Interface Group

Interface groups provide a powerful mechanism for applying consistent configurations to multiple interfaces across one or more devices. They enable you to define reusable interface configuration templates that can be applied to interfaces with similar roles or requirements, promoting standardization and reducing configuration complexity.

Interface groups are particularly valuable for:

• Role-based interface configuration: Standardizing configurations for server ports, uplinks, access ports, etc.
• Service deployment: Applying consistent security policies, QoS settings, or VLAN configurations
• Operational consistency: Ensuring uniform interface behaviors across your network infrastructure
• Configuration maintenance: Centralizing interface policies for easier updates and troubleshooting

Interface groups work by:

1. Defining a named configuration template with interface-specific settings
2. Referencing the interface group from individual interfaces via the interface_groups attribute
3. Supporting variables for dynamic configuration based on device or group context
4. Allowing multiple interface groups to be applied to a single interface (configurations are merged)

This approach separates interface policy definition from individual interface declarations, making your network configurations more modular and maintainable.

Interface Group Policy

When interface groups are applied at both the device_group and device levels for the same interface, the interface_group_policy attribute controls how they interact:

• merge (default): Interface groups from device_groups and devices are combined. All referenced groups are applied, with device-level interface attributes taking final precedence over any group configuration.
• replace: Device-level interface groups completely replace any interface groups inherited from device_groups. Only the groups explicitly listed at the device level are applied.

The policy can be set at two levels:

1. Device level (devices[].interface_group_policy): Applies as the default for all interfaces on the device.
2. Per-interface level (ethernets[].interface_group_policy, etc.): Overrides the device-level policy for a specific interface.

Precedence: per-interface policy > device-level policy > default (merge).

If interface_group_policy: replace is set but an interface is only defined in a device_group (not redefined at the device level), the inherited groups are still applied since there is nothing to replace them with.

Interface groups provide a powerful mechanism for applying consistent configurations to multiple interfaces across one or more devices. They enable you to define reusable interface configuration templates that can be applied to interfaces with similar roles or requirements, promoting standardization and reducing configuration complexity.

Interface groups are particularly valuable for:

• Role-based interface configuration: Standardizing configurations for server ports, uplinks, access ports, etc.
• Service deployment: Applying consistent security policies, QoS settings, or VLAN configurations
• Operational consistency: Ensuring uniform interface behaviors across your network infrastructure
• Configuration maintenance: Centralizing interface policies for easier updates and troubleshooting

Interface groups work by:

1. Defining a named configuration template with interface-specific settings
2. Referencing the interface group from individual interfaces via the interface_groups attribute
3. Supporting variables for dynamic configuration based on device or group context
4. Allowing multiple interface groups to be applied to a single interface (configurations are merged)

This approach separates interface policy definition from individual interface declarations, making your network configurations more modular and maintainable.

Diagram

Diagram

Classes

iosxe

Name	Type	Constraint	Mandatory	Default Value
interface_groups	List	interface_groups	No

interface_groups (iosxe)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
variables	Map		No
configuration	Class	configuration	No

configuration (iosxe.interface_groups)

Name	Type	Constraint	Mandatory	Default Value
media_type	Choice	auto-select, rj45, sfp	No
bandwidth	Integer	min: 1, max: 200000000	No
mtu	Integer	min: 64, max: 18000	No
description	String		No
shutdown	Boolean	true, false	No
vrf_forwarding	String		No
ipv4	Class	ipv4	No
ipv6	Class	ipv6	No
bfd	Class	bfd	No
spanning_tree	Class	spanning_tree	No
speed	Choice	100, 1000, 2500, 5000, 10000, 25000, 40000, 50000, 100000, auto	No
speed_nonegotiate	Boolean	true, false	No
port_channel_id	Integer	min: 1, max: 512	No
port_channel_mode	Choice	active, auto, desirable, on, passive	No
source_templates	List	source_templates	No
arp_timeout	Integer	min: 0, max: 2147483	No
negotiation_auto	Boolean	true, false	No
service_policy_input	String		No
service_policy_output	String		No
load_interval	Integer	min: 30, max: 600	No
snmp_trap_link_status	Boolean	true, false	No
logging_event_link_status	Boolean	true, false	No
device_tracking	Boolean	true, false	No
device_tracking_attached_policies	List	String	No
encapsulation_dot1q_vlan_id	Integer	min: 1, max: 4094	No
nbar_protocol_discovery	Boolean	true, false	No
mpls	Class	mpls	No
ospf	Class	ospf	No
ospfv3	Class	ospfv3	No
isis	Class	isis	No
pim	Class	pim	No
igmp	Class	igmp	No
switchport	Class	switchport	No
network_access_control	Class	network_access_control	No
auto_qos	Class	auto_qos	No
cdp	Boolean	true, false	No
cdp_tlv_app	Boolean	true, false	No
cdp_tlv_location	Boolean	true, false	No
cdp_tlv_server_location	Boolean	true, false	No
carrier_delay_msec	Integer	min: 0, max: 1000	No
hold_queue_in	Integer	min: 0, max: 240000	No
hold_queue_out	Integer	min: 0, max: 240000	No
autostate	Boolean	true, false	No

configuration (iosxe.interface_groups)

Name	Type	Constraint	Mandatory	Default Value
media_type	Choice	auto-select, rj45, sfp	No
bandwidth	Integer	min: 1, max: 200000000	No
mtu	Integer	min: 64, max: 18000	No
description	String		No
shutdown	Boolean	true, false	No
vrf_forwarding	String		No
ipv4	Class	ipv4	No
ipv6	Class	ipv6	No
bfd	Class	bfd	No
spanning_tree	Class	spanning_tree	No
speed	Choice	100, 1000, 2500, 5000, 10000, 25000, 40000, 100000, auto	No
speed_nonegotiate	Boolean	true, false	No
port_channel_id	Integer	min: 1, max: 512	No
port_channel_mode	Choice	active, auto, desirable, on, passive	No
source_templates	List	source_templates	No
arp_timeout	Integer	min: 0, max: 2147483	No
negotiation_auto	Boolean	true, false	No
service_policy_input	String		No
service_policy_output	String		No
load_interval	Integer	min: 30, max: 600	No
snmp_trap_link_status	Boolean	true, false	No
logging_event_link_status	Boolean	true, false	No
device_tracking	Boolean	true, false	No
device_tracking_attached_policies	List	String	No
encapsulation_dot1q_vlan_id	Integer	min: 1, max: 4094	No
nbar_protocol_discovery	Boolean	true, false	No
mpls	Class	mpls	No
ospf	Class	ospf	No
ospfv3	Class	ospfv3	No
pim	Class	pim	No
switchport	Class	switchport	No
network_access_control	Class	network_access_control	No
auto_qos	Class	auto_qos	No
autostate	Boolean	true, false	No

ipv4 (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
address	IP		No
address_mask	IP		No
proxy_arp	Boolean	true, false	No
arp_inspection_trust	Boolean	true, false	No
arp_inspection_limit_rate	Integer	min: 0, max: 4294967295	No
dhcp_snooping_trust	Boolean	true, false	No
dhcp_relay_source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, FiftyGigabitEthernet, HundredGigabitEthernet, PortChannel	No
dhcp_relay_source_interface_id	Any	String or Integer[min: 0]	No
dhcp_relay_information_option_vpn_id	Boolean	true, false	No
helper_addresses	List	helper_addresses	No
access_group_in	String		No
access_group_out	String		No
flow_monitors	List	flow_monitors	No
redirects	Boolean	true, false	No
unreachables	Boolean	true, false	No
unnumbered_interface_type	Choice	Loopback, Vlan, GigabitEthernet, TwoGigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, TwentyFiveGigabitEthernet, FortyGigabitEthernet, FiftyGigabitEthernet, HundredGigabitEthernet, PortChannel	No
unnumbered_interface_id	Any	String or Integer[min: 0]	No
nat_inside	Boolean	true, false	No
nat_outside	Boolean	true, false	No
address_dhcp	Boolean	true, false	No
verify_unicast_source_reachable_via	Choice	any, rx	No
verify_unicast_source_allow_self_ping	Boolean	true, false	No
verify_unicast_source_allow_default	Boolean	true, false	No

ipv4 (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
address	IP		No
address_mask	IP		No
proxy_arp	Boolean	true, false	No
arp_inspection_trust	Boolean	true, false	No
arp_inspection_limit_rate	Integer	min: 0, max: 4294967295	No
dhcp_snooping_trust	Boolean	true, false	No
dhcp_relay_source_interface_type	Choice	Loopback, Vlan, GigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernet, PortChannel	No
dhcp_relay_source_interface_id	Any	String or Integer[min: 0]	No
dhcp_relay_information_option_vpn_id	Boolean	true, false	No
helper_addresses	List	helper_addresses	No
access_group_in	String		No
access_group_out	String		No
flow_monitors	List	flow_monitors	No
redirects	Boolean	true, false	No
unreachables	Boolean	true, false	No
unnumbered_interface_type	Choice	Loopback, Vlan, GigabitEthernet, FiveGigabitEthernet, TenGigabitEthernet, FortyGigabitEthernet, HundredGigabitEthernet, PortChannel	No
unnumbered_interface_id	Any	String or Integer[min: 0]	No
nat_inside	Boolean	true, false	No
nat_outside	Boolean	true, false	No

ipv6 (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No
addresses	List	addresses	No
link_local_addresses	List	IP	No
address_autoconfig_default	Boolean	true, false	No
address_dhcp	Boolean	true, false	No
mtu	Integer	min: 1280, max: 9976	No
nd_ra_suppress_all	Boolean	true, false	No
flow_monitors	List	flow_monitors	No
pim	Class	pim	No

bfd (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
template	String		No
enable	Boolean	true, false	No
local_address	IP		No
interval	Integer	min: 50, max: 9999	No
interval_min_rx	Integer	min: 50, max: 9999	No
interval_multiplier	Integer	min: 3, max: 50	No
echo	Boolean	true, false	No

bfd (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
template	String		No
enable	Boolean	true, false	No
local_address	String		No
interval	Integer	min: 50, max: 9999	No
interval_min_rx	Integer	min: 50, max: 9999	No
interval_multiplier	Integer	min: 3, max: 50	No
echo	Boolean	true, false	No

spanning_tree (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
portfast	Boolean	true, false	No
portfast_disable	Boolean	true, false	No
bpduguard	Boolean	true, false	No
bpduguard_disable	Boolean	true, false	No
guard	Choice	loop, none, root	No
link_type	Choice	shared, point-to-point	No
portfast_trunk	Boolean	true, false	No
portfast_edge	Boolean	true, false	No

source_templates (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
merge	Boolean	true, false	No

mpls (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
ip	Boolean	true, false	No
mtu	Integer		No

ospf (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
authentication_key_chain	String		No
authentication_message_digest	Boolean	true, false	No
authentication_null	Boolean	true, false	No
cost	Integer	min: 1, max: 65535	No
dead_interval	Integer	min: 1, max: 65535	No
hello_interval	Integer	min: 1, max: 65535	No
message_digest_keys	List	message_digest_keys	No
mtu_ignore	Boolean	true, false	No
multi_area_ids	List	Any[String or Integer[min: 0]]	No
network_type	Choice	broadcast, non-broadcast, point-to-multipoint, point-to-point	No
priority	Integer	min: 0, max: 255	No
process_ids	List	process_ids	No
ttl_security_hops	Integer	min: 1, max: 254	No

ospf (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
cost	Integer	min: 1, max: 65535	No
dead_interval	Integer	min: 1, max: 65535	No
hello_interval	Integer	min: 1, max: 65535	No
mtu_ignore	Boolean	true, false	No
network_type	Choice	broadcast, non-broadcast, point-to-multipoint, point-to-point	No
priority	Integer	min: 0, max: 255	No
ttl_security_hops	Integer	min: 1, max: 254	No
process_ids	List	process_ids	No
message_digest_keys	List	message_digest_keys	No

ospfv3 (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
bfd	Boolean	true, false	No
cost	Integer	min: 1, max: 65535	No
dead_interval	Integer	min: 1, max: 65535	No
hello_interval	Integer	min: 1, max: 65535	No
mtu_ignore	Boolean	true, false	No
network_type	Choice	broadcast, non-broadcast, point-to-multipoint, point-to-point	No
priority	Integer	min: 0, max: 255	No

ospfv3 (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
network_type	Choice	broadcast, non-broadcast, point-to-multipoint, point-to-point	No
cost	Integer	min: 1, max: 65535	No

isis (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
area_tag	String		No
ipv4_metric_levels	List	ipv4_metric_levels	No
network_point_to_point	Boolean	true, false	No

pim (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
passive	Boolean	true, false	No
dense_mode	Boolean	true, false	No
sparse_mode	Boolean	true, false	No
sparse_dense_mode	Boolean	true, false	No
bfd	Boolean	true, false	No
border	Boolean	true, false	No
bsr_border	Boolean	true, false	No
dr_priority	Integer	min: 0, max: 4294967294	No

igmp (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
version	Integer	min: 1, max: 3	No

switchport (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No
mode	Choice	access, dot1q-tunnel, private-vlan-trunk, private-vlan-host, private-vlan-promiscuous, trunk	No
nonegotiate	Boolean	true, false	No
access_vlan	Integer	min: 1, max: 4094	No
voice_vlan	Any	Integer[min: 1, max: 4094] or Choice[dot1p, none, untagged] or String[Regex: ^.*[\$\%]\{.*$]	No
trunk_allowed_vlans	Class	trunk_allowed_vlans	No
trunk_allowed_vlans_legacy	Class	trunk_allowed_vlans_legacy	No
trunk_native_vlan_tag	Boolean	true, false	No
trunk_native_vlan_id	Integer	min: 1, max: 4094	No
host	Boolean	true, false	No

switchport (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No
mode	Choice	access, dot1q-tunnel, private-vlan-trunk, private-vlan-host, private-vlan-promiscuous, trunk	No
nonegotiate	Boolean	true, false	No
access_vlan	Integer	min: 1, max: 4094	No
trunk_allowed_vlans	Class	trunk_allowed_vlans	No
trunk_allowed_vlans_legacy	Class	trunk_allowed_vlans_legacy	No
trunk_native_vlan_tag	Boolean	true, false	No
trunk_native_vlan_id	Integer	min: 1, max: 4094	No
host	Boolean	true, false	No

network_access_control (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
authentication_periodic	Boolean	true, false	No
authentication_timer_reauthenticate	Integer	min: 1, max: 1073741823	No
authentication_timer_reauthenticate_server	Boolean	true, false	No
mab	Boolean	true, false	No
mab_eap	Boolean	true, false	No
dot1x_pae	Choice	authenticator, supplicant, both	No
dot1x_timeout_auth_period	Integer	min: 1, max: 65535	No
dot1x_timeout_held_period	Integer	min: 1, max: 65535	No
dot1x_timeout_quiet_period	Integer	min: 1, max: 65535	No
dot1x_timeout_ratelimit_period	Integer	min: 1, max: 65535	No
dot1x_timeout_server_timeout	Integer	min: 1, max: 65535	No
dot1x_timeout_start_period	Integer	min: 1, max: 65535	No
dot1x_timeout_supp_timeout	Integer	min: 1, max: 65535	No
dot1x_timeout_tx_period	Integer	min: 1, max: 65535	No
dot1x_max_req	Integer	min: 1, max: 10	No
dot1x_max_reauth_req	Integer	min: 1, max: 10	No

auto_qos (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
classify	Boolean	true, false	No
classify_police	Boolean	true, false	No
trust	Boolean	true, false	No
trust_cos	Boolean	true, false	No
trust_dscp	Boolean	true, false	No
video_cts	Boolean	true, false	No
video_ip_camera	Boolean	true, false	No
video_media_player	Boolean	true, false	No
voip_cisco_phone	Boolean	true, false	No
voip_cisco_softphone	Boolean	true, false	No
voip_trust	Boolean	true, false	No
trust_device	Choice	cisco-phone, cts, ip-camera, media-player	No

auto_qos (iosxe.interface_groups.configuration)

Name	Type	Constraint	Mandatory	Default Value
classify	Boolean	true, false	No
classify_police	Boolean	true, false	No
trust	Boolean	true, false	No
trust_cos	Boolean	true, false	No
trust_dscp	Boolean	true, false	No
video_cts	Boolean	true, false	No
video_ip_camera	Boolean	true, false	No
video_media_player	Boolean	true, false	No
voip	Boolean	true, false	No
voip_cisco_phone	Boolean	true, false	No
voip_cisco_softphone	Boolean	true, false	No
voip_trust	Boolean	true, false	No
trust_device	Choice	cisco-phone, cts, ip-camera, media-player	No

helper_addresses (iosxe.interface_groups.configuration.ipv4)

Name	Type	Constraint	Mandatory	Default Value
address	IP		Yes
global	Boolean	true, false	No
vrf	String		No

flow_monitors (iosxe.interface_groups.configuration.ipv4)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
direction	Choice	input, output	Yes

addresses (iosxe.interface_groups.configuration.ipv6)

Name	Type	Constraint	Mandatory	Default Value
prefix	IP		Yes
eui_64	Boolean	true, false	No

pim (iosxe.interface_groups.configuration.ipv6)

Name	Type	Constraint	Mandatory	Default Value
pim	Boolean	true, false	No
bfd	Boolean	true, false	No
bsr_border	Boolean	true, false	No
dr_priority	Integer	min: 0, max: 4294967295	No

message_digest_keys (iosxe.interface_groups.configuration.ospf)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 255	Yes
md5_auth_key	String		No
md5_auth_type	Choice	0, 7	No

process_ids (iosxe.interface_groups.configuration.ospf)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 65535	No
areas	List	Any[String or Integer[min: 0]]	No

ipv4_metric_levels (iosxe.interface_groups.configuration.isis)

Name	Type	Constraint	Mandatory	Default Value
level	Choice	level-1, level-2	Yes
value	Integer	min: 1, max: 16777214	Yes

trunk_allowed_vlans (iosxe.interface_groups.configuration.switchport)

Name	Type	Constraint	Mandatory	Default Value
all	Boolean	true, false	No
none	Boolean	true, false	No
vlans	Class	vlans	No
add	Class	add	No
except	Class	except	No
remove	Class	remove	No

trunk_allowed_vlans_legacy (iosxe.interface_groups.configuration.switchport)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

vlans (iosxe.interface_groups.configuration.switchport.trunk_allowed_vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

add (iosxe.interface_groups.configuration.switchport.trunk_allowed_vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

except (iosxe.interface_groups.configuration.switchport.trunk_allowed_vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

remove (iosxe.interface_groups.configuration.switchport.trunk_allowed_vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

ranges (iosxe.interface_groups.configuration.switchport.trunk_allowed_vlans_legacy)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

Examples

iosxe:
  interface_groups:
    # Server access port configuration
    - name: SERVER_ACCESS_PORT
      configuration:
        description: "Server Access Port"
        switchport:
          mode: access
          access_vlan: 100
          port_security: true
          port_security_maximum_ranges:
            - range: 2
        spanning_tree:
          portfast: true
          bpduguard: true
        auto_qos:
          trust_dscp: true

    # Trunk uplink configuration
    - name: TRUNK_UPLINK
      configuration:
        description: "Trunk Uplink to ${uplink_device}"
        switchport:
          mode: trunk
          nonegotiate: true
          trunk_allowed_vlans: "1-200,300-400"
        spanning_tree:
          link_type: point-to-point

    # Access port with dynamic VLAN
    - name: DYNAMIC_ACCESS_PORT
      variables:
        port_vlan: 10
      configuration:
        switchport:
          mode: access
          access_vlan: ${port_vlan}
        network_access_control:
          dot1x_pae: authenticator
          mab: true
          access_session_port_control: auto

    # Management interface configuration
    - name: MGMT_INTERFACE
      configuration:
        description: "Management Interface"
        ipv4:
          address: ${mgmt_ip}
          address_mask: "255.255.255.0"
        snmp_trap_link_status: true

    # CDP, IGMP, and queue tuning via interface group
    - name: MULTICAST_CDP_TUNED
      configuration:
        igmp:
          version: 3
        cdp: true
        cdp_tlv_app: true
        cdp_tlv_location: true
        cdp_tlv_server_location: true
        carrier_delay_msec: 500
        hold_queue_in: 100
        hold_queue_out: 200

    # VLAN interface configuration with autostate
    - name: VLAN_CONFIG_AUTO
      configuration:
        description: "VLAN with Autostate Control"
        autostate: false
        ipv4:
          address: ${vlan_ip}
          address_mask: "255.255.255.0"

  # Apply interface groups to devices
  devices:
    - name: Access-SW-01
      variables:
        uplink_device: "Core-SW-01"
        mgmt_ip: "192.168.1.10"
      configuration:
        interfaces:
          ethernets:
            # Server ports using SERVER_ACCESS_PORT group
            - type: GigabitEthernet
              id: "1/0/1"
              interface_groups: [SERVER_ACCESS_PORT]
            - type: GigabitEthernet
              id: "1/0/2"
              interface_groups: [SERVER_ACCESS_PORT]

            # Uplink using TRUNK_UPLINK group
            - type: GigabitEthernet
              id: "1/0/48"
              interface_groups: [TRUNK_UPLINK]

            # User ports with dynamic access and multiple groups
            - type: GigabitEthernet
              id: "1/0/10"
              interface_groups: [DYNAMIC_ACCESS_PORT]
              variables:
                port_vlan: 20

          vlans:
            # Management VLAN using MGMT_INTERFACE group
            - id: 100
              interface_groups: [MGMT_INTERFACE]

            # VLAN with autostate control via interface group
            - id: 200
              interface_groups: [VLAN_CONFIG_AUTO]
              variables:
                vlan_ip: "192.168.200.1"

Interface Group Policy Example

iosxe:
  interface_groups:
    - name: IFG_FREE_PORT
      configuration:
        description: "Z;FREE_PORT"
        switchport:
          mode: access
          access_vlan: 999
        shutdown: true

    - name: IFG_TRUNK_PORT
      configuration:
        switchport:
          mode: trunk
        shutdown: false
        auto_qos:
          trust_dscp: true

  device_groups:
    - name: PLATFORM_C9300
      configuration:
        interfaces:
          ethernets:
            - type: GigabitEthernet
              id: "1/0/1"
              interface_groups: [IFG_FREE_PORT]
            - type: GigabitEthernet
              id: "1/0/2"
              interface_groups: [IFG_FREE_PORT]
            - type: GigabitEthernet
              id: "1/0/3"
              interface_groups: [IFG_FREE_PORT]

  devices:
    - name: Switch-01
      host: 10.1.1.1
      device_groups: [PLATFORM_C9300]
      interface_group_policy: replace
      configuration:
        interfaces:
          ethernets:
            # Gi1/0/3 gets ONLY IFG_TRUNK_PORT (replace policy, device redefines this interface)
            - type: GigabitEthernet
              id: "1/0/3"
              interface_groups: [IFG_TRUNK_PORT]
            # Gi1/0/1 still gets IFG_FREE_PORT (not redefined at device level, so inherited groups apply)

Sample Configuration

Example configuring VLAN autostate control using an interface group. When autostate: false is set, the VLAN interface remains up even if no physical ports are active in that VLAN. The interface_groups attribute is a NAC abstraction - the group configuration is merged and rendered to device CLI at template time.

Cisco IOS-XE CLI Equivalent:

interface Vlan200
 description VLAN with Autostate for Interface Groups Documentation
 ip address 192.168.200.1 255.255.255.0
 no autostate

NAC YAML Configuration:

iosxe:
  interface_groups:
    - name: VLAN_CONFIG_AUTO
      configuration:
        description: "VLAN with Autostate Control"
        autostate: false
        ipv4:
          address: ${vlan_ip}
          address_mask: "255.255.255.0"
  devices:
    - name: Device1
      configuration:
        interfaces:
          vlans:
            - id: 200
              interface_groups: [VLAN_CONFIG_AUTO]
              variables:
                vlan_ip: "192.168.200.1"

Examples

iosxe:
  interface_groups:
    # Server access port configuration
    - name: SERVER_ACCESS_PORT
      configuration:
        description: "Server Access Port"
        switchport:
          mode: access
          access_vlan: 100
          port_security: true
          port_security_maximum_ranges:
            - range: 2
        spanning_tree:
          portfast: true
          bpduguard: true
        auto_qos:
          trust_dscp: true

    # Trunk uplink configuration
    - name: TRUNK_UPLINK
      configuration:
        description: "Trunk Uplink to ${uplink_device}"
        switchport:
          mode: trunk
          nonegotiate: true
          trunk_allowed_vlans: "1-200,300-400"
        spanning_tree:
          link_type: point-to-point

    # Access port with dynamic VLAN
    - name: DYNAMIC_ACCESS_PORT
      variables:
        port_vlan: 10
      configuration:
        switchport:
          mode: access
          access_vlan: ${port_vlan}
        network_access_control:
          dot1x_pae: authenticator
          mab: true
          access_session_port_control: auto

    # Management interface configuration
    - name: MGMT_INTERFACE
      configuration:
        description: "Management Interface"
        ipv4:
          address: ${mgmt_ip}
          address_mask: "255.255.255.0"
        snmp_trap_link_status: true

  # Apply interface groups to devices
  devices:
    - name: Access-SW-01
      variables:
        uplink_device: "Core-SW-01"
        mgmt_ip: "192.168.1.10"
      configuration:
        interfaces:
          ethernets:
            # Server ports using SERVER_ACCESS_PORT group
            - type: GigabitEthernet
              id: "1/0/1"
              interface_groups: [SERVER_ACCESS_PORT]
            - type: GigabitEthernet
              id: "1/0/2"
              interface_groups: [SERVER_ACCESS_PORT]

            # Uplink using TRUNK_UPLINK group
            - type: GigabitEthernet
              id: "1/0/48"
              interface_groups: [TRUNK_UPLINK]

            # User ports with dynamic access and multiple groups
            - type: GigabitEthernet
              id: "1/0/10"
              interface_groups: [DYNAMIC_ACCESS_PORT]
              variables:
                port_vlan: 20

          vlans:
            # Management VLAN using MGMT_INTERFACE group
            - id: 100
              interface_groups: [MGMT_INTERFACE]