netascode/terraform-aci-nac-aci

Terraform Cisco ACI Nexus-as-Code Module

Terraform ACI Nexus-as-Code Module

A Terraform module to configure ACI.

This module is part of the Cisco Nexus-as-Code project. Its goal is to allow users to instantiate network fabrics in minutes using an easy to use, opinionated data model. It takes away the complexity of having to deal with references, dependencies or loops. By completely separating data (defining variables) from logic (infrastructure declaration), it allows the user to focus on describing the intended configuration while using a set of maintained and tested Terraform Modules without the need to understand the low-level ACI object model. More information can be found here: https://cisco.com/go/nexusascode.

A comprehensive example using this module is available here: https://github.com/netascode/nac-aci-comprehensive-example

Usage

This module supports an inventory driven approach, where a complete ACI configuration or parts of it are either modeled in one or more YAML files or natively using Terraform variables.

There are six configuration sections which can be selectively enabled or disabled using module flags:

• fabric_policies: Configurations applied at the fabric level (e.g., fabric BGP route reflectors)
• access_policies: Configurations applied to external facing (downlink) interfaces (e.g., VLAN pools)
• pod_policies: Configurations applied at the pod level (e.g., TEP pool addresses)
• node_policies: Configurations applied at the node level (e.g., OOB node management address)
• interface_policies: Configurations applied at the interface level (e.g., assigning interface policy groups to physical ports)
• tenants: Configurations applied at the tenant level (e.g., VRFs and Bridge Domains)

The full data model documentation is available here: https://developer.cisco.com/docs/nexus-as-code/#!data-model

Examples

Configuring a VLAN Pool using YAML:

vlan_pool.yaml

apic:
  access_policies:
    vlan_pools:
      - name: VLAN_POOL_1
        ranges:
          - from: 1000
            to: 1099

main.tf

module "vlan_pool" {
  source  = "netascode/nac-aci/aci"
  version = ">= 0.7.0"

  yaml_files = ["vlan_pool.yaml"]

  manage_access_policies = true
}

Configuring a Banner using native HCL:

main.tf

module "banner" {
  source  = "netascode/nac-aci/aci"
  version = ">= 0.7.0"

  model = {
    apic = {
      fabric_policies = {
        banners = {
          apic_cli_banner = "My APIC Banner"
        }
      }
    }
  }

  manage_fabric_policies = true
}

Additional example repositories:

• https://github.com/netascode/nac-aci-simple-example
• https://github.com/netascode/nac-aci-comprehensive-example

Requirements

Name	Version
terraform	>= 1.3.0
aci	>= 2.15.0
local	>= 2.3.0
utils	>= 0.2.5

Inputs

Name	Description	Type	Default	Required
manage_access_policies	Flag to indicate if access policies should be managed.	bool	false	no
manage_fabric_policies	Flag to indicate if fabric policies should be managed.	bool	false	no
manage_interface_policies	Flag to indicate if interface policies should be managed.	bool	false	no
manage_node_policies	Flag to indicate if node policies should be managed.	bool	false	no
manage_pod_policies	Flag to indicate if pod policies should be managed.	bool	false	no
manage_tenants	Flag to indicate if tenants should be managed.	bool	false	no
managed_interface_policies_nodes	List of node IDs for which interface policies should be managed. By default interface policies for all nodes will be managed.	list(number)	[]	no
managed_tenants	List of tenant names to be managed. By default all tenants will be managed.	list(string)	[]	no
model	As an alternative to YAML files, a native Terraform data structure can be provided as well.	map(any)	{}	no
write_default_values_file	Write all default values to a YAML file. Value is a path pointing to the file to be created.	string	""	no
yaml_directories	List of paths to YAML directories.	list(string)	[]	no
yaml_files	List of paths to YAML files.	list(string)	[]	no

Outputs

Name	Description
default_values	All default values.
model	Full model.

Providers

Name	Version
local	>= 2.3.0
utils	>= 0.2.5

Resources

Name	Type
local_sensitive_file.defaults	resource
utils_yaml_merge.defaults	data source
utils_yaml_merge.model	data source
utils_yaml_merge.modules	data source

