Fix manual_underlay_allocation with TOR switches

roles/dtc/common/templates/ndfc_underlay_ip_address.j2

@@ -25,6 +25,7 @@
 {%- endif %}
 {%- endfor %}
 {% if not ((switch.role == 'spine' or switch.role == 'super_spine') and loopback_id == vtep_lo_id) %}
+{% if switch.role != 'tor' %}
 - entity_name: "{{ switch_list[switch.name].serial_number }}~loopback{{ loopback_id }}"
   pool_type: IP
   pool_name: "LOOPBACK{{ loopback_id }}_IP_POOL"
@@ -33,6 +34,7 @@
   switch:
     - "{{ switch_list[switch.name].management_ipv4_address }}"
 {% endif %}
+{% endif %}
 {% endfor %}
 {% endmacro %}
 {# resource for routing loopback #}
@@ -42,13 +44,15 @@
 {# resource for leaf in vPC #}
 {% if data_model_extended.vxlan.topology.vpc_peers is defined %}
 {% for peer in data_model_extended.vxlan.topology.vpc_peers %}
+{% if switch_list[peer.peer1].role != 'tor' and switch_list[peer.peer2].role != 'tor' %}
 - entity_name: "{{ switch_list[peer.peer1].serial_number }}~{{ switch_list[peer.peer2].serial_number }}~loopback{{ vtep_lo_id }}"
   pool_type: IP
   pool_name: "LOOPBACK{{ vtep_lo_id }}_IP_POOL"
   scope_type: device_interface
   resource: "{{ peer.vtep_vip }}"
   switch:
     - "{{ switch_list[peer.peer1].management_ipv4_address }}"
+{% endif %}
 {% endfor %}
 {% endif %}
 {# build p2p links - Check if ipv4 or ipv6 is present to distinct with fabric_link with template #}

roles/validate/files/rules/ibgp_vxlan/208_manual_ipaddress_allocation.py

@@ -48,6 +48,11 @@ def match(cls, data_model):
         switches = cls.safeget(data_model, ["vxlan", "topology", "switches"])
         for switch in switches:
             switch_name = switch.get("name")
+            switch_role = switch.get("role", "").lower()
+
+            if switch_role == "tor":
+                cls.validate_tor_no_underlay(switch, switch_name, underlay_routing_loopback_id, underlay_vtep_loopback_id)
+                continue
 
             if "interfaces" not in switch:
                 cls.results.append(f"Missing interfaces in vxlan.topology.switches.{switch_name}")
@@ -67,18 +72,68 @@ def match(cls, data_model):
             vtep_loopback_name = f"loopback{underlay_vtep_loopback_id}"
             vtep_loopback_found = cls.check_interface_with_ipv4(interfaces, vtep_loopback_name)
 
-            switch_role = switch.get("role", "").lower()
-
-            if not vtep_loopback_found and switch_role != "spine":
+            if not vtep_loopback_found and switch_role not in ["spine"]:
                 cls.results.append(
                     f"Switch '{switch_name}' is missing a configured interface '{vtep_loopback_name}' with an IPv4 address."
                 )
 
         # Check if vtep_ip exist in vpc_peers
         cls.validate_vpc_peers_and_vtep_vip(data_model)
 
+        # Check if TOR switches have IPv4 on fabric links
+        cls.validate_tor_no_fabric_link_ipv4(data_model)
+
         return cls.results
 
+    @classmethod
+    def validate_tor_no_underlay(cls, switch, switch_name, routing_lo_id, vtep_lo_id):
+        """
+        Validates that TOR switches do not have underlay IP configuration.
+        TOR switches do not participate in the VXLAN underlay.
+        """
+        interfaces = switch.get("interfaces", [])
+        for interface in interfaces:
+            intf_name = interface.get("name", "").lower()
+            if intf_name in (f"loopback{routing_lo_id}", f"lo{routing_lo_id}",
+                             f"loopback{vtep_lo_id}", f"lo{vtep_lo_id}"):
+                if interface.get("ipv4_address"):
+                    cls.results.append(
+                        f"TOR switch '{switch_name}': underlay loopback '{interface.get('name')}' with IPv4 "
+                        "should not be defined (TOR switches do not participate in VXLAN underlay)."
+                    )
+
+    @classmethod
+    def validate_tor_no_fabric_link_ipv4(cls, data_model):
+        """
+        Validates that fabric links involving TOR switches do not have IPv4 underlay configuration.
+        """
+        check = cls.data_model_key_check(data_model, ["vxlan", "topology", "fabric_links"])
+        if 'fabric_links' not in check['keys_data']:
+            return
+
+        switches = cls.safeget(data_model, ["vxlan", "topology", "switches"]) or []
+        tor_names = {sw.get("name", "") for sw in switches if sw.get("role", "").lower() == "tor"}
+
+        if not tor_names:
+            return
+
+        fabric_links = cls.safeget(data_model, ["vxlan", "topology", "fabric_links"])
+        for link in fabric_links:
+            src = link.get("source_device", "")
+            dst = link.get("dest_device", "")
+            ipv4_config = link.get("ipv4", {})
+
+            if not ipv4_config:
+                continue
+
+            if src in tor_names or dst in tor_names:
+                tor_device = src if src in tor_names else dst
+                if ipv4_config.get("subnet") or ipv4_config.get("source_ipv4") or ipv4_config.get("dest_ipv4"):
+                    cls.results.append(
+                        f"Fabric link '{src}' → '{dst}': IPv4 underlay configuration should not be defined "
+                        f"for TOR switch '{tor_device}' (TOR switches do not participate in VXLAN underlay)."
+                    )
+
     @classmethod
     def validate_vpc_peers_and_vtep_vip(cls, data_model):
         """
@@ -89,14 +144,26 @@ def validate_vpc_peers_and_vtep_vip(cls, data_model):
             # If switches key is missing, no need to proceed
             return cls.results
         vpc_peers = cls.safeget(data_model, ["vxlan", "topology", "vpc_peers"])
+        switches = cls.safeget(data_model, ["vxlan", "topology", "switches"]) or []
+        switch_role_map = {sw.get("name", ""): sw.get("role", "").lower() for sw in switches}
         vtep_vip_list = set()
         vpc_peers_list = []
 
