Device Credentials

Location in GUI: Design » Network Settings » Device Credentials

Diagram

Diagram

Classes

catalyst_center

Name	Type	Constraint	Mandatory	Default Value
network_settings	Class	network_settings	No

network_settings (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
device_credentials	Class	device_credentials	No

device_credentials (catalyst_center.network_settings)

Name	Type	Constraint	Mandatory	Default Value
cli_credentials	List	cli_credentials	No
https_read_credentials	List	https_read_credentials	No
https_write_credentials	List	https_write_credentials	No
snmpv3_credentials	List	snmpv3_credentials	No
snmpv2_read_credentials	List	snmpv2_read_credentials	No
snmpv2_write_credentials	List	snmpv2_write_credentials	No

cli_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: 1	No
enable	String		No
enable_version	Integer	min: 1	No

cli_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
enable	String		No

https_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: 1	No
port	Integer	min: 1, max: 65535	No	443

https_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
port	Integer	min: 1, max: 65535	No	443

https_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: 1	No
port	Integer	min: 1, max: 65535	No	443

https_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
port	Integer	min: 1, max: 65535	No	443

snmpv3_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
auth_type	Choice	SHA, MD5, SHA256	No	SHA
privacy_type	Choice	AES256, AES192, AES128	No	AES128
snmp_mode	Choice	AUTHPRIV, AUTHNOPRIV, NOAUTHNOPRIV	Yes
username	String		Yes
auth_password	String		Yes
auth_password_version	Integer	min: 1	No
privacy_password	String		Yes
privacy_password_version	Integer	min: 1	No

snmpv3_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
auth_type	Choice	SHA, MD5	No	SHA
privacy_type	Choice	AES256, AES192, AES128	No	AES128
snmp_mode	Choice	AUTHPRIV, AUTHNOPRIV, NOAUTHNOPRIV	Yes
username	String		Yes
auth_password	String		Yes
auth_password_version	Integer	min: 1	No
privacy_password	String		Yes
privacy_password_version	Integer	min: 1	No

snmpv3_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
auth_type	Choice	SHA, MD5	No	SHA
privacy_type	Choice	AES256, AES192, AES128	No	AES128
snmp_mode	Choice	AUTHPRIV, AUTHNOPRIV, NOAUTHNOPRIV	Yes
username	String		Yes
auth_password	String		Yes
privacy_password	String		Yes

snmpv2_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
read_community	String		Yes
read_community_version	Integer	min: 1	No

snmpv2_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
read_community	String		Yes

snmpv2_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
write_community	String		Yes
write_community_version	Integer	min: 1	No

snmpv2_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
write_community	String		Yes

Device Credentials define the authentication credentials used by Catalyst Center to communicate with network devices. This includes CLI (SSH/Telnet), SNMPv2 Read/Write, SNMPv3, HTTPS Read/Write, and NETCONF credentials. Credentials are created globally and then assigned to sites (Areas, Buildings, Floors) for inheritance. They are applicable to both SDA fabric and non-fabric deployments.

Note: At individual site levels below Global (sub-areas, buildings, floors), you can selectively assign only the specific credentials you want to override; any credential that is not explicitly assigned is inherited from the parent site.

Note: Because the Global site has no parent to inherit from, Catalyst Center will not accept a partial credential assignment there. This is handled for you automatically, so you do not need to declare all six credential types yourself. The preserve_unmanaged_global default (see Preserving Global Credentials) controls what happens to the slots you did not declare in the data model: by default they are left untouched (preserving credentials configured outside Terraform), or you can opt to unset them.

Preserving Global Credentials Configured Outside Terraform

preserve_unmanaged_global is a defaults-level attribute under network_settings.device_credentials that controls how the module reconciles Global credential slots that are not declared in the data model. It defaults to true.

Value	Behavior at Global
true (default)	Slots you declare are set/updated. Slots you do not declare but that are already configured on Global (e.g. via the GUI or another tool) are preserved. Removing a previously managed slot from the data model still unsets that slot. This also applies on destroy: only the Terraform-managed slots are unset, unmanaged ones are kept.
false	Slots you declare are set/updated, and every other Global slot is unset. Use this when Terraform should be the single source of truth for Global credentials.

The attribute only affects the Global site — child sites always inherit unspecified slots from their parent regardless of this setting. It is set in your defaults: block, not per credential:

defaults:
  catalyst_center:
    network_settings:
      device_credentials:
        preserve_unmanaged_global: true # false = unset unmanaged Global slots

Known Catalyst Center GUI caveat (NCIM11016): When only a subset of credential slots is assigned at Global, the Catalyst Center GUI under Design » Network Settings » Device Credentials » Manage Credentials may show NCIM11016: Failed to get applied credential status. Reason : null, and the per-credential Actions (including Apply) stay greyed out. This is a GUI-only defect — the Terraform apply itself still succeeds — and it appears because some Global slots are intentionally left unset (not yet synced to devices).

Workaround (in the GUI): close the Manage Credentials window, click Save on the Device Credentials page, and when the “Do you want to apply the assigned credentials now?” prompt appears, choose No. The Manage Credentials actions then become available again (credential statuses show as Not Synced, which you can apply from the GUI when needed).

Examples

Example-1: Basic CLI Credentials with Enable Password

Basic device credentials configuration with CLI access using standard Cisco credentials and an enable password for network device management.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: BASIC_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          enable: CiscoEnable123!

Example-2: SNMP Read and Write Community Strings

SNMP monitoring setup with both read and write community strings for network device monitoring and configuration management across European sites.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: EUROPE_CLI_ADMIN
          username: netadmin
          password: EuropeAdmin456!
          enable: EuropeEnable456!
      snmpv2_read_credentials:
        - name: EUROPE_SNMP_READ
          read_community: EuropeReadComm789
      snmpv2_write_credentials:
        - name: EUROPE_SNMP_WRITE
          write_community: EuropeWriteComm789

Example-3: CLI, SNMPv2, SNMPv3, and HTTPS Credentials

Comprehensive device credentials deployment with all supported authentication methods, including CLI, SNMPv2, SNMPv3 with multiple security modes, and HTTPS credentials for REST API access across global enterprise infrastructure.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: GLOBAL_CLI_ADMIN
          username: globaladmin
          password: GlobalAdmin2024!
          enable: GlobalEnable2024!
        - name: BRANCH_CLI_READONLY
          username: branchread
          password: BranchRead2024!
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: GlobalMonitorRead
        - name: BRANCH_SNMP_READ
          read_community: BranchMonitorRead
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: GlobalConfigWrite
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES256
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2024!
          privacy_password: SecurePriv2024!
        - name: STANDARD_SNMPV3_AUTHNOPRIV
          auth_type: MD5
          privacy_type: AES128
          snmp_mode: AUTHNOPRIV
          username: standarduser
          auth_password: StandardAuth2024!
          privacy_password: StandardPriv2024!
        - name: BASIC_SNMPV3_NOAUTH
          snmp_mode: NOAUTHNOPRIV
          username: basicuser
          auth_password: BasicAuth2024!
          privacy_password: BasicPriv2024!
      https_read_credentials:
        - name: API_READ_ACCESS
          username: apiread
          password: ApiRead2024!
          port: 443
        - name: MONITORING_API_ACCESS
          username: monitor
          password: Monitor2024!
          port: 8443
      https_write_credentials:
        - name: API_WRITE_ACCESS
          username: apiwrite
          password: ApiWrite2024!
          port: 443
        - name: CONFIG_API_ACCESS
          username: configapi
          password: ConfigApi2024!
          port: 9443

Example-4: Credential Sets Assigned to Specific Sites

Site assignment configuration demonstrating how to apply different credential sets to various site types and geographic locations.

catalyst_center:
  sites:
    areas:
      - name: Corporate Headquarters
        parent_name: Global/Americas/USA/California
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: API_WRITE_ACCESS
      - name: European Operations
        parent_name: Global/Europe/Germany
        cli_credentials: EUROPE_CLI_ADMIN
        snmpv2_read_credentials: EUROPE_SNMP_READ
        snmpv2_write_credentials: EUROPE_SNMP_WRITE
        https_read_credentials: MONITORING_API_ACCESS
    buildings:
      - name: Branch Office
        parent_name: Global/Americas/USA/Texas/Austin
        address: 110 Inner Campus Dr., Austin, TX 78712, USA
        cli_credentials: BRANCH_CLI_READONLY
        snmpv2_read_credentials: BRANCH_SNMP_READ
        snmpv3_credentials: STANDARD_SNMPV3_AUTHNOPRIV
      - name: Regional Center
        parent_name: Global/Americas/USA/Texas/College Station
        address: 400 Bizzell St, College Station, TX 77840, USA
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: CONFIG_API_ACCESS

