---
title: "Network Automation at Fleet Scale"
outcome: "Took a multi-region switch fleet from hand-managed to single-pane - automated config backup, bulk change in minutes, and credentials secured and rotated."
summary: "Productionised a vendor-agnostic network config-management platform (Unimus) with NetBox as the source-of-truth across an AU/NZ/PNG switch fleet: scheduled config backups, mass config push, and a centrally vaulted, rotated credential model - community tooling stood up ground-up under a corporate-supported licence."
role: "Global IT Infrastructure Engineer · Linde Asia Pacific"
period: "2019 - 2022"
stack: ["Unimus (NCM)", "NetBox (IPAM / SoT)", "Config backup & DR", "Bulk config push", "Credential vaulting + rotation", "Multi-vendor switching"]
featured: false
order: 45
cover: "network-automation-fleet"
diagram: "network-fleet"
links:
  - label: "Unimus"
    href: "https://unimus.net"
  - label: "NetBox"
    href: "https://netbox.dev"
---

## Problem

A multi-region switch fleet - Australia, New Zealand and PNG - was maintained by hand.
Configs drifted, backups were "hope someone saved the last one," bulk changes were pushed
box-by-box, and device credentials were scattered across people and scripts. For a network
that production depends on, there was no real recovery path and no audit trail.

## Constraints

- **Live production network** - change the fleet without taking sites down.
- **Mixed-vendor estate** - the tooling had to be vendor-agnostic, not tied to one OS.
- **Credentials are the crown jewels** - secured, rotated, and never sitting in a script.
- **Cost-justified** - a lean tool that earns its place through a real CapEx/OpEx case.

## Design

I productionised **Unimus** - a vendor-agnostic Network Configuration Management platform - 
as the automation backbone, and stood it up **ground-up**: install, device onboarding,
backup scheduling, and change workflows. It gave the fleet three things it never had from one
place: **automated, scheduled config backups**, **change tracking with config diffs**, and
**mass / bulk config push** across many devices at once.

Paired with it, **NetBox** served as the **IPAM and source-of-truth** for the device
inventory the automation runs against - so the fleet is driven from a single, accurate model
of what exists rather than tribal knowledge. Both are lean, community-rooted tools adopted
under a **corporate-supported licence**, which made them viable inside an enterprise change
process - the open-source-into-corporate pattern, done properly.

## Security & reliability decisions

- **Centralised, vaulted credentials with rotation** - the network's secrets live in one
  scoped, rotated place, never embedded in scripts or shared by hand.
- **Config backup = real network DR** - every device restorable from a known-good config.
- **Diffs + auditing** - every configuration change is visible, attributable, and reversible.
- **Source-of-truth driven** - automation acts on NetBox's model, not on guesswork.

## Outcome

The switch fleet across AU/NZ/PNG was maintained from a single pane: configs backed up
automatically, bulk changes pushed in minutes instead of days, credentials secured and
rotated, and - for the first time - a genuine recovery path for network configuration. A lean
community toolset, productionised with enterprise rigour.

## Future improvements

Drive the automation deeper from the source-of-truth - intent in NetBox, pushed to the fleet
through Unimus - and template standard site configs so a new location onboards straight from
the inventory.
