Fabric create/update fails on ND 4.2.1.10 with empty `securityGroupTagMacSegmentation_PREV` when TRM is enabled

[Anders-Marius]

Ansible Version

ansible [core 2.18.18]
  config file = /home/amj/projects/nac-multisite/ansible.cfg
  configured module search path = ['/home/amj/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/amj/projects/nac-multisite/.venv/lib/python3.14/site-packages/ansible
  ansible collection location = /home/amj/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/amj/projects/nac-multisite/.venv/bin/ansible
  python version = 3.14.4 (main, Jun 18 2026, 14:25:02) [GCC 15.2.0] (/home/amj/projects/nac-multisite/.venv/bin/python3.14)
  jinja version = 3.1.6
  libyaml = True

Ansible Collection Versions

# /home/amj/.ansible/collections/ansible_collections
Collection                               Version
---------------------------------------- -------
ansible.netcommon                        8.6.1
ansible.utils                            6.0.3
cisco.dcnm                               3.12.1
cisco.nac_dc_vxlan                       0.8.1
community.general                        13.2.0
community.library_inventory_filtering_v1 1.1.5

Cisco Nexus Dashboard Version

Version 4.2.1.10 (GUI reports)
Version 12.5.0.475 (according to "appcenter/cisco/ndfc/api/about/version"

Cisco NX-OS Version

10.5(1) on Nexus 9000V

Which role is this issue related to?

cisco.nac_dc_vxlan.dtc.create

Which section of the data model is this issue related to?

vxlan.underlay

Expected Behavior

Tried to add Multicast TRM to the EVPN/VXLAN fabric

Actual Behavior

The `dcnm_fabric` module fails at the `fabric` step. ND returns HTTP 500:


DATA: Invalid JSON response: Failed to update the fabric, due to invalid fields
[{securityGroupTagMacSegmentation_PREV=}], please provide valid fields
[{securityGroupTagMacSegmentation_PREV=false}] for fabric-settings
MESSAGE: Internal Server Error
METHOD: PUT
REQUEST_PATH: https://<ND-IP>/appcenter/cisco/ndfc/api/v1/lan-fabric/rest/control/fabrics/DK-DC1/Easy_Fabric
RETURN_CODE: 500


Longer output:
--------------

EXEC /bin/sh -c 'rm -f -r /home/amj/.ansible/tmp/ansible-local-155826p67uks5w/ansible-tmp-1785567753.1127424-156211-247981258926738/ > /dev/null 2>&1 && sleep 0'
fatal: [DK-DC1]: FAILED! => {
    "changed": false,
    "msg": "Create pipeline failed at step 'fabric' (dcnm_fabric): Module failed.",
    "results": [
        {
            "module": "dcnm_fabric",
            "resource_name": "fabric",
            "result": {
                "changed": false,
                "diff": [
                    {
                        "sequence_number": 1
                    }
                ],
                "failed": true,
                "invocation": {
                    "module_args": {
                        "config": [
                            {
                                "AAA_REMOTE_IP_ENABLED": false,
                                "AAA_SERVER_CONF": "",
                                "ADVERTISE_PIP_BGP": false,
                                "ADVERTISE_PIP_ON_BORDER": true,
                                "ANYCAST_GW_MAC": "de:ad:be:ef:00:01",
                                "ANYCAST_RP_IP_RANGE": "10.1.4.0/24",
                                "BANNER": "",
                                "BFD_ENABLE": false,
                                "BGP_AS": "65001",
                                "BGP_AUTH_ENABLE": false,
                                "BGP_LB_ID": 0,
                                "DEPLOY": false,
                                "ENABLE_FABRIC_VPC_DOMAIN_ID": false,
                                "ENABLE_L3VNI_NO_VLAN": false,
                                "ENABLE_NETFLOW": false,
                                "ENABLE_NXAPI": true,
                                "ENABLE_NXAPI_HTTP": false,
                                "ENABLE_PVLAN": false,
                                "ENABLE_SGT": false,
                                "ENABLE_TRM": true,
                                "EXTRA_CONF_INTRA_LINKS": "",
                                "EXTRA_CONF_LEAF": "",
                                "EXTRA_CONF_SPINE": "",
                                "EXTRA_CONF_TOR": "",
                                "FABRIC_INTERFACE_TYPE": "p2p",
                                "FABRIC_MTU": 9216,
                                "FABRIC_NAME": "DK-DC1",
                                "FABRIC_TYPE": "VXLAN_EVPN",
                                "FABRIC_VPC_QOS": false,
                                "FEATURE_PTP": false,
                                "GRFIELD_DEBUG_FLAG": "Disable",
                                "HOST_INTF_ADMIN_STATE": true,
                                "IBGP_PEER_TEMPLATE": "",
                                "IBGP_PEER_TEMPLATE_LEAF": "",
                                "L2_HOST_INTF_MTU": 9216,
                                "L2_SEGMENT_ID_RANGE": "30000-49000",
                                "L3VNI_MCAST_GROUP": "239.1.1.0",
                                "L3_PARTITION_ID_RANGE": "50000-59000",
                                "LINK_STATE_ROUTING": "ospf",
                                "LINK_STATE_ROUTING_TAG": "UNDERLAY",
                                "LOOPBACK0_IP_RANGE": "10.1.1.0/24",
                                "LOOPBACK1_IP_RANGE": "10.1.2.0/24",
                                "MPLS_HANDOFF": false,
                                "MULTICAST_GROUP_SUBNET": "239.1.1.0/25",
                                "MVPN_VRI_ID_RANGE": "3000-3099",
                                "NETWORK_VLAN_RANGE": "2300-2999",
                                "NVE_LB_ID": 1,
                                "NXAPI_HTTPS_PORT": 443,
                                "OSPF_AREA_ID": "0.0.0.0",
                                "OSPF_AUTH_ENABLE": false,
                                "OVERLAY_MODE": "cli",
                                "PIM_HELLO_AUTH_ENABLE": false,
                                "REPLICATION_MODE": "Multicast",
                                "RP_COUNT": "2",
                                "RP_LB_ID": 250,
                                "RP_MODE": "asm",
                                "RR_COUNT": 2,
                                "SNMP_SERVER_HOST_TRAP": true,
                                "STATIC_UNDERLAY_IP_ALLOC": false,
                                "STP_ROOT_OPTION": "unmanaged",
                                "SUBNET_RANGE": "10.1.3.0/24",
                                "SUBNET_TARGET_MASK": 31,
                                "TCAM_ALLOCATION": true,
                                "UNDERLAY_IS_V6": false,
                                "VPC_AUTO_RECOVERY_TIME": 360,
                                "VPC_DELAY_RESTORE": 150,
                                "VPC_DELAY_RESTORE_TIME": 150,
                                "VPC_DOMAIN_ID_RANGE": "1-1000",
                                "VPC_ENABLE_IPv6_ND_SYNC": true,
                                "VPC_PEER_KEEP_ALIVE_OPTION": "management",
                                "VPC_PEER_LINK_PO": 500,
                                "VPC_PEER_LINK_VLAN": 3600,
                                "VRF_VLAN_RANGE": "2000-2299",
                                "enableMvpnVriId": true,
                                "preInterfaceConfigLeaf": "",
                                "preInterfaceConfigSpine": "",
                                "preInterfaceConfigTor": ""
                            }
                        ],
                        "skip_validation": false,
                        "state": "merged"
                    }
                },
                "metadata": [
                    {
                        "action": "fabric_update",
                        "check_mode": false,
                        "sequence_number": 1,
                        "state": "merged"
                    }
                ],
                "msg": "Module failed.",
                "response": [
                    {
                        "DATA": "Invalid JSON response: Failed to update the fabric, due to invalid fields [{securityGroupTagMacSegmentation_PREV=}], please provide valid fields [{securityGroupTagMacSegmentation_PREV=false}] for fabric-settings",
                        "MESSAGE": "Internal Server Error",
                        "METHOD": "PUT",
                        "REQUEST_PATH": "https://<removed>:443/appcenter/cisco/ndfc/api/v1/lan-fabric/rest/control/fabrics/DK-DC1/Easy_Fabric",
                        "RETURN_CODE": 500,
                        "sequence_number": 1
                    }
                ],
                "result": [
                    {
                        "changed": false,
                        "sequence_number": 1,
                        "success": false
                    }
                ]
            },
            "status": "failed"
        }
    ]
}