Modules

Name	Source	Version
aci_aaa	./modules/terraform-aci-aaa	n/a
aci_aaep	./modules/terraform-aci-aaep	n/a
aci_access_fex_interface_profile_auto	./modules/terraform-aci-access-fex-interface-profile	n/a
aci_access_fex_interface_profile_manual	./modules/terraform-aci-access-fex-interface-profile	n/a
aci_access_fex_interface_selector_auto	./modules/terraform-aci-access-fex-interface-selector	n/a
aci_access_fex_interface_selector_manual	./modules/terraform-aci-access-fex-interface-selector	n/a
aci_access_leaf_interface_policy_group	./modules/terraform-aci-access-leaf-interface-policy-group	n/a
aci_access_leaf_interface_profile_auto	./modules/terraform-aci-access-leaf-interface-profile	n/a
aci_access_leaf_interface_profile_manual	./modules/terraform-aci-access-leaf-interface-profile	n/a
aci_access_leaf_interface_selector_auto	./modules/terraform-aci-access-leaf-interface-selector	n/a
aci_access_leaf_interface_selector_manual	./modules/terraform-aci-access-leaf-interface-selector	n/a
aci_access_leaf_interface_selector_sub_auto	./modules/terraform-aci-access-leaf-interface-selector	n/a
aci_access_leaf_switch_configuration	./modules/terraform-aci-switch-configuration	n/a
aci_access_leaf_switch_policy_group	./modules/terraform-aci-access-leaf-switch-policy-group	n/a
aci_access_leaf_switch_profile_auto	./modules/terraform-aci-access-leaf-switch-profile	n/a
aci_access_leaf_switch_profile_manual	./modules/terraform-aci-access-leaf-switch-profile	n/a
aci_access_span_destination_group	./modules/terraform-aci-access-span-destination-group	n/a
aci_access_span_filter_group	./modules/terraform-aci-access-span-filter-group	n/a
aci_access_span_source_group	./modules/terraform-aci-access-span-source-group	n/a
aci_access_spine_interface_policy_group	./modules/terraform-aci-access-spine-interface-policy-group	n/a
aci_access_spine_interface_profile_auto	./modules/terraform-aci-access-spine-interface-profile	n/a
aci_access_spine_interface_profile_manual	./modules/terraform-aci-access-spine-interface-profile	n/a
aci_access_spine_interface_selector_auto	./modules/terraform-aci-access-spine-interface-selector	n/a
aci_access_spine_interface_selector_manual	./modules/terraform-aci-access-spine-interface-selector	n/a
aci_access_spine_switch_configuration	./modules/terraform-aci-switch-configuration	n/a
aci_access_spine_switch_policy_group	./modules/terraform-aci-access-spine-switch-policy-group	n/a
aci_access_spine_switch_profile_auto	./modules/terraform-aci-access-spine-switch-profile	n/a
aci_access_spine_switch_profile_manual	./modules/terraform-aci-access-spine-switch-profile	n/a
aci_apic_connectivity_preference	./modules/terraform-aci-apic-connectivity-preference	n/a
aci_application_profile	./modules/terraform-aci-application-profile	n/a
aci_banner	./modules/terraform-aci-banner	n/a
aci_bfd_interface_policy	./modules/terraform-aci-bfd-interface-policy	n/a
aci_bfd_ipv4_policy	./modules/terraform-aci-bfd-policy	n/a
aci_bfd_ipv6_policy	./modules/terraform-aci-bfd-policy	n/a
aci_bfd_multihop_node_policy	./modules/terraform-aci-bfd-multihop-node-policy	n/a
aci_bgp_address_family_context_policy	./modules/terraform-aci-bgp-address-family-context-policy	n/a
aci_bgp_best_path_policy	./modules/terraform-aci-bgp-best-path-policy	n/a
aci_bgp_peer_prefix_policy	./modules/terraform-aci-bgp-peer-prefix-policy	n/a
aci_bgp_policy	./modules/terraform-aci-bgp-policy	n/a
aci_bgp_route_summarization_policy	./modules/terraform-aci-bgp-route-summarization-policy	n/a
aci_bgp_timer_policy	./modules/terraform-aci-bgp-timer-policy	n/a
aci_bridge_domain	./modules/terraform-aci-bridge-domain	n/a
aci_ca_certificate	./modules/terraform-aci-ca-certificate	n/a
aci_cdp_policy	./modules/terraform-aci-cdp-policy	n/a
aci_config_export	./modules/terraform-aci-config-export	n/a
aci_config_passphrase	./modules/terraform-aci-config-passphrase	n/a
aci_contract	./modules/terraform-aci-contract	n/a
aci_coop_policy	./modules/terraform-aci-coop-policy	n/a
aci_date_time_format	./modules/terraform-aci-date-time-format	n/a
aci_date_time_policy	./modules/terraform-aci-date-time-policy	n/a
aci_device_selection_policy	./modules/terraform-aci-device-selection-policy	n/a
aci_dhcp_option_policy	./modules/terraform-aci-dhcp-option-policy	n/a
aci_dhcp_relay_policy	./modules/terraform-aci-dhcp-relay-policy	n/a
aci_dns_policy	./modules/terraform-aci-dns-policy	n/a
aci_eigrp_interface_policy	./modules/terraform-aci-eigrp-interface-policy	n/a
aci_endpoint_group	./modules/terraform-aci-endpoint-group	n/a
aci_endpoint_loop_protection	./modules/terraform-aci-endpoint-loop-protection	n/a
aci_endpoint_security_group	./modules/terraform-aci-endpoint-security-group	n/a
aci_error_disabled_recovery	./modules/terraform-aci-error-disabled-recovery	n/a
