VXLAN EVPN eBGP

Diagram

Classes

global (vxlan)

Name	Type	Constraint	Mandatory	Default Value
ebgp	Class	`[ebgp]`	No

ebgp (vxlan.global)

Name	Type	Constraint	Mandatory	Default Value
spine_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	Yes
super_spine_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
bgp_asn_mode	Choice	`Multi-AS`, `Same-Tier-AS`	No	`Multi-AS`
leaf_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
border_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
leaf_same_bgp_asn	Boolean	`true`, `false`	No	`false`
bgp_asn_auto_allocation	Boolean	`true`, `false`	No	`true`
anycast_gateway_mac	Any	String[Regex: `^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$`] or String[Regex: `^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$`] or String[Regex: `^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$`] or String[Regex: `^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$`]	No	`20:20:00:00:00:aa`
overlay_mode	Choice	`cli`, `config-profile`	No	`cli`
greenfield_cleanup	Choice	`Enable`, `Disable`	No	`Disable`
layer2_vni_range	Class	`[layer2_vni_range]`	No
layer3_vni_range	Class	`[layer3_vni_range]`	No
layer2_vlan_range	Class	`[layer2_vlan_range]`	No
layer3_vlan_range	Class	`[layer3_vlan_range]`	No
enable_l3_vni_no_vlan	Boolean	`true`, `false`	No	`false`
multisite_site_id	Integer	min: `1`, max: `281474976710655`	No
vpc	Class	`[vpc]`	No
ptp	Class	`[ptp]`	No
snmp_server_host_trap	Boolean	`true`, `false`	No	`true`
enable_nxapi_http	Boolean	`true`, `false`	No	`false`
nxapi_http_port	Integer		No	`80`
enable_nxapi_https	Boolean	`true`, `false`	No	`true`
nxapi_https_port	Integer		No	`443`
auth_proto	Choice	`MD5`, `SHA`, `MD5_DES`, `MD5_AES`, `SHA_DES`, `SHA_AES`	No	`MD5`
dns_servers	List	`[dns_servers]`	No
ntp_servers	List	`[ntp_servers]`	No
syslog_servers	List	`[syslog_servers]`	No
netflow	Class	`[netflow]`	No
bootstrap	Class	`[bootstrap]`	No
aaa_freeform	String		No
banner_freeform	String		No
leaf_pre_interface_freeform	String		No
leaf_post_interface_freeform	String		No
spine_pre_interface_freeform	String		No
spine_post_interface_freeform	String		No
tor_pre_interface_freeform	String		No
tor_post_interface_freeform	String		No
intra_fabric_link_freeform	String		No

ebgp (vxlan.global)

Name	Type	Constraint	Mandatory	Default Value
spine_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	Yes
super_spine_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
bgp_asn_mode	Choice	`Multi-AS`, `Same-Tier-AS`	No	`Multi-AS`
leaf_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
border_bgp_asn	String	Regex: `^(?:\d{1,10}\|\d{1,5}\.\d{1,5})$`	No
leaf_same_bgp_asn	Boolean	`true`, `false`	No	`false`
anycast_gateway_mac	Any	String[Regex: `^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$`] or String[Regex: `^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$`] or String[Regex: `^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$`] or String[Regex: `^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$`]	No	`20:20:00:00:00:aa`
overlay_mode	Choice	`cli`, `config-profile`	No	`cli`
layer2_vni_range	Class	`[layer2_vni_range]`	No
layer3_vni_range	Class	`[layer3_vni_range]`	No
layer2_vlan_range	Class	`[layer2_vlan_range]`	No
layer3_vlan_range	Class	`[layer3_vlan_range]`	No
enable_l3_vni_no_vlan	Boolean	`true`, `false`	No	`false`
multisite_site_id	Integer	min: `1`, max: `281474976710655`	No
vpc	Class	`[vpc]`	No
ptp	Class	`[ptp]`	No
snmp_server_host_trap	Boolean	`true`, `false`	No	`true`
enable_nxapi_http	Boolean	`true`, `false`	No	`false`
nxapi_http_port	Integer		No	`80`
enable_nxapi_https	Boolean	`true`, `false`	No	`true`
nxapi_https_port	Integer		No	`443`
auth_proto	Choice	`MD5`, `SHA`, `MD5_DES`, `MD5_AES`, `SHA_DES`, `SHA_AES`	No	`MD5`
dns_servers	List	`[dns_servers]`	No
ntp_servers	List	`[ntp_servers]`	No
syslog_servers	List	`[syslog_servers]`	No
netflow	Class	`[netflow]`	No
bootstrap	Class	`[bootstrap]`	No
aaa_freeform	String		No
banner_freeform	String		No
leaf_pre_interface_freeform	String		No
leaf_post_interface_freeform	String		No
spine_pre_interface_freeform	String		No
spine_post_interface_freeform	String		No
tor_pre_interface_freeform	String		No
tor_post_interface_freeform	String		No
intra_fabric_link_freeform	String		No

layer2_vni_range (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: `1`, max: `16777214`	Yes	`30000`
to	Integer	min: `1`, max: `16777214`	No	`49000`

layer3_vni_range (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: `1`, max: `16777214`	Yes	`50000`
to	Integer	min: `1`, max: `16777214`	No	`59000`

layer2_vlan_range (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: `2`, max: `4094`	Yes	`2300`
to	Integer	min: `2`, max: `4094`	No	`2999`

layer3_vlan_range (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: `2`, max: `4094`	Yes	`2000`
to	Integer	min: `2`, max: `4094`	No	`2299`

vpc (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
peer_link_vlan	Integer	min: `2`, max: `3967`	No	`3600`
peer_keep_alive	Choice	`loopback`, `management`	No	`management`
auto_recovery_time	Integer	min: `240`, max: `3600`	No	`360`
delay_restore_time	Integer	min: `1`, max: `3600`	No	`150`
peer_link_port_channel_id	Integer	min: `1`, max: `4096`	No	`500`
ipv6_nd_sync	Boolean	`true`, `false`	No	`true`
advertise_pip	Boolean	`true`, `false`	No	`false`
advertise_pip_border_only	Boolean	`true`, `false`	No	`true`
advertise_pip_border_gateway	Boolean	`true`, `false`	No	`false`
domain_id_range	String		No	`1-1000`
fabric_vpc_qos	Boolean	`true`, `false`	No	`false`
fabric_vpc_qos_policy_name	String		No	`spine_qos_for_fabric_vpc_peering`

ptp (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	`true`, `false`	No	`false`
domain_id	Integer	min: `0`, max: `127`	No	0
lb_id	Integer	min: `0`, max: `1023`	No	0

ptp (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	`true`, `false`	No	`false`
domain_id	Integer	min: `0`, max: `127`	No	0
lb_id	Integer	min: `0`, max: `1023`	No	0
vlan_id	Integer	min: `2`, max: `3967`	No

dns_servers (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
vrf	String		Yes

ntp_servers (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
vrf	String		Yes

syslog_servers (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory
ip_address	IP		Yes
vrf	String		Yes
severity	Integer	min: `0`, max: `7`	Yes

netflow (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	`true`, `false`	No	`false`
exporter	List	`[exporter]`	No
record	List	`[record]`	No
monitor	List	`[monitor]`	No

bootstrap (vxlan.global.ebgp)

Name	Type	Constraint	Mandatory	Default Value
enable_bootstrap	Boolean	`true`, `false`	No	`false`
enable_local_dhcp_server	Boolean	`true`, `false`	No	`false`
dhcp_version	Choice	`DHCPv4`, `DHCPv6`	No
dhcp_v4	Class	`[dhcp_v4]`	No
dhcp_v6	Class	`[dhcp_v6]`	No
enable_cdp_mgmt	Boolean	`true`, `false`	No	`false`
bootstrap_freeform	String		No

exporter (vxlan.global.ebgp.netflow)

