[Day #20 PyATS Series] Introduction to Verification APIs in pyATS using pyATS for Cisco [Python for Network Engineer]

• Trainer Sagar Dhawan
• Posted on September 6, 2025
• No Comments

[Day #20 PyATS Series] Introduction to Verification APIs in pyATS using pyATS for Cisco [Python for Network Engineer]

Introduction on the Key Points

Welcome to Day 20 of the 101 Days of pyATS (Vendor-Agnostic) series! Today, we dive into Verification APIs in pyATS, a critical feature for automated network validation. If you’re a Python for Network Engineer enthusiast looking to master network automation, understanding these APIs is essential.

Verification APIs allow engineers to programmatically validate the operational state of network devices and services. With these APIs, you can:

• Automate verification of routing protocols, interfaces, VLANs, and more.
• Simplify troubleshooting and reduce manual checks.
• Achieve consistency in multi-vendor environments.
• Speed up testing during deployments and change management.

This post explains verification APIs in detail, demonstrates their usage in Cisco environments, and provides vendor-agnostic guidance to prepare you for broader network automation challenges.

---

Topology Overview

For this lab, we use a simple topology:

• Cisco IOS-XE Router (R1)
• Cisco Catalyst Switch (SW1)
• End host (Test Client)

The router connects to the switch, and the switch connects to the end host. We’ll validate:

• OSPF neighbors between R1 and SW1.
• VLAN configuration on SW1.
• Interface operational status.

This topology is straightforward, making it perfect for demonstrating pyATS Verification APIs.

---

Topology & Communications

• R1 <-> SW1: OSPF adjacency established.
• SW1 <-> Test Client: VLAN 10 connectivity.
• Management access to both Cisco devices via SSH.
• Testbed is defined in YAML for easy device onboarding.

---

Workflow Script

Here’s a Python script demonstrating how to use pyATS Verification APIs:

from pyats.topology import loader
from genie.libs.sdk.apis.iosxe.ospf.get import get_ospf_neighbors
from genie.libs.sdk.apis.iosxe.interface.get import get_interface_status
from genie.libs.sdk.apis.iosxe.vlan.get import get_vlan_information

# Load testbed
testbed = loader.load('testbed.yml')
device = testbed.devices['R1']

# Connect to device
device.connect()

# OSPF Neighbor Verification
ospf_neighbors = get_ospf_neighbors(device)
print("OSPF Neighbors:", ospf_neighbors)

# Interface Status
interface_status = get_interface_status(device)
print("Interface Status:", interface_status)

# VLAN Information
switch = testbed.devices['SW1']
switch.connect()
vlan_info = get_vlan_information(switch)
print("VLAN Information:", vlan_info)

# Disconnect devices
device.disconnect()
switch.disconnect()

---

Explanation by Line

• Imports: Load pyATS and Genie SDK APIs specific to IOS-XE for OSPF, interfaces, and VLANs.
• Testbed Loading: Reads YAML configuration for multi-device automation.
• Device Connection: Establishes SSH sessions to Cisco devices.
• get_ospf_neighbors: Fetches OSPF neighbor information.
• get_interface_status: Checks operational status of interfaces.
• get_vlan_information: Retrieves VLAN database from the switch.
• Print Statements: Display verification results for easy debugging.
• Disconnect: Closes device sessions gracefully.

---

testbed.yml Example

devices:
  R1:
    os: iosxe
    type: router
    connections:
      cli:
        protocol: ssh
        ip: 192.168.1.1
    credentials:
      default:
        username: admin
        password: admin

  SW1:
    os: iosxe
    type: switch
    connections:
      cli:
        protocol: ssh
        ip: 192.168.1.2
    credentials:
      default:
        username: admin
        password: admin

---

Post-validation CLI Screenshots (Real Expected Output)

When you run the script, you can expect output like:

OSPF Neighbors:

{'neighbor': '192.168.1.2', 'state': 'FULL', 'interface': 'GigabitEthernet0/0'}

Interface Status:

{'GigabitEthernet0/0': 'up', 'GigabitEthernet0/1': 'down'}

VLAN Information:

{'10': {'name': 'Users', 'status': 'active'}, '20': {'name': 'Servers', 'status': 'active'}}

---

FAQs
1. What are Verification APIs in pyATS, and why are they important for network engineers?

Answer:
Verification APIs in pyATS are high-level Python functions designed to validate network states and configurations automatically. Instead of writing raw parsing logic, these APIs allow you to directly test if certain conditions (like interface status, VLAN presence, or routing protocols) meet expected results. For Cisco devices, they simplify tasks such as checking BGP neighbors, OSPF adjacencies, or interface admin states. This is crucial for network engineers because it reduces manual CLI checks, ensures repeatability, and speeds up pre- and post-change verifications during network automation workflows.

---

2. How do Verification APIs differ from Parsers and Learn APIs in pyATS?

Answer:

• Parsers: Extract structured data (Python dicts) from raw CLI outputs.
• Learn APIs: Provide a comprehensive snapshot of a specific feature (like full OSPF database).
• Verification APIs: Built on top of parsers/learn APIs, adding logic to validate conditions and return pass/fail results.

Example:

• Parser → “Show interface GigabitEthernet0/1” structured output.
• Learn API → Learns all interfaces’ operational details.
• Verification API → Directly checks if GigabitEthernet0/1 is UP/UP and reports result.

---

3. What common network checks can be performed using pyATS Verification APIs on Cisco devices?

Answer:
Verification APIs support multiple validation tasks, including:

• Interface operational/admin state checks
• BGP session establishment and route advertisement
• OSPF neighbor adjacency verification
• VLAN database consistency
• VRF and routing table entries validation
• SNMP trap functionality
• Device health and CPU/memory status checks

These checks are reusable and can be combined to create pre- and post-change automated test suites for multi-vendor networks.

---

4. Can Verification APIs be used in multi-vendor environments, or are they Cisco-only?

Answer:
While pyATS originated from Cisco, its architecture and many Verification APIs are vendor-agnostic. With Genie parsers and plugins, you can run the same verification scripts on Cisco, Arista, Palo Alto, and Fortinet devices. For instance, validating interface status or checking BGP sessions works across vendors as long as parsers are available. However, some specialized Cisco features (e.g., EIGRP-specific checks) are Cisco-only, and for other vendors, custom verification plugins might be needed.

---

5. How do you write a simple verification test using pyATS for a Cisco device?

Answer:
A basic test includes:

1. Defining your testbed (testbed.yml)
2. Importing the verification API
3. Running the check against a connected device

Example:

from genie.libs.sdk.apis.iosxe.interface.get import get_interface_admin_state

device = testbed.devices['CSR1000v']
device.connect()
result = get_interface_admin_state(device, interface='GigabitEthernet1')

if result == 'up':
    print(" Interface is UP")
else:
    print(" Interface is DOWN")

This eliminates the need for manual CLI parsing and allows integration into larger test scripts.

---

6. What are common pitfalls when using pyATS Verification APIs?

Answer:

• Missing parsers: If no parser exists for a specific command/vendor, verification may fail.
• Device OS mismatch: Ensure correct OS type is defined in the testbed for parser matching.
• Async behaviors: Some verifications require wait timers (e.g., BGP adjacency after reboot).
• False negatives: Misconfigured test expectations can report failures even when the network is healthy.
• Limited coverage: Some advanced features (like SD-WAN or proprietary CLI commands) may not have built-in verification yet.

---

7. How can Verification APIs be integrated into CI/CD pipelines for network automation?

Answer:
Verification APIs can be wrapped inside pyATS aetest testcases and executed via Jenkins, GitLab CI, or Ansible playbooks.

• Pre-change validation: Ensure baseline health before deploying configs.
• Post-change validation: Confirm successful feature enablement (e.g., OSPF adjacency up).
• Continuous monitoring: Schedule pyATS jobs to continuously verify network health.

This brings DevOps practices to networking (NetDevOps), reducing outages and enabling faster, safer change management.

---

8. Are Verification APIs suitable for large-scale networks with hundreds of devices?

Answer:
Yes, pyATS is built for scalability.

• Supports parallel device connections and verifications
• Uses reusable verification functions for different devices
• Integrates with distributed testing (multi-process runs)
• Generates HTML/JSON reports for quick analysis

For very large networks, you can combine pyATS Verification APIs with data-driven testing, where testcases iterate over a CSV/Excel/YAML list of devices and interfaces, ensuring minimal code duplication.

---

YouTube Link

Watch the Complete Python for Network Engineer: Introduction to Verification APIs in pyATS using pyATS for Cisco [Python for Network Engineer] Lab Demo & Explanation on our channel:

---

Join Our Training

Mastering pyATS and Verification APIs is just the beginning. To become a true network automation expert, join Trainer Sagar Dhawan’s 3-month instructor-led training on Python, Ansible, and APIs for Network Engineers. This program equips you with hands-on labs, multi-vendor automation, and DevNet best practices.

Enroll Now to transform your career with Python for Network Engineer skills and become an automation leader in your organization.

Enroll Now & Future‑Proof Your Career
Email: info@networkjourney.com
WhatsApp / Call: +91 97395 21088

---