Network

The Network configuration section of the Data Model defines how to create networks and update supported network parameters.

From the network section, you can perform some of, but not limited to, the following operations:

• Creating a new network
• Modifying supported settings of an existing network such as VLAN ID, VLAN name, VLAN/SVI interface description, gateway settings, DHCP relay settings, and attachments
• Associating a network with specific switches and switchports in the fabric

After a network is created, name (the data model key used to identify the network) and net_id (VXLAN L2VNID / VNI) cannot be updated. If either value needs to change, delete and recreate the network.

This does not prevent updates to supported switch-facing values such as VLAN ID, vlan_name, VLAN/SVI interface description (int_desc), gateway settings, DHCP relay settings, or attachments.

Diagram

Classes

overlay (vxlan)

Name	Type	Constraint	Mandatory	Default Value
networks	List	[networks]	No
network_attach_groups	List	[network_attach_groups]	No

networks (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
is_l2_only	Boolean	true, false	No	false
vrf_name	String		No
net_id	Integer	min: 1, max: 16777214	No
vlan_id	Integer	min: 1, max: 4094	No
vlan_name	String		No
int_desc	String		No
gw_ip_address	IP		No
gw_ipv6_address	String		No
secondary_ip_addresses	List	[secondary_ip_addresses]	No
mtu_l3intf	Integer		No	9216
l3gw_on_border	Boolean	true, false	No	false
route_tag	Integer	min: 0, max: 4294967295	No	12345
multicast_group_address	IP		No	239.1.1.1
arp_suppress	Boolean	true, false	No	false
route_target_both	Boolean	true, false	No	false
dhcp_loopback_id	Integer	min: 0, max: 1023	No
dhcp_servers	List	[dhcp_servers]	No
netflow_enable	Boolean	true, false	No	false
vlan_netflow_monitor	String		No
trm_enable	Boolean	true, false	No	false
xconnect	Boolean	true, false	No	false
network_attach_group	String		No
switch_attach_overrides	List	[switch_attach_overrides]	No

network_attach_groups (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
switches	List	[switches]	No

secondary_ip_addresses (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
route_tag	Integer	min: 0, max: 4294967295	No

dhcp_servers (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
vrf	String		Yes

switch_attach_overrides (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
vlan_id	Integer	min: 1, max: 4094	No
freeform_config	String		No
svi_enabled	Boolean	true, false	No

switches (vxlan.overlay.network_attach_groups)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
ports	List	String[Regex: (?i)^(?:e|eth(?:ernet)?)((\d)/\d{1,3})$|^(?:po|port-channel)([1-9]|[1-9][0-9]{1,2}|[1-3][0-9]{3}|40[0-8][0-9]|409[0-6])$]	No

Examples

The following configuration creates 2 networks: NetworkDMZ and Network1:

• NetworkDMZ is created as a L2 Only network (no unicast routing). It is assigned a VXLAN L2VNID of 33100, and a VLAN ID of 3100. It is associated with a network_attach_group called ‘dmz’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Ethernet1/23 and Ethernet1/24 ports of both switches.
• Network1 is created as a routed network (unicast routing enabled). It is associated with the VrfRed VRF. It is assigned a VXLAN L2VNID of 30100, and a VLAN ID of 100. The network is assigned a GW IP address of 192.168.10.1/24 with a route tag of 12345. It is associated with a ‘network_attach_group’ called ‘esxi’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Port-channel10, Port-channel20, Port-channel30 and Port-channel40 of both switches.

The network_attach_group object helps create a mapping of switches and switchports to be associated with one or more networks.

Note

Full interface names should be provided in the network_attach_group > switches > ports

overlay_networks.nac.yaml

vxlan:
  overlay:
    networks:
        # simple example
      - name: NetworkDMZ
        is_l2_only: true
        net_id: 33100
        vlan_id: 3100
        network_attach_group: dmz
        # full example
      - name: Network1
        is_l2_only: false
        vrf_name: VrfRed
        net_id: 30100
        vlan_id: 100
        vlan_name: Network1
        gw_ip_address: 192.168.10.1/24
        arp_suppress: false
        dhcp_loopback_id: 100
        dhcp_servers:
          - ip_address: 10.125.10.100
            vrf: VrfRed
          - ip_address: 10.125.10.101
            vrf: VrfRed
        gw_ipv6_address: 203e:10:15:10::1/128
        int_desc: Network1
        l3gw_on_border: true
        mtu_l3intf: 9216
        multicast_group_address: 239.1.1.1
        netflow_enable: false
        route_target_both: true
        route_tag: 12345
        secondary_ip_addresses:
          - ip_address: 192.168.11.1/24
            route_tag: 54321
        trm_enable: true
        vlan_netflow_monitor: test
        network_attach_group: esxi
    network_attach_groups:
      - name: esxi
        switches:
          - hostname: dc1-leaf1
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
          - hostname: dc1-leaf2
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
      - name: dmz
        switches:
          - hostname: dc1-leaf1
            ports:
              - Ethernet1/23
              - Ethernet1/24
          - hostname: dc1-leaf2
            ports:
              - Ethernet1/23
              - Ethernet1/24

Enabling Removal Operations (using Ansible)

By default, network removal is disabled for safety. To enable automatic removal:

network_delete_mode: true

Caution

When network_delete_mode: true, removing a network from your configuration will automatically delete it from NDFC on the next playbook run.

The Network configuration section of the Data Model defines how to create networks and update supported network parameters.

From the network section, you can perform some of, but not limited to, the following operations:

• Creating a new network
• Modifying supported settings of an existing network such as VLAN ID, VLAN name, VLAN/SVI interface description, gateway settings, DHCP relay settings, and attachments
• Associating a network with specific switches and switchports in the fabric

After a network is created, name (the data model key used to identify the network) and net_id (VXLAN L2VNID / VNI) cannot be updated. If either value needs to change, delete and recreate the network.

This does not prevent updates to supported switch-facing values such as VLAN ID, vlan_name, VLAN/SVI interface description (int_desc), gateway settings, DHCP relay settings, or attachments.

Diagram

Classes

overlay (vxlan)

Name	Type	Constraint	Mandatory	Default Value
networks	List	[networks]	No
network_attach_groups	List	[network_attach_groups]	No

networks (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
is_l2_only	Boolean	true, false	No	false
vrf_name	String		No
net_id	Integer	min: 1, max: 16777214	No
vlan_id	Integer	min: 1, max: 4094	No
vlan_name	String		No
int_desc	String		No
gw_ip_address	IP		No
gw_ipv6_address	String		No
secondary_ip_addresses	List	[secondary_ip_addresses]	No
mtu_l3intf	Integer		No	9216
l3gw_on_border	Boolean	true, false	No	false
route_tag	Integer	min: 0, max: 4294967295	No	12345
multicast_group_address	IP		No	239.1.1.1
arp_suppress	Boolean	true, false	No	false
route_target_both	Boolean	true, false	No	false
dhcp_loopback_id	Integer	min: 0, max: 1023	No
dhcp_servers	List	[dhcp_servers]	No
netflow_enable	Boolean	true, false	No	false
vlan_netflow_monitor	String		No
trm_enable	Boolean	true, false	No	false
network_attach_group	String		No

network_attach_groups (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
switches	List	[switches]	No

secondary_ip_addresses (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
route_tag	Integer	min: 0, max: 4294967295	No

dhcp_servers (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
vrf	String		Yes

switches (vxlan.overlay.network_attach_groups)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
ports	List	String[Regex: (?i)^(?:e|eth(?:ernet)?)((\d)/\d{1,3})$|^(?:po|port-channel)([1-9]|[1-9][0-9]{1,2}|[1-3][0-9]{3}|40[0-8][0-9]|409[0-6])$]	No

Examples

The following configuration creates 2 networks: NetworkDMZ and Network1:

• NetworkDMZ is created as a L2 Only network (no unicast routing). It is assigned a VXLAN L2VNID of 33100, and a VLAN ID of 3100. It is associated with a network_attach_group called ‘dmz’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Ethernet1/23 and Ethernet1/24 ports of both switches.
• Network1 is created as a routed network (unicast routing enabled). It is associated with the VrfRed VRF. It is assigned a VXLAN L2VNID of 30100, and a VLAN ID of 100. The network is assigned a GW IP address of 192.168.10.1/24 with a route tag of 12345. It is associated with a ‘network_attach_group’ called ‘esxi’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Port-channel10, Port-channel20, Port-channel30 and Port-channel40 of both switches.

The network_attach_group object helps create a mapping of switches and switchports to be associated with one or more networks.

Note

Full interface names should be provided in the network_attach_group > switches > ports

overlay_networks.nac.yaml

vxlan:
  overlay:
    networks:
        # simple example
      - name: NetworkDMZ
        is_l2_only: true
        net_id: 33100
        vlan_id: 3100
        network_attach_group: dmz
        # full example
      - name: Network1
        is_l2_only: false
        vrf_name: VrfRed
        net_id: 30100
        vlan_id: 100
        vlan_name: Network1
        gw_ip_address: 192.168.10.1/24
        arp_suppress: false
        dhcp_loopback_id: 100
        dhcp_servers:
          - ip_address: 10.125.10.100
            vrf: VrfRed
          - ip_address: 10.125.10.101
            vrf: VrfRed
        gw_ipv6_address: 203e:10:15:10::1/128
        int_desc: Network1
        l3gw_on_border: true
        mtu_l3intf: 9216
        multicast_group_address: 239.1.1.1
        netflow_enable: false
        route_target_both: true
        route_tag: 12345
        secondary_ip_addresses:
          - ip_address: 192.168.11.1/24
            route_tag: 54321
        trm_enable: true
        vlan_netflow_monitor: test
        network_attach_group: esxi
    network_attach_groups:
      - name: esxi
        switches:
          - hostname: dc1-leaf1
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
          - hostname: dc1-leaf2
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
      - name: dmz
        switches:
          - hostname: dc1-leaf1
            ports:
              - Ethernet1/23
              - Ethernet1/24
          - hostname: dc1-leaf2
            ports:
              - Ethernet1/23
              - Ethernet1/24

Enabling Removal Operations (using Ansible)

By default, network removal is disabled for safety. To enable automatic removal:

network_delete_mode: true

Caution

When network_delete_mode: true, removing a network from your configuration will automatically delete it from NDFC on the next playbook run.

The Network configuration section of the Data Model defines how to create/modify networks, and their associated parameters.

From the network section, you can perform some of, but not limited to, the following operations:

• Creating a new network
• Modifying settings of an existing network such as name, associated VRF, VXLAN L2VNID, VLAN ID
• Associating a network with specific switches and switchports in the fabric

Diagram

Classes

overlay (vxlan)

Name	Type	Constraint	Mandatory	Default Value
networks	List	[networks]	No
network_attach_groups	List	[network_attach_groups]	No

networks (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
is_l2_only	Boolean	true, false	No	false
vrf_name	String		No
net_id	Integer	min: 1, max: 16777214	No
vlan_id	Integer	min: 1, max: 4094	No
vlan_name	String		No
int_desc	String		No
gw_ip_address	IP		No
gw_ipv6_address	String		No
secondary_ip_addresses	List	[secondary_ip_addresses]	No
mtu_l3intf	Integer		No	9216
l3gw_on_border	Boolean	true, false	No	false
route_tag	Integer	min: 0, max: 4294967295	No	12345
multicast_group_address	IP		No	239.1.1.1
arp_suppress	Boolean	true, false	No	false
route_target_both	Boolean	true, false	No	false
dhcp_loopback_id	Integer	min: 0, max: 1023	No
dhcp_servers	List	[dhcp_servers]	No
netflow_enable	Boolean	true, false	No	false
vlan_netflow_monitor	String		No
trm_enable	Boolean	true, false	No	false
network_attach_group	String		No

network_attach_groups (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
switches	List	[switches]	No

secondary_ip_addresses (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
route_tag	Integer	min: 0, max: 4294967295	No

dhcp_servers (vxlan.overlay.networks)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		Yes
vrf	String		Yes

switches (vxlan.overlay.network_attach_groups)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
ports	List	String[Regex: (?i)^(?:e|eth(?:ernet)?)((\d)/\d{1,3})$|^(?:po|port-channel)([1-9]|[1-9][0-9]{1,2}|[1-3][0-9]{3}|40[0-8][0-9]|409[0-6])$]	No

Examples

The following configuration creates 2 networks: NetworkDMZ and Network1:

• NetworkDMZ is created as a L2 Only network (no unicast routing). It is assigned a VXLAN L2VNID of 33100, and a VLAN ID of 3100. It is associated with a network_attach_group called ‘dmz’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Ethernet1/23 and Ethernet1/24 ports of both switches.
• Network1 is created as a routed network (unicast routing enabled). It is associated with the VrfRed VRF. It is assigned a VXLAN L2VNID of 30100, and a VLAN ID of 100. The network is assigned a GW IP address of 192.168.10.1/24 with a route tag of 12345. It is associated with a ‘network_attach_group’ called ‘esxi’, which will deploy this network on the dc1-leaf1 and dc1-leaf2 switches, and allows the network on the Port-channel10, Port-channel20, Port-channel30 and Port-channel40 of both switches.

The network_attach_group object helps create a mapping of switches and switchports to be associated with one or more networks.

Note

Full interface names should be provided in the network_attach_group > switches > ports

overlay_networks.nac.yaml

vxlan:
  overlay:
    networks:
        # simple example
      - name: NetworkDMZ
        is_l2_only: true
        net_id: 33100
        vlan_id: 3100
        network_attach_group: dmz
        # full example
      - name: Network1
        is_l2_only: false
        vrf_name: VrfRed
        net_id: 30100
        vlan_id: 100
        vlan_name: Network1
        gw_ip_address: 192.168.10.1/24
        arp_suppress: false
        dhcp_loopback_id: 100
        dhcp_servers:
          - ip_address: 10.125.10.100
            vrf: VrfRed
          - ip_address: 10.125.10.101
            vrf: VrfRed
        gw_ipv6_address: 203e:10:15:10::1/128
        int_desc: Network1
        l3gw_on_border: true
        mtu_l3intf: 9216
        multicast_group_address: 239.1.1.1
        netflow_enable: false
        route_target_both: true
        route_tag: 12345
        secondary_ip_addresses:
          - ip_address: 192.168.11.1/24
            route_tag: 54321
        trm_enable: true
        vlan_netflow_monitor: test
        network_attach_group: esxi
    network_attach_groups:
      - name: esxi
        switches:
          - hostname: dc1-leaf1
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
          - hostname: dc1-leaf2
            ports:
              - Port-channel10
              - Port-channel20
              - Port-channel30
              - Port-channel40
      - name: dmz
        switches:
          - hostname: dc1-leaf1
            ports:
              - Ethernet1/23
              - Ethernet1/24
          - hostname: dc1-leaf2
            ports:
              - Ethernet1/23
              - Ethernet1/24