aci_external_connectivity_policy	./modules/terraform-aci-external-connectivity-policy	n/a
aci_external_endpoint_group	./modules/terraform-aci-external-endpoint-group	n/a
aci_fabric_isis_bfd	./modules/terraform-aci-fabric-isis-bfd	n/a
aci_fabric_isis_policy	./modules/terraform-aci-fabric-isis-policy	n/a
aci_fabric_l2_mtu	./modules/terraform-aci-fabric-l2-mtu	n/a
aci_fabric_leaf_interface_profile_auto	./modules/terraform-aci-fabric-leaf-interface-profile	n/a
aci_fabric_leaf_interface_profile_manual	./modules/terraform-aci-fabric-leaf-interface-profile	n/a
aci_fabric_leaf_switch_configuration	./modules/terraform-aci-switch-configuration	n/a
aci_fabric_leaf_switch_policy_group	./modules/terraform-aci-fabric-leaf-switch-policy-group	n/a
aci_fabric_leaf_switch_profile_auto	./modules/terraform-aci-fabric-leaf-switch-profile	n/a
aci_fabric_leaf_switch_profile_manual	./modules/terraform-aci-fabric-leaf-switch-profile	n/a
aci_fabric_link_level_policy	./modules/terraform-aci-fabric-link-level-policy	n/a
aci_fabric_pod_policy_group	./modules/terraform-aci-fabric-pod-policy-group	n/a
aci_fabric_pod_profile_auto	./modules/terraform-aci-fabric-pod-profile	n/a
aci_fabric_pod_profile_manual	./modules/terraform-aci-fabric-pod-profile	n/a
aci_fabric_scheduler	./modules/terraform-aci-fabric-scheduler	n/a
aci_fabric_span_destination_group	./modules/terraform-aci-fabric-span-destination-group	n/a
aci_fabric_span_source_group	./modules/terraform-aci-fabric-span-source-group	n/a
aci_fabric_spine_interface_profile_auto	./modules/terraform-aci-fabric-spine-interface-profile	n/a
aci_fabric_spine_interface_profile_manual	./modules/terraform-aci-fabric-spine-interface-profile	n/a
aci_fabric_spine_switch_configuration	./modules/terraform-aci-switch-configuration	n/a
aci_fabric_spine_switch_policy_group	./modules/terraform-aci-fabric-spine-switch-policy-group	n/a
aci_fabric_spine_switch_profile_auto	./modules/terraform-aci-fabric-spine-switch-profile	n/a
aci_fabric_spine_switch_profile_manual	./modules/terraform-aci-fabric-spine-switch-profile	n/a
aci_fabric_wide_settings	./modules/terraform-aci-fabric-wide-settings	n/a
aci_filter	./modules/terraform-aci-filter	n/a
aci_firmware_group	./modules/terraform-aci-firmware-group	n/a
aci_forwarding_scale_policy	./modules/terraform-aci-forwarding-scale-policy	n/a
aci_geolocation	./modules/terraform-aci-geolocation	n/a
aci_health_score_evaluation_policy	./modules/terraform-aci-health-score-evaluation-policy	n/a
aci_igmp_interface_policy	./modules/terraform-aci-igmp-interface-policy	n/a
aci_igmp_snooping_policy	./modules/terraform-aci-igmp-snooping-policy	n/a
aci_imported_contract	./modules/terraform-aci-imported-contract	n/a
aci_imported_l4l7_device	./modules/terraform-aci-imported-l4l7-device	n/a
aci_inband_endpoint_group	./modules/terraform-aci-inband-endpoint-group	n/a
aci_inband_node_address	./modules/terraform-aci-inband-node-address	n/a
aci_infra_dhcp_relay_policy	./modules/terraform-aci-infra-dhcp-relay-policy	n/a
aci_infra_dscp_translation_policy	./modules/terraform-aci-infra-dscp-translation-policy	n/a
aci_interface_configuration_fex	./modules/terraform-aci-interface-configuration	n/a
aci_interface_type	./modules/terraform-aci-interface-type	n/a
aci_ip_aging	./modules/terraform-aci-ip-aging	n/a
aci_ip_sla_policy	./modules/terraform-aci-ip-sla-policy	n/a
aci_keyring	./modules/terraform-aci-keyring	n/a
aci_l2_mtu_policy	./modules/terraform-aci-l2-mtu-policy	n/a
aci_l2_policy	./modules/terraform-aci-l2-policy	n/a
aci_l3out	./modules/terraform-aci-l3out	n/a
aci_l3out_interface_profile_auto	./modules/terraform-aci-l3out-interface-profile	n/a
aci_l3out_interface_profile_manual	./modules/terraform-aci-l3out-interface-profile	n/a
aci_l3out_node_profile_auto	./modules/terraform-aci-l3out-node-profile	n/a
aci_l3out_node_profile_manual	./modules/terraform-aci-l3out-node-profile	n/a
aci_l4l7_device	./modules/terraform-aci-l4l7-device	n/a
aci_ldap	./modules/terraform-aci-ldap	n/a
aci_leaf_fabric_interface_configuration	./modules/terraform-aci-fabric-interface-configuration	n/a
aci_leaf_fabric_interface_configuration_sub	./modules/terraform-aci-fabric-interface-configuration	n/a
aci_leaf_interface_configuration	./modules/terraform-aci-interface-configuration	n/a
aci_leaf_interface_configuration_sub	./modules/terraform-aci-interface-configuration	n/a
aci_link_level_policy	./modules/terraform-aci-link-level-policy	n/a
aci_lldp_policy	./modules/terraform-aci-lldp-policy	n/a
aci_login_domain	./modules/terraform-aci-login-domain	n/a
aci_maintenance_group	./modules/terraform-aci-maintenance-group	n/a
aci_management_access_policy	./modules/terraform-aci-management-access-policy	n/a