         for peer in vpc_peers:
             peer_name = f"{peer.get('peer1')}-{peer.get('peer2')}"
             vpc_peers_list.append(peer_name)
+
+            peer1_role = switch_role_map.get(peer.get("peer1", ""), "")
+            peer2_role = switch_role_map.get(peer.get("peer2", ""), "")
+            if peer1_role == "tor" or peer2_role == "tor":
+                if peer.get("vtep_vip"):
+                    cls.results.append(
+                        f"vPC peer '{peer_name}': vtep_vip should not be defined for TOR switches "
+                        "(TOR switches do not participate in VXLAN underlay)."
+                    )
+                continue
+
             vtep_vip = peer.get("vtep_vip", False)
-            # Check if vtep_vip is defined
             if not vtep_vip:
                 cls.results.append(f"vPC peer '{peer_name}' is missing a defined vtep_vip address.")
                 continue
@@ -114,7 +181,47 @@ def validate_vpc_peers_and_vtep_vip(cls, data_model):
                 # Check IP address under vxlan.topology.fabric_link only if
                 # fabric numbering is P2P or fabric peering is false (Use Fabric Peer-Link)
                 if peer.get("fabric_peering") is False or interface_numbering["fabric_interface_numbering"] == "p2p":
-                    cls.validate_fabric_links(data_model, vpc_peers_list)
+                    if interface_numbering["fabric_interface_numbering"] == "p2p":
+                        cls.validate_fabric_links(data_model, vpc_peers_list)
+                    else:
+                        cls.validate_vpc_peer_fabric_link(data_model, peer)
+
+    @classmethod
+    def validate_vpc_peer_fabric_link(cls, data_model, peer):
+        """
+        Validates that a specific vPC peer with fabric_peering=false has a fabric link with IPv4 config.
+        Only checks the link between the two peers, not all switches.
+        """
+        peer1 = peer.get("peer1")
+        peer2 = peer.get("peer2")
+
+        check = cls.data_model_key_check(data_model, ["vxlan", "topology", "fabric_links"])
+        if 'fabric_links' not in check['keys_data']:
+            cls.results.append(
+                f"Fabric link between '{peer1}' and '{peer2}' is missing (required for vPC with fabric_peering=false)."
+            )
+            return
+
+        fabric_links = cls.safeget(data_model, ["vxlan", "topology", "fabric_links"])
+        peer_link = None
+        for link in fabric_links:
+            src = link.get("source_device", "")
+            dst = link.get("dest_device", "")
+            if (src == peer1 and dst == peer2) or (src == peer2 and dst == peer1):
+                peer_link = link
+                break
+
+        if not peer_link:
+            cls.results.append(
+                f"Fabric link between '{peer1}' and '{peer2}' is missing (required for vPC with fabric_peering=false)."
+            )
+            return
+
+        ipv4_config = peer_link.get("ipv4", {})
+        if not ipv4_config or not ipv4_config.get("subnet") or not ipv4_config.get("source_ipv4") or not ipv4_config.get("dest_ipv4"):
+            cls.results.append(
+                f"Fabric link between '{peer1}' and '{peer2}' is missing IPv4 configuration (required for vPC with fabric_peering=false)."
+            )
 
     @classmethod
     def validate_fabric_links(cls, data_model, vpc_peers_list):
@@ -154,7 +261,7 @@ def validate_fabric_links(cls, data_model, vpc_peers_list):
         # and P2P configured
 
         switches = cls.safeget(data_model, ["vxlan", "topology", "switches"])
-        switch_names = [switch.get("name") for switch in switches if switch.get("role", "").lower() not in ["spine", "border_gateway_spine"]]
+        switch_names = [switch.get("name") for switch in switches if switch.get("role", "").lower() not in ["spine", "border_gateway_spine", "tor"]]
 
         # If switch in switch_names not in regex fabric_links_list:
         # Switch doesn't have fabric link configured
@@ -184,10 +291,15 @@ def validate_fabric_links(cls, data_model, vpc_peers_list):
 
         # Check if vpc_peers is on fabric_link
         vpc_peers = cls.safeget(data_model, ["vxlan", "topology", "vpc_peers"])
+        switch_role_map = {sw.get("name", ""): sw.get("role", "").lower() for sw in switches}
         for peer in vpc_peers:
             peer1 = f"{peer.get('peer1')}-{peer.get('peer2')}"
             peer2 = f"{peer.get('peer2')}-{peer.get('peer1')}"
             fabric_peering = peer.get("fabric_peering", False)
+
+            if switch_role_map.get(peer.get("peer1", ""), "") == "tor" or switch_role_map.get(peer.get("peer2", ""), "") == "tor":
+                continue
+
             # Skip fabric link validation when fabric_peering is true
             # because vPC uses virtual peer-link instead of physical fabric links
             if fabric_peering is False: