Device Credentials

Location in GUI: Design » Network Settings » Device Credentials

Diagram

Classes

network_settings (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
device_credentials	Class	`[device_credentials]`	No

device_credentials (catalyst_center.network_settings)

Name	Type	Constraint	Mandatory
cli_credentials	List	`[cli_credentials]`	No
https_read_credentials	List	`[https_read_credentials]`	No
https_write_credentials	List	`[https_write_credentials]`	No
snmpv3_credentials	List	`[snmpv3_credentials]`	No
snmpv2_read_credentials	List	`[snmpv2_read_credentials]`	No
snmpv2_write_credentials	List	`[snmpv2_write_credentials]`	No

cli_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: `1`	No
enable	String		No
enable_version	Integer	min: `1`	No

https_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: `1`	No
port	Integer	min: `1`, max: `65535`	No	`443`

https_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
password_version	Integer	min: `1`	No
port	Integer	min: `1`, max: `65535`	No	`443`

snmpv3_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
auth_type	Choice	`SHA`, `MD5`	No	`SHA`
privacy_type	Choice	`AES256`, `AES192`, `AES128`	No	`AES128`
snmp_mode	Choice	`AUTHPRIV`, `AUTHNOPRIV`, `NOAUTHNOPRIV`	Yes
username	String		Yes
auth_password	String		Yes
auth_password_version	Integer	min: `1`	No
privacy_password	String		Yes
privacy_password_version	Integer	min: `1`	No

snmpv2_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory
name	String		Yes
read_community	String		Yes
read_community_version	Integer	min: `1`	No

snmpv2_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory
name	String		Yes
write_community	String		Yes
write_community_version	Integer	min: `1`	No

Device Credentials define the authentication credentials used by Catalyst Center to communicate with network devices. This includes CLI (SSH/Telnet), SNMPv2 Read/Write, SNMPv3, HTTPS Read/Write, and NETCONF credentials. Credentials are created globally and then assigned to sites (Areas, Buildings, Floors) for inheritance. They are applicable to both SDA fabric and non-fabric deployments.

Note: To assign credentials at the Global site, all credential types (CLI, SNMPv2 Read, SNMPv2 Write, SNMPv3, HTTPS Read, HTTPS Write) must be defined and assigned together. At individual site levels below Global (sub-areas, buildings, floors), you can selectively assign only the specific credentials you want to override; any credential that is not explicitly assigned is inherited from the parent site.

Examples

Example-1: Basic CLI Credentials with Enable Password

Basic device credentials configuration with CLI access using standard Cisco credentials and an enable password for network device management.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: BASIC_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          enable: CiscoEnable123!

Example-2: SNMP Read and Write Community Strings

SNMP monitoring setup with both read and write community strings for network device monitoring and configuration management across European sites.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: EUROPE_CLI_ADMIN
          username: netadmin
          password: EuropeAdmin456!
          enable: EuropeEnable456!
      snmpv2_read_credentials:
        - name: EUROPE_SNMP_READ
          read_community: EuropeReadComm789
      snmpv2_write_credentials:
        - name: EUROPE_SNMP_WRITE
          write_community: EuropeWriteComm789

Example-3: CLI, SNMPv2, SNMPv3, and HTTPS Credentials

Comprehensive device credentials deployment with all supported authentication methods, including CLI, SNMPv2, SNMPv3 with multiple security modes, and HTTPS credentials for REST API access across global enterprise infrastructure.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: GLOBAL_CLI_ADMIN
          username: globaladmin
          password: GlobalAdmin2024!
          enable: GlobalEnable2024!
        - name: BRANCH_CLI_READONLY
          username: branchread
          password: BranchRead2024!
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: GlobalMonitorRead
        - name: BRANCH_SNMP_READ
          read_community: BranchMonitorRead
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: GlobalConfigWrite
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES256
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2024!
          privacy_password: SecurePriv2024!
        - name: STANDARD_SNMPV3_AUTHNOPRIV
          auth_type: MD5
          privacy_type: AES128
          snmp_mode: AUTHNOPRIV
          username: standarduser
          auth_password: StandardAuth2024!
          privacy_password: StandardPriv2024!
        - name: BASIC_SNMPV3_NOAUTH
          snmp_mode: NOAUTHNOPRIV
          username: basicuser
          auth_password: BasicAuth2024!
          privacy_password: BasicPriv2024!
      https_read_credentials:
        - name: API_READ_ACCESS
          username: apiread
          password: ApiRead2024!
          port: 443
        - name: MONITORING_API_ACCESS
          username: monitor
          password: Monitor2024!
          port: 8443
      https_write_credentials:
        - name: API_WRITE_ACCESS
          username: apiwrite
          password: ApiWrite2024!
          port: 443
        - name: CONFIG_API_ACCESS
          username: configapi
          password: ConfigApi2024!
          port: 9443

Example-4: Credential Sets Assigned to Specific Sites

Site assignment configuration demonstrating how to apply different credential sets to various site types and geographic locations.

catalyst_center:
  sites:
    areas:
      - name: Corporate Headquarters
        parent_name: Global/Americas/USA/California
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: API_WRITE_ACCESS
      - name: European Operations
        parent_name: Global/Europe/Germany
        cli_credentials: EUROPE_CLI_ADMIN
        snmpv2_read_credentials: EUROPE_SNMP_READ
        snmpv2_write_credentials: EUROPE_SNMP_WRITE
        https_read_credentials: MONITORING_API_ACCESS
    buildings:
      - name: Branch Office
        parent_name: Global/Americas/USA/Texas/Austin
        address: 110 Inner Campus Dr., Austin, TX 78712, USA
        cli_credentials: BRANCH_CLI_READONLY
        snmpv2_read_credentials: BRANCH_SNMP_READ
        snmpv3_credentials: STANDARD_SNMPV3_AUTHNOPRIV
      - name: Regional Center
        parent_name: Global/Americas/USA/Texas/College Station
        address: 400 Bizzell St, College Station, TX 77840, USA
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: CONFIG_API_ACCESS

Example-5: Global Credentials with a Site-Level CLI Override

Global vs. individual site credential assignment. The Global area receives all credential types (required at the Global level), while the child Poland area selectively overrides only the CLI credential and inherits the remaining credentials from Global.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
        - name: dnacadmin_super2
          username: dnacadmin2
          password: C1sco12345
          enable: C1sco12345
      https_read_credentials:
        - name: HTTP_READ_ACCESS
          username: apphost_http_read
          password: ApiRead2026!
          port: 443
      https_write_credentials:
        - name: HTTP_WRITE_ACCESS
          username: dnacadmin
          password: C1sco12345
          port: 443
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: RO
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: RW
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv2_read_credentials: GLOBAL_SNMP_READ
        snmpv2_write_credentials: GLOBAL_SNMP_WRITE
        https_read_credentials: HTTP_READ_ACCESS
        https_write_credentials: HTTP_WRITE_ACCESS
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV

      - name: Poland
        parent_name: Global
        cli_credentials: dnacadmin_super2

Example-6: Write-Only Secrets for Device Credentials

Opt a credential’s secret into Terraform’s write-only handling so it is never persisted to Terraform state (requires the Catalyst Center provider 0.6.0+ and Terraform 1.11+). Declaring a <secret>_version key next to a secret (password_version, enable_version, read_community_version, write_community_version, auth_password_version, privacy_password_version) opts that secret in; a secret without a _version key keeps using the existing state-storing attribute unchanged. Because the write-only value itself is invisible to Terraform’s plan, the _version integer is the only signal it has that the secret changed — bump it to any higher value whenever the secret value changes, in the same apply.

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: SECURE_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          password_version: 1 # bump alongside `password` to rotate it; the value itself is never written to state
          enable: CiscoEnable123!
          enable_version: 1

Location in GUI: Design » Network Settings » Device Credentials

Diagram

Classes

network_settings (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
device_credentials	Class	`[device_credentials]`	No

device_credentials (catalyst_center.network_settings)

Name	Type	Constraint	Mandatory
cli_credentials	List	`[cli_credentials]`	No
https_read_credentials	List	`[https_read_credentials]`	No
https_write_credentials	List	`[https_write_credentials]`	No
snmpv3_credentials	List	`[snmpv3_credentials]`	No
snmpv2_read_credentials	List	`[snmpv2_read_credentials]`	No
snmpv2_write_credentials	List	`[snmpv2_write_credentials]`	No

cli_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Mandatory
name	String	Yes
username	String	Yes
password	String	Yes
enable	String	No

https_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
port	Integer	min: `1`, max: `65535`	No	`443`

https_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
username	String		Yes
password	String		Yes
port	Integer	min: `1`, max: `65535`	No	`443`

snmpv3_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
auth_type	Choice	`SHA`, `MD5`	No	`SHA`
privacy_type	Choice	`AES256`, `AES192`, `AES128`	No	`AES128`
snmp_mode	Choice	`AUTHPRIV`, `AUTHNOPRIV`, `NOAUTHNOPRIV`	Yes
username	String		Yes
auth_password	String		Yes
privacy_password	String		Yes

snmpv2_read_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
read_community	String		Yes

snmpv2_write_credentials (catalyst_center.network_settings.device_credentials)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
write_community	String		Yes

Note: To assign credentials at the Global site, all credential types (CLI, SNMPv2 Read, SNMPv2 Write, SNMPv3, HTTPS Read, HTTPS Write) must be defined and assigned together. At individual site levels below Global (sub-areas, buildings, floors), you can selectively assign only the specific credentials you want to override; any credential that is not explicitly assigned is inherited from the parent site.

Examples

Example-1: Basic device credentials configuration with CLI access using standard Cisco credentials and enable password for network device management:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: BASIC_CLI_ADMIN
          username: admin
          password: CiscoAdmin123!
          enable: CiscoEnable123!

Example-2: SNMP monitoring setup with both read and write community strings for network device monitoring and configuration management across European sites:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: EUROPE_CLI_ADMIN
          username: netadmin
          password: EuropeAdmin456!
          enable: EuropeEnable456!
      snmpv2_read_credentials:
        - name: EUROPE_SNMP_READ
          read_community: EuropeReadComm789
      snmpv2_write_credentials:
        - name: EUROPE_SNMP_WRITE
          write_community: EuropeWriteComm789

Example-3: Comprehensive device credentials deployment with all supported authentication methods including CLI, SNMPv2, SNMPv3 with multiple security modes, and HTTPS credentials for REST API access across global enterprise infrastructure:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: GLOBAL_CLI_ADMIN
          username: globaladmin
          password: GlobalAdmin2024!
          enable: GlobalEnable2024!
        - name: BRANCH_CLI_READONLY
          username: branchread
          password: BranchRead2024!
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: GlobalMonitorRead
        - name: BRANCH_SNMP_READ
          read_community: BranchMonitorRead
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: GlobalConfigWrite
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES256
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2024!
          privacy_password: SecurePriv2024!
        - name: STANDARD_SNMPV3_AUTHNOPRIV
          auth_type: MD5
          privacy_type: AES128
          snmp_mode: AUTHNOPRIV
          username: standarduser
          auth_password: StandardAuth2024!
          privacy_password: StandardPriv2024!
        - name: BASIC_SNMPV3_NOAUTH
          snmp_mode: NOAUTHNOPRIV
          username: basicuser
          auth_password: BasicAuth2024!
          privacy_password: BasicPriv2024!
      https_read_credentials:
        - name: API_READ_ACCESS
          username: apiread
          password: ApiRead2024!
          port: 443
        - name: MONITORING_API_ACCESS
          username: monitor
          password: Monitor2024!
          port: 8443
      https_write_credentials:
        - name: API_WRITE_ACCESS
          username: apiwrite
          password: ApiWrite2024!
          port: 443
        - name: CONFIG_API_ACCESS
          username: configapi
          password: ConfigApi2024!
          port: 9443

Example-4: Site assignment configuration demonstrating how to apply different credential sets to various site types and geographic locations:

catalyst_center:
  sites:
    areas:
      - name: Corporate Headquarters
        parent_name: Global/Americas/USA/California
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: API_WRITE_ACCESS
      - name: European Operations
        parent_name: Global/Europe/Germany
        cli_credentials: EUROPE_CLI_ADMIN
        snmpv2_read_credentials: EUROPE_SNMP_READ
        snmpv2_write_credentials: EUROPE_SNMP_WRITE
        https_read_credentials: MONITORING_API_ACCESS
    buildings:
      - name: Branch Office
        parent_name: Global/Americas/USA/Texas/Austin
        address: 110 Inner Campus Dr., Austin, TX 78712, USA
        cli_credentials: BRANCH_CLI_READONLY
        snmpv2_read_credentials: BRANCH_SNMP_READ
        snmpv3_credentials: STANDARD_SNMPV3_AUTHNOPRIV
      - name: Regional Center
        parent_name: Global/Americas/USA/Texas/College Station
        address: 400 Bizzell St, College Station, TX 77840, USA
        cli_credentials: GLOBAL_CLI_ADMIN
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV
        https_read_credentials: API_READ_ACCESS
        https_write_credentials: CONFIG_API_ACCESS

Example-5: Global vs. individual site credential assignment. The Global area receives all credential types (required at the Global level), while the child Poland area selectively overrides only the CLI credential and inherits the remaining credentials from Global:

catalyst_center:
  network_settings:
    device_credentials:
      cli_credentials:
        - name: dnacadmin_super
          username: dnacadmin
          password: C1sco12345
          enable: C1sco12345
        - name: dnacadmin_super2
          username: dnacadmin2
          password: C1sco12345
          enable: C1sco12345
      https_read_credentials:
        - name: HTTP_READ_ACCESS
          username: apphost_http_read
          password: ApiRead2026!
          port: 443
      https_write_credentials:
        - name: HTTP_WRITE_ACCESS
          username: dnacadmin
          password: C1sco12345
          port: 443
      snmpv2_read_credentials:
        - name: GLOBAL_SNMP_READ
          read_community: RO
      snmpv2_write_credentials:
        - name: GLOBAL_SNMP_WRITE
          write_community: RW
      snmpv3_credentials:
        - name: SECURE_SNMPV3_AUTHPRIV
          auth_type: SHA
          privacy_type: AES128
          snmp_mode: AUTHPRIV
          username: secureuser
          auth_password: SecureAuth2026!
          privacy_password: SecurePriv2026!

  sites:
    areas:
      - name: Global
        cli_credentials: dnacadmin_super
        snmpv2_read_credentials: GLOBAL_SNMP_READ
        snmpv2_write_credentials: GLOBAL_SNMP_WRITE
        https_read_credentials: HTTP_READ_ACCESS
        https_write_credentials: HTTP_WRITE_ACCESS
        snmpv3_credentials: SECURE_SNMPV3_AUTHPRIV

      - name: Poland
        parent_name: Global
        cli_credentials: dnacadmin_super2