VRF

The VRF configuration section of the Data Model defines how to create VRFs and update supported VRF parameters.

After a VRF is created, name (the data model key used to identify the VRF) and vrf_id (L3 VNI / VNI) cannot be updated. If either value needs to change, delete and recreate the VRF.

This does not prevent updates to supported switch-facing values such as VLAN ID, vrf_vlan_name, vrf_description, VRF interface description (vrf_intf_desc), MTU, route maps, or other routing parameters.

Diagram

Classes

vxlan

Name	Type	Constraint	Mandatory	Default Value
overlay	Class	overlay	No

overlay (vxlan)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	vrfs	No
vrf_attach_groups	List	vrf_attach_groups	No

vrfs (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vrf_id	Integer	min: 1, max: 16777214	No
vlan_id	Integer	min: 1, max: 4094	No
vrf_vlan_name	String		No
vrf_intf_desc	String		No	Configured by Ansible NetAsCode
vrf_description	String		No	Configured by Ansible NetAsCode
vrf_int_mtu	Integer	min: 1500, max: 9216	No	9216
loopback_route_tag	Integer	min: 0, max: 4294967295	No	12345
max_bgp_paths	Integer	min: 1, max: 128	No	1
max_ibgp_paths	Integer	min: 1, max: 128	No	2
ipv6_linklocal_enable	Boolean	true, false	No	true
adv_host_routes	Boolean	true, false	No	false
adv_default_routes	Boolean	true, false	No	true
static_default_route	Boolean	true, false	No	true
bgp_password	String		No
bgp_password_encryption_type	Choice	3, 7	No
disable_rt_auto	Boolean	true, false	No	false
export_evpn_rt	String		No
export_mvpn_rt	String		No
export_vpn_rt	String		No
import_evpn_rt	String		No
import_mvpn_rt	String		No
import_vpn_rt	String		No
netflow_enable	Boolean	true, false	No	false
netflow_monitor	String		No
no_rp	Boolean	true, false	No	false
overlay_multicast_group	String		No
redist_direct_routemap	String		No	FABRIC-RMAP-REDIST-SUBNET
ipv6_redist_direct_routemap	String		No	FABRIC-RMAP-REDIST-SUBNET
rp_address	IP		No
rp_external	Boolean	true, false	No	false
rp_loopback_id	Integer	min: 0, max: 1023	No
trm_enable	Boolean	true, false	No	false
trm_bgw_msite	Boolean	true, false	No	false
enable_l3_vni_no_vlan	Boolean	true, false	No
underlay_mcast_ip	IP		No
vrf_attach_group	String		No

vrf_attach_groups (vxlan.overlay)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
switches	List	switches	No

switches (vxlan.overlay.vrf_attach_groups)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
loopback_id	Integer	min: 0, max: 1023	No
loopback_ipv4	IP		No
loopback_ipv6	IP		No
freeform_config	String		No

Examples

vxlan:
  overlay:
    vrfs:
      # simple example
      - name: NetAsCodeVrf1
        vrf_id: 150001
        vlan_id: 2001
        vrf_attach_group: all_leaf
      # full example
      - name: NetAsCodeVrf2
        vrf_id: 150002
        vlan_id: 2002
        vrf_vlan_name: NetAsCodeVrf2
        vrf_intf_desc: NetAsCodeVrf2
        vrf_description: NetAsCodeVrf2
        vrf_int_mtu: 9216
        loopback_route_tag: 12345
        max_bgp_paths: 4
        max_ibgp_paths: 16
        ipv6_linklocal_enable: true
        adv_host_routes: false
        adv_default_routes: true
        static_default_route: false
        bgp_password: 014903c077689077e5b4548432c3d91d
        bgp_password_encryption_type: 3
        disable_rt_auto: true
        export_evpn_rt: 655000:15002
        export_mvpn_rt: 655000:15002
        export_vpn_rt: 655000:15002
        import_evpn_rt: 655000:15001
        import_mvpn_rt: 655000:15001
        import_vpn_rt: 655000:15001
        netflow_enable: true
        netflow_monitor: test
        no_rp: false
        overlay_multicast_group: 239.10.10.1
        redist_direct_routemap: fabric-rmap-redist-subnet
        trm_enable: true
        rp_address: 224.10.12.123
        rp_external: true
        rp_loopback_id: 10
        trm_bgw_msite: false
        underlay_mcast_ip: 239.1.1.1
        vrf_attach_group: all_leaf

    vrf_attach_groups:
      - name: all_leaf
        switches:
          - hostname: dc1-leaf1
          - hostname: dc1-leaf2
      - name: leaf1
        switches:
          - hostname: dc1-leaf1
      - name: leaf2
        switches:
          - hostname: dc1-leaf2

Enabling Removal Operations (using Ansible)

By default, VRF removal is disabled for safety. To enable automatic removal:

vrf_delete_mode: true

Caution

When vrf_delete_mode: true, removing a VRF from your configuration will automatically delete it from NDFC on the next playbook run.

Examples

vxlan:
  overlay:
    vrfs:
      # simple example
      - name: NetAsCodeVrf1
        vrf_id: 150001
        vlan_id: 2001
        vrf_attach_group: all_leaf
      # full example
      - name: NetAsCodeVrf2
        vrf_id: 150002
        vlan_id: 2002
        vrf_vlan_name: NetAsCodeVrf2
        vrf_intf_desc: NetAsCodeVrf2
        vrf_description: NetAsCodeVrf2
        vrf_int_mtu: 9216
        loopback_route_tag: 12345
        max_bgp_paths: 4
        max_ibgp_paths: 16
        ipv6_linklocal_enable: true
        adv_host_routes: false
        adv_default_routes: true
        static_default_route: false
        bgp_password: 014903c077689077e5b4548432c3d91d
        bgp_password_encryption_type: 3
        disable_rt_auto: true
        export_evpn_rt: 655000:15002
        export_mvpn_rt: 655000:15002
        export_vpn_rt: 655000:15002
        import_evpn_rt: 655000:15001
        import_mvpn_rt: 655000:15001
        import_vpn_rt: 655000:15001
        netflow_enable: true
        netflow_monitor: test
        no_rp: false
        overlay_multicast_group: 239.10.10.1
        redist_direct_routemap: fabric-rmap-redist-subnet
        trm_enable: true
        rp_address: 224.10.12.123
        rp_external: true
        rp_loopback_id: 10
        trm_bgw_msite: false
        underlay_mcast_ip: 239.1.1.1
        vrf_attach_group: all_leaf

    vrf_attach_groups:
      - name: all_leaf
        switches:
          - hostname: dc1-leaf1
          - hostname: dc1-leaf2
      - name: leaf1
        switches:
          - hostname: dc1-leaf1
      - name: leaf2
        switches:
          - hostname: dc1-leaf2