🎯 Modul 6: VXLAN as Code - Das Hauptmodul

📋 Kopieren
┌──────────────────────────────────────────────────────────────────┐
│                        VXLAN Header                               │
├──────────────────────────────────────────────────────────────────┤
│ Outer Ethernet │ Outer IP │ UDP:4789 │ VXLAN │ Inner Frame       │
│   (Underlay)   │(Src→Dst) │          │  VNI  │   (Original)      │
└──────────────────────────────────────────────────────────────────┘

Original Frame: [MAC-A] → [MAC-B] | VLAN 100

Nach VXLAN-Encapsulation:
[VTEP-1 MAC] → [VTEP-2 MAC] | [VTEP-1 IP] → [VTEP-2 IP] | VNI 10100 | [Original Frame]

💡 Der innere Frame bleibt unverändert - wird nur "eingepackt"!

📋 Kopieren
┌─────────────────────────────────────────────────────────────────┐
│                                                                  │
│   📝 YAML Files      →   🦊 Git/GitLab   →   ⚙️ CI/CD Pipeline  │
│   (Data Model)            (Versioning)       (Automation)        │
│                                                                  │
│                              ↓                                   │
│                                                                  │
│   📊 NDFC            ←   🤖 Ansible      ←   🐳 Docker          │
│   (Controller)           (Execution)         (Environment)       │
│                                                                  │
│                              ↓                                   │
│                                                                  │
│                       🔌 Nexus Switches                          │
│                       (Config deployed!)                         │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

📋 Kopieren
vxlan/
├── topology/
│   └── switches          # Welche Switches gehören zur Fabric?
│       ├── serial_number # Eindeutige ID des Switches
│       ├── role          # spine, leaf, border
│       └── management    # IP-Adressen, Gateway
│
├── underlay/
│   ├── general           # Fabric-weite Settings
│   └── interfaces        # Physische Links
│
└── overlay/
    ├── vrfs              # VRF-Definitionen
    ├── networks          # L2/L3 Networks
    └── attach_groups     # Wo werden Networks/VRFs deployed?

📋 Kopierenvxlan:
  topology:
    switches:
      # Spine Switches
      - name: dc1-spine1
        serial_number: FDO24261WAT    # ← Wichtig! Von "show inventory" oder NDFC
        role: spine
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.11
          
      - name: dc1-spine2
        serial_number: FDO24261WAU
        role: spine
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.12
          
      # Leaf Switches
      - name: dc1-leaf1
        serial_number: FDO24261WAV
        role: leaf
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.21
          
      - name: dc1-leaf2
        serial_number: FDO24261WAW
        role: leaf
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.22

📋 Kopierenvxlan:
  overlay:
    vrfs:
      # Produktion VRF
      - name: VRF_PROD
        vrf_id: 150001                    # L3 VNI für den VRF
        vlan_id: 2001                     # SVI VLAN für den VRF
        vrf_attach_group: all_leafs       # Auf welchen Switches deployen?
        description: "Production Environment"
        
      # Entwicklung VRF  
      - name: VRF_DEV
        vrf_id: 150002
        vlan_id: 2002
        vrf_attach_group: all_leafs
        description: "Development Environment"
        
      # DMZ VRF
      - name: VRF_DMZ
        vrf_id: 150003
        vlan_id: 2003
        vrf_attach_group: border_leafs    # Nur auf Border Leafs
        description: "DMZ for external access"

📋 Kopierenvxlan:
  overlay:
    networks:
      # Web-Server Netzwerk
      - name: NET_Web_Servers
        vrf_name: VRF_PROD                # Gehört zum PROD VRF
        net_id: 130001                    # L2 VNI
        vlan_id: 2301                     # Access VLAN
        vlan_name: Web-Servers
        gw_ip_address: "192.168.10.1/24"  # Anycast Gateway
        network_attach_group: all_leafs
        description: "Web Server Segment"
        