aci_match_rule	./modules/terraform-aci-match-rule	n/a
aci_mcp	./modules/terraform-aci-mcp	n/a
aci_mcp_policy	./modules/terraform-aci-mcp-policy	n/a
aci_monitoring_policy	./modules/terraform-aci-monitoring-policy	n/a
aci_mst_policy	./modules/terraform-aci-mst-policy	n/a
aci_multicast_route_map	./modules/terraform-aci-multicast-route-map	n/a
aci_nd_interface_policy	./modules/terraform-aci-nd-interface-policy	n/a
aci_nd_ra_prefix_policy	./modules/terraform-aci-nd-ra-prefix-policy	n/a
aci_netflow_exporter	./modules/terraform-aci-netflow-exporter	n/a
aci_netflow_monitor	./modules/terraform-aci-netflow-monitor	n/a
aci_netflow_record	./modules/terraform-aci-netflow-record	n/a
aci_node_control_policy	./modules/terraform-aci-node-control-policy	n/a
aci_node_registration	./modules/terraform-aci-node-registration	n/a
aci_oob_contract	./modules/terraform-aci-oob-contract	n/a
aci_oob_endpoint_group	./modules/terraform-aci-oob-endpoint-group	n/a
aci_oob_external_management_instance	./modules/terraform-aci-oob-external-management-instance	n/a
aci_oob_node_address	./modules/terraform-aci-oob-node-address	n/a
aci_ospf_interface_policy	./modules/terraform-aci-ospf-interface-policy	n/a
aci_ospf_timer_policy	./modules/terraform-aci-ospf-timer-policy	n/a
aci_physical_domain	./modules/terraform-aci-physical-domain	n/a
aci_pim_policy	./modules/terraform-aci-pim-policy	n/a
aci_pod_setup	./modules/terraform-aci-pod-setup	n/a
aci_port_channel_member_policy	./modules/terraform-aci-port-channel-member-policy	n/a
aci_port_channel_policy	./modules/terraform-aci-port-channel-policy	n/a
aci_port_tracking	./modules/terraform-aci-port-tracking	n/a
aci_psu_policy	./modules/terraform-aci-psu-policy	n/a
aci_ptp	./modules/terraform-aci-ptp	n/a
aci_ptp_profile	./modules/terraform-aci-ptp-profile	n/a
aci_qos	./modules/terraform-aci-qos	n/a
aci_qos_policy	./modules/terraform-aci-qos-policy	n/a
aci_radius	./modules/terraform-aci-radius	n/a
aci_redirect_backup_policy	./modules/terraform-aci-redirect-backup-policy	n/a
aci_redirect_health_group	./modules/terraform-aci-redirect-health-group	n/a
aci_redirect_policy	./modules/terraform-aci-redirect-policy	n/a
aci_remote_location	./modules/terraform-aci-remote-location	n/a
aci_rogue_endpoint_control	./modules/terraform-aci-rogue-endpoint-control	n/a
aci_route_control_route_map	./modules/terraform-aci-route-control-route-map	n/a
aci_route_tag_policy	./modules/terraform-aci-route-tag-policy	n/a
aci_routed_domain	./modules/terraform-aci-routed-domain	n/a
aci_service_epg_policy	./modules/terraform-aci-service-epg-policy	n/a
aci_service_graph_template	./modules/terraform-aci-service-graph-template	n/a
aci_set_rule	./modules/terraform-aci-set-rule	n/a
aci_smart_licensing	./modules/terraform-aci-smart-licensing	n/a
aci_snmp_policy	./modules/terraform-aci-snmp-policy	n/a
aci_snmp_trap_policy	./modules/terraform-aci-snmp-trap-policy	n/a
aci_spanning_tree_policy	./modules/terraform-aci-spanning-tree-policy	n/a
aci_spine_fabric_interface_configuration	./modules/terraform-aci-fabric-interface-configuration	n/a
aci_spine_interface_configuration	./modules/terraform-aci-interface-configuration	n/a
aci_sr_mpls_external_endpoint_group	./modules/terraform-aci-external-endpoint-group	n/a
aci_sr_mpls_l3out	./modules/terraform-aci-l3out	n/a
aci_sr_mpls_l3out_interface_profile_manual	./modules/terraform-aci-l3out-interface-profile	n/a
aci_sr_mpls_l3out_node_profile_manual	./modules/terraform-aci-l3out-node-profile	n/a
aci_storm_control_policy	./modules/terraform-aci-storm-control-policy	n/a
aci_syslog_policy	./modules/terraform-aci-syslog-policy	n/a
aci_system_global_gipo	./modules/terraform-aci-system-global-gipo	n/a
aci_system_performance	./modules/terraform-aci-system-performance	n/a
aci_tacacs	./modules/terraform-aci-tacacs	n/a
aci_tenant	./modules/terraform-aci-tenant	n/a
aci_tenant_span_destination_group	./modules/terraform-aci-tenant-span-destination-group	n/a
aci_tenant_span_source_group	./modules/terraform-aci-tenant-span-source-group	n/a
aci_track_list	./modules/terraform-aci-track-list	n/a
aci_track_member	./modules/terraform-aci-track-member	n/a
aci_trust_control_policy	./modules/terraform-aci-trust-control-policy	n/a
aci_useg_endpoint_group	./modules/terraform-aci-useg-endpoint-group	n/a
aci_user	./modules/terraform-aci-user	n/a
aci_vlan_pool	./modules/terraform-aci-vlan-pool	n/a
aci_vmware_vmm_domain	./modules/terraform-aci-vmware-vmm-domain	n/a
aci_vpc_group	./modules/terraform-aci-vpc-group	n/a
aci_vpc_policy	./modules/terraform-aci-vpc-policy	n/a
aci_vrf	./modules/terraform-aci-vrf	n/a
aci_vspan_destination_group	./modules/terraform-aci-vspan-destination-group	n/a
aci_vspan_session	./modules/terraform-aci-vspan-session	n/a

