Agentless automation over SSH: a control node connects to managed nodes, runs YAML playbooks, and enforces desired state — idempotent, so re-running a correct playbook changes nothing.

• Inventory groups hosts ([routers] R1 ansible_host=10.1.1.1); variables cascade inventory → group_vars → host_vars for templating.
• Network modules (ios_config, ios_command) speak CLI through netconf/ssh connection plugins.
• Push model, no agents — contrast with Puppet/Chef.

- hosts: switches
  gather_facts: false
  tasks:
    - name: Port security
      ios_config:
        parents: "{{ item }}"
        lines:
          - switchport port-security
        loop: "{{ access_ports }}"

The everyday playbook set: config backup (show run → files), push (template → devices), compliance/upgrade/restore. Configuration drift, the silent killer of CLI-managed networks, dies here — a playbook from git is the truth, devices are just the cache.