Name	Type	Constraint	Mandatory
name	String		Yes
ip_address	IP		Yes
vrf	String		No
source_interface	String	Regex: `(?i)^(?:mgmt0\|(?:e\|eth(?:ernet)?)\d(?:/\d+){1,2}(?:\.\d{1,4})?)$`	Yes
udp_port	Integer	min: `1`, max: `65535`	Yes

exporter (vxlan.global.ebgp.netflow)

Name	Type	Constraint	Mandatory
name	String		Yes
ip_address	IP		Yes
vrf	String		No
source_interface	String	Regex: `(?i)^(?:e\|eth(?:ernet)?)\d(?:\/\d+){1,2}(\.\d{1,4})?$`	Yes
udp_port	Integer	min: `1`, max: `65535`	Yes

record (vxlan.global.ebgp.netflow)

Name	Type	Constraint	Mandatory
name	String		Yes
template	Choice	`netflow_ipv4_record`, `netflow_l2_record`	Yes
layer2	Boolean	`true`, `false`	No

monitor (vxlan.global.ebgp.netflow)

Name	Type	Mandatory
name	String	Yes
record	String	Yes
exporter1	String	Yes
exporter2	String	No

dhcp_v4 (vxlan.global.ebgp.bootstrap)

Name	Type	Constraint	Mandatory
scope_start_address	IP		Yes
scope_end_address	IP		Yes
switch_mgmt_default_gw	IP		Yes
mgmt_prefix	Integer	min: `8`, max: `30`	Yes
multi_subnet_scope	String		No
domain_name	String		No

dhcp_v6 (vxlan.global.ebgp.bootstrap)

Name	Type	Constraint	Mandatory
scope_start_address	IP		Yes
scope_end_address	IP		Yes
switch_mgmt_default_gw	IP		Yes
mgmt_prefix	Integer	min: `64`, max: `126`	Yes
multi_subnet_scope	String		No
domain_name	String		No

With release 0.5.1, the data model was updated under the global key to provide segmentation for the different fabric types that are supported to provide better clarity for applicable parameters and attributes for a given fabric type. The primary keys for fabric types that are directly under the global key are ibgp, ebgp, and external. For fabric types ibgp and external, keys that were available in 0.5.0 under the global key are maintained and mapped for backwards compatibility for the time being. For the ebgp fabric type, initial support started with the usage of the ebgp key under the global key directly. Users should target the global section of the data model to reference vxlan.global.ibgp, vxlan.global.ebgp, or vxlan.global.external going forward. With release 0.8.1, the ptp.vlan_id key has been removed from the data model for vxlan.global.ebgp, vxlan.global.external, and vxlan.multisite.isn as the PTP VLAN ID is not supported for these fabric types.

eBGP with Nexus Dashboard <= 4.1

For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.1 or earlier releases, refer to the Cisco ND BGP Fabric Documentation.

Basic eBGP Fabric Configuration

vxlan:
  fabric:
    name: ebgp-fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      leaf_same_bgp_asn: true
      anycast_gateway_mac: 20:20:00:00:00:aa
      layer2_vni_range:
        from: 30000
        to: 49000
      layer3_vni_range:
        from: 50000
        to: 59000
      layer2_vlan_range:
        from: 2300
        to: 2999
      layer3_vlan_range:
        from: 2000
        to: 2299
      vpc:
        peer_link_vlan: 3600
        peer_keep_alive: management
        auto_recovery_time: 360
        delay_restore_time: 150
        peer_link_port_channel_id: 500
        ipv6_nd_sync: false
        advertise_pip: true
        advertise_pip_border_only: false
        domain_id_range: 1-100
        advertise_pip_border_gateway: true
      snmp_server_host_trap: true
      auth_proto: MD5
      dns_servers:
        - ip_address: 10.200.253.13
        vrf: management
      ntp_servers:
        - ip_address: 10.200.253.13
        vrf: management
      syslog_servers:
        - ip_address: 10.200.253.19
        vrf: management
        severity: 4
      ptp:
        enable: true
        domain_id: 10
        lb_id: 0
      intra_fabric_link_freeform: |
        service-policy type qos input my_fabric_policy

Required Policies

With Nexus Dashboard 4.1 or earlier releases, eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.

