Skip to content
Network as Code

Global

Diagram

Section titled “Diagram”
Diagram

Classes

Section titled “Classes”

vxlan

Section titled “vxlan”
NameTypeConstraintMandatoryDefault Value
globalClass[global]No

global (vxlan)

Section titled “global (vxlan)”
NameTypeConstraintMandatoryDefault Value
ebgpClass[ebgp]No
ibgpClass[ibgp]No
externalClass[external]No

ebgp (vxlan.global)

Section titled “ebgp (vxlan.global)”
NameTypeConstraintMandatoryDefault Value
spine_bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$Yes
super_spine_bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$No
bgp_asn_modeChoiceMulti-AS, Same-Tier-ASNoMulti-AS
leaf_bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$No
border_bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$No
leaf_same_bgp_asnBooleantrue, falseNofalse
anycast_gateway_macAnyString[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]No20:20:00:00:00:aa
overlay_modeChoicecli, config-profileNocli
layer2_vni_rangeClass[layer2_vni_range]No
layer3_vni_rangeClass[layer3_vni_range]No
layer2_vlan_rangeClass[layer2_vlan_range]No
layer3_vlan_rangeClass[layer3_vlan_range]No
enable_mvpn_vri_id_rangeBooleantrue, falseNotrue
enable_l3_vni_no_vlanBooleantrue, falseNofalse
multisite_site_idIntegermin: 1, max: 281474976710655No
vpcClass[vpc]No
ptpClass[ptp]No
snmp_server_host_trapBooleantrue, falseNotrue
enable_nxapi_httpBooleantrue, falseNofalse
nxapi_http_portIntegerNo80
enable_nxapi_httpsBooleantrue, falseNotrue
nxapi_https_portIntegerNo443
auth_protoChoiceMD5, SHA, MD5_DES, MD5_AES, SHA_DES, SHA_AESNoMD5
dns_serversList[dns_servers]No
ntp_serversList[ntp_servers]No
syslog_serversList[syslog_servers]No
netflowClass[netflow]No
bootstrapClass[bootstrap]No

ibgp (vxlan.global)

Section titled “ibgp (vxlan.global)”
NameTypeConstraintMandatoryDefault Value
bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$Yes
route_reflectorsChoice2, 4No2
anycast_gateway_macAnyString[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]No20:20:00:00:00:aa
overlay_modeChoicecli, config-profileNocli
layer2_vni_rangeClass[layer2_vni_range]No
layer3_vni_rangeClass[layer3_vni_range]No
layer2_vlan_rangeClass[layer2_vlan_range]No
layer3_vlan_rangeClass[layer3_vlan_range]No
enable_mvpn_vri_id_rangeBooleantrue, falseNotrue
enable_l3_vni_no_vlanBooleantrue, falseNofalse
multisite_site_idIntegermin: 1, max: 281474976710655No
vpcClass[vpc]No
ptpClass[ptp]No
snmp_server_host_trapBooleantrue, falseNotrue
enable_nxapi_httpBooleantrue, falseNofalse
nxapi_http_portIntegerNo80
enable_nxapi_httpsBooleantrue, falseNotrue
nxapi_https_portIntegerNo443
spanning_treeClass[spanning_tree]No
auth_protoChoiceMD5, SHA, MD5_DES, MD5_AES, SHA_DES, SHA_AESNoMD5
dns_serversList[dns_servers]No
ntp_serversList[ntp_servers]No
syslog_serversList[syslog_servers]No
netflowClass[netflow]No
bootstrapClass[bootstrap]No
tcam_allocationBooleantrue, falseNotrue

external (vxlan.global)

Section titled “external (vxlan.global)”
NameTypeConstraintMandatoryDefault Value
bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$Yes
enable_nxapi_httpBooleantrue, falseNofalse
nxapi_http_portIntegerNo80
enable_nxapi_httpsBooleantrue, falseNotrue
nxapi_https_portIntegerNo443
auth_protoChoiceMD5, SHA, MD5_DES, MD5_AES, SHA_DES, SHA_AESNoMD5
ptpClass[ptp]No
snmp_server_host_trapBooleantrue, falseNotrue
netflowClass[netflow]No
bootstrapClass[bootstrap]No

layer2_vni_range (vxlan.global.ebgp)

Section titled “layer2_vni_range (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
fromIntegermin: 1, max: 16777214Yes30000
toIntegermin: 1, max: 16777214No49000

layer2_vlan_range (vxlan.global.ebgp)

Section titled “layer2_vlan_range (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
fromIntegermin: 2, max: 4094Yes2300
toIntegermin: 2, max: 4094No2999

vpc (vxlan.global.ebgp)

Section titled “vpc (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
peer_link_vlanIntegermin: 2, max: 3967No3600
peer_keep_aliveChoiceloopback, managementNomanagement
auto_recovery_timeIntegermin: 240, max: 3600No360
delay_restore_timeIntegermin: 1, max: 3600No150
peer_link_port_channel_idIntegermin: 1, max: 4096No500
ipv6_nd_syncBooleantrue, falseNotrue
advertise_pipBooleantrue, falseNofalse
advertise_pip_border_onlyBooleantrue, falseNotrue
advertise_pip_border_gatewayBooleantrue, falseNofalse
domain_id_rangeStringNo1-1000
fabric_vpc_qosBooleantrue, falseNofalse
fabric_vpc_qos_policy_nameStringNospine_qos_for_fabric_vpc_peering

ptp (vxlan.global.ebgp)

Section titled “ptp (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
enableBooleantrue, falseNofalse
domain_idIntegermin: 0, max: 127No0
lb_idIntegermin: 0, max: 1023No0
vlan_idIntegermin: 2, max: 3967No

dns_servers (vxlan.global.ebgp)

Section titled “dns_servers (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
vrfStringYes

ntp_servers (vxlan.global.ebgp)

Section titled “ntp_servers (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
vrfStringYes

syslog_servers (vxlan.global.ebgp)

Section titled “syslog_servers (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
vrfStringYes
severityIntegermin: 0, max: 7Yes

netflow (vxlan.global.ebgp)

Section titled “netflow (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
enableBooleantrue, falseNofalse
exporterList[exporter]No
recordList[record]No
monitorList[monitor]No

bootstrap (vxlan.global.ebgp)

Section titled “bootstrap (vxlan.global.ebgp)”
NameTypeConstraintMandatoryDefault Value
enable_bootstrapBooleantrue, falseNofalse
enable_local_dhcp_serverBooleantrue, falseNofalse
dhcp_versionChoiceDHCPv4, DHCPv6No
dhcp_v4Class[dhcp_v4]No
dhcp_v6Class[dhcp_v6]No
enable_cdp_mgmtBooleantrue, falseNofalse

spanning_tree (vxlan.global.ibgp)

Section titled “spanning_tree (vxlan.global.ibgp)”
NameTypeConstraintMandatoryDefault Value
root_bridge_protocolChoicerpvst+, mst, unmanagedYesunmanaged
vlan_rangeList[vlan_range]No
mst_instance_rangeList[mst_instance_range]No
bridge_priorityChoice0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, 61440No0

exporter (vxlan.global.ebgp.netflow)

Section titled “exporter (vxlan.global.ebgp.netflow)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
ip_addressIPYes
vrfStringNo
source_interfaceStringRegex: (?i)^(?:e|eth(?:ernet)?)\d(?:\/\d+){1,2}(\.\d{1,4})?$Yes
udp_portIntegermin: 1, max: 65535Yes

record (vxlan.global.ebgp.netflow)

Section titled “record (vxlan.global.ebgp.netflow)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
templateChoicenetflow_ipv4_record, netflow_l2_recordYes
layer2Booleantrue, falseNo

monitor (vxlan.global.ebgp.netflow)

Section titled “monitor (vxlan.global.ebgp.netflow)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
recordStringYes
exporter1StringYes
exporter2StringNo

dhcp_v4 (vxlan.global.ebgp.bootstrap)

Section titled “dhcp_v4 (vxlan.global.ebgp.bootstrap)”
NameTypeConstraintMandatoryDefault Value
scope_start_addressIPYes
scope_end_addressIPYes
switch_mgmt_default_gwIPYes
mgmt_prefixIntegermin: 8, max: 30Yes
multi_subnet_scopeStringNo
domain_nameStringNo

dhcp_v6 (vxlan.global.ebgp.bootstrap)

Section titled “dhcp_v6 (vxlan.global.ebgp.bootstrap)”
NameTypeConstraintMandatoryDefault Value
scope_start_addressIPYes
scope_end_addressIPYes
switch_mgmt_default_gwIPYes
mgmt_prefixIntegermin: 64, max: 126Yes
multi_subnet_scopeStringNo
domain_nameStringNo

vlan_range (vxlan.global.ibgp.spanning_tree)

Section titled “vlan_range (vxlan.global.ibgp.spanning_tree)”
NameTypeConstraintMandatoryDefault Value
fromIntegermin: 1, max: 3967Yes
toIntegermin: 1, max: 3967No

mst_instance_range (vxlan.global.ibgp.spanning_tree)

Section titled “mst_instance_range (vxlan.global.ibgp.spanning_tree)”
NameTypeConstraintMandatoryDefault Value
fromIntegermin: 0, max: 4094Yes
toIntegermin: 0, max: 4094No

Examples

Section titled “Examples”

iBGP

Section titled “iBGP”

In this example we will create a EVPN Fabric name myfabric with the AS Number: 6512

The value in bgp_asn should between double quotes. Example:

global:
    ibgp:
      bgp_asn: "6512"
global:
  ibgp:
    bgp_asn: "65000.1"
global.nac.yaml
vxlan:
  fabric:
    name: myfabric
    type: VXLAN_EVPN
  global:
    ibgp:
      bgp_asn: "6512"   # Use quotes
      route_reflectors: 2
      anycast_gateway_mac: 20:20:00:00:00:aa
      dns_servers:
        - ip_address: 172.25.74.200
          vrf: service
        - ip_address: 172.25.74.201
          vrf: service
      ntp_servers:
        - ip_address: 10.195.225.200
          vrf: service
      syslog_servers:
        - ip_address: 172.16.255.251
          vrf: management
          severity: 3
        - ip_address: 172.16.255.252
          vrf: management
          severity: 3
      vpc:
        peer_link_vlan: 3600
        peer_keep_alive: management
        auto_recovery_time: 240
        delay_restore_time: 150
        peer_link_port_channel_id: 500
        advertise_pip: false
        advertise_pip_border_only: true
        domain_id_range: 1-100

To display BGP session in asdot format, you can add the following CLI with a policy.

Terminal window
netascode-bgw(config)# as-format asdot
netascode-bgw# sh bgp l2vpn evpn summary | begin Neighbor
Neighbor        V    AS    MsgRcvd    MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.1        4 65000.1
                             24569      24529      224    0    0     2w3d 10
10.0.0.3        4 65000.1
                             24531      24532      224    0    0     2w3d 1
10.0.0.4        4 65000.1
                             24554      24531      224    0    0     2w3d 10
10.0.0.5        4 65000.1
                             24599      24537      224    0    0     2w3d 1
100.64.0.1      4 65000.100
                              6868       6873      224    0    0 12:19:50 1
100.64.0.2      4 65000.100
                              6871       6873      224    0    0 12:19:54 1
100.64.0.3      4 65000.100
                              1697       1700      224    0    0 12:20:07 1
100.64.0.4      4 65000.100
                              1697       1700      224    0    0 12:19:22 1


Neighbor        T    AS PfxRcd     Type-2     Type-3     Type-4     Type-5     Type-12
10.0.0.1        I 65000.1
                        10         6          0          0          4          0
10.0.0.3        I 65000.1                       1697       1699      224    0    0 12:18:34 1
policy.nac.yaml
---
vxlan:
  policy:
    policies:
       - name: asdot
        template_name: switch_freeform
        template_vars:
          CONF: |-
            as-format asdot
    groups:
      - name: commonPolicies
        priority: 500
        policies:
          - name: asdot
    switches:
      - name: netascode-bgw
        groups:
          - commonPolicies

eBGP

Section titled “eBGP”

For detailed information about eBGP fabric creation and deployment, refer to the Cisco NDFC BGP Fabric Documentation.