Ansible Playbook

---
# This is the main entry point playbook for calling the various
# roles in this collection.
- name: Manage VXLAN Fabric Configuration
  hosts: DK-DC1
  any_errors_fatal: true
  gather_facts: false

  roles:
    # Prepare service model for all subsequent roles
    # Note - The validate role is run automatically as a prerequisite to the create, deploy, and remove roles.
    #
    # - role: cisco.nac_dc_vxlan.validate
    # -----------------------
    # DataCenter Roles
    #   Role: cisco.netascode_dc_vxlan.dtc manages direct to controller NDFC workflows
    #
    - role: cisco.nac_dc_vxlan.dtc.create
      tags: 'role_create'

    - role: cisco.nac_dc_vxlan.dtc.deploy
      tags: 'role_deploy'

    - role: cisco.nac_dc_vxlan.dtc.remove
      tags: 'role_remove'

Data Model

underlay.nac.yaml:

---
# ============================================================
# SITE 1 underlay — IGP + multicast for TRM
# [CONFIRM] against vxlan/underlay/underlay_general, underlay_ipv4,
#           underlay_ospf (or underlay_isis), underlay_multicast.
# All keys below are commented until confirmed, so this file parses clean.
# ============================================================
vxlan:
  underlay:
    general:
      routing_protocol: ospf
      enable_ipv6_underlay: false
      replication_mode: multicast
      underlay_routing_loopback_id: 0
      underlay_vtep_loopback_id: 1
      underlay_routing_protocol_tag: UNDERLAY
      intra_fabric_interface_mtu: 9216
      layer2_host_interface_mtu: 9216
      unshut_host_interfaces: true
    ipv4:
      fabric_interface_numbering: p2p
      subnet_mask: 31
      underlay_routing_loopback_ip_range: 10.1.1.0/24
      underlay_vtep_loopback_ip_range: 10.1.2.0/24
      underlay_subnet_ip_range: 10.1.3.0/24
      underlay_rp_loopback_ip_range: 10.1.4.0/24
    ipv6:
      enable_ipv6_link_local_address: false
      underlay_subnet_mask: 126
    ospf:
      area_id: 0.0.0.0
      authentication_enable: false
      authentication_key_id: 0
      authentication_key: ""
    multicast:
      rendezvous_points: 2                 
      underlay_rp_loopback_id: 250
      underlay_primary_rp_loopback_id: 0
      rp_mode: asm                         
      enable_mvpn_vri_id_range: true       
      mvpn_vri_id_range:                   
        from: 3000
        to: 3099
      ipv4:
        group_subnet: 239.1.1.0/25
        authentication_enable: false
        trm_enable: true
        trm_default_group: 239.1.1.0

Steps to Reproduce

Add TRM parameters to underlay.nac.yaml.

Relevant Debug Output

[Anders-Marius]

If I change the "dc_vxlan_fabric_security.j2" from this:

{# Auto-generated NDFC DC VXLAN EVPN Security config data structure for fabric {{ vxlan.fabric.name }} #}
{% if not (vxlan.underlay.general.enable_ipv6_underlay | default(defaults.vxlan.underlay.general.enable_ipv6_underlay) | ansible.builtin.bool) %}
{% set enable_sgt = false %}
ENABLE_SGT: {{ enable_sgt | lower }}
{% if enable_sgt and (ndfc_version | cisco.nac_dc_vxlan.version_compare('12.5.0', '>=')) %}
securityGroupTagMacSegmentation: false
securityGroupTagMacSegmentation_PREV: false
{% endif %}
{% endif %}

To this (only change the version from 12.5.0 to 12.5.0.475. The TRM configuration is pushed ND and the devices:

{# Auto-generated NDFC DC VXLAN EVPN Security config data structure for fabric {{ vxlan.fabric.name }} #}
{% if not (vxlan.underlay.general.enable_ipv6_underlay | default(defaults.vxlan.underlay.general.enable_ipv6_underlay) | ansible.builtin.bool) %}
{% set enable_sgt = false %}
ENABLE_SGT: {{ enable_sgt | lower }}
{% if ndfc_version | cisco.nac_dc_vxlan.version_compare('12.5.0.475', '>=') %}
securityGroupTagMacSegmentation: false
securityGroupTagMacSegmentation_PREV: false
{% endif %}
{% endif %}