1. Leaf BGP AS Policies

Each leaf switch must have a leaf_bgp_asn policy to specify its BGP AS number:

---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

2. Spine Switch Overlay Policies

For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:

ND overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.

Important: You must manually duplicate the following templates in ND:

ebgp_overlay_spine_all_neighbor → ebgp_overlay_spine_all_neighbor_custom
ebgp_overlay_leaf_all_neighbor → ebgp_overlay_leaf_all_neighbor_custom

This step is required before using these templates. For template management instructions, refer to the Cisco ND Templates Documentation.

The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”

policies:
  - name: ebgp_overlay_spine_all_neighbor_custom
    template_name: ebgp_overlay_spine_all_neighbor_custom
    template_vars:
      LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
      INTF_NAME: "Loopback0"
      LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

3. Leaf Switch Overlay Policies

For leaf switches, use the custom ebgp_overlay_leaf_all_neighbor_custom policy:

policies:
  - name: ebgp_overlay_leaf_all_neighbor_custom
    template_name: ebgp_overlay_leaf_all_neighbor_custom
    template_vars:
      SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
      INTF_NAME: "Loopback0"

Complete Policy Example

Here’s a complete example showing all required policies with proper priority settings:

---
vxlan:
  policy:
    policies:
      # Leaf BGP AS Policies
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

      # Spine Overlay Policy
      - name: ebgp_overlay_spine_all_neighbor_custom
        template_name: ebgp_overlay_spine_all_neighbor_custom
        template_vars:
          LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
          INTF_NAME: "Loopback0"
          LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

      # Leaf Overlay Policy
      - name: ebgp_overlay_leaf_all_neighbor_custom
        template_name: ebgp_overlay_leaf_all_neighbor_custom
        template_vars:
          SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
          INTF_NAME: "Loopback0"

    groups:
      - name: leaf_group
        policies:
          - name: bgp_as_policy_leaf
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_group
        policies:
          - name: bgp_as_policy_BGW
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_leaf
        policies:
          - name: bgp_as_policy_BL
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: spine_group
        policies:
          - name: ebgp_overlay_spine_all_neighbor_custom

    switches:
      - name: S1-S1
        groups:
          - spine_group
      - name: S1-S2
        groups:
          - spine_group
      - name: S1-L1
        groups:
          - leaf_group
      - name: S1-L2
        groups:
          - leaf_group
      - name: S1-BL1
        groups:
          - leaf_border_leaf
      - name: S1-BL2
        groups:
          - leaf_border_leaf
      - name: S1-BGW1
        groups:
          - leaf_border_group

eBGP with Nexus Dashboard >= 4.2

For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.2, refer to the Cisco ND Fabric Management Documentation.

Starting with release 4.2, Nexus Dashboard supports two new features for fabrics with eBGP overlay routing protocol:

BGP ASN Auto Allocation - Enables automated BGP ASN allocation for leaf switches, border devices, and border gateways in Multi-AS mode. Nexus Dashboard assigns unique ASNs from a pool. It cannot be enabled when ‘Allow same ASN on leafs’ is enabled. BGP ASN Auto Allocation is enabled by default.
Auto Config EVPN Overlay Peering - Automatically configures the eBGP EVPN overlay peerings. You do not need to manually configure the leaf and spine switch overlay policies anymore. Auto Config EVPN Overlay Peering is enabled by default. NaC VXLAN currently does not support to disable it.

With release 0.8.1, NaC VXLAN supports the following eBGP fabric scenarios with Nexus Dashboard 4.2 or later releases:

Multi-AS Mode with ASN Auto Allocation
Multi-AS Mode with Allow Same ASN On Leafs
Same-Tier-AS Mode

The following sections provide configuration examples for each of these scenarios.

Multi-AS Mode with ASN Auto Allocation

In a Multi-AS fabric, a unique AS number per leaf/border is used. BGP ASN Auto Allocation is enabled by default. Nexus Dashboard will automatically generate the BGP ASN range. The ‘Allow Same ASN On Leafs’ option must be set to false.

vxlan:
  fabric:
    name: eBGP-MultiAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      bgp_asn_auto_allocation: true
      leaf_same_bgp_asn: false
      anycast_gateway_mac: 20:20:00:00:00:aa

Multi-AS Mode with Allow Same ASN On Leafs

The ‘Allow Same ASN On Leafs’ option allows to use the same ASN on all leaf nodes even when you have configured Multi-AS mode. BGP ASN Auto Allocation must be disabled as ‘Allow Same ASN On Leafs’ and BGP ASN Auto Allocation are mutually exclusive.

vxlan:
  fabric:
    name: eBGP-MultiAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      bgp_asn_auto_allocation: false
      leaf_same_bgp_asn: true
      anycast_gateway_mac: 20:20:00:00:00:aa

Since BGP ASN Auto Allocation is disabled in this scenario, each leaf/border switch must have a leaf_bgp_asn policy to specify its BGP AS number:

---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

Same-Tier-AS Mode

In a Same-Tier-AS fabric, all leaf nodes share one unique AS and all border nodes share another unique AS. BGP ASN Auto Allocation does not apply in this scenario.

---
vxlan:
  fabric:
    name: eBGP-SameTierAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Same-Tier-AS
      leaf_bgp_asn: "65000.4"
      border_bgp_asn: "65000.22"
      anycast_gateway_mac: 20:20:00:00:00:aa

Switch Discovery Authentication Protocol

auth_proto selects the SNMPv3 authentication/privacy protocol that ND uses when discovering a switch for the first time. The default is MD5. The value applies to every switch in the fabric; it cannot be set per switch.

Value	Authentication	Privacy
`MD5`	MD5	—
`SHA`	SHA-1	—
`MD5_DES`	MD5	DES
`MD5_AES`	MD5	AES-128
`SHA_DES`	SHA-1	DES
`SHA_AES`	SHA-1	AES-128

NX-OS prerequisite: The SNMPv3 user must already exist on each switch with authentication and privacy algorithms that match the selected auth_proto. Create the local user once, then apply the single snmp-server user line for your chosen value:

username <USERNAME> password <PASSWORD> role network-admin

! Apply ONE of the following, matching the auth_proto value

! MD5 (default) — authentication only
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD>

! SHA — authentication only
snmp-server user <USERNAME> network-admin auth sha <PASSWORD>

! MD5_DES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv des <PASSWORD>

! MD5_AES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv aes-128 <PASSWORD>

! SHA_DES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv des <PASSWORD>

! SHA_AES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv aes-128 <PASSWORD>

Verify the result with show snmp user <USERNAME>. The Auth and Priv columns must match the table above.

The authentication and privacy passphrases must be identical. NaC sends a single password to ND, which uses it for both. Mismatched passphrases are the most common cause of notManageable and SNMPv3 timeouts during discovery.

Environment variables: ND uses NDFC_SW_USERNAME and NDFC_SW_PASSWORD to reach the switch during discovery. These values must match the <USERNAME> and <PASSWORD> used when configuring the SNMPv3 user on the switch.

