TOR switches fail with manual_underlay_allocation: true

[ccoueffe]

Description

When a fabric topology includes TOR switches and manual_underlay_allocation: true, both the validate role (rule 208) and the underlay IP address template fail because they don't account for TOR switches not participating in the VXLAN underlay.

Steps to Reproduce

1. Define a VXLAN_EVPN fabric with manual_underlay_allocation: true and fabric_interface_numbering: unnumbered
2. Add TOR switches to the topology with a vPC pair (fabric_peering: false)
3. Define tor_peers linking TORs to parent leaves
4. Run the playbook

vxlan:
  underlay:
    general:
      manual_underlay_allocation: true
      fabric_interface_numbering: unnumbered
  topology:
    vpc_peers:
      - peer1: dc1-lf1
        peer2: dc1-lf2
        vtep_vip: 100.2.0.10
        fabric_peering: true
      - peer1: dc1-tor-1
        peer2: dc1-tor-2
        fabric_peering: false
    tor_peers:
      - parent_leaf1: dc1-lf1
        parent_leaf2: dc1-lf2
        tor1: dc1-tor-1
        tor2: dc1-tor-2
    switches:
      - name: dc1-lf1
        role: leaf
      - name: dc1-tor-1
        role: tor
      - name: dc1-tor-2
        role: tor

Expected Behavior

• Validate passes (TOR switches should not require underlay IPs, loopbacks, or vtep_vip)
• Template renders successfully (TOR excluded from underlay IP resource allocation)

Actual Behavior

Validate fails with rule 208 errors:

Semantic error, rule 208: Verify IP addresses when manual_underlay_allocation is true
- "Fabric link not found for 'dc1-tor-1'."
- "Switch 'dc1-tor-1' is missing a configured interface 'loopback0' with an IPv4 address."

Template fails with:

Template rendering failed for underlay_ip_address: 'dict object' has no attribute 'vtep_vip'

Root Cause

TOR switches do not participate in the VXLAN underlay (no VTEP, no underlay routing, no P2P links), but:

1. Rule 208 treats TOR like any other leaf — requires loopbacks with IPv4, vtep_vip on vPC pairs, and fabric links with IPv4
2. ndfc_underlay_ip_address.j2 iterates all vpc_peers and accesses peer.vtep_vip without checking if the pair involves TOR switches
3. validate_fabric_links() (called in P2P mode or when fabric_peering: false) requires ALL non-spine switches to have fabric links — including TOR

Additionally, when fabric_interface_numbering: unnumbered and a non-TOR vPC peer has fabric_peering: false, the rule incorrectly calls validate_fabric_links() which validates ALL switches instead of just the specific vPC peer-link.

Environment

• Cisco Nexus Dashboard: 12.4.1
• NaC DC VXLAN Collection: develop branch
• Fabric type: VXLAN_EVPN with TOR topology