Basic eBGP Fabric Configuration

Section titled “Basic eBGP Fabric Configuration”
global.nac.yaml
vxlan:
  fabric:
    name: ebgp-fabric
    type: eBGP_VXLAN
  global:
    ebgp:
        spine_bgp_asn: "65000.3"
        super_spine_bgp_asn: "65000.1"
        bgp_asn_mode: Multi-AS
        leaf_same_bgp_asn: true
        anycast_gateway_mac: 20:20:00:00:00:aa
        layer2_vni_range:
            from: 30000
            to: 49000
        layer3_vni_range:
            from: 50000
            to: 59000
        layer2_vlan_range:
            from: 2300
            to: 2999
        layer3_vlan_range:
            from: 2000
            to: 2299
        vpc:
            peer_link_vlan: 3600
            peer_keep_alive: management
            auto_recovery_time: 360
            delay_restore_time: 150
            peer_link_port_channel_id: 500
            ipv6_nd_sync: false
            advertise_pip: true
            advertise_pip_border_only: false
            domain_id_range: 1-100
            advertise_pip_border_gateway: true
        snmp_server_host_trap: true
        auth_proto: MD5
        dns_servers:
            - ip_address: 10.200.253.13
            vrf: management
        ntp_servers:
            - ip_address: 10.200.253.13
            vrf: management
        syslog_servers:
            - ip_address: 10.200.253.19
            vrf: management
            severity: 4

Required Policies

Section titled “Required Policies”

eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.

1. Leaf BGP AS Policies
Section titled “1. Leaf BGP AS Policies”

Each leaf switch must have a leaf_bgp_asn policy to specify its BGP AS number:

policy.nac.yaml
---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"
2. Spine Switch Overlay Policies
Section titled “2. Spine Switch Overlay Policies”

For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:

NDFC overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.

Important: You must manually duplicate the following templates in NDFC:

  • ebgp_overlay_spine_all_neighbor → ebgp_overlay_spine_all_neighbor_custom
  • ebgp_overlay_leaf_all_neighbor → ebgp_overlay_leaf_all_neighbor_custom

This step is required before using these templates. For template management instructions, refer to the Cisco NDFC Templates Documentation.

The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”

policy.nac.yaml
policies:
  - name: ebgp_overlay_spine_all_neighbor_custom
    template_name: ebgp_overlay_spine_all_neighbor_custom
    template_vars:
      LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
      INTF_NAME: "Loopback0"
      LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"
3. Leaf Switch Overlay Policies
Section titled “3. Leaf Switch Overlay Policies”

For leaf switches, use the custom ebgp_overlay_leaf_all_neighbor_custom policy:

policy.nac.yaml
policies:
  - name: ebgp_overlay_leaf_all_neighbor_custom
    template_name: ebgp_overlay_leaf_all_neighbor_custom
    template_vars:
      SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
      INTF_NAME: "Loopback0"

Complete Policy Example

Section titled “Complete Policy Example”

Here’s a complete example showing all required policies with proper priority settings:

policy.nac.yaml
---
vxlan:
  policy:
    policies:
      # Leaf BGP AS Policies
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"


      # Spine Overlay Policy
      - name: ebgp_overlay_spine_all_neighbor_custom
        template_name: ebgp_overlay_spine_all_neighbor_custom
        template_vars:
          LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
          INTF_NAME: "Loopback0"
          LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"


      # Leaf Overlay Policy
      - name: ebgp_overlay_leaf_all_neighbor_custom
        template_name: ebgp_overlay_leaf_all_neighbor_custom
        template_vars:
          SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
          INTF_NAME: "Loopback0"


    groups:
      - name: leaf_group
        policies:
          - name: bgp_as_policy_leaf
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_group
        policies:
          - name: bgp_as_policy_BGW
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_leaf
        policies:
          - name: bgp_as_policy_BL
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: spine_group
        policies:
          - name: ebgp_overlay_spine_all_neighbor_custom


    switches:
      - name: S1-S1
        groups:
          - spine_group
      - name: S1-S2
        groups:
          - spine_group
      - name: S1-L1
        groups:
          - leaf_group
      - name: S1-L2
        groups:
          - leaf_group
      - name: S1-BL1
        groups:
          - leaf_border_leaf
      - name: S1-BL2
        groups:
          - leaf_border_leaf
      - name: S1-BGW1
        groups:
          - leaf_border_group