Policy

Diagram

Classes

vxlan

Name	Type	Constraint	Mandatory	Default Value
policy	Class	[policy]	No

policy (vxlan)

Name	Type	Constraint	Mandatory	Default Value
policies	List	[policies]	No
groups	List	[groups]	No
switches	List	[switches]	No

policies (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
template_name	String		No
filename	String		No
template_vars	Map		No

groups (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No
policies	List	[policies]	No

switches (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
groups	List	String	Yes

policies (vxlan.policy.groups)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No

Example 1 - Policy configuration

In this example, we define four different policies to be applied to the switch: two are read from an external file, and two are defined directly within the data model. You can define the configuration for each policy in a separate file and specify the file’s location within the data model. The following tree structure illustrates the working directory for this example:

working directory

❯ tree -L3 .
.
├── ansible.cfg
├── collections
│   ├── ... Folder contents ...
├── data
│   └── policies
│       ├── alias.cfg
│       ├── grpc_config.yml
├── group_vars
│   ├── ... Folder contents ...
├── host_vars
│   └── nac-fabric1
│       ├── ... Folder contents ...
│   └── nac-fabric2
│       ├── ... Folder contents ...
├── inventory.yaml
├── requirements.txt
├── requirements.yaml
└── vxlan.yaml

The corresponding data model is shown below:

vxlan:
  policy:
    policies:
      - name: alias
        filename: ./data/policies/alias.cfg
        # file contents:
        # cli alias name wr copy run start
      - name: banner
        template_name: banner
        template_vars:
          BANNER: "VXLAN as Code Banner"
          BANNERDELIMITER: "_"
          TYPE: "motd"
      - name: grpc feature
        template_vars:
          CONF: |-
            feature grpc
      - name: grpc config
        template_name: switch_freeform
        filename: ./data/policies/grpc_config.yml
        # file contents:
        # ---
        # CONF: |-
        #   grpc use-vrf default
        #   grpc port 50051
        #   grpc gnmi max-concurrent-call 16
    groups:
      - name: server leafs
        priority: 500
        policies:
          - name: grpc feature
            priority: 50
          - name: grpc config
          - name: banner
          - name: alias
    switches:
      - name: nac-leaf3
        groups:
          - server leafs
      - name: nac-leaf4
        groups:
          - server leafs

Example 2 - Freeform-like configuration on the template

This example demonstrates two special cases:

1. The template contains Freeform-like configuration that requires indentation.
2. The string value for a variable contains special characters.

For case 1, the value requiring indentation must be defined using the block scalar indicator (|), and the multiline string must include the necessary indentation. In this example, we require two spaces of indentation; this is achieved by using the “2” value on the scalar indicator, ensuring each line has two additional spaces at the beginning of the string.

For case 2, we must ensure that double quotes within the string are escaped. The string defined in the data model will be used to create a payload and subsequently processed by the base module. We need to prevent YAML from performing automatic type conversion (in this case, from hex to decimal).

vxlan:
  policy:
    policies:
      - name: POLICY-BGP-PEER-TEMPLATE
        template_name: bgp_peer_template
        template_vars:
          BGP_AS: "64690"
          TEMPLATE_TYPE: peer
          TEMPLATE_NAME: ebgp-cmd-pr-fmg-f5
          # Use the "2" block scalar indicator to ensure indentation is preserved in the API request
          CONF: |2-
              bfd multihop
              remote-as 65386
              description ebgp-cmd-pr-fmg-f5
              update-source Loopback5
      - name: POLICY-SNMP-USER-TEST
        template_name: nfm_switch_snmp_user
        template_vars:
          USERNAME: test
          USER_ROLE: network-operator
          AUTH: "\"0x55b3c64a53fb95518e75358ee75e82e9\""
          PRIV: "\"0x55b3c64a53fb95518e75358ee75e82e9\""

Enabling Removal Operations (using Ansible)

By default, policy removal is disabled for safety. To enable automatic removal:

policy_delete_mode: true

Caution

When policy_delete_mode: true, removing a policy from your configuration will automatically delete it from NDFC on the next playbook run.