Example-5: Global Credentials with a Site-Level CLI Override

Global vs. individual site credential assignment. Here the Global area is assigned a full set of credential types, while the child Poland area selectively overrides only the CLI credential and inherits the remaining credentials from Global. Assigning every credential type at Global is not required.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
        - name: dnacadmin_super2
          username: dnacadmin2
          password: C1sco12345
          enable: C1sco12345
      https_read_credentials:
        - name: HTTP_READ_ACCESS
          username: apphost_http_read
          password: ApiRead2026!
          port: 443
      https_write_credentials:
        - name: HTTP_WRITE_ACCESS
          username: dnacadmin
          password: C1sco12345
          port: 443
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: RO
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: RW
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv2_read_credentials: GLOBAL_SNMP_READ
        snmpv2_write_credentials: GLOBAL_SNMP_WRITE
        https_read_credentials: HTTP_READ_ACCESS
        https_write_credentials: HTTP_WRITE_ACCESS
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV

      - name: Poland
        parent_name: Global
        cli_credentials: dnacadmin_super2

Example-6: Write-Only Secrets for Device Credentials

Opt a credential’s secret into Terraform’s write-only handling so it is never persisted to Terraform state (requires the Catalyst Center provider 0.6.0+ and Terraform 1.11+). Declaring a <secret>_version key next to a secret (password_version, enable_version, read_community_version, write_community_version, auth_password_version, privacy_password_version) opts that secret in; a secret without a _version key keeps using the existing state-storing attribute unchanged. Because the write-only value itself is invisible to Terraform’s plan, the _version integer is the only signal it has that the secret changed — bump it to any higher value whenever the secret value changes, in the same apply.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: SECURE_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          password_version: 1 # bump alongside `password` to rotate it; the value itself is never written to state
          enable: CiscoEnable123!
          enable_version: 1

Example-7: Managing Only Some Global Credentials While Keeping the Rest

Manage a subset of Global credential slots with Terraform while leaving the remaining slots (configured directly in the Catalyst Center GUI) in place. With preserve_unmanaged_global: true (the default), only the declared cli_credentials and snmpv3_credentials bindings at Global are written; the SNMPv2 and HTTPS slots already present on Global are preserved. Set it to false to instead have Terraform unset every Global slot it does not declare.

defaults:
  catalyst_center:
    network_settings:
      device_credentials:
        preserve_unmanaged_global: true

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        # snmpv2 / https slots intentionally omitted -> preserved from existing Global config

Device Credentials define the authentication credentials used by Catalyst Center to communicate with network devices. This includes CLI (SSH/Telnet), SNMPv2 Read/Write, SNMPv3, HTTPS Read/Write, and NETCONF credentials. Credentials are created globally and then assigned to sites (Areas, Buildings, Floors) for inheritance. They are applicable to both SDA fabric and non-fabric deployments.

Note: To assign credentials at the Global site, all credential types (CLI, SNMPv2 Read, SNMPv2 Write, SNMPv3, HTTPS Read, HTTPS Write) must be defined and assigned together. At individual site levels below Global (sub-areas, buildings, floors), you can selectively assign only the specific credentials you want to override; any credential that is not explicitly assigned is inherited from the parent site.

Examples

Example-1: Basic CLI Credentials with Enable Password

Basic device credentials configuration with CLI access using standard Cisco credentials and an enable password for network device management.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: BASIC_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          enable: CiscoEnable123!

Example-2: SNMP Read and Write Community Strings

SNMP monitoring setup with both read and write community strings for network device monitoring and configuration management across European sites.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: EUROPE_CLI_ADMIN
          username: netadmin
          password: EuropeAdmin456!
          enable: EuropeEnable456!
      snmpv2_read_credentials:
        - name: EUROPE_SNMP_READ
          read_community: EuropeReadComm789
      snmpv2_write_credentials:
        - name: EUROPE_SNMP_WRITE
          write_community: EuropeWriteComm789

Example-3: CLI, SNMPv2, SNMPv3, and HTTPS Credentials

Comprehensive device credentials deployment with all supported authentication methods, including CLI, SNMPv2, SNMPv3 with multiple security modes, and HTTPS credentials for REST API access across global enterprise infrastructure.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: GLOBAL_CLI_ADMIN
          username: globaladmin
          password: GlobalAdmin2024!
          enable: GlobalEnable2024!
        - name: BRANCH_CLI_READONLY
          username: branchread
          password: BranchRead2024!
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: GlobalMonitorRead
        - name: BRANCH_SNMP_READ
          read_community: BranchMonitorRead
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: GlobalConfigWrite
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES256
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2024!
          privacy_password: SecurePriv2024!
        - name: STANDARD_SNMPV3_AUTHNOPRIV
          auth_type: MD5
          privacy_type: AES128
          snmp_mode: AUTHNOPRIV
          username: standarduser
          auth_password: StandardAuth2024!
          privacy_password: StandardPriv2024!
        - name: BASIC_SNMPV3_NOAUTH
          snmp_mode: NOAUTHNOPRIV
          username: basicuser
          auth_password: BasicAuth2024!
          privacy_password: BasicPriv2024!
      https_read_credentials:
        - name: API_READ_ACCESS
          username: apiread
          password: ApiRead2024!
          port: 443
        - name: MONITORING_API_ACCESS
          username: monitor
          password: Monitor2024!
          port: 8443
      https_write_credentials:
        - name: API_WRITE_ACCESS
          username: apiwrite
          password: ApiWrite2024!
          port: 443
        - name: CONFIG_API_ACCESS
          username: configapi
          password: ConfigApi2024!
          port: 9443

Example-4: Credential Sets Assigned to Specific Sites

Site assignment configuration demonstrating how to apply different credential sets to various site types and geographic locations.

catalyst_center:
  sites:
    areas:
      - name: Corporate Headquarters
        parent_name: Global/Americas/USA/California
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: API_WRITE_ACCESS
      - name: European Operations
        parent_name: Global/Europe/Germany
        cli_credentials: EUROPE_CLI_ADMIN
        snmpv2_read_credentials: EUROPE_SNMP_READ
        snmpv2_write_credentials: EUROPE_SNMP_WRITE
        https_read_credentials: MONITORING_API_ACCESS
    buildings:
      - name: Branch Office
        parent_name: Global/Americas/USA/Texas/Austin
        address: 110 Inner Campus Dr., Austin, TX 78712, USA
        cli_credentials: BRANCH_CLI_READONLY
        snmpv2_read_credentials: BRANCH_SNMP_READ
        snmpv3_credentials: STANDARD_SNMPV3_AUTHNOPRIV
      - name: Regional Center
        parent_name: Global/Americas/USA/Texas/College Station
        address: 400 Bizzell St, College Station, TX 77840, USA
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: CONFIG_API_ACCESS

Example-5: Global Credentials with a Site-Level CLI Override

Global vs. individual site credential assignment. The Global area receives all credential types (required at the Global level), while the child Poland area selectively overrides only the CLI credential and inherits the remaining credentials from Global.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
        - name: dnacadmin_super2
          username: dnacadmin2
          password: C1sco12345
          enable: C1sco12345
      https_read_credentials:
        - name: HTTP_READ_ACCESS
          username: apphost_http_read
          password: ApiRead2026!
          port: 443
      https_write_credentials:
        - name: HTTP_WRITE_ACCESS
          username: dnacadmin
          password: C1sco12345
          port: 443
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: RO
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: RW
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv2_read_credentials: GLOBAL_SNMP_READ
        snmpv2_write_credentials: GLOBAL_SNMP_WRITE
        https_read_credentials: HTTP_READ_ACCESS
        https_write_credentials: HTTP_WRITE_ACCESS
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV

      - name: Poland
        parent_name: Global
        cli_credentials: dnacadmin_super2

Example-6: Write-Only Secrets for Device Credentials

Opt a credential’s secret into Terraform’s write-only handling so it is never persisted to Terraform state (requires the Catalyst Center provider 0.6.0+ and Terraform 1.11+). Declaring a <secret>_version key next to a secret (password_version, enable_version, read_community_version, write_community_version, auth_password_version, privacy_password_version) opts that secret in; a secret without a _version key keeps using the existing state-storing attribute unchanged. Because the write-only value itself is invisible to Terraform’s plan, the _version integer is the only signal it has that the secret changed — bump it to any higher value whenever the secret value changes, in the same apply.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: SECURE_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          password_version: 1 # bump alongside `password` to rotate it; the value itself is never written to state
          enable: CiscoEnable123!
          enable_version: 1

Device Credentials define the authentication credentials used by Catalyst Center to communicate with network devices. This includes CLI (SSH/Telnet), SNMPv2 Read/Write, SNMPv3, HTTPS Read/Write, and NETCONF credentials. Credentials are created globally and then assigned to sites (Areas, Buildings, Floors) for inheritance. They are applicable to both SDA fabric and non-fabric deployments.

Note: To assign credentials at the Global site, all credential types (CLI, SNMPv2 Read, SNMPv2 Write, SNMPv3, HTTPS Read, HTTPS Write) must be defined and assigned together. At individual site levels below Global (sub-areas, buildings, floors), you can selectively assign only the specific credentials you want to override; any credential that is not explicitly assigned is inherited from the parent site.