terraform-aci-nac-aci's Issues

Enhancement: Support for secondary IP on floating SVI

The L3out module offers support floating SVIs. The interfaces ip_shared attribute is available to set a secondary IP. The ip_shared attribute is not used when configuring a floating SVI.

Example of floating svi secondary IP DN:
uni/tn-isovalent/out-isovalent.vrf-01-bgp-AS-65152/lnodep-border-leafs/lifp-hx-dev-01-fi-a-vlan-16/vlifp-[topology/pod-1/node-101]-[vlan-16]/addr-[1.1.1.1/24]

Example of svi secondary IP DN:
uni/tn-isovalent/out-isovalent.vrf-01-bgp-AS-65152/lnodep-border-leafs/lifp-hx-dev-01-fi-a-vlan-16/rspathL3OutAtt-[topology/pod-1/paths-101/pathep-[hx-dev-01-fi-a]]/addr-[1.1.1.1/24]

The module should allow user to configure shared_ip on floating SVI.

Annotation for Tenant

Hello,
I could not find how to add annotation natively via Nexus-as-Code for an ACI tenant.
I used "aci_rest_managed" resource and it worked but it would be good to have in NaC module itself.

Thank you.

Question: add filter in tenant common to a contract's subject on other tenant

how can i add a filter present in the tenant common to subject of a contract in a client tenant ?

Enhancement request: add option to select route-reflectors vs full-mesh in External Connectivity Policy

Within the policy external_connectivity_policy (apic.fabric_policies) there is no option to choose route-reflectors by default the configuration is full-mesh. It would be great to set this flag through Terraform.

Feature Request: Add VPC Interface Support as Static Ports in Endpoint Group Module

Would like to be able to add vpc interfaces as static ports in the Endpoint Group module.

Bug: aci-aaa LDAP domain

https://developer.cisco.com/docs/nexus-as-code/aaa-settings/#classes lists LDAP as supported attribute, but there is no support for LDAP in the AAA module.

variables.tf update needed:

variable "default_realm" {
  description = "Default realm. Choices: `local`, `tacacs`, `radius`, `ldap`."
  type        = string
  default     = "local"

  validation {
    condition     = contains(["local", "tacacs", "radius", "ldap"], var.default_realm)
    error_message = "Valid values are `local`, `tacacs` or `radius`."
  }
}
variable "console_realm" {
  description = "Console realm. Choices: `local`, `tacacs`, `radius`, `ldap`."
  type        = string
  default     = "local"

  validation {
    condition     = contains(["local", "tacacs", "radius", "ldap"], var.console_realm)
    error_message = "Valid values are `local`, `tacacs` or `radius`."
  }
}

and main.tf:

resource "aci_rest_managed" "aaaDefaultAuth" {
  dn         = "${aci_rest_managed.aaaAuthRealm.dn}/defaultauth"
  class_name = "aaaDefaultAuth"
  content = {
    fallbackCheck = var.default_fallback_check ? "true" : "false"
    realm         = var.default_realm
    providerGroup = var.default_realm == "tacacs" || var.default_realm == "radius" || var.default_realm == "ldap" ? var.default_login_domain : ""
  }
}

resource "aci_rest_managed" "aaaConsoleAuth" {
  dn         = "${aci_rest_managed.aaaAuthRealm.dn}/consoleauth"
  class_name = "aaaConsoleAuth"
  content = {
    realm         = var.console_realm
    providerGroup = var.console_realm == "tacacs" || var.console_realm == "radius" || var.default_realm == "ldap" ? var.console_login_domain : ""
  }
}

Enhancement request: Add netflow interface policies

Unfortunately it is currently not supported to specify Netflow Interface Policies (NetFlow Exporters, NetFlow Exporters for VM Networking, NetFlow Monitors, NetFlow Records) and link them to an Interface Policy Group. Adding those policies would be highly appreciated.

Policy location

I dont quite understand why the location of the policies is different, for example:

err_disabled_recovery resides under fabric_policies:

apic:
  fabric_policies:
    err_disabled_recovery:
      interval: 360
      mcp_loop: true
      ep_move: true
      bpdu_guard: true

and mcp resides under access_policies:

apic:
access_policies:
 mcp:
   action: false
   admin_state: true
   key: cisco
   frequency_sec: 5
   initial_delay: 300
   loop_detection: 5
   per_vlan: false

even though both have the same path in the gui:

Location in GUI: Fabric » Access Policies » Policies » Global » Error Disabled Recovery Policy

Location in GUI: Fabric » Access Policies » Policies » Global » MCP Instance Policy default

aaep description

Not possible to add descriptions to aaep's per now, at least as far as i can see in the doc:
https://developer.cisco.com/docs/nexus-as-code/#!aaep/examples

Would be nice to add description.

Multiple sr_mpls_infra_l3out entries in sr_mpls_l3outs ?

Hello,

First of all, thanks for your work, that's great !

I'm using 4 SR-MPLS_L3OUT in the infra tenant : SR-MPLS_RT1, SR-MPLS_RT2, SR-MPLS_RT3 and SR-MPLS_RT4.
In a tenant configuration on nac yaml files, i would like to add all 4 sr_mpls_infra_l3out entries in 1 sr_mpls_l3outs like this (with 2) :

      sr_mpls_l3outs:
        - name: SR-MPLS_DEV
          external_endpoint_groups:
              - name: ExtEPG_SR-MPLS_DEV
                subnets:
                  - prefix: 0.0.0.0/0
                contracts:
                  consumers:
                  - Contract_Permit-All_DEV
          vrf: VRF_DEV
          sr_mpls_infra_l3out: SR-MPLS_L3Out_RT1
          outbound_route_map: RM4RC_export_RT1
          inbound_route_map: RM4RC_import_RT1
          sr_mpls_infra_l3out: SR-MPLS_L3Out_RT2
          outbound_route_map: RM4RC_export_RT2
          inbound_route_map: RM4RC_import_RT2

I understand with the online documentation that sr_mpls_infra_l3out, outbound_route_map and inbound_route_map are strings and then cannot be duplicate.

Confirmed by terraform's error :

terraform apply
module.aci.data.utils_yaml_merge.model: Reading...
╷
│ Error: Error reading YAML string
│
│   with module.aci.data.utils_yaml_merge.model,
│   on .terraform\modules\aci\merge.tf line 20, in data "utils_yaml_merge" "model":
│   20: data "utils_yaml_merge" "model" {
│
│ Error reading YAML string: yaml: unmarshal errors:
│   line 137: mapping key "sr_mpls_infra_l3out" already defined at line 133
│   line 138: mapping key "outbound_route_map" already defined at line 134
│   line 139: mapping key "inbound_route_map" already defined at line 135

I was able to create 4 sr_mpls_l3outs with 1 sr_mpls_infra_l3out on each but that is not the way it should work because it adds 3 more L3Out per tenant.
It would be nice to be capable of associate different outbound_route_map and inbound_route_map (and even external_endpoint_groups) to each sr_mpls_infra_l3out !
Is there a way to do this configuration ? Or should I wait for an upcoming release with this feature ? A maybe a "feature request" ?

