ExamFinch.com My Study

Study guide

18.1 Python Fundamentals for Network Engineers & Cisco Libraries

Practice this exam

CCNP Enterprise ENCOR 350-401

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Enterprise Architecture & Hierarchical Design

1.1 Enterprise Network Design Models & Hierarchical Campus Architecture 1.2 On-Premises, Cloud & Hybrid Infrastructure Deployment Models 1.3 Hardware Switching Architecture & Packet Forwarding

2 Chapter 2: Enterprise Quality of Service (QoS)

2.1 QoS Components: Classification, Marking & Trust Boundaries 2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output

3 Chapter 3: Software-Defined WAN (Catalyst SD-WAN)

3.1 Cisco Catalyst SD-WAN Architecture & Orchestration 3.2 SD-WAN Policies, Traffic Engineering & Application-Aware Routing

4 Chapter 4: Software-Defined Access (Catalyst SD-Access)

4.1 Catalyst SD-Access Fabric Architecture & Plane Separation 4.2 Cisco TrustSec, Security Group Tags (SGT), SXP & MACsec

5 Chapter 5: Device & Data Path Virtualization

5.1 Server & Network Device Virtualization 5.2 VRF-Lite & Virtual Routing Multi-Tenancy 5.3 GRE & IPsec Tunnel Virtualization Mechanics

6 Chapter 6: Network Virtualization & Overlay Technologies

6.1 LISP Architecture & EID-to-RLOC Mapping Mechanics 6.2 VXLAN & EVPN Overlay Architecture

7 Chapter 7: Layer 2 Infrastructure & Switching

7.1 VLANs, 802.1Q Trunking & VTPv3 7.2 Spanning Tree Protocol Mechanics 7.3 Advanced STP Protection Mechanisms 7.4 EtherChannel Link Aggregation

8 Chapter 8: Layer 3 Routing Foundations & EIGRP

8.1 IP Routing Foundations & Administrative Distance 8.2 Enhanced Interior Gateway Routing Protocol (EIGRP)

9 Chapter 9: OSPFv2 & OSPFv3 Operations

9.1 OSPFv2 Architecture & Neighbor State Machine 9.2 OSPF LSA Types & Multi-Area Design 9.3 OSPFv3 for IPv4 and IPv6 Address Families

10 Chapter 10: Border Gateway Protocol (BGP)

10.1 BGP Architecture, Neighbor States & Peering 10.2 BGP Path Attributes & Best Path Selection Algorithm

11 Chapter 11: Policy-Based Routing & Route Redistribution

11.1 Policy-Based Routing (PBR) & Route Maps 11.2 Route Redistribution & Loop Prevention

12 Chapter 12: IP Services & High Availability

12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP) 12.2 Network Time Protocol (NTPv4) & Precision Time Protocol (PTP) 12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

13 Chapter 13: IP Multicast Operations

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping 13.2 Protocol Independent Multicast (PIM-SM, PIM-SSM & Bidir-PIM) 13.3 Rendezvous Point (RP) Distribution Mechanisms

14 Chapter 14: Network Assurance & Monitoring

14.1 Diagnostic Utilities, Conditional Debugging & Path MTU Discovery 14.2 Syslog Architecture, Logging Facilities & Severity Levels 14.3 SNMPv1/v2c/v3 Security & Flexible NetFlow (FNF) Architecture 14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking

15 Chapter 15: Catalyst Center Assurance & Controller Operations

15.1 Cisco Catalyst Center (DNA Center) Assurance & AI Network Analytics 15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)

16 Chapter 16: Enterprise Security & Access Control

16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+ 16.2 Access Control Lists (ACLs) for Infrastructure Security 16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr) 16.4 Layer 2 Infrastructure Security Features 16.5 IEEE 802.1X Port-Based Authentication & MAB

17 Chapter 17: Threat Defense & API Security

17.1 Enterprise VPN Technologies (DMVPN Phase 1/2/3 & FlexVPN) 17.2 Next-Generation Threat Defense & Secure Access Service Edge (SASE)

18 Chapter 18: Network Automation, Programmability & Data Modeling

18.1 Python Fundamentals for Network Engineers & Cisco Libraries 18.2 YANG Data Modeling Language (RFC 6020/7950) & Model Types 18.3 REST API Architecture, HTTP Verbs, Security & Cisco Controller APIs 18.4 Model-Driven Telemetry (MDT) & NETCONF/RESTCONF Operations

19 Chapter 19: Orchestration, EEM & AI Operations

19.1 Configuration Management & Infrastructure as Code (Ansible & Terraform) 19.2 Cisco Embedded Event Manager (EEM) & Intent-Based Networking

18.1 Python Fundamentals for Network Engineers & Cisco Libraries

Key Takeaways Explain This Topic AI

Python core data types (int, float, str, bool) and collections (list, dict, tuple) form the data manipulation bedrock of network automation, where dictionaries and lists map directly to serialized JSON objects and arrays.

Data parsing functions transform structured data across formats: json.loads() and json.dumps() convert between JSON strings and Python dictionaries, while yaml.safe_load() and yaml.dump() securely parse and emit human-readable YAML documents.

The requests library delivers synchronous HTTP/REST API capabilities, managing authentication, headers, JSON body serialization, SSL verification (verify=False), and response status code validation.

Netmiko provides multi-vendor SSH CLI automation via ConnectHandler, executing operational inspection with send_command() and configuration transactional pushes with send_config_set() and save_config().

The ncclient library establishes secure NETCONF sessions over SSH (port 830) using manager.connect(), executing XML Remote Procedure Calls (RPCs) such as get_config() and edit_config() against structured YANG datastores.

Last updated: August 2026

18.1 Python Fundamentals for Network Engineers & Cisco Libraries

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topics 6.1 (interpret basic Python components and scripts) and 6.2 (construct valid JSON-encoded files), in the domain v1.2 renamed "Automation and Artificial Intelligence", test a candidate's ability to construct, interpret, and troubleshoot Python automation scripts interacting with Cisco enterprise infrastructure. Mastery requires proficiency in native Python data structures (lists, dictionaries, tuples), serialization formats (JSON and YAML), and the three dominant automation libraries: requests for RESTful API controllers, netmiko for multi-vendor SSH CLI interactions, and ncclient for NETCONF XML RPC transactions.

Modern network engineering requires shifting from manual CLI configuration to scalable, programmatic infrastructure management. Python has emerged as the industry-standard language for network automation due to its expressive syntax, extensive standard library, and robust ecosystem of networking packages. +---------------------------------------------------------------------------------------------------+

  • | PYTHON NETWORK AUTOMATION ARCHITECTURE |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | +---------------------------------------------------------------------------------------------+ |
  • | | PYTHON AUTOMATION SCRIPT | |
  • | | - Primitive Types: int, float, str, bool - Data Collections: list, dict, tuple | |
  • | | - Serialization Parsers: json (loads/dumps) - YAML Parsers: PyYAML (safe_load/dump) | |
  • | +---------------------------------------------------------------------------------------------+ |
  • | | | | |
  • | v v v |
  • | +-------------------+ +----------------------+ +--------------------+ |
  • | | REQUESTS (HTTP) | | NETMIKO (SSH) | | NCCLIENT (NETCONF)| |
  • | | - HTTPS Port 443 | | - SSH Port 22 | | - SSH Port 830 | |
  • | | - JSON Payloads | | - CLI Text Engine | | - XML / YANG RPCs | |
  • | | - RESTful APIs | | - send_command() | | - edit-config | |
  • | | - Webhooks / SSO | | - send_config_set | | - get-config | |
  • | +-------------------+ +----------------------+ +--------------------+ |
  • | | | | |
  • | v v v |
  • | +-------------------+ +----------------------+ +--------------------+ |
  • | | Cisco Catalyst | | Cisco IOS-XE / NX-OS | | Cisco Catalyst | |
  • | | Center / vManage | | Switches & Routers | | 9000 Series (YANG) | |
  • | +-------------------+ +----------------------+ +--------------------+ |
  • +---------------------------------------------------------------------------------------------------+

1. Python Data Types & Core Data Structures

Network automation scripts process configuration templates, interface states, routing tables, and API responses. Understanding how Python handles primitive types and complex collections is fundamental to writing reliable automation.

Primitive Data Types

  • Data Type Python Keyword Description Example Network Value
  • Integer int Whole numerical values (no decimal points) vlan_id = 100 , bgp_as = 65001
  • Float float Decimal numerical values cpu_util = 42.8 , snr_db = 28.5
  • String str Textual data enclosed in quotes hostname = "core-sw01" , ip = "10.1.1.1"
  • Boolean bool Logical truth values ( True or False ) is_up = True , spanning_tree_enabled = False

Collections: Lists, Dictionaries, and Tuples # 1. LIST: Ordered, mutable, indexed by integer sequence, allows duplicates

  • interfaces = ["GigabitEthernet1/0/1", "GigabitEthernet1/0/2", "TenGigabitEthernet1/0/1"]
  • interfaces.append("Loopback0") # Append element to end
  • primary_uplink = interfaces[0] # Zero-based indexing -> "GigabitEthernet1/0/1"
  • sub_interfaces = interfaces[1:3] # Slicing -> ["GigabitEthernet1/0/2", "TenGigabitEthernet1/0/1"]
  • # 2. DICTIONARY: Key-value mapping, unordered (Python 3.7+ preserves insertion order), mutable
  • device = {
  • "hostname": "dist-rtr-01",
  • "ip_address": "192.168.10.1",
  • "vendor": "cisco",
  • "os": "iosxe",
  • "vlans": [10, 20, 30, 99]
  • }
  • hostname = device["hostname"] # Direct key lookup -> "dist-rtr-01"
  • management_ip = device.get("mgmt_ip", "10.0.0.1") # Safe lookup with default fallback
  • device["os_version"] = "17.9.4a" # Add or update key-value pair
  • # 3. TUPLE: Ordered, immutable sequence, fixed footprint, often used for constants
  • socket_binding = ("192.168.1.10", 830) # IP address and TCP port pair

# socket_binding[1] = 22 # ERROR: Tuples cannot be modified after instantiation +---------------------------------------------------------------------------------------------------+

  • | DATA STRUCTURE COMPARISON MATRIX |
  • +---------------------------------------------------------------------------------------------------+
  • | Structure | Syntax Literal | Ordered? | Mutable? | Key Lookup / Access | Primary Network Use |
  • | :--------- | :-------------- | :------- | :------- | :------------------ | :------------------------- |
  • | **List** | `[elem1, elem2]`| Yes | Yes | Integer Index `[0]` | Interface lists, IP pools |
  • | **Dict** | `{"k": "v"}` | Yes (3.7)| Yes | Key Name `["k"]` | Device configs, JSON payloads|
  • | **Tuple** | `(elem1, elem2)`| Yes | No | Integer Index `[0]` | Static (host, port) pairs |
  • +---------------------------------------------------------------------------------------------------+

2. Serialization Formats: JSON & YAML Parsing

Modern APIs, controllers (Catalyst Center, vManage), and configuration management tools exchange data using serialized formats. Python provides built-in and third-party modules to serialize (convert Python objects to text) and deserialize (parse text into Python objects).

JSON Parsing with the json Module

JSON (JavaScript Object Notation) is the dominant data format for RESTful APIs. It maps directly to Python primitives:

  • JSON Objects ↔ \leftrightarrow ↔ Python Dictionaries
  • JSON Arrays ↔ \leftrightarrow ↔ Python Lists
  • JSON Strings ↔ \leftrightarrow ↔ Python Strings
  • JSON Numbers ↔ \leftrightarrow ↔ Python Integers / Floats
  • JSON Booleans ( true / false ) ↔ \leftrightarrow ↔ Python Booleans ( True / False )
  • JSON null ↔ \leftrightarrow ↔ Python None import json

# Raw JSON string received from a REST API

api_response = '{"response": [{"hostname": "sw-access-01", "managementIp": "10.10.20.1", "reachabilityStatus": "Reachable"}]}'

  • # DESERIALIZATION: Parse JSON string into Python dict (json.loads -> Load String)
  • pdata = json.loads(api_response)
  • first_device = pdata["response"][0]
  • print(f"Device {first_device['hostname']} is {first_device['reachabilityStatus']}")
  • # Output: Device sw-access-01 is Reachable
  • # SERIALIZATION: Convert Python dictionary into formatted JSON string (json.dumps -> Dump String)
  • payload = {
  • "interface": "GigabitEthernet1/0/24",
  • "description": "Uplink to Core",
  • "enabled": True,
  • "speed": 1000
  • }
  • json_string = json.dumps(payload, indent=2, sort_keys=True)
  • print(json_string)

# Output:

  • # {
  • # "description": "Uplink to Core",
  • # "enabled": true,
  • # "interface": "GigabitEthernet1/0/24",
  • # "speed": 1000
  • # }
  • YAML Parsing with PyYAML ( yaml.safe_load )

YAML (YAML Ain't Markup Language) is human-readable, relying on indentation rather than brackets. It is widely used in Ansible playbooks, CI/CD pipelines, and configuration modeling.

Important

Always use yaml.safe_load() instead of yaml.load() . Calling yaml.load() without specifying a SafeLoader can execute arbitrary code embedded inside untrusted YAML strings, creating a critical remote code execution (RCE) vulnerability. import yaml

  • yaml_document = """
  • --

device:

  • hostname: core-rtr-01
  • bgp_as: 65100

peers:

  • neighbor: 10.255.255.2
  • remote_as: 65200
  • description: Transit ISP-A
  • neighbor: 10.255.255.6
  • remote_as: 65300
  • description: Transit ISP-B
  • """
  • # Securely parse YAML string into Python dictionary
  • config_dict = yaml.safe_load(yaml_document)
  • print(f"BGP AS: {config_dict['device']['bgp_as']}")

for peer in config_dict['device']['peers']:

print(f" Peer {peer['neighbor']} (AS {peer['remote_as']}) -> {peer['description']}")

  • # Export Python dictionary back to YAML string
  • yaml_output = yaml.dump(config_dict, default_flow_style=False)

Loading diagram... Python Automation Protocol Stack and Cisco Libraries

3. Cisco Automation Library 1: requests (REST APIs)

The requests package is the standard Python library for interacting with HTTP-based REST APIs exposed by network controllers like Cisco Catalyst Center, Cisco SD-WAN vManage, and Cisco Meraki.

  • Core Methods and Request Components
  • HTTP Methods: requests.get() , requests.post() , requests.put() , requests.patch() , requests.delete()
  • Authentication: auth=('admin', 'password') for HTTP Basic Auth
  • Headers: headers={'Content-Type': 'application/json', 'Accept': 'application/json'}

Payload Serialization: json=payload_dict automatically serializes dictionaries to JSON and sets the Content-Type: application/json header

SSL Verification: verify=False ignores untrusted/self-signed SSL certificates (disables TLS validation)

Response Handling: response.status_code (e.g., 200, 201), response.json() (deserializes JSON response directly to Python dict), response.text (raw text body) import requests

import urllib3

  • # Suppress insecure HTTPS request warnings when verify=False
  • urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
  • url = "https://catalyst-center.enterprise.local/dna/intent/api/v1/network-device"
  • headers = {
  • "x-auth-token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  • "Accept": "application/json"
  • }
  • params = {"managementIpAddress": "10.1.100.1"}

try:

  • response = requests.get(url, headers=headers, params=params, verify=False, timeout=10)
  • response.raise_for_status() # Raises HTTPError for 4xx or 5xx status codes
  • device_data = response.json()
  • print(f"HTTP Status: {response.status_code}")
  • print(f"Device Family: {device_data['response'][0]['family']}")
  • print(f"Software Version: {device_data['response'][0]['softwareVersion']}")

except requests.exceptions.HTTPError as err:

print(f"HTTP Error encountered: {err}")

except requests.exceptions.ConnectionError:

print("Failed to connect to Catalyst Center. Verify IP and routing reachability.")

4. Cisco Automation Library 2: netmiko (SSH CLI Automation)

netmiko (developed by Kirk Byers) is a multi-vendor library built on top of Paramiko . It abstracts low-level SSH handling, terminal screen scraping, prompt detection, and privilege elevation across Cisco IOS-XE, NX-OS, IOS-XR, and third-party operating systems.

Essential netmiko Functions

ConnectHandler(**device_dict) : Establishes an encrypted SSHv2 connection to the network device.

send_command(command_string) : Executes an operational show command, waits for the CLI prompt to return, and returns the output as a string.

send_config_set(config_commands) : Enters configuration mode ( config t ), sends a list or tuple of configuration commands, exits config mode, and returns the output.

save_config() : Writes the running configuration to non-volatile memory ( write memory or copy running-config startup-config ).

  • disconnect() : Gracefully closes the SSH session. from netmiko import ConnectHandler
  • from netmiko.exceptions import NetmikoTimeoutException, NetmikoAuthenticationException
  • cisco_switch = {
  • "device_type": "cisco_ios", # Specifies device OS driver
  • "host": "192.168.1.50",
  • "username": "admin",
  • "password": "C1sco123!",
  • "secret": "EnableSecret456!", # Enable password for privilege escalation
  • "port": 22,
  • "timeout": 10,
  • }

try:

  • print(f"Connecting to {cisco_switch['host']}...")
  • net_connect = ConnectHandler(**cisco_switch)
  • net_connect.enable() # Enters privileged EXEC mode (# prompt)
  • # 1. Operational Command Execution
  • version_output = net_connect.send_command("show version | include uptime")
  • print(f"Uptime info:\n{version_output}")
  • # 2. Transactional Configuration Push
  • config_payload = [
  • "interface Loopback100",
  • "description Automation Management Interface",
  • "ip address 10.100.100.1 255.255.255.255",
  • "no shutdown"
  • ]
  • config_result = net_connect.send_config_set(config_payload)
  • print(f"Configuration Result:\n{config_result}")
  • # 3. Save Running Configuration to NVRAM
  • save_result = net_connect.save_config()
  • print(f"Save status: {save_result}")

net_connect.disconnect()

except NetmikoTimeoutException:

print(f"Connection timed out to device {cisco_switch['host']}.")

except NetmikoAuthenticationException:

print(f"Authentication failed for user {cisco_switch['username']}.")

5. Cisco Automation Library 3: ncclient (NETCONF XML RPCs)

ncclient is a Python client library for NETCONF (RFC 6241). It establishes an SSH connection over TCP port 830 to communicate with YANG-modeled network devices using structured XML Remote Procedure Calls (RPCs).

Key Methods of ncclient.manager

manager.connect() : Establishes NETCONF connection with parameters host , port=830 , username , password , hostkey_verify=False , and device_params={'name': 'iosxe'} .

m.get_config(source='running', filter=xml_filter) : Retrieves configuration data from the designated datastore filtered by a specific XML subtree.

m.get(filter=xml_filter) : Retrieves both configuration data AND operational/state data (e.g., interface counters, CPU utilization).

m.edit_config(target='running', config=xml_config) : Modifies configuration elements in the target datastore.

m.commit() : Commits staged changes (required on candidate-datastore platforms such as IOS-XR).

  • m.close_session() : Gracefully terminates the NETCONF session. from ncclient import manager
  • import xmltodict
  • router = {
  • "host": "192.168.1.1",
  • "port": 830,
  • "username": "admin",
  • "password": "Cisco123!",
  • "hostkey_verify": False,
  • "device_params": {"name": "iosxe"}
  • }
  • # XML Filter targeting the ietf-interfaces YANG model
  • xml_filter = """
  • <filter xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  • <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
  • <interface>
  • <name>GigabitEthernet1</name>
  • </interface>
  • </interfaces>
  • </filter>
  • """

with manager.connect(**router) as m:

  • # Execute NETCONF <get-config> RPC
  • netconf_reply = m.get_config(source="running", filter=("subtree", xml_filter))
  • # Parse returned XML into a native Python dictionary using xmltodict
  • data_dict = xmltodict.parse(netconf_reply.xml)
  • intf = data_dict['rpc-reply']['data']['interfaces']['interface']
  • print(f"Interface: {intf['name']}")
  • print(f"Admin Status: {intf.get('enabled', 'unknown')}")
  • Comparison: requests vs netmiko vs ncclient
  • Attribute requests netmiko ncclient
  • Protocol HTTP / HTTPS SSHv2 NETCONF over SSH
  • Standard Port TCP 80 / 443 TCP 22 TCP 830
  • Data Format JSON / Form-Data Unstructured Plain Text (CLI) Structured XML (YANG schema)
  • Target Systems Controllers (Catalyst Center, vManage) IOS-XE, NX-OS, IOS-XR CLI IOS-XE, IOS-XR, NX-OS NETCONF
  • Idempotency Method dependent (PUT/DELETE) Non-idempotent (CLI text scripts) Idempotent (State-defined XML)
  • Parsing Burden Low ( response.json() ) High (Regex / TextFSM / TTP) Low (XML tree / xmltodict )