Case study
Network Automation at Fleet Scale
Took a multi-region switch fleet from hand-managed to single-pane - automated config backup, bulk change in minutes, and credentials secured and rotated.
- Unimus (NCM)
- Config backup + restore
- Config diffs
- Bulk config push
- Credential vaulting + rotation
- Multi-vendor switching
Problem
A multi-region switch fleet - Australia, New Zealand and PNG - was maintained by hand. Configs drifted, backups were "hope someone saved the last one," bulk changes were pushed box-by-box, and device credentials were scattered across people and scripts. For a network that production depends on, there was no real recovery path and no audit trail.
Constraints
- Live production network - change the fleet without taking sites down.
- Mixed-vendor estate - the tooling had to be vendor-agnostic, not tied to one OS.
- Credentials are the crown jewels - secured, rotated, and never sitting in a script.
- Cost-justified - a lean tool that earns its place through a real CapEx/OpEx case.
Design
I productionised Unimus - a vendor-agnostic Network Configuration Management platform - as the automation backbone, and stood it up ground-up: install, device onboarding, backup scheduling, and change workflows. It gave the fleet three things it never had from one place: automated, scheduled config backups, change tracking with config diffs, and mass / bulk config push across many devices at once.
It is a lean, community-rooted tool, adopted under a corporate-supported licence so it had a support path and could pass an enterprise change process - the deciding constraint, since an unsupported tool would not have been approved to hold the fleet's credentials.
Security & reliability decisions
- Centralised, vaulted credentials with rotation - the network's secrets live in one scoped, rotated place, never embedded in scripts or shared by hand.
- Known-good config backups - a recovery path for device configuration. Full network DR also depends on replacement hardware, firmware and console access, which sit outside this platform.
- Diffs + auditing - configuration changes are visible and attributable, and the stored known-good config is the material you roll back from. Changes that cut management access or touch firmware still need console/physical access.
- One inventory to act on - the device list the automation runs against lives in one place rather than in per-engineer spreadsheets.
Outcome
The switch fleet across AU/NZ/PNG was maintained from a single pane: configs backed up automatically, bulk changes pushed in minutes instead of days, credentials secured and rotated, and a known-good configuration on file for every device - the material a restore starts from, where previously there was none.
Future improvements
Drive the fleet from an external source-of-truth (an IPAM/DCIM system feeding device intent into Unimus) and template standard site configs so a new location onboards from the inventory rather than by hand.