Thank you.

Question: Sensitive content protection in the different yaml files

Question: How to protect sensitive content ex. passwords in different yaml files?

OOB Node Adress - Management EPG

Link: https://developer.cisco.com/docs/nexus-as-code/#!oob-node-address/oob-node-address

Is there any option to add OOB Management EPG when assigning oob-node-address, as there is in the GUI:

Br

MCP key configuration not pushed to ACI

---

apic:
access_policies:
mcp:
action: false
admin_state: true
frequency_sec: 5
initial_delay: 300
loop_detection: 5
per_vlan: true
key: $ECRETKEY1

Error: The post rest request failed 29s
10149│ 29s
10150│ with module.nac-aci.module.aci_mcp[0].aci_rest_managed.mcpInstPol, 29s
10151│ on .terraform/modules/nac-aci/modules/terraform-aci-mcp/main.tf line 1, in resource "aci_rest_managed" "mcpInstPol": 29s
10152│ 1: resource "aci_rest_managed" "mcpInstPol" { 29s
10153│ 29s
10154│ Code: 400 Response: [map[error:map[attributes:map[code:182 text:Password is 29s
10155│ required for MCP Instance Policy.]]]], err: %!s(). Please report this 29s
10156│ issue to the provider developers.

Not taking into account when pushing this configuration or when changing the key it is not changing anything when hitting terraform apply.

Not sure if this is expected behavior ?

NaC version = 0.8.1
Terraform module = v2.13.2

Bug: Port-tracking feature configuration push causes the feature to break in ACI

Setting the following feature causes the feature to break on ACI (tested with version 6.04(d)), and it causes the interfaces to go into FabricTrack Oper State. (see screenshots output after using NaC abstraction)

Setting port-tracking

port_tracking:
  admin_state: true
  delay: 120
  min_links: 2

Using the native terraform module works as expected if configured in the main.tf (as part of test)

Optional include the support for [include_apic_ports] in the abstraction layer (https://registry.terraform.io/providers/CiscoDevNet/aci/latest/docs/resources/port_tracking#include_apic_ports)

NaC version = 0.8.1
Terraform ACI module = v2.13.2

Autogeneration of LF/SPINE fabric/access profiles fails when suffix is added

For example, in the aci_fabric_policies.tf module "aci_fabric_leaf_switch_profile_auto" (starting code line 368), the replace statement does not account for when a suffix is added in the default values for autogenerating fabric/access leaf/spine profiles, etc.

Working "LEAF\g" -> output is LEAF1001, LEAF1002 etc..
Not working "LEAF\g_SwPro" -> output is LEAF

Expected behaviour is to account for suffixes added to the naming

Maintenance groups

Maintenance groups does not seem to work, when applying them they show up as failed because no version is specified.

Also using them fails:

Here is my config:

---
apic:
  node_policies:
    update_groups:
      - name: odd
      - name: even

---
apic:
  node_policies:
    nodes:
      - id: 2101
        pod: 1
        role: leaf
        update_group: odd
      - id: 2102
        pod: 1
        role: leaf
        name: LabDrLeaf2102
        update_group: even
      - id: 2901
        pod: 1
        role: spine
        update_group: odd

question: How can I create a routed domain without associating it with a vlan pool

How can I create a routed domain without associating it with a vlan pool which is a mandatory field

---

apic:
access_policies:
routed_domains:
- name: L3Out
vlan_pool: ??? <- mandatory

Leave the VLAN pool field blank because you do not need it for routed interface L3
For example, you need the pool for L3 connections with SVIs and subinterfaces.

Enhancement: Need support for uni-directional contracts

The current contract implementation does not allow for uni directional contracts under the subject.

Currently revFltPorts is hardcoded to "yes"

Uni directional contracts are required for situations where DSR is required with a SG to return flows to a L4-7 devices, and also when configuring leaking between VRFs where consumer and provider contracts are required in both directions.

resource "aci_rest_managed" "vzSubj" {
  for_each   = { for subj in var.subjects : subj.name => subj }
  dn         = "${aci_rest_managed.vzBrCP.dn}/subj-${each.value.name}"
  class_name = "vzSubj"
  content = {
    name        = each.value.name
    nameAlias   = each.value.alias
    descr       = each.value.description
    revFltPorts = "yes"
    prio        = each.value.qos_class
    targetDscp  = each.value.target_dscp
  }
}

Unidirectional contract payload:

{
    "vzSubj": {
        "attributes": {
            "dn": "uni/tn-demo-05/brc-test/subj-test1",
            "name": "test1",
            "revFltPorts": "false",
            "rn": "subj-test1",
            "status": "created"
        },
        "children": [
            {
                "vzInTerm": {
                    "attributes": {
                        "dn": "uni/tn-demo-05/brc-test/subj-test1/intmnl",
                        "status": "created",
                        "targetDscp": "64"
                    },
                    "children": []
                }
            },
            {
                "vzOutTerm": {
                    "attributes": {
                        "dn": "uni/tn-demo-05/brc-test/subj-test1/outtmnl",
                        "status": "created",
                        "targetDscp": "64"
                    },
                    "children": []
                }
            }
        ]
    }
}

Need enhancement for configure Fabric L2 MTU / Port MTU size

Hello,

When testing netascode/nac-aci/aci v0.8.0 with below yaml file as input on APIC v4.2, simulator, default Fabric L2 MTU Policy / Port MTU size(bytes) will be updated between 9000 and 9216 every time after running terraform apply with the same input yaml file. That's because below yaml input will be applied by two modules -- terraform-aci-fabric-l2-mtu and terraform-aci-l2-mtu-policy and the two modules are all applied on default Fabric L2 MTU Policy / Port MTU size(bytes), but with different values.

apic:
  fabric_policies:
    l2_port_mtu: 9000
    l2_mtu_policies:
      - name: default
        port_mtu_size: 9216

If module aci_l2_mtu_policy is designed for customized L2 MTU Policy, how about excluding default as showed below?

Line 150 https://github.com/netascode/terraform-aci-nac-aci/blob/eda11599284526188037bfaecb6db17beeec7eca/aci_fabric_policies.tf
from
for_each = { for policy in try(local.fabric_policies.l2_mtu_policies, []) : policy.name => policy if local.modules.aci_l2_mtu_policy && var.manage_fabric_policies }
to
for_each = { for policy in try(local.fabric_policies.l2_mtu_policies, []) : policy.name => policy if local.modules.aci_l2_mtu_policy && var.manage_fabric_policies && policy.name != "default" }

Apply service graph template uncertainty.

Good day,

After you have created a service graph template in ACI you have to right click it to and click apply. This apply option does not seem to be available from the module.

Is it anything that I dont know, or is this not implemented per now?

Best regards

Question: Placement of default variables for Data Plane Policing Policies

Hello, I'm writing a module for Data Plane Policing policies which can be defined as an access_policy.interface_policy (like cdp) to be attached to an interface policy group; or it can be defined as a Tenant policy to be attached to an EPG or L3out logical interface profile.

My question is for the data_plane_policer_policies definition in defaults.yaml - where would be the best place to place a single defaults definition for something that needs to be under defaults.apic.access_policies.interface_policies and defaults.apic.tenants.policies.

Should there be a single definition, or should it just be copied to those two locations?

Enhancement: Support VM attributes in uSeg EPGs

How can I create a useg epg

Dependency issue with `terraform-aci-pod-setup` module

This error was reported:

╷
│ Error: The post rest request failed
│ 
│   with module.aci.module.aci_pod_setup["2"].aci_rest_managed.fabricExtRoutablePodSubnet["172.31.3.0/24"],
│   on .terraform/modules/aci/modules/terraform-aci-pod-setup/main.tf line 11, in resource "aci_rest_managed" "fabricExtRoutablePodSubnet":
│   11: resource "aci_rest_managed" "fabricExtRoutablePodSubnet" {
│ 
│ Code: 400 Response: [map[error:map[attributes:map[code:102 text:configured object ((Dn0)) not found Dn0=uni/controller/setuppol/setupp-2/extrtpodsubnet-[172.31.3.0/24],
│ ]]]], err: %!s(<nil>). Please report this issue to the provider developers.
╵ 

The configuration applied successfully in a subsequent apply operation.

I believe the terraform-aci-pod-setup module needs a dependency on the aci_rest_managed.fabricSetupP resource to be added to the aci_rest_managed.fabricExtRoutablePodSubnet resource.

Proposed solution:

resource "aci_rest_managed" "fabricExtRoutablePodSubnet" {
  for_each   = { for extpool in var.external_tep_pools : extpool.prefix => extpool }
  dn         = "uni/controller/setuppol/setupp-${var.pod_id}/extrtpodsubnet-[${each.value.prefix}]"
  class_name = "fabricExtRoutablePodSubnet"
  content = {
    pool                = each.value.prefix
    reserveAddressCount = each.value.reserved_address_count
    state               = "active"
  }

  depends_on = [
    aci_rest_managed.fabricSetupP
  ]
}

Resource changes where values are not defined.

Some resources prompts for changes when values are not defined, this is affecting;

Bridge Domain, where vmac is changed from "not applicable" to "" when not defined:

  # module.aci.module.aci_bridge_domain["mgmt/192.168.0.0"].aci_rest_managed.fvBD will be updated in-place
  ~ resource "aci_rest_managed" "fvBD" {
      ~ content    = {
          ~ "vmac"                  = "not-applicable" -> ""
            # (17 unchanged elements hidden)
        }
        id         = "uni/tn-mgmt/BD-192.168.0.0"
        # (3 unchanged attributes hidden)
    }

Inband and outband node adress where ipv6 addr and gateway is not defined is also changed from "::" to "":

  # module.aci.module.aci_inband_node_address["1901"].aci_rest_managed.mgmtRsInBStNode will be updated in-place
  ~ resource "aci_rest_managed" "mgmtRsInBStNode" {
      ~ content    = {
          ~ "v6Addr" = "::" -> ""
          ~ "v6Gw"   = "::" -> ""
            # (3 unchanged elements hidden)
        }
        id         = "uni/tn-mgmt/mgmtp-default/inb-inband/rsinBStNode-[topology/pod-1/node-1901]"
        # (3 unchanged attributes hidden)
    }

  # module.aci.module.aci_oob_node_address["1901"].aci_rest_managed.mgmtRsOoBStNode will be updated in-place
  ~ resource "aci_rest_managed" "mgmtRsOoBStNode" {
      ~ content    = {
          ~ "v6Addr" = "::" -> ""
          ~ "v6Gw"   = "::" -> ""
            # (3 unchanged elements hidden)
        }
        id         = "uni/tn-mgmt/mgmtp-default/oob-ooband/rsooBStNode-[topology/pod-1/node-1901]"
        # (3 unchanged attributes hidden)
    }

Allow the Ipv6 Link-Local address to be customizable on L3out interface profile

See original issue: netascode/terraform-aci-l3out-interface-profile#17
The IPv6 Link-Local address cannot be changed.
The value is hardcoded to "llAddr = "::""

Question - Pod Policies and auto generation.

