docs: add auth_proto switch discovery example

docs/SWITCH_DISCOVERY_AUTH_PROTO_GUIDE.md

@@ -0,0 +1,110 @@
+# Switch Discovery Authentication Protocol Guide
+
+## Overview
+
+This guide explains how to configure `auth_proto` — the SNMPv3 authentication and privacy
+protocol that NDFC uses when discovering a switch for the first time.
+
+> [!NOTE]
+> This guide covers **normal initial switch discovery** (switches already reachable by IP).
+> For POAP and preprovision flows, see [SWITCH_DISCOVERY_CREDENTIALS_GUIDE.md](./SWITCH_DISCOVERY_CREDENTIALS_GUIDE.md).
+
+## What auth_proto Controls
+
+When NDFC discovers a switch, it uses SNMPv3 to test reachability and gather inventory.
+`auth_proto` selects the authentication and privacy algorithms for that SNMPv3 session.
+
+The field is set in the data model under `vxlan.global` or `vxlan.multisite.isn`,
+depending on the fabric type:
+
+| Fabric type | Data model path |
+|---|---|
+| VXLAN EVPN (iBGP) | `vxlan.global.ibgp.auth_proto` |
+| VXLAN EVPN (eBGP) | `vxlan.global.ebgp.auth_proto` |
+| External | `vxlan.global.external.auth_proto` |
+| ISN | `vxlan.multisite.isn.auth_proto` |
+
+### Supported Values
+
+| Value | Authentication | Privacy | Default |
+|---|---|---|---|
+| `MD5` | MD5 | — | ✓ |
+| `SHA` | SHA-1 | — | |
+| `MD5_DES` | MD5 | DES | |
+| `MD5_AES` | MD5 | AES-128 | |
+| `SHA_DES` | SHA-1 | DES | |
+| `SHA_AES` | SHA-1 | AES-128 | |
+
+## Prerequisites
+
+Before running NaC with a non-default `auth_proto`, two prerequisites must be satisfied.
+
+### 1. NX-OS: SNMPv3 user configuration
+
+The SNMPv3 user must exist on every switch with authentication and privacy algorithms
+that match the selected `auth_proto`. For `SHA_AES`:
+
+```
+username <USERNAME> password <PASSWORD> role network-admin
+snmp-server user <USERNAME> network-admin auth sha <PASSWORD> priv <PASSWORD>
+```
+
+### 2. Environment variables
+
+NDFC uses `NDFC_SW_USERNAME` and `NDFC_SW_PASSWORD` to reach the switch during discovery.
+These values must match `<USERNAME>` and `<PASSWORD>` used in the NX-OS configuration above.
+
+```bash
+export NDFC_SW_USERNAME='<USERNAME>'
+export NDFC_SW_PASSWORD='<PASSWORD>'
+```
+
+In `group_vars`, the standard lookup pattern is:
+
+```yaml
+# group_vars/nd/connection.yaml
+ndfc_switch_username: "{{ lookup('env', 'NDFC_SW_USERNAME') }}"
+ndfc_switch_password: "{{ lookup('env', 'NDFC_SW_PASSWORD') }}"
+```
+
+## End-to-End SHA_AES Example
+
+### Step 1 — Configure NX-OS on each switch
+
+```
+username nac_discovery password Cisco!123 role network-admin
+snmp-server user nac_discovery network-admin auth sha Cisco!123 priv Cisco!123
+```
+
+### Step 2 — Set environment variables
+
+```bash
+export NDFC_SW_USERNAME='nac_discovery'
+export NDFC_SW_PASSWORD='Cisco!123'
+```
+
+### Step 3 — Set auth_proto in the data model
+
+```yaml title="global.nac.yaml"
+---
+vxlan:
+  fabric:
+    name: myfabric
+    type: VXLAN_EVPN
+  global:
+    ibgp:
+      auth_proto: SHA_AES
+      bgp_asn: "65001"
+      route_reflectors: 2
+      anycast_gateway_mac: 20:20:00:00:00:aa
+```
+
+### Step 4 — Run NaC
+
+```bash
+ansible-playbook vxlan.yaml -i inventory.yaml --limit myfabric --forks 1
+```
+
+> [!NOTE]
+> `SHA_AES` was validated end-to-end through the full NaC pipeline
+> (validate → create → deploy → idempotency) against NDFC 4.2 with NX-OS 10.6.

docs/SWITCH_DISCOVERY_CREDENTIALS_GUIDE.md

@@ -2,7 +2,11 @@
 
 ## Overview
 
-This guide explains how to set and use different credential types with the NaC VXLAN solution for switch discovery with POAP. 
+This guide explains how to set and use different credential types with the NaC VXLAN solution for switch discovery with POAP.
+
+> [!NOTE]
+> This guide covers **POAP and preprovision** discovery credentials (`NDFC_SW_DISCOVERY_USERNAME` / `NDFC_SW_DISCOVERY_PASSWORD`).
+> For the SNMPv3 authentication protocol used during **normal initial switch discovery**, see [SWITCH_DISCOVERY_AUTH_PROTO_GUIDE.md](./SWITCH_DISCOVERY_AUTH_PROTO_GUIDE.md). 
 Understanding the distinction between switch admin credentials and discovery credentials is essential for proper fabric management.
 
 | Action | Device Credentials | Discovery Credentials |