Skip to content

Multisite

Diagram
NameTypeConstraintMandatoryDefault Value
multisiteClass[multisite]No

NameTypeConstraintMandatoryDefault Value
child_fabricsList[child_fabrics]No
layer2_vni_rangeClass[layer2_vni_range]No
layer3_vni_rangeClass[layer3_vni_range]No
overlayClass[overlay]No
anycast_gateway_macAnyString[Regex: ^[a-f0-9]{1}\.[a-f0-9]{1}\.[a-f0-9]{1}$] or String[Regex: ^[a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}$] or String[Regex: ^[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}$] or String[Regex: ^[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}$]No20:20:00:00:00:aa
vtep_loopback_idIntegermin: 0, max: 1023No100
bgw_ip_tagIntegermin: 0, max: 4294967295No54321
overlay_dciClass[overlay_dci]No
ipv4_vtep_loopback_rangeIPNo10.10.0.0/24
isnClass[isn]No

NameTypeConstraintMandatoryDefault Value
nameStringYes
bgw_anycast_vip_ipv4IPNo
clusterStringNo

NameTypeConstraintMandatoryDefault Value
fromIntegermin: 1, max: 16777214Yes30000
toIntegermin: 1, max: 16777214No49000

NameTypeConstraintMandatoryDefault Value
vrfsList[vrfs]No
networksList[networks]No
vrf_attach_groupsList[vrf_attach_groups]No
network_attach_groupsList[network_attach_groups]No

NameTypeConstraintMandatoryDefault Value
deployment_methodChoiceManual, Centralized_To_Route_Server, Direct_To_BGWSNoDirect_To_BGWS
ipv4_dci_subnet_rangeIPNo10.10.1.0/24
ipv4_dci_subnet_maskIntegermin: 8, max: 31No30
route_serverClass[route_server]No
underlay_autoconfigBooleantrue, falseNotrue
enable_bgp_send_communityBooleantrue, falseNofalse
enable_bgp_log_neighbor_changeBooleantrue, falseNofalse
enable_bgp_bfdBooleantrue, falseNofalse
delay_restoreIntegermin: 30, max: 1000No300
enable_ebgp_passwordBooleantrue, falseNofalse
ebgp_passwordStringNo
ebgp_password_encryption_typeChoice3, 7No
enable_trmBooleantrue, falseNofalse

NameTypeConstraintMandatoryDefault Value
bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$Yes
auth_protoChoiceMD5, SHA, MD5_DES, MD5_AES, SHA_DES, SHA_AESNoMD5
sub_int_rangeStringNo2-511
enable_nxapi_httpBooleantrue, falseNofalse
nxapi_http_portIntegerNo80
enable_nxapi_httpsBooleantrue, falseNotrue
nxapi_https_portIntegerNo443
ptpClass[ptp]No
netflowClass[netflow]No
bootstrapClass[bootstrap]No

NameTypeConstraintMandatoryDefault Value
nameStringYes
vrf_idIntegermin: 1, max: 16777214No
vlan_idIntegermin: 1, max: 4094No
vrf_vlan_nameStringNo
vrf_intf_descStringNoConfigured by Ansible NetAsCode
vrf_descriptionStringNoConfigured by Ansible NetAsCode
vrf_int_mtuIntegermin: 1500, max: 9216No9216
loopback_route_tagIntegermin: 0, max: 4294967295No12345
max_bgp_pathsIntegermin: 1, max: 128No1
max_ibgp_pathsIntegermin: 1, max: 128No2
ipv6_linklocal_enableBooleantrue, falseNotrue
disable_rt_autoBooleantrue, falseNofalse
export_evpn_rtStringNo
export_vpn_rtStringNo
import_evpn_rtStringNo
import_vpn_rtStringNo
redist_direct_routemapStringNoFABRIC-RMAP-REDIST-SUBNET
ipv6_redist_direct_routemapStringNoFABRIC-RMAP-REDIST-SUBNET
child_fabricsList[child_fabrics]No
vrf_attach_groupStringNo

NameTypeConstraintMandatoryDefault Value
nameStringYes
is_l2_onlyBooleantrue, falseNofalse
vrf_nameStringNo
net_idIntegermin: 1, max: 16777214No
vlan_idIntegermin: 1, max: 4094No
vlan_nameStringNo
int_descStringNo
gw_ip_addressIPNo
gw_ipv6_addressStringNo
secondary_ip_addressesList[secondary_ip_addresses]No
mtu_l3intfIntegerNo9216
route_tagIntegermin: 0, max: 4294967295No12345
arp_suppressBooleantrue, falseNofalse
route_target_bothBooleantrue, falseNofalse
child_fabricsList[child_fabrics]No
network_attach_groupStringNo

vrf_attach_groups (vxlan.multisite.overlay)

Section titled “vrf_attach_groups (vxlan.multisite.overlay)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
switchesList[switches]No

network_attach_groups (vxlan.multisite.overlay)

Section titled “network_attach_groups (vxlan.multisite.overlay)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
switchesList[switches]No

route_server (vxlan.multisite.overlay_dci)

Section titled “route_server (vxlan.multisite.overlay_dci)”
NameTypeConstraintMandatoryDefault Value
peersList[peers]No
redistribute_directBooleantrue, falseNofalse
ip_tagIntegermin: 0, max: 4294967295No54321

NameTypeConstraintMandatoryDefault Value
enableBooleantrue, falseNofalse
domain_idIntegermin: 0, max: 127No0
lb_idIntegermin: 0, max: 1023No0
vlan_idIntegermin: 2, max: 3967No

NameTypeConstraintMandatoryDefault Value
enableBooleantrue, falseNofalse
exporterList[exporter]No
recordList[record]No
monitorList[monitor]No

NameTypeConstraintMandatoryDefault Value
enable_bootstrapBooleantrue, falseNofalse
enable_local_dhcp_serverBooleantrue, falseNofalse
dhcp_versionChoiceDHCPv4, DHCPv6No
dhcp_v4Class[dhcp_v4]No
dhcp_v6Class[dhcp_v6]No
enable_cdp_mgmtBooleantrue, falseNo
bootstrap_freeformStringNo

child_fabrics (vxlan.multisite.overlay.vrfs)

Section titled “child_fabrics (vxlan.multisite.overlay.vrfs)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
adv_host_routesBooleantrue, falseNo
adv_default_routesBooleantrue, falseNo
static_default_routeBooleantrue, falseNo
bgp_passwordStringNo
bgp_password_encryption_typeChoice3, 7No
netflow_enableBooleantrue, falseNo
netflow_monitorStringNo
trm_enableBooleantrue, falseNo
trm_bgw_msiteBooleantrue, falseNo
enable_l3_vni_no_vlanBooleantrue, falseNo
no_rpBooleantrue, falseNo
rp_externalBooleantrue, falseNo
rp_addressIPNo
rp_loopback_idIntegermin: 0, max: 1023No
underlay_mcast_ipIPNo
overlay_multicast_groupStringNo
import_mvpn_rtStringNo
export_mvpn_rtStringNo

secondary_ip_addresses (vxlan.multisite.overlay.networks)

Section titled “secondary_ip_addresses (vxlan.multisite.overlay.networks)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
route_tagIntegermin: 0, max: 4294967295No

child_fabrics (vxlan.multisite.overlay.networks)

Section titled “child_fabrics (vxlan.multisite.overlay.networks)”
NameTypeConstraintMandatoryDefault Value
nameStringYes
dhcp_loopback_idIntegermin: 0, max: 1023No
dhcp_serversList[dhcp_servers]No
multicast_group_addressIPNo
trm_enableBooleantrue, falseNo
netflow_enableBooleantrue, falseNo
vlan_netflow_monitorStringNo
l3gw_on_borderBooleantrue, falseNo

switches (vxlan.multisite.overlay.vrf_attach_groups)

Section titled “switches (vxlan.multisite.overlay.vrf_attach_groups)”
NameTypeConstraintMandatoryDefault Value
hostnameStringYes
loopback_idIntegermin: 0, max: 1023No
loopback_ipv4IPNo
loopback_ipv6IPNo
freeform_configStringNo

switches (vxlan.multisite.overlay.network_attach_groups)

Section titled “switches (vxlan.multisite.overlay.network_attach_groups)”
NameTypeConstraintMandatoryDefault Value
hostnameStringYes
portsListString[Regex: (?i)^(?:e|eth(?:ernet)?)((\d)/\d{1,3})$|^(?:po|port-channel)([1-9]|[1-9][0-9]{1,2}|[1-3][0-9]{3}|40[0-8][0-9]|409[0-6])$]No

peers (vxlan.multisite.overlay_dci.route_server)

Section titled “peers (vxlan.multisite.overlay_dci.route_server)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
bgp_asnStringRegex: ^(?:\d{1,10}|\d{1,5}\.\d{1,5})$Yes

NameTypeConstraintMandatoryDefault Value
nameStringYes
ip_addressIPYes
vrfStringNo
source_interfaceStringRegex: (?i)^(?:e|eth(?:ernet)?)\d(?:\/\d+){1,2}(\.\d{1,4})?$Yes
udp_portIntegermin: 1, max: 65535Yes

NameTypeConstraintMandatoryDefault Value
nameStringYes
templateChoicenetflow_ipv4_record, netflow_l2_recordYes
layer2Booleantrue, falseNo

NameTypeConstraintMandatoryDefault Value
nameStringYes
recordStringYes
exporter1StringYes
exporter2StringNo

NameTypeConstraintMandatoryDefault Value
scope_start_addressIPYes
scope_end_addressIPYes
switch_mgmt_default_gwIPYes
mgmt_prefixIntegermin: 8, max: 30Yes
multi_subnet_scopeStringNo
domain_nameStringNo

NameTypeConstraintMandatoryDefault Value
scope_start_addressIPYes
scope_end_addressIPYes
switch_mgmt_default_gwIPYes
mgmt_prefixIntegermin: 64, max: 126Yes
multi_subnet_scopeStringNo
domain_nameStringNo

dhcp_servers (vxlan.multisite.overlay.networks.child_fabrics)

Section titled “dhcp_servers (vxlan.multisite.overlay.networks.child_fabrics)”
NameTypeConstraintMandatoryDefault Value
ip_addressIPYes
vrfStringYes

To manage an MSD Fabric, you need to follow this process:

Step 1 - Create your child fabrics. In this example, we have four (4) childs fabrics:

  • nac-ndfc1
  • nac-ndfc2
  • nac-ndfc3
  • nac-isn

Each fabric has their own data source under host_vars.

host_vars directories
tree -L1 host_vars
host_vars
├── nac-isn
├── nac-msd
├── nac-ndfc1
├── nac-ndfc2
└── nac-ndfc3
inventory.yaml
❯ cat inventory.yaml
---
all:
children:
ndfc:
hosts:
nac-isn:
ansible_host: 10.x.x.x
nac-msd:
ansible_host: 10.x.x.x
nac-ndfc1:
ansible_host: 10.x.x.x
nac-ndfc2:
ansible_host: 10.x.x.x
nac-ndfc3:
ansible_host: 10.x.x.x

Step 2 - Create the MSD fabric, which includes child fabrics.

Figure: MultiSite topology overview

In this example, we have a fabric named nac-msd. In this MSD fabric, all fabrics use the same anycast gateway mac: DE:AD:BE:EF:FE:ED. The loopback ID used for the Anycast IP configured on each Border Gateway is: 100 and the subnet used to allocate an IP is: 10.10.0.0/24.

This configuration uses external ISN devices as the Route Server. In this configuration there are four (4) IP addresses:

  • 100.64.0.1
  • 100.64.0.2
  • 100.64.0.3
  • 100.64.0.4

Each IP will be associated to an Autonomous System (ASN), which can be different for each Route Server. In this example, all Route Servers will use the ASN 65000.100. When underlay_autoconfig is true, you need to provide a subnet for the DCI point-to-point (p2p) connection(s). Here we used the subnet 10.10.1.0/24. Each p2p will used CIDR /30.

The value in bgp_asn should between double quotes. Example:

global:
bgp_asn: "6512"
global:
bgp_asn: "65000.1"
global.nac.yaml
---
vxlan:
fabric:
name: nac-msd
type: MSD
multisite:
child_fabrics:
- name: nac-ndfc1
- name: nac-ndfc2
- name: nac-ndfc3
- name: nac-isn
anycast_gateway_mac: de:ad:be:ef:fe:ed
bgw_ip_tag: 54321
vtep_loopback_id: 100
ipv4_vtep_loopback_range: 10.10.0.0/24
overlay_dci:
underlay_autoconfig: true
deployment_method: 'Centralized_To_Route_Server'
ipv4_dci_subnet_range: 10.10.1.0/24
ipv4_dci_subnet_mask: 30
route_server:
peers:
- ip_address: 100.64.0.1
bgp_asn: "65000.100" # Use quotes
- ip_address: 100.64.0.2
bgp_asn: "65000.100" # Use quotes
- ip_address: 100.64.0.3
bgp_asn: "65000.100" # Use quotes
- ip_address: 100.64.0.4
bgp_asn: "65000.100" # Use quotes
redistribute_direct: false
ip_tag: 54321
enable_bgp_bfd: false
enable_bgp_log_neighbor_change: true
enable_bgp_send_community: true
enable_ebgp_password: false
enable_trm: false
delay_restore: 300

Starting with release 0.4.3, we are introducing a new key, vxlan.multisite.child_fabrics.bgw_anycast_vip_ipv4, which allows you to configure a custom Virtual IP (VIP) address or anycast IP for the Border Gateway. This key is utilized only when vxlan.underlay.general.manual_underlay_allocation is set to true for at least one child fabric.

