Ethernet interfaces provide the fundamental physical and logical connectivity for network devices, supporting various speeds from Fast Ethernet (100 Mbps) to multi-gigabit rates (1G, 2.5G, 5G, 10G, 25G, 40G, 100G) with comprehensive Layer 2 switching and Layer 3 routing capabilities. They offer extensive configuration options including switchport modes (access, trunk), VLAN assignments, spanning tree parameters, quality of service policies, security features, and advanced protocols such as OSPF, BFD, and IPv6. Ethernet interfaces serve as the backbone of modern networks, enabling both access layer connectivity for end devices and high-performance trunk links between network infrastructure components while supporting features like port channels, network access control, and comprehensive monitoring capabilities.
managed attribute: Controls whether Terraform continuously manages the interface configuration. When set to false, Terraform will push the initial configuration but will not continuously read it, detect drift, or reconcile changes. This is useful for:
Interfaces whose configuration changes dynamically due to authorization policies
Interfaces modified by local scripts or automation
Interfaces where configuration drift should be allowed and not corrected
Default: true (Terraform fully manages the interface and reconciles drift)
Usage example:
interfaces:
ethernets:
- id: 1/0/1
type: GigabitEthernet
description: Dynamic interface
managed: false# Terraform pushes initial config but ignores subsequent changes
spanning_tree_portfast_edge attribute limitation: The spanning_tree_portfast_edge attribute uses a deprecated YANG model path (spanning-tree/portfast/edge) that does not translate to valid CLI commands on Catalyst switch platforms. While the YANG model accepts this configuration for backward compatibility with routers or older platforms, modern Catalyst switches (including Catalyst 9000 series) do not support the spanning-tree portfast edge CLI command. Attempting to configure this attribute on Catalyst switches will result in device configuration rejection errors (“inconsistent value: Device refused one or more commands”).
Recommended alternatives for Catalyst switches:
For access ports: Use spanning_tree_portfast: true (translates to spanning-tree portfast)
For trunk ports: Use spanning_tree_portfast_trunk: true (translates to spanning-tree portfast trunk)
Both options provide the same portfast functionality and are fully supported on Catalyst platforms
Portfast and guard mutual exclusivity: The spanning-tree portfast variants (portfast, portfast_disable, portfast_trunk) and guard options (loop, root, none) serve different purposes:
Portfast enables immediate forwarding for edge ports connecting to end devices
Guard protects against topology loops (loop) or unauthorized root bridges (root)
These can be configured together on the same interface for comprehensive protection
BPDU guard configuration: BPDU guard (bpduguard: true or bpduguard_disable: true) can be configured alongside any portfast variant to protect against unauthorized switches. When global BPDU guard is enabled (spanning-tree portfast bpduguard default), use bpduguard_disable: true to selectively disable it on specific interfaces.