SHA_AES Example

---
vxlan:
  fabric:
    name: myebgpfabric
    type: eBGP_VXLAN
  global:
    ebgp:
      auth_proto: SHA_AES
      spine_bgp_asn: "65000.3"
      bgp_asn_mode: Multi-AS
      anycast_gateway_mac: 20:20:00:00:00:aa

eBGP with Nexus Dashboard <= 4.1

For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.1 or earlier releases, refer to the Cisco NDFC BGP Fabric Documentation.

Basic eBGP Fabric Configuration

vxlan:
  fabric:
    name: ebgp-fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      leaf_same_bgp_asn: true
      anycast_gateway_mac: 20:20:00:00:00:aa
      layer2_vni_range:
        from: 30000
        to: 49000
      layer3_vni_range:
        from: 50000
        to: 59000
      layer2_vlan_range:
        from: 2300
        to: 2999
      layer3_vlan_range:
        from: 2000
        to: 2299
      vpc:
        peer_link_vlan: 3600
        peer_keep_alive: management
        auto_recovery_time: 360
        delay_restore_time: 150
        peer_link_port_channel_id: 500
        ipv6_nd_sync: false
        advertise_pip: true
        advertise_pip_border_only: false
        domain_id_range: 1-100
        advertise_pip_border_gateway: true
      snmp_server_host_trap: true
      auth_proto: MD5
      dns_servers:
        - ip_address: 10.200.253.13
        vrf: management
      ntp_servers:
        - ip_address: 10.200.253.13
        vrf: management
      syslog_servers:
        - ip_address: 10.200.253.19
        vrf: management
        severity: 4
      ptp:
        enable: true
        domain_id: 10
        lb_id: 0
      intra_fabric_link_freeform: |
        service-policy type qos input my_fabric_policy

Required Policies

With Nexus Dashboard 4.1 or earlier releases, eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.

1. Leaf BGP AS Policies

Each leaf switch must have a leaf_bgp_asn policy to specify its BGP AS number:

---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

2. Spine Switch Overlay Policies

For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:

NDFC overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.

Important: You must manually duplicate the following templates in NDFC:

ebgp_overlay_spine_all_neighbor → ebgp_overlay_spine_all_neighbor_custom
ebgp_overlay_leaf_all_neighbor → ebgp_overlay_leaf_all_neighbor_custom

This step is required before using these templates. For template management instructions, refer to the Cisco NDFC Templates Documentation.

The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”

policies:
  - name: ebgp_overlay_spine_all_neighbor_custom
    template_name: ebgp_overlay_spine_all_neighbor_custom
    template_vars:
      LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
      INTF_NAME: "Loopback0"
      LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

3. Leaf Switch Overlay Policies

For leaf switches, use the custom ebgp_overlay_leaf_all_neighbor_custom policy:

policies:
  - name: ebgp_overlay_leaf_all_neighbor_custom
    template_name: ebgp_overlay_leaf_all_neighbor_custom
    template_vars:
      SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
      INTF_NAME: "Loopback0"

Complete Policy Example

Here’s a complete example showing all required policies with proper priority settings:

---
vxlan:
  policy:
    policies:
      # Leaf BGP AS Policies
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

      # Spine Overlay Policy
      - name: ebgp_overlay_spine_all_neighbor_custom
        template_name: ebgp_overlay_spine_all_neighbor_custom
        template_vars:
          LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
          INTF_NAME: "Loopback0"
          LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

      # Leaf Overlay Policy
      - name: ebgp_overlay_leaf_all_neighbor_custom
        template_name: ebgp_overlay_leaf_all_neighbor_custom
        template_vars:
          SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
          INTF_NAME: "Loopback0"

    groups:
      - name: leaf_group
        policies:
          - name: bgp_as_policy_leaf
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_group
        policies:
          - name: bgp_as_policy_BGW
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_leaf
        policies:
          - name: bgp_as_policy_BL
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: spine_group
        policies:
          - name: ebgp_overlay_spine_all_neighbor_custom

    switches:
      - name: S1-S1
        groups:
          - spine_group
      - name: S1-S2
        groups:
          - spine_group
      - name: S1-L1
        groups:
          - leaf_group
      - name: S1-L2
        groups:
          - leaf_group
      - name: S1-BL1
        groups:
          - leaf_border_leaf
      - name: S1-BL2
        groups:
          - leaf_border_leaf
      - name: S1-BGW1
        groups:
          - leaf_border_group

eBGP with Nexus Dashboard >= 4.2

For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.2, refer to the Cisco ND Fabric Management Documentation.

Starting with release 4.2, Nexus Dashboard supports two new features for fabrics with eBGP overlay routing protocol:

BGP ASN Auto Allocation - Enables automated BGP ASN allocation for leaf switches, border devices, and border gateways in Multi-AS mode. Nexus Dashboard assigns unique ASNs from a pool. It cannot be enabled when ‘Allow same ASN on leafs’ is enabled. BGP ASN Auto Allocation is enabled by default.
Auto Config EVPN Overlay Peering - Automatically configures the eBGP EVPN overlay peerings. You do not need to manually configure the leaf and spine switch overlay policies anymore. Auto Config EVPN Overlay Peering is enabled by default. NaC VXLAN currently does not support to disable it.

With release 0.8.1, NaC VXLAN supports the following eBGP fabric scenarios with Nexus Dashboard 4.2 or later releases:

Multi-AS Mode with ASN Auto Allocation
Multi-AS Mode with Allow Same ASN On Leafs
Same-Tier-AS Mode

The following sections provide configuration examples for each of these scenarios.

Multi-AS Mode with ASN Auto Allocation

vxlan:
  fabric:
    name: eBGP-MultiAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      bgp_asn_auto_allocation: true
      leaf_same_bgp_asn: false
      anycast_gateway_mac: 20:20:00:00:00:aa

Multi-AS Mode with Allow Same ASN On Leafs

vxlan:
  fabric:
    name: eBGP-MultiAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Multi-AS
      bgp_asn_auto_allocation: false
      leaf_same_bgp_asn: true
      anycast_gateway_mac: 20:20:00:00:00:aa

Since BGP ASN Auto Allocation is disabled in this scenario, each leaf/border switch must have a leaf_bgp_asn policy to specify its BGP AS number:

---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

Same-Tier-AS Mode

In a Same-Tier-AS fabric, all leaf nodes share one unique AS and all border nodes share another unique AS. BGP ASN Auto Allocation does not apply in this scenario.

---
vxlan:
  fabric:
    name: eBGP-SameTierAS-Fabric
    type: eBGP_VXLAN
  global:
    ebgp:
      spine_bgp_asn: "65000.3"
      super_spine_bgp_asn: "65000.1"
      bgp_asn_mode: Same-Tier-AS
      leaf_bgp_asn: "65000.4"
      border_bgp_asn: "65000.22"
      anycast_gateway_mac: 20:20:00:00:00:aa

eBGP

For detailed information about eBGP fabric creation and deployment, refer to the Cisco NDFC BGP Fabric Documentation.

Basic eBGP Fabric Configuration

vxlan:
  fabric:
    name: ebgp-fabric
    type: eBGP_VXLAN
  global:
    ebgp:
        spine_bgp_asn: "65000.3"
        super_spine_bgp_asn: "65000.1"
        bgp_asn_mode: Multi-AS
        leaf_same_bgp_asn: true
        anycast_gateway_mac: 20:20:00:00:00:aa
        layer2_vni_range:
            from: 30000
            to: 49000
        layer3_vni_range:
            from: 50000
            to: 59000
        layer2_vlan_range:
            from: 2300
            to: 2999
        layer3_vlan_range:
            from: 2000
            to: 2299
        vpc:
            peer_link_vlan: 3600
            peer_keep_alive: management
            auto_recovery_time: 360
            delay_restore_time: 150
            peer_link_port_channel_id: 500
            ipv6_nd_sync: false
            advertise_pip: true
            advertise_pip_border_only: false
            domain_id_range: 1-100
            advertise_pip_border_gateway: true
        snmp_server_host_trap: true
        auth_proto: MD5
        dns_servers:
            - ip_address: 10.200.253.13
            vrf: management
        ntp_servers:
            - ip_address: 10.200.253.13
            vrf: management
        syslog_servers:
            - ip_address: 10.200.253.19
            vrf: management
            severity: 4
        intra_fabric_link_freeform: |
            service-policy type qos input my_fabric_policy

Required Policies

eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.

1. Leaf BGP AS Policies

Each leaf switch must have a leaf_bgp_asn policy to specify its BGP AS number:

---
vxlan:
  policy:
    policies:
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

2. Spine Switch Overlay Policies

For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:

Important: You must manually duplicate the following templates in NDFC:

ebgp_overlay_spine_all_neighbor → ebgp_overlay_spine_all_neighbor_custom
ebgp_overlay_leaf_all_neighbor → ebgp_overlay_leaf_all_neighbor_custom

This step is required before using these templates. For template management instructions, refer to the Cisco NDFC Templates Documentation.

The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”

policies:
  - name: ebgp_overlay_spine_all_neighbor_custom
    template_name: ebgp_overlay_spine_all_neighbor_custom
    template_vars:
      LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
      INTF_NAME: "Loopback0"
      LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

3. Leaf Switch Overlay Policies

For leaf switches, use the custom ebgp_overlay_leaf_all_neighbor_custom policy:

policies:
  - name: ebgp_overlay_leaf_all_neighbor_custom
    template_name: ebgp_overlay_leaf_all_neighbor_custom
    template_vars:
      SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
      INTF_NAME: "Loopback0"

Complete Policy Example

Here’s a complete example showing all required policies with proper priority settings:

---
vxlan:
  policy:
    policies:
      # Leaf BGP AS Policies
      - name: bgp_as_policy_leaf
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.4"
      - name: bgp_as_policy_BL
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.5"
      - name: bgp_as_policy_BGW
        template_name: leaf_bgp_asn
        template_vars:
          BGP_AS: "65000.22"

      # Spine Overlay Policy
      - name: ebgp_overlay_spine_all_neighbor_custom
        template_name: ebgp_overlay_spine_all_neighbor_custom
        template_vars:
          LEAF_IP_LIST: "10.12.0.249,10.12.0.199,10.12.0.198,10.12.0.254,10.12.0.253"
          INTF_NAME: "Loopback0"
          LEAF_ASNS: "65000.22,65000.4,65000.4,65000.5,65000.5"

      # Leaf Overlay Policy
      - name: ebgp_overlay_leaf_all_neighbor_custom
        template_name: ebgp_overlay_leaf_all_neighbor_custom
        template_vars:
          SPINE_IP_LIST: "10.12.0.229,10.12.0.239"
          INTF_NAME: "Loopback0"

    groups:
      - name: leaf_group
        policies:
          - name: bgp_as_policy_leaf
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_group
        policies:
          - name: bgp_as_policy_BGW
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: leaf_border_leaf
        policies:
          - name: bgp_as_policy_BL
          - name: ebgp_overlay_leaf_all_neighbor_custom
      - name: spine_group
        policies:
          - name: ebgp_overlay_spine_all_neighbor_custom

    switches:
      - name: S1-S1
        groups:
          - spine_group
      - name: S1-S2
        groups:
          - spine_group
      - name: S1-L1
        groups:
          - leaf_group
      - name: S1-L2
        groups:
          - leaf_group
      - name: S1-BL1
        groups:
          - leaf_border_leaf
      - name: S1-BL2
        groups:
          - leaf_border_leaf
      - name: S1-BGW1
        groups:
          - leaf_border_group