While trying to apply pod policies it fails like this:

╷
│ Error: The post rest request failed
│
│   with module.aci.module.aci_fabric_pod_profile_auto["1"].aci_rest_managed.fabricRsPodPGrp["pod-1"],
│   on .terraform/modules/aci/modules/terraform-aci-fabric-pod-profile/main.tf line 35, in resource "aci_rest_managed" "fabricRsPodPGrp":
│   35: resource "aci_rest_managed" "fabricRsPodPGrp" {
│
│ Code: 400 Response: [map[error:map[attributes:map[code:182 text:Validation failed: Validation failed: there is POD selector of type ALL and one of type range. Last considered for validation:
│ Dn0=uni/fabric/podprof-default/pods-default-typ-ALL, ]]]], err: %!s(<nil>). Please report this issue to the provider developers.

Here is my pod policy config:

---
apic:
 pod_policies:
   pods:
     - id: 1
       tep_pool: 10.4.96.0/19
       policy: default

If I try to add this to the fabric policies:

---
apic:
 fabric_policies:
   pod_profiles:
     - name: default
       selectors:
         - name: default 
           type: all
 pod_policies:
   pods:
     - id: 1
       tep_pool: 10.4.96.0/19
       policy: default

It fails like this:

│ Error: The post rest request failed
│
│   with module.aci.module.aci_fabric_pod_profile_manual["pod-1"].aci_rest_managed.fabricPodS["pod-1"],
│   on .terraform/modules/aci/modules/terraform-aci-fabric-pod-profile/main.tf line 25, in resource "aci_rest_managed" "fabricPodS":
│   25: resource "aci_rest_managed" "fabricPodS" {
│
│ Code: 400 Response: [map[error:map[attributes:map[code:182 text:Validation failed: POD Ids overlap. Dn0=uni/fabric/podprof-pod-1, ]]]], err: %!s(<nil>). Please report this issue to the provider developers.
╵

I'm having this enabled:

apic:
  auto_generate_switch_pod_profiles: true
  auto_generate_pod_profiles: true
  fabric_policies:
    pod_profile_name: "pod-\\g<id>"
    pod_profile_pod_selector_name: "pod-\\g<id>"

Not quite sure about how the auto generation things work either so if someone could explain that aswell it would be awesome.

L3Out Interface Profiles description missing

Hi,

This is a small request for improvement :

I noticed that the description field of the interface_profiles was not available (work as designed/as documented) :

It would be great to add it like this

l3outs:
             [...]
         node_profiles:
             [...]
              interface_profiles:
                - name: vl10
                  description: "SVI Vlan 10" # Support this
                  interfaces:
                   [...]

Thanks in advance

Enhancement to TF module endpoint-loop-protection

Currently only the following values are accepted for i.e. "port-disable" and "bd-learn-disable", missing the option to deselect either option, just to generate a log entry. Disabling the interface or disable learning within a BD can be aggressive and have widespread affect. (ex. trunk interface towards legacy network)

ep_loop_protection:
  admin_state: true
  detection_interval: 180
  detection_multiplier: 10
  **action: port-disable**

thanks

Alexander

Boolean for MCP action (access policies) when set to false not clearing the flag

MCP action boolean when set to false, the expectation is that the flag is cleared on the APIC controller.
Setting the boolean to true is setting correctly the flag on the APIC controller.

mcp:
action: false
admin_state: true
key: password
frequency_sec: 5
initial_delay: 300
loop_detection: 5
per_vlan: true

MGMT EPG only supports oob/inb for validation and NOT default

Within the mgmt tenant, there is a default node mgmt epg (Out-of-Band EPG - default) , however, this value is not accepted as entry for validation for different fabric policies such as dns, tacacs etc.

However this is the default epg used by the APIC controllers and we cannot change this, resulting in mismatching node mgmt epg for leafs/spines vs apic and thus this reflects the contract that needs to be applied.

It would make sense to use the default oob epg that is available under the mgmt tenant to have all leafs/spines/apic use the default oob epg.

ERROR:

Error: Invalid value for variable
│
│ on .terraform/modules/nac-aci/aci_fabric_policies.tf line 160, in module "aci_dns_policy":
│ 160: mgmt_epg_type = try(each.value.mgmt_epg, local.defaults.apic.fabric_policies.dns_policies.mgmt_epg)
│ ├────────────────
│ │ var.mgmt_epg_type is "default"
│
│ Allowed values are inb or oob.
│
│ This was checked by the validation rule at .terraform/modules/nac-aci/modules/terraform-aci-dns-policy/variables.tf:16,3-13.

Feature Request - Multiple Match rules per context in apic.tenants.l3outs.import_route_map.contexts

Current example and usage only allows for a single match rule per context in import_route_map and export_route_map

          import_route_map:
            description: desc
            type: global
            contexts:
              - name: CONTEXT1
                description: desc1
                action: deny
                order: 2
                match_rule: MATCH1
                set_rule: SET1

Would like to be able to define multiple match rules per context similar to apic.tenants.polices

New usage and example would be:

          import_route_map:
            description: desc
            type: global
            contexts:
              - name: CONTEXT1
                description: desc1
                action: deny
                order: 2
                match_rule: 
                  - MATCH1
                  - MATCH2
                  - MATCHn
                set_rule: SET1

question: folder custom file modules.yaml in cisco ACI nexus as code

I would like to know in which folder I have to put the custom modules.yaml file since it only uses the one inside the .terraform folder which enables all the modules creating resources not required with the default setting. also I would like to know how the external bridge domains can be created since it seems to be an absent feature