Diagram

Classes

vxlan

Name	Type	Constraint	Mandatory	Default Value
policy	Class	[policy]	No

policy (vxlan)

Name	Type	Constraint	Mandatory	Default Value
policies	List	[policies]	No
groups	List	[groups]	No
switches	List	[switches]	No

policies (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
template_name	String		No
filename	String		No
template_vars	Map		No

groups (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No
policies	List	[policies]	No

switches (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
groups	List	String	Yes

policies (vxlan.policy.groups)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No

Example 1 - Policy configuration

In this example, we define four different policies to be applied to the switch: two are read from an external file, and two are defined directly within the data model. You can define the configuration for each policy in a separate file and specify the file’s location within the data model. The following tree structure illustrates the working directory for this example:

working directory

❯ tree -L3 .
.
├── ansible.cfg
├── collections
│   ├── ... Folder contents ...
├── data
│   └── policies
│       ├── alias.cfg
│       ├── grpc_config.yml
├── group_vars
│   ├── ... Folder contents ...
├── host_vars
│   └── nac-fabric1
│       ├── ... Folder contents ...
│   └── nac-fabric2
│       ├── ... Folder contents ...
├── inventory.yaml
├── requirements.txt
├── requirements.yaml
└── vxlan.yaml

The corresponding data model is shown below:

vxlan:
  policy:
    policies:
      - name: alias
        filename: ./data/policies/alias.cfg
        # file contents:
        # cli alias name wr copy run start
      - name: banner
        template_name: banner
        template_vars:
          BANNER: "VXLAN as Code Banner"
          BANNERDELIMITER: "_"
          TYPE: "motd"
      - name: grpc feature
        template_vars:
          CONF: |-
            feature grpc
      - name: grpc config
        template_name: switch_freeform
        filename: ./data/policies/grpc_config.yml
        # file contents:
        # ---
        # CONF: |-
        #   grpc use-vrf default
        #   grpc port 50051
        #   grpc gnmi max-concurrent-call 16
    groups:
      - name: server leafs
        priority: 500
        policies:
          - name: grpc feature
            priority: 50
          - name: grpc config
          - name: banner
          - name: alias
    switches:
      - name: nac-leaf3
        groups:
          - server leafs
      - name: nac-leaf4
        groups:
          - server leafs

Example 2 - Freeform-like configuration on the template

This example demonstrates two special cases:

1. The template contains Freeform-like configuration that requires indentation.
2. The string value for a variable contains special characters.

For case 1, the value requiring indentation must be defined using the block scalar indicator (|), and the multiline string must include the necessary indentation. In this example, we require two spaces of indentation; this is achieved by using the “2” value on the scalar indicator, ensuring each line has two additional spaces at the beginning of the string.

For case 2, we must ensure that double quotes within the string are escaped. The string defined in the data model will be used to create a payload and subsequently processed by the base module. We need to prevent YAML from performing automatic type conversion (in this case, from hex to decimal).

vxlan:
  policy:
    policies:
      - name: POLICY-BGP-PEER-TEMPLATE
        template_name: bgp_peer_template
        template_vars:
          BGP_AS: "64690"
          TEMPLATE_TYPE: peer
          TEMPLATE_NAME: ebgp-cmd-pr-fmg-f5
          # Use the "2" block scalar indicator to ensure indentation is preserved in the API request
          CONF: |2-
              bfd multihop
              remote-as 65386
              description ebgp-cmd-pr-fmg-f5
              update-source Loopback5
      - name: POLICY-SNMP-USER-TEST
        template_name: nfm_switch_snmp_user
        template_vars:
          USERNAME: test
          USER_ROLE: network-operator
          AUTH: "\"0x55b3c64a53fb95518e75358ee75e82e9\""
          PRIV: "\"0x55b3c64a53fb95518e75358ee75e82e9\""

Diagram

Classes

vxlan

Name	Type	Constraint	Mandatory	Default Value
policy	Class	[policy]	No

policy (vxlan)

Name	Type	Constraint	Mandatory	Default Value
policies	List	[policies]	No
groups	List	[groups]	No
switches	List	[switches]	No

policies (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
template_name	String		No
filename	String		No
template_vars	Map		No

groups (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No
policies	List	[policies]	No

switches (vxlan.policy)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
groups	List	String	Yes

policies (vxlan.policy.groups)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
priority	Integer	min: 1, max: 1000	No

Examples

vxlan:
  policy:
    policies:
      - name: alias
        filename: ./data/policies/alias.cfg
        # file contents:
        # cli alias name wr copy run start
      - name: banner
        template_name: banner
        template_vars:
          BANNER: "VXLAN as Code Banner"
          BANNERDELIMITER: "_"
          TYPE: "motd"
      - name: grpc feature
        template_vars:
          CONF: |-
            feature grpc
      - name: grpc config
        template_name: switch_freeform
        filename: ./data/policies/grpc_config.yml
        # file contents:
        # ---
        # CONF: |-
        #   grpc use-vrf default
        #   grpc port 50051
        #   grpc gnmi max-concurrent-call 16
    groups:
      - name: server leafs
        priority: 500
        policies:
          - name: grpc feature
            priority: 50
          - name: grpc config
          - name: banner
          - name: alias
    switches:
      - name: nac-leaf3
        groups:
          - server leafs
      - name: nac-leaf4
        groups:
          - server leafs