Automate VLAN Provisioning Across Multiple Switches with IOS Scripting (Tcl)

This Tcl script runs on Cisco IOS to provision the same VLAN set across a list of switches via SSH, using the IOS Tcl shell and the cli_open/cli_write commands. Internally, IOS embeds a Tcl 8.3 interpreter accessible via tclsh. The script iterates over a list of management IPs, opens a CLI session to each, enters configuration mode, and issues vlan and name commands. This avoids external orchestration tooling and works entirely on-box, which is useful in air-gapped or highly restricted environments where Ansible or Python cannot be deployed.

Production use cases include brownfield networks with no automation platform, emergency VLAN rollouts during incidents, and branch offices managed by a single engineer. The script can be stored in flash and executed on demand. For larger scale, the same pattern is better implemented with Ansible ios_config or NAPALM, but Tcl remains a valid fallback. Always include error handling and logging, since a partial rollout can leave switches inconsistent.

Security implications: storing credentials in a script on flash is risky. Use aaa new-model with TACACS+ and enable secret rather than plaintext passwords, and restrict flash access. The script should verify the VLAN does not already exist before creating it to avoid overwriting an existing name. Performance is acceptable for tens of switches; for hundreds, use a proper orchestrator. Common pitfalls include Tcl quoting issues with special characters, the need for ip domain-lookup and crypto key generation for SSH, and the fact that some IOS versions restrict Tcl commands unless the image is a crypto or advanced image. Test with a single switch before running against a fleet.

> System.Execute()

tclsh
set switches {10.0.0.1 10.0.0.2 10.0.0.3}
set vlans {10 NYC-FINANCE-USERS 20 NYC-ENGINEERING 30 NYC-GUEST}
foreach sw $switches {
  puts "Connecting to $sw"
  if {[catch {cli_open} result]} { puts "Failed: $result"; continue }
  set fd [lindex $result 1]
  cli_write $fd "enable\n"
  cli_write $fd "configure terminal\n"
  foreach {vid vname} $vlans {
    cli_write $fd "vlan $vid\n"
    cli_write $fd "name $vname\n"
    cli_write $fd "exit\n"
  }
  cli_write $fd "end\n"
  cli_write $fd "write memory\n"
  cli_close $fd
}
exit

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-FB18C00F1BFE