Examples

Example-1: Basic device credentials configuration with CLI access using standard Cisco credentials and enable password for network device management:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: BASIC_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          enable: CiscoEnable123!

Example-2: SNMP monitoring setup with both read and write community strings for network device monitoring and configuration management across European sites:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: EUROPE_CLI_ADMIN
          username: netadmin
          password: EuropeAdmin456!
          enable: EuropeEnable456!
      snmpv2_read_credentials:
        - name: EUROPE_SNMP_READ
          read_community: EuropeReadComm789
      snmpv2_write_credentials:
        - name: EUROPE_SNMP_WRITE
          write_community: EuropeWriteComm789

Example-3: Comprehensive device credentials deployment with all supported authentication methods including CLI, SNMPv2, SNMPv3 with multiple security modes, and HTTPS credentials for REST API access across global enterprise infrastructure:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: GLOBAL_CLI_ADMIN
          username: globaladmin
          password: GlobalAdmin2024!
          enable: GlobalEnable2024!
        - name: BRANCH_CLI_READONLY
          username: branchread
          password: BranchRead2024!
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: GlobalMonitorRead
        - name: BRANCH_SNMP_READ
          read_community: BranchMonitorRead
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: GlobalConfigWrite
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES256
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2024!
          privacy_password: SecurePriv2024!
        - name: STANDARD_SNMPV3_AUTHNOPRIV
          auth_type: MD5
          privacy_type: AES128
          snmp_mode: AUTHNOPRIV
          username: standarduser
          auth_password: StandardAuth2024!
          privacy_password: StandardPriv2024!
        - name: BASIC_SNMPV3_NOAUTH
          snmp_mode: NOAUTHNOPRIV
          username: basicuser
          auth_password: BasicAuth2024!
          privacy_password: BasicPriv2024!
      https_read_credentials:
        - name: API_READ_ACCESS
          username: apiread
          password: ApiRead2024!
          port: 443
        - name: MONITORING_API_ACCESS
          username: monitor
          password: Monitor2024!
          port: 8443
      https_write_credentials:
        - name: API_WRITE_ACCESS
          username: apiwrite
          password: ApiWrite2024!
          port: 443
        - name: CONFIG_API_ACCESS
          username: configapi
          password: ConfigApi2024!
          port: 9443

Example-4: Site assignment configuration demonstrating how to apply different credential sets to various site types and geographic locations:

catalyst_center:
  sites:
    areas:
      - name: Corporate Headquarters
        parent_name: Global/Americas/USA/California
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: API_WRITE_ACCESS
      - name: European Operations
        parent_name: Global/Europe/Germany
        cli_credentials: EUROPE_CLI_ADMIN
        snmpv2_read_credentials: EUROPE_SNMP_READ
        snmpv2_write_credentials: EUROPE_SNMP_WRITE
        https_read_credentials: MONITORING_API_ACCESS
    buildings:
      - name: Branch Office
        parent_name: Global/Americas/USA/Texas/Austin
        address: 110 Inner Campus Dr., Austin, TX 78712, USA
        cli_credentials: BRANCH_CLI_READONLY
        snmpv2_read_credentials: BRANCH_SNMP_READ
        snmpv3_credentials: STANDARD_SNMPV3_AUTHNOPRIV
      - name: Regional Center
        parent_name: Global/Americas/USA/Texas/College Station
        address: 400 Bizzell St, College Station, TX 77840, USA
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: CONFIG_API_ACCESS

Example-5: Global vs. individual site credential assignment. The Global area receives all credential types (required at the Global level), while the child Poland area selectively overrides only the CLI credential and inherits the remaining credentials from Global:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
        - name: dnacadmin_super2
          username: dnacadmin2
          password: C1sco12345
          enable: C1sco12345
      https_read_credentials:
        - name: HTTP_READ_ACCESS
          username: apphost_http_read
          password: ApiRead2026!
          port: 443
      https_write_credentials:
        - name: HTTP_WRITE_ACCESS
          username: dnacadmin
          password: C1sco12345
          port: 443
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: RO
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: RW
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv2_read_credentials: GLOBAL_SNMP_READ
        snmpv2_write_credentials: GLOBAL_SNMP_WRITE
        https_read_credentials: HTTP_READ_ACCESS
        https_write_credentials: HTTP_WRITE_ACCESS
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV

      - name: Poland
        parent_name: Global
        cli_credentials: dnacadmin_super2