Skip to content

SWITCH_DISCOVERY_AUTH_PROTO_GUIDE.md

Latest commit

 

History

History
110 lines (81 loc) · 3.08 KB

SWITCH_DISCOVERY_AUTH_PROTO_GUIDE.md

File metadata and controls

110 lines (81 loc) · 3.08 KB
Raw

Switch Discovery Authentication Protocol Guide

Overview

This guide explains how to configure auth_proto — the SNMPv3 authentication and privacy protocol that NDFC uses when discovering a switch for the first time.

Note

This guide covers normal initial switch discovery (switches already reachable by IP). For POAP and preprovision flows, see SWITCH_DISCOVERY_CREDENTIALS_GUIDE.md.

What auth_proto Controls

When NDFC discovers a switch, it uses SNMPv3 to test reachability and gather inventory. auth_proto selects the authentication and privacy algorithms for that SNMPv3 session.

The field is set in the data model under vxlan.global or vxlan.multisite.isn, depending on the fabric type:

Fabric type Data model path
VXLAN EVPN (iBGP) vxlan.global.ibgp.auth_proto
VXLAN EVPN (eBGP) vxlan.global.ebgp.auth_proto
External vxlan.global.external.auth_proto
ISN vxlan.multisite.isn.auth_proto

Supported Values

Value Authentication Privacy Default
MD5 MD5 — ✓
SHA SHA-1 —
MD5_DES MD5 DES
MD5_AES MD5 AES-128
SHA_DES SHA-1 DES
SHA_AES SHA-1 AES-128

Prerequisites

Before running NaC with a non-default auth_proto, two prerequisites must be satisfied.

1. NX-OS: SNMPv3 user configuration

The SNMPv3 user must exist on every switch with authentication and privacy algorithms that match the selected auth_proto. For SHA_AES:

username <USERNAME> password <PASSWORD> role network-admin
snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv <PASSWORD>

2. Environment variables

NDFC uses NDFC_SW_USERNAME and NDFC_SW_PASSWORD to reach the switch during discovery. These values must match <USERNAME> and <PASSWORD> used in the NX-OS configuration above.

export NDFC_SW_USERNAME='<USERNAME>'
export NDFC_SW_PASSWORD='<PASSWORD>'

In group_vars, the standard lookup pattern is:

# group_vars/nd/connection.yaml
ndfc_switch_username: "{{ lookup('env', 'NDFC_SW_USERNAME') }}"
ndfc_switch_password: "{{ lookup('env', 'NDFC_SW_PASSWORD') }}"

End-to-End SHA_AES Example

Step 1 — Configure NX-OS on each switch

username nac_discovery password Cisco!123 role network-admin
snmp-server user nac_discovery network-admin auth sha Cisco!123 priv Cisco!123

Step 2 — Set environment variables

export NDFC_SW_USERNAME='nac_discovery'
export NDFC_SW_PASSWORD='Cisco!123'

Step 3 — Set auth_proto in the data model

---
vxlan:
  fabric:
    name: myfabric
    type: VXLAN_EVPN
  global:
    ibgp:
      auth_proto: SHA_AES
      bgp_asn: "65001"
      route_reflectors: 2
      anycast_gateway_mac: 20:20:00:00:00:aa

Step 4 — Run NaC

ansible-playbook vxlan.yaml -i inventory.yaml --limit myfabric --forks 1

Note

SHA_AES was validated end-to-end through the full NaC pipeline (validate → create → deploy → idempotency) against NDFC 4.2 with NX-OS 10.6.