Network Automation Ubuntu Server Setup

Series overview | Next: Collect Cisco Syslog with Rsyslog and MySQL

Part 1 of 5: In Part 1, we prepare and harden the Ubuntu Server that will host the network-automation workflow. The goal is a patched, recoverable server that accepts management and syslog traffic only from approved networks.

Safety note: Use an isolated lab, replace every example value, protect all credentials, maintain console access, and back up configurations before allowing automated changes.

Before You Begin

Build and validate this in an isolated lab before using it on production switches.
Replace every example IP address, VLAN, username, password, email address, and MAC address.
Use a dedicated, least-privileged network-automation account and protect credentials with Ansible Vault or another secrets manager.
Back up switch configurations and confirm out-of-band access before allowing automation to change interfaces.
Review each playbook and template against your switch platform and software release.

Tested with: Ubuntu Server 24.04.3 LTS and Cisco IOS/IOS XE switches. Last reviewed: August 2026.

Configuring Ubuntu

This implementation was built on Ubuntu Server 24.04.3 LTS. We run it on Nutanix AHV and have also tested the underlying components on VMware and Hyper-V. Start with a clean server, assign it a static IP address, apply current updates, and take a snapshot before continuing.

Harden the Ubuntu Server

The downloadable script reflects one environment and is provided as a starting point—not a universal security baseline. Read the entire script before running it. Confirm its package, SSH, firewall, IPv6, user, and update settings against your organization’s standards.

ubuntuHarden Download

At minimum, customize the permitted SSH source networks and decide whether IPv6 should remain enabled. Keep an active console or hypervisor session available while changing firewall rules so you can recover if SSH is accidentally blocked.

sudo chmod +x ubuntuHarden.sh
sudo ./ubuntuHarden.sh

Configure UFW to deny unsolicited inbound traffic while permitting only the management and syslog sources required in your environment. The networks below are examples.

#Wipe UFW config if there is one
sudo ufw reset

#Configure default incoming deny all and outgoing allow all
sudo ufw default deny incoming
sudo ufw default allow outgoing
#Allow SSH from client network - my pc
sudo ufw allow from 10.24.0.0/16 to any port 22 proto tcp
sudo ufw allow from 192.168.204.0/24 to any port 22 proto tcp
#Allow Syslog from switch network
sudo ufw allow from 10.24.224.0/19 to any port 514 proto udp
#Turn on UFW
sudo ufw enable

Check UFW status to verify configuration

sudo ufw status

Install the Required Packages

#Install Inotify
sudo apt install inotify-tools -y
#Install MySQL
sudo apt install mysql-server -y
#Install Ansible
sudo apt install ansible -y
sudo apt install python3-paramiko -y
#Install rsyslog
sudo apt install rsyslog -y
sudo apt install rsyslog-mysql -y
#when asked to do you want a database created say no

Expected Result

At the end of this part, Ubuntu is updated, the required packages are installed, UFW is active, and you still have verified administrative access.

Troubleshooting

If SSH stops working, use the hypervisor or physical console and run sudo ufw status numbered to inspect the active rules.
If a package cannot be found, run sudo apt update and confirm the server has working DNS and repository access.
Do not continue until sudo systemctl --failed reports no unexplained failures.