---
vxlan:
fabric:
name: nac-msd
type: MSD
multisite:
child_fabrics:
- name: nac-ndfc1
bgw_anycast_vip_ipv4: 100.66.1.1
- name: nac-ndfc2
bgw_anycast_vip_ipv4: 100.66.1.2
- name: nac-ndfc3
bgw_anycast_vip_ipv4: 100.66.1.3
- name: nac-isn

This fabric named nac-isn, uses a fabric type: ISN. Here, we must configure an ASN. In addition we can add a range of vlan for sub-interface.

global.nac.yaml
---
vxlan:
fabric:
name: nac-isn
type: ISN
multisite:
isn:
bgp_asn: "65000.100" # Use quotes
sub_int_range: 2-511

Example 1:

vrfs.nac.yaml
vxlan:
multisite:
overlay:
vrfs:
# simple example
- vrf_name: NetAsCodeVrf1
vrf_id: 150001
vlan_id: 2001
attach_group: NetAsCodeVrf1_AttachGroup
vrf_attach_groups:
- name: NetAsCodeVrf1_AttachGroup
switches:
- hostname: dc1-leaf1
- hostname: dc1-leaf2

Example 1 - Layer2 network:

networks.nac.yaml
vxlan:
multisite:
overlay:
networks:
# simple example
- name: NetworkDMZ
is_l2_only: true
net_id: 33100
vlan_id: 3100
attach_group: dmz
network_attach_groups:
- name: dmz
switches:
- hostname: dc1-leaf1
ports:
- Ethernet1/23
- Ethernet1/24
- hostname: dc1-leaf2
ports:
- Ethernet1/23
- Ethernet1/24

Example 2 - Layer3 network:

This section defines a Layer 3 network with IPv4 and IPv6 gateway addresses that spans multiple child fabrics in a Multi-Site deployment. The Network_53001 configuration establishes a distributed SVI (Switch Virtual Interface) across both nac-ndfc1 and nac-ndfc2 fabrics, associated with NaC-VRF1. Each child fabric is configured with the same multicast group address for BUM (Broadcast, Unknown unicast, Multicast) traffic handling, and the l3gw_on_border: true parameter enables Layer 3 gateway functionality on the border leaf switches. This creates a stretched Layer 3 network where the gateway IP addresses (10.0.1.1/24 for IPv4 and 2001:0db8:0001:0000:0000:0000:0000:0001/64 for IPv6) are active on border devices in both data centers, providing localized gateway services and optimal traffic flow for hosts connected to this network segment.

networks.nac.yaml
---
vxlan:
multisite:
overlay:
networks:
- name: Network_53001
vrf_name: NaC-VRF1
vlan_name: Network_530001_vlan3001_VRF-NaC-VRF1-Subnet_10.0.1.0_24
int_desc: "SVI_Net_53001_VRF-NaC-VRF1-Subnet_10.0.1.0_24"
net_id: 53001
vlan_id: 3001
gw_ip_address: "10.0.1.1/24"
gw_ipv6_address: "2001:0db8:0001:0000:0000:0000:0000:0001/64"
child_fabrics:
- name: nac-ndfc1
multicast_group_address: 239.2.1.0
l3gw_on_border: true
- name: nac-ndfc2
multicast_group_address: 239.2.1.0
l3gw_on_border: true
network_attach_group: Network_53001_AttGrp

Managing Multi-Cluster Fabrics Groups (MCFG) follow the same steps of managing an MSD Fabric. Additional keys and value must be defined in the data model and on the inventory file. In this example we have a fabric named nac-mcfg. This fabric is similar as the MSD example, the main difference is that nac-ndfc1 and nac-ndfc2 child fabrics are managed by nd-cluster-1 while nac-ndfc3 and nac-isn are managed by nd-cluster-2.

global.nac.yaml
---
vxlan:
fabric:
name: nac-mcfg
type: MCFG
multisite:
child_fabrics:
- name: nac-ndfc1
cluster: nd-cluster-1
- name: nac-ndfc2
cluster: nd-cluster-1
- name: nac-ndfc3
cluster: nd-cluster-2
- name: nac-isn
cluster: nd-cluster-2
anycast_gateway_mac: de:ad:be:ef:fe:ed

MCFG uses a feature called One Manage. This features requires remote authentication, which means that the inventory file must be updated to reflect the multiple clusters.

For detailed information about One Manage, refer to the Cisco NDFC One Manage Documentation.

inventory.yaml
❯ cat inventory.yaml
---
all:
children:
ndfc:
hosts:
nac-ndfc1:
ansible_host: 10.x.x.x
nac-ndfc2:
ansible_host: 10.x.x.x
nac-ndfc3:
ansible_host: 10.y.y.y
nac-isn:
ansible_host: 10.y.y.y
nac-mcfg:
ansible_host: 10.x.x.x
ansible_httpapi_login_domain: LOGIN_DOMAIN