      # Datenbank Netzwerk
      - name: NET_Databases
        vrf_name: VRF_PROD
        net_id: 130002
        vlan_id: 2302
        vlan_name: Databases
        gw_ip_address: "192.168.20.1/24"
        network_attach_group: db_leafs    # Nur auf bestimmten Leafs
        description: "Database Segment"
        
      # Dev Test Netzwerk
      - name: NET_Dev_Test
        vrf_name: VRF_DEV
        net_id: 130101
        vlan_id: 2401
        vlan_name: Dev-Testing
        gw_ip_address: "192.168.100.1/24"
        network_attach_group: all_leafs
        description: "Development Testing"

📋 Kopierenvxlan:
  overlay:
    network_attach_groups:
      # Alle Leafs
      - name: all_leafs
        switches:
          - hostname: dc1-leaf1
            ports: []                      # Keine spezifischen Ports = Trunk
          - hostname: dc1-leaf2
            ports: []
            
      # Nur Leafs mit Datenbank-Servern
      - name: db_leafs
        switches:
          - hostname: dc1-leaf1
            ports: [Ethernet1/10, Ethernet1/11]   # Spezifische Access Ports
            
      # Leafs mit Server-Anbindung + Ports
      - name: web_leafs
        switches:
          - hostname: dc1-leaf1
            ports: [Ethernet1/13, Ethernet1/14]
          - hostname: dc1-leaf2
            ports: [Ethernet1/13, Ethernet1/14]
            
    # VRF Attach Groups (separart für VRFs)
    vrf_attach_groups:
      - name: all_leafs
        switches:
          - hostname: dc1-leaf1
          - hostname: dc1-leaf2
          
      - name: border_leafs
        switches:
          - hostname: dc1-leaf1             # Border Leaf für External Routing

📋 Kopieren# Was wird validiert:
# ✓ YAML Syntax korrekt?
# ✓ Alle Pflichtfelder vorhanden?
# ✓ VRF existiert, wenn Network ihn referenziert?
# ✓ Attach Group existiert?
# ✓ Keine doppelten VNIs oder VLANs?

📋 Kopieren# Was passiert:
# → Fabric wird erstellt/aktualisiert
# → Switches werden der Fabric hinzugefügt
# → VRFs werden angelegt (Status: PENDING)
# → Networks werden angelegt (Status: PENDING)
# → Attach-Beziehungen werden definiert

📋 Kopieren# Was passiert:
# → NDFC generiert die CLI-Befehle
# → Config wird auf Switches gepushed
# → Status wechselt von PENDING → DEPLOYED
# → Switches erhalten die VLANs, VRFs, VNIs

📋 Kopieren---
all:
  hosts:
    ndfc:
      ansible_host: "{{ lookup('env', 'ND_HOST') }}"
      ansible_user: "{{ lookup('env', 'ND_USERNAME') }}"
      ansible_password: "{{ lookup('env', 'ND_PASSWORD') }}"
      ansible_connection: ansible.netcommon.httpapi
      ansible_httpapi_port: 443
      ansible_httpapi_use_ssl: true
      ansible_httpapi_validate_certs: false
      ansible_network_os: cisco.dcnm.dcnm
      
      # NaC-spezifische Variablen
      vxlan_fabric: "{{ lookup('env', 'FABRIC_NAME') | default('MyFabric') }}"
      nac_data_model: "data/"            # Pfad zu den YAML-Dateien

📋 Kopieren---
# VXLAN Network as Code Playbook
- name: NaC for VXLAN EVPN
  hosts: ndfc
  gather_facts: false
  
  roles:
    # 1. Validierung des Data Models
    - role: cisco.nac_dc_vxlan.validate
      tags: [validate]
      
    # 2. Konfiguration in NDFC erstellen  
    - role: cisco.nac_dc_vxlan.create
      tags: [create]
      
    # 3. Config auf Switches deployen
    - role: cisco.nac_dc_vxlan.deploy
      tags: [deploy]
      
    # 4. Optional: Nicht definiertes entfernen
    # - role: cisco.nac_dc_vxlan.remove
    #   tags: [remove]

📋 Kopierenvxlan-fabric/
├── ansible.cfg              # Ansible-Konfiguration
├── inventory.yaml           # NDFC Connection
├── vxlan.yaml              # Haupt-Playbook
│
├── data/                    # 📂 DATA MODEL (Single Source of Truth)
│   ├── vxlan.yaml          # Haupt-Datei mit allem
│   └── optional/           # Oder aufgeteilt:
│       ├── topology.yaml   #   - Nur Switches
│       ├── vrfs.yaml       #   - Nur VRFs
│       └── networks.yaml   #   - Nur Networks
│
├── .gitlab-ci.yml          # CI/CD Pipeline
└── .env.example            # Environment Variables Template

📋 Kopieren# NDFC/Nexus Dashboard Connection
export ND_HOST="ndfc.lab.local"
export ND_USERNAME="admin"
export ND_PASSWORD="SuperSecretPassword123!"

# Fabric Settings
export FABRIC_NAME="DC1-VXLAN-Fabric"

# Optional: Ansible Settings
export ANSIBLE_HOST_KEY_CHECKING=false
export ANSIBLE_PYTHON_INTERPRETER=auto_silent

📋 Kopieren# Option 1: Manuell vor Ausführung
source .env
ansible-playbook -i inventory.yaml vxlan.yaml

# Option 2: In der CI/CD Pipeline (GitLab)
# Variables werden in Settings → CI/CD → Variables definiert

# Option 3: Mit einem .envrc (direnv)
# Automatisches Laden beim Betreten des Verzeichnisses

📋 Kopieren---
# ============================================================
# VXLAN EVPN Fabric - Network as Code Data Model
# Single Source of Truth für DC1-VXLAN-Fabric
# ============================================================

vxlan:
  # ----------------------------------------------------------
  # TOPOLOGY: Physische Switches der Fabric
  # ----------------------------------------------------------
  topology:
    switches:
      # Spine Layer
      - name: dc1-spine1
        serial_number: FDO24261WAT
        role: spine
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.11
          
      - name: dc1-spine2
        serial_number: FDO24261WAU
        role: spine
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.12
          
      # Leaf Layer
      - name: dc1-leaf1
        serial_number: FDO24261WAV
        role: leaf
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.21
          
      - name: dc1-leaf2
        serial_number: FDO24261WAW
        role: leaf
        management:
          default_gateway_v4: 10.1.1.1
          management_ipv4_address: 10.1.1.22

  # ----------------------------------------------------------
  # OVERLAY: Virtuelle Netzwerk-Konstrukte
  # ----------------------------------------------------------
  overlay:
    # VRF Definitions
    vrfs:
      - name: VRF_PROD
        vrf_id: 150001
        vlan_id: 2001
        vrf_attach_group: all_leafs
        description: "Production Workloads"
        
      - name: VRF_DEV
        vrf_id: 150002
        vlan_id: 2002
        vrf_attach_group: all_leafs
        description: "Development Environment"
        
      - name: VRF_MGMT
        vrf_id: 150003
        vlan_id: 2003
        vrf_attach_group: all_leafs
        description: "Management Traffic"

    # Network Definitions
    networks:
      # Production Networks
      - name: NET_Web_Frontend
        vrf_name: VRF_PROD
        net_id: 130001
        vlan_id: 2301
        vlan_name: Web-Frontend
        gw_ip_address: "10.10.1.1/24"
        network_attach_group: all_leafs
        description: "Web Frontend Servers"
        
      - name: NET_App_Backend
        vrf_name: VRF_PROD
        net_id: 130002
        vlan_id: 2302
        vlan_name: App-Backend
        gw_ip_address: "10.10.2.1/24"
        network_attach_group: all_leafs
        description: "Application Backend"
        
      - name: NET_Database
        vrf_name: VRF_PROD
        net_id: 130003
        vlan_id: 2303
        vlan_name: Databases
        gw_ip_address: "10.10.3.1/24"
        network_attach_group: db_leafs
        description: "Database Segment"
        
      # Development Networks
      - name: NET_Dev_Apps
        vrf_name: VRF_DEV
        net_id: 130101
        vlan_id: 2401
        vlan_name: Dev-Apps
        gw_ip_address: "10.20.1.1/24"
        network_attach_group: all_leafs
        description: "Development Applications"
        
      # Management Networks
      - name: NET_Infra_Mgmt
        vrf_name: VRF_MGMT
        net_id: 130201
        vlan_id: 2501
        vlan_name: Infra-Mgmt
        gw_ip_address: "10.30.1.1/24"
        network_attach_group: all_leafs
        description: "Infrastructure Management"

    # Attach Groups
    network_attach_groups:
      - name: all_leafs
        switches:
          - hostname: dc1-leaf1
            ports: []
          - hostname: dc1-leaf2
            ports: []
            
      - name: db_leafs
        switches:
          - hostname: dc1-leaf1
            ports: [Ethernet1/10]
            
    vrf_attach_groups:
      - name: all_leafs
        switches:
          - hostname: dc1-leaf1
          - hostname: dc1-leaf2

📋 Kopieren#!/bin/bash
# ============================================================
# VXLAN Fabric Deployment Script
# ============================================================

set -e  # Exit on error

echo "🚀 Starting VXLAN Fabric Deployment..."

# 1. Environment laden
echo "📦 Loading environment..."
source .env

# 2. Validierung
echo "✅ Validating data model..."
ansible-playbook -i inventory.yaml vxlan.yaml --tags validate
if [ $? -ne 0 ]; then
    echo "❌ Validation failed! Aborting."
    exit 1
fi

# 3. Create in NDFC
echo "🏗️ Creating configuration in NDFC..."
ansible-playbook -i inventory.yaml vxlan.yaml --tags create

# 4. Deploy to Switches
echo "🚀 Deploying to switches..."
ansible-playbook -i inventory.yaml vxlan.yaml --tags deploy

# 5. Verification
echo "🔍 Verifying deployment..."
ansible-playbook -i inventory.yaml verify.yaml

echo "✅ Deployment complete!"
echo "📊 Check NDFC: https://$ND_HOST"

📋 Kopieren---
# GitLab CI/CD Pipeline für VXLAN Network as Code
stages:
  - validate
  - test
  - stage
  - deploy
  - verify

variables:
  ANSIBLE_HOST_KEY_CHECKING: "false"
  ANSIBLE_FORCE_COLOR: "true"

default:
  image: ghcr.io/netascode/nac-dc-vxlan:latest
  before_script:
    - ansible --version
    - ansible-galaxy collection list

# ============================================================
# Stage 1: VALIDATE
# ============================================================
validate:
  stage: validate
  script:
    - yamllint data/
    - ansible-playbook -i inventory.yaml vxlan.yaml --tags validate
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# ============================================================
# Stage 2: TEST (Dry-Run)
# ============================================================
dry-run:
  stage: test
  script:
    - ansible-playbook -i inventory.yaml vxlan.yaml --tags create --check
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  environment:
    name: staging

# ============================================================
# Stage 3: STAGE (Create in NDFC)
# ============================================================
stage-config:
  stage: stage
  script:
    - ansible-playbook -i inventory.yaml vxlan.yaml --tags create
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  environment:
    name: production

# ============================================================
# Stage 4: DEPLOY (Push to Switches)
# ============================================================
deploy:
  stage: deploy
  script:
    - ansible-playbook -i inventory.yaml vxlan.yaml --tags deploy
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  when: manual  # Manueller Trigger für Safety
  environment:
    name: