String[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]
For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.1 or earlier releases, refer to the Cisco ND BGP Fabric Documentation.
With Nexus Dashboard 4.1 or earlier releases, eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.
For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:
ND overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.
Important: You must manually duplicate the following templates in ND:
This step is required before using these templates. For template management instructions, refer to the Cisco ND Templates Documentation.
The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”
Starting with release 4.2, Nexus Dashboard supports two new features for fabrics with eBGP overlay routing protocol:
BGP ASN Auto Allocation - Enables automated BGP ASN allocation for leaf switches, border devices, and border gateways in Multi-AS mode. Nexus Dashboard assigns unique ASNs from a pool. It cannot be enabled when ‘Allow same ASN on leafs’ is enabled. BGP ASN Auto Allocation is enabled by default.
Auto Config EVPN Overlay Peering - Automatically configures the eBGP EVPN overlay peerings. You do not need to manually configure the leaf and spine switch overlay policies anymore. Auto Config EVPN Overlay Peering is enabled by default. NaC VXLAN currently does not support to disable it.
With release 0.8.1, NaC VXLAN supports the following eBGP fabric scenarios with Nexus Dashboard 4.2 or later releases:
Multi-AS Mode with ASN Auto Allocation
Multi-AS Mode with Allow Same ASN On Leafs
Same-Tier-AS Mode
The following sections provide configuration examples for each of these scenarios.
In a Multi-AS fabric, a unique AS number per leaf/border is used. BGP ASN Auto Allocation is enabled by default. Nexus Dashboard will automatically generate the BGP ASN range. The ‘Allow Same ASN On Leafs’ option must be set to false.
The ‘Allow Same ASN On Leafs’ option allows to use the same ASN on all leaf nodes even when you have configured Multi-AS mode. BGP ASN Auto Allocation must be disabled as ‘Allow Same ASN On Leafs’ and BGP ASN Auto Allocation are mutually exclusive.
global.nac.yaml
vxlan:
fabric:
name: eBGP-MultiAS-Fabric
type: eBGP_VXLAN
global:
ebgp:
spine_bgp_asn: "65000.3"
super_spine_bgp_asn: "65000.1"
bgp_asn_mode: Multi-AS
bgp_asn_auto_allocation: false
leaf_same_bgp_asn: true
anycast_gateway_mac: 20:20:00:00:00:aa
Since BGP ASN Auto Allocation is disabled in this scenario, each leaf/border switch must have a leaf_bgp_asn policy to specify its BGP AS number:
In a Same-Tier-AS fabric, all leaf nodes share one unique AS and all border nodes share another unique AS. BGP ASN Auto Allocation does not apply in this scenario.
auth_proto selects the SNMPv3 authentication/privacy protocol that ND uses when
discovering a switch for the first time. The default is MD5. The value applies to every
switch in the fabric; it cannot be set per switch.
Value
Authentication
Privacy
MD5
MD5
—
SHA
SHA-1
—
MD5_DES
MD5
DES
MD5_AES
MD5
AES-128
SHA_DES
SHA-1
DES
SHA_AES
SHA-1
AES-128
NX-OS prerequisite: The SNMPv3 user must already exist on each switch with
authentication and privacy algorithms that match the selected auth_proto. Create the local
user once, then apply the single snmp-server user line for your chosen value:
username <USERNAME> password <PASSWORD> role network-admin
! Apply ONE of the following, matching the auth_proto value
! MD5 (default) — authentication only
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD>
! SHA — authentication only
snmp-server user <USERNAME> network-admin auth sha <PASSWORD>
! MD5_DES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv des <PASSWORD>
! MD5_AES
snmp-server user <USERNAME> network-admin auth md5 <PASSWORD> priv aes-128 <PASSWORD>
! SHA_DES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv des <PASSWORD>
! SHA_AES
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv aes-128 <PASSWORD>
Verify the result with show snmp user <USERNAME>. The Auth and Priv columns must match
the table above.
The authentication and privacy passphrases must be identical. NaC sends a single
password to ND, which uses it for both. Mismatched passphrases are the most common
cause of notManageable and SNMPv3 timeouts during discovery.
Environment variables: ND uses NDFC_SW_USERNAME and NDFC_SW_PASSWORD to reach the
switch during discovery. These values must match the <USERNAME> and <PASSWORD> used when
configuring the SNMPv3 user on the switch.
String[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]
For detailed information about eBGP fabric creation and deployment with Nexus Dashboard 4.1 or earlier releases, refer to the Cisco NDFC BGP Fabric Documentation.
With Nexus Dashboard 4.1 or earlier releases, eBGP underlay deployment requires specific policies to be configured for proper underlay and overlay operation.
For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:
NDFC overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.
Important: You must manually duplicate the following templates in NDFC:
This step is required before using these templates. For template management instructions, refer to the Cisco NDFC Templates Documentation.
The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”
Starting with release 4.2, Nexus Dashboard supports two new features for fabrics with eBGP overlay routing protocol:
BGP ASN Auto Allocation - Enables automated BGP ASN allocation for leaf switches, border devices, and border gateways in Multi-AS mode. Nexus Dashboard assigns unique ASNs from a pool. It cannot be enabled when ‘Allow same ASN on leafs’ is enabled. BGP ASN Auto Allocation is enabled by default.
Auto Config EVPN Overlay Peering - Automatically configures the eBGP EVPN overlay peerings. You do not need to manually configure the leaf and spine switch overlay policies anymore. Auto Config EVPN Overlay Peering is enabled by default. NaC VXLAN currently does not support to disable it.
With release 0.8.1, NaC VXLAN supports the following eBGP fabric scenarios with Nexus Dashboard 4.2 or later releases:
Multi-AS Mode with ASN Auto Allocation
Multi-AS Mode with Allow Same ASN On Leafs
Same-Tier-AS Mode
The following sections provide configuration examples for each of these scenarios.
In a Multi-AS fabric, a unique AS number per leaf/border is used. BGP ASN Auto Allocation is enabled by default. Nexus Dashboard will automatically generate the BGP ASN range. The ‘Allow Same ASN On Leafs’ option must be set to false.
The ‘Allow Same ASN On Leafs’ option allows to use the same ASN on all leaf nodes even when you have configured Multi-AS mode. BGP ASN Auto Allocation must be disabled as ‘Allow Same ASN On Leafs’ and BGP ASN Auto Allocation are mutually exclusive.
global.nac.yaml
vxlan:
fabric:
name: eBGP-MultiAS-Fabric
type: eBGP_VXLAN
global:
ebgp:
spine_bgp_asn: "65000.3"
super_spine_bgp_asn: "65000.1"
bgp_asn_mode: Multi-AS
bgp_asn_auto_allocation: false
leaf_same_bgp_asn: true
anycast_gateway_mac: 20:20:00:00:00:aa
Since BGP ASN Auto Allocation is disabled in this scenario, each leaf/border switch must have a leaf_bgp_asn policy to specify its BGP AS number:
In a Same-Tier-AS fabric, all leaf nodes share one unique AS and all border nodes share another unique AS. BGP ASN Auto Allocation does not apply in this scenario.
String[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]
For spine switches, use the custom ebgp_overlay_spine_all_neighbor_custom policy:
NDFC overrides description fields during deployment for the standard ebgp_overlay_spine_all_neighbor as these overlay policies are part of core system overlay policies, which interferes with VXLAN as Code tracking using the policy description. Therefore, a custom version with a different template name is required.
Important: You must manually duplicate the following templates in NDFC:
This step is required before using these templates. For template management instructions, refer to the Cisco NDFC Templates Documentation.
The LEAF_IP_LIST has the loopback0 addresses of leaf switches, and LEAF_ASNS has their ASN numbers. For instance, the leaf with loopback0 IP 10.12.0.249 has the ASN number “65000.22.”
