External

Diagram

Diagram

Classes

vxlan

Name	Type	Constraint	Mandatory	Default Value
global	Class	global	No

global (vxlan)

Name	Type	Constraint	Mandatory	Default Value
external	Class	external	No

external (vxlan.global)

Name	Type	Constraint	Mandatory	Default Value
bgp_asn	String	Regex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$	Yes
enable_nxapi_http	Boolean	true, false	No	false
nxapi_http_port	Integer		No	80
enable_nxapi_https	Boolean	true, false	No	true
nxapi_https_port	Integer		No	443
auth_proto	Choice	MD5, SHA, MD5_DES, MD5_AES, SHA_DES, SHA_AES	No	MD5
ptp	Class	ptp	No
snmp_server_host_trap	Boolean	true, false	No	true
netflow	Class	netflow	No
bootstrap	Class	bootstrap	No
aaa_freeform	String		No

ptp (vxlan.global.external)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No	false
domain_id	Integer	min: 0, max: 127	No	0
lb_id	Integer	min: 0, max: 1023	No	0

ptp (vxlan.global.external)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No	false
domain_id	Integer	min: 0, max: 127	No	0
lb_id	Integer	min: 0, max: 1023	No	0
vlan_id	Integer	min: 2, max: 3967	No

netflow (vxlan.global.external)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No	false
exporter	List	exporter	No
record	List	record	No
monitor	List	monitor	No

bootstrap (vxlan.global.external)

Name	Type	Constraint	Mandatory	Default Value
enable_bootstrap	Boolean	true, false	No	false
enable_local_dhcp_server	Boolean	true, false	No	false
dhcp_version	Choice	DHCPv4, DHCPv6	No
dhcp_v4	Class	dhcp_v4	No
dhcp_v6	Class	dhcp_v6	No
enable_cdp_mgmt	Boolean	true, false	No	false
bootstrap_freeform	String		No

exporter (vxlan.global.external.netflow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_address	IP		Yes
vrf	String		No
source_interface	String	Regex: (?i)^(?:mgmt0|(?:e|eth(?:ernet)?)\d(?:/\d+){1,2}(?:\.\d{1,4})?)$	Yes
udp_port	Integer	min: 1, max: 65535	Yes

exporter (vxlan.global.external.netflow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_address	IP		Yes
vrf	String		No
source_interface	String	Regex: (?i)^(?:e|eth(?:ernet)?)\d(?:\/\d+){1,2}(\.\d{1,4})?$	Yes
udp_port	Integer	min: 1, max: 65535	Yes

record (vxlan.global.external.netflow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
template	Choice	netflow_ipv4_record, netflow_l2_record	Yes
layer2	Boolean	true, false	No

monitor (vxlan.global.external.netflow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
record	String		Yes
exporter1	String		Yes
exporter2	String		No

dhcp_v4 (vxlan.global.external.bootstrap)

Name	Type	Constraint	Mandatory	Default Value
scope_start_address	IP		Yes
scope_end_address	IP		Yes
switch_mgmt_default_gw	IP		Yes
mgmt_prefix	Integer	min: 8, max: 30	Yes
multi_subnet_scope	String		No
domain_name	String		No

dhcp_v6 (vxlan.global.external.bootstrap)

Name	Type	Constraint	Mandatory	Default Value
scope_start_address	IP		Yes
scope_end_address	IP		Yes
switch_mgmt_default_gw	IP		Yes
mgmt_prefix	Integer	min: 64, max: 126	Yes
multi_subnet_scope	String		No
domain_name	String		No

Note

With release 0.5.1, the data model was updated under the global key to provide segmentation for the different fabric types that are supported to provide better clarity for applicable parameters and attributes for a given fabric type. The primary keys for fabric types that are directly under the global key are ibgp, ebgp, and external. For fabric types ibgp and external, keys that were available in 0.5.0 under the global key are maintained and mapped for backwards compatibility for the time being. For the ebgp fabric type, initial support started with the usage of the ebgp key under the global key directly. Users should target the global section of the data model to reference vxlan.global.ibgp, vxlan.global.ebgp, or vxlan.global.external going forward. With release 0.8.1, the ptp.vlan_id key has been removed from the data model for vxlan.global.ebgp, vxlan.global.external, and vxlan.multisite.isn as the PTP VLAN ID is not supported for these fabric types.

Examples

global.nac.yaml

---
vxlan:
  fabric:
    name: MyExternalFabric
    type: External
  global:
    external:
      bgp_asn: '65100'
      enable_nxapi_https: true
      nxapi_https_port: 443
      bootstrap:
        enable_bootstrap: true
      netflow:
        enable: false

Switch Discovery Authentication Protocol

auth_proto selects the SNMPv3 authentication/privacy protocol that ND uses when discovering a switch for the first time. The default is MD5. The value applies to every switch in the fabric; it cannot be set per switch.

Value	Authentication	Privacy
MD5	MD5	—
SHA	SHA-1	—
MD5_DES	MD5	DES
MD5_AES	MD5	AES-128
SHA_DES	SHA-1	DES
SHA_AES	SHA-1	AES-128

Note

auth_proto applies to the normal initial switch discovery flow only. For POAP/preprovision flows, use NDFC_SW_DISCOVERY_USERNAME and NDFC_SW_DISCOVERY_PASSWORD instead.

Support for auth_proto in External fabrics is confirmed by code inspection. It has not been validated live in this release cycle.

NX-OS prerequisite: The SNMPv3 user must already exist on each switch with authentication and privacy algorithms that match the selected auth_proto. Create the local user once, then apply the single snmp-server user line for your chosen value:

username <USERNAME> password <PASSWORD> role network-admin

! Apply ONE of the following, matching the auth_proto value

! MD5 (default) — authentication only
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD>

! SHA — authentication only
snmp-server user <USERNAME> network-admin auth sha <PASSWORD>

! MD5_DES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv des <PASSWORD>

! MD5_AES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv aes-128 <PASSWORD>

! SHA_DES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv des <PASSWORD>

! SHA_AES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv aes-128 <PASSWORD>

Verify the result with show snmp user <USERNAME>. The Auth and Priv columns must match the table above.

The authentication and privacy passphrases must be identical. NaC sends a single password to ND, which uses it for both. Mismatched passphrases are the most common cause of notManageable and SNMPv3 timeouts during discovery.

Note

Always specify the privacy keyword explicitly. Omitting it (priv <PASSWORD>) relies on a platform default that is not guaranteed to be stable across NX-OS releases. des also emits a deprecation warning on current releases.

Environment variables: ND uses NDFC_SW_USERNAME and NDFC_SW_PASSWORD to reach the switch during discovery. These values must match the <USERNAME> and <PASSWORD> used when configuring the SNMPv3 user on the switch.

SHA_AES Example

global.nac.yaml

---
vxlan:
  fabric:
    name: MyExternalFabric
    type: External
  global:
    external:
      auth_proto: SHA_AES
      bgp_asn: '65100'

Note

With release 0.5.1, the data model was updated under the global key to provide segmentation for the different fabric types that are supported to provide better clarity for applicable parameters and attributes for a given fabric type. The primary keys for fabric types that are directly under the global key are ibgp, ebgp, and external. For fabric types ibgp and external, keys that were available in 0.5.0 under the global key are maintained and mapped for backwards compatibility for the time being. For the ebgp fabric type, initial support started with the usage of the ebgp key under the global key directly. Users should target the global section of the data model to reference vxlan.global.ibgp, vxlan.global.ebgp, or vxlan.global.external going forward. With release 0.8.1, the ptp.vlan_id key has been removed from the data model for vxlan.global.ebgp, vxlan.global.external, and vxlan.multisite.isn as the PTP VLAN ID is not supported for these fabric types.

Examples

global.nac.yaml

---
vxlan:
  fabric:
    name: MyExternalFabric
    type: External
  global:
    external:
      bgp_asn: '65100'
      enable_nxapi_https: true
      nxapi_https_port: 443
      bootstrap:
        enable_bootstrap: true
      netflow:
        enable: false

Note

With release 0.5.1, the data model was updated under the global key to provide segmentation for the different fabric types that are supported to provide better clarity for applicable parameters and attributes for a given fabric type. The primary keys for fabric types that are directly under the global key are ibgp, ebgp, and external. For fabric types ibgp and external, keys that were available in 0.5.0 under the global key are maintained and mapped for backwards compatibility for the time being. For the ebgp fabric type, initial support started with the usage of the ebgp key under the global key directly. Users should target the global section of the data model to reference vxlan.global.ibgp, vxlan.global.ebgp, or vxlan.global.external going forward.

Examples

global.nac.yaml

---
vxlan:
  fabric:
    name: MyExternalFabric
    type: External
  global:
    external:
      bgp_asn: '65100'
      enable_nxapi_https: true
      nxapi_https_port: 443
      bootstrap:
        enable_bootstrap: true
      netflow:
        enable: false