_text())["devices"]
for d in devices:
    status = "up" if reachable(d["ip"]) else "down"
    print(f'{d["hostname"]:<15} {d["ip"]:<15} {d["role"]:<8} {status}')

Done when: you can write a 50-line script without copying from a tutorial, and you use Git for every change.

Month 2: talking to devices

Skills

  • SSH automation with Netmiko or Scrapli: connecting, sending show commands, sending config, handling errors and timeouts.
  • Parsing CLI output into structured data with TextFSM (via ntc-templates) or Genie, instead of regular expressions.
  • NAPALM getters for multi-vendor data, and config merge/replace with diff.
  • Credentials: environment variables, a vault, never hard-coded.
  • Concurrency basics: running against many devices with concurrent.futures.

Project: configuration backup and audit tool

  1. Pull the running configuration from every device in your inventory and save it to files in a Git repository, committing only on change.
  2. Parse interface and version data into JSON.
  3. Add three compliance checks (for example, NTP servers present, SNMP community not default, SSH version 2).
  4. Output a report listing devices that fail each check.
from netmiko import ConnectHandler

device = {
    "device_type": "cisco_ios",
    "host": "192.0.2.10",
    "username": "admin",
    "password": "from-env-or-vault",
}
with ConnectHandler(**device) as conn:
    parsed = conn.send_command("show ip interface brief", use_textfsm=True)
    for intf in parsed:
        print(intf["interface"], intf["status"])

Done when: one command backs up and audits 10 lab devices, and the output is structured data.

Month 3: Ansible, templates and APIs

Skills

  • Ansible: inventory, playbooks, roles, variables, group_vars, Vault, the cisco.ios collection (ios_config, ios_facts, ios_vlans, ios_interfaces) or the collection for your vendor.
  • Jinja2 templates to render configuration from data.
  • Idempotency, check mode (--check --diff) and handlers.
  • REST APIs: HTTP methods, status codes, authentication, pagination, using requests.
  • Models: what YANG is, and a first look at NETCONF or RESTCONF against a lab device.

Project: templated configuration generation and deployment

Define VLANs, interfaces and routing for your lab in YAML. Render configurations with Jinja2, push them with Ansible, and verify with --check --diff before applying. Add a rollback by restoring the previous configuration from Git.

- name: Configure VLANs
  hosts: access_switches
  gather_facts: false
  tasks:
    - name: Apply VLAN set
      cisco.ios.ios_vlans:
        config: "{{ vlans }}"
        state: merged

Also write a small script that calls a REST API (for example, a controller in your lab, a public API for practice, or NetBox in month 5) and processes JSON.

Done when: a change begins as an edit in a YAML file and ends on the devices with a visible diff.

Month 4: cloud networking and infrastructure as code

Skills

  • One public cloud in depth (AWS, Azure or Google, picked by what your target employers use): virtual networks, subnets, route tables, security groups or NSGs, NAT gateways, peering, transit constructs, DNS, load balancers, and IAM basics.
  • Hybrid connectivity: VPN and the concepts behind private circuits. See Hybrid Cloud Connectivity Design.
  • Terraform: providers, resources, variables, outputs, state, modules, plan and apply, and remote state.
  • Cost awareness: delete resources when done and set budgets and alerts.

Project: a hybrid lab in code

Use Terraform to build a VPC or VNet with public and private subnets, route tables, a VPN gateway and a test instance. Connect it with an IPsec VPN to a router in your lab or a second cloud network, run BGP over it, and prove failover. Everything is created and destroyed with terraform apply and terraform destroy.

resource "aws_vpc" "lab" {
  cidr_block           = "10.50.0.0/16"
  enable_dns_hostnames = true
  tags = { Name = "lab-vpc" }
}

resource "aws_subnet" "private_a" {
  vpc_id            = aws_vpc.lab.id
  cidr_block        = "10.50.1.0/24"
  availability_zone = "eu-west-1a"
  tags = { Name = "lab-private-a" }
}

Done when: you can destroy and recreate the whole environment in under 20 minutes and explain every route in it.

Warning

Cloud resources cost money while they run. Set a billing alert before your first apply, and always run terraform destroy after a lab session. NAT gateways and VPN connections are classic sources of surprise bills.

Month 5: pipelines, testing and a source of truth

Skills

  • A source of truth such as NetBox: devices, interfaces, IP addresses, VLANs, and its API. Generate Ansible inventory from it.
  • CI/CD: GitHub Actions or GitLab CI. Linting (ansible-lint, yamllint, ruff), unit tests with pytest, and running playbooks in check mode on a pull request.
  • Pre- and post-change validation: collect state before, apply, collect after, compare. Tools such as pyATS, or a script of your own.
  • Observability basics: SNMP, streaming telemetry, syslog and flow data; Prometheus and Grafana at a conceptual level.
  • Secrets management in pipelines.

Project: a pull-request-driven network change

Build a pipeline where a change to a YAML file in a Git repository triggers lint and test jobs, renders configuration, runs Ansible in check mode against lab devices, and posts the diff. On merge, a manual approval step applies the change and runs post-change validation. If validation fails, the pipeline reports and offers a rollback.

Done when: a pull request shows you what would change before it changes.

Capstone

Combine the pieces into one end-to-end project, for example "branch onboarding": NetBox holds the new site, a pipeline renders the configuration, Ansible deploys to lab routers, Terraform builds the cloud side with a VPN, and a validation job proves reachability. Document the architecture with a Mermaid or diagram image and a design write-up covering trade-offs.

Portfolio

  • A GitHub profile with 4 to 6 pinned repositories: the inventory tool, backup/audit tool, Ansible project, Terraform hybrid lab, pipeline and capstone.
  • Each README states the problem, architecture diagram, how to run it, a sample of the output and what you would improve.
  • No credentials, real IPs or customer data in any repository. Use RFC 5737 documentation addresses (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) and RFC 1918 space.
  • A short blog post or write-up on one thing you learned. Teaching shows understanding.
  • A CV that lists projects with outcomes: "reduced the time to audit 200 devices from two days to ten minutes (lab simulation)". Be honest about what is lab work.

Job search

  • Look for roles where automation is part of a network job, not only pure development roles. Your network depth is your edge.
  • Start automating something at your current job. A small, safe, approved script that saves hours is the best experience you can get, and it makes the internal move easier than an external one.
  • Prepare to explain your projects in interviews. See interview prep.
  • Mention automation and cloud skills when you negotiate.

Weekly rhythm

Day Activity
2 weekday evenings 90 minutes of reading and building
1 weekend block 3 to 4 hours on the month's project
Daily 10 minutes to commit what you have, even if small
End of each month Review, tidy the README, tag a release

Tools to know by the end

Area Tools
Language Python 3.10 or later
Device access Netmiko, Scrapli, NAPALM, ncclient
Parsing TextFSM with ntc-templates, Genie
Configuration Ansible with vendor collections, Jinja2
Cloud One of AWS, Azure, Google; Terraform
Source of truth NetBox
Version control and CI Git, GitHub Actions or GitLab CI
Testing pytest, pyATS, ansible-lint
Lab containerlab, EVE-NG, CML or similar

Most of these are open source or have free tiers. Check each licence before using it at work.

Common pitfalls

  • Tool hopping. Pick one library or tool per task and finish a project with it.
  • Automating a bad process. Fix the process or standardize the config first. Automation makes mistakes faster.
  • Skipping the lab. Never run an untested script on production.
  • Ignoring fundamentals. Automation will not rescue a poor design. Keep your routing and switching skills sharp with the CCNP course and its study plan.
  • Not shipping. A half-finished project teaches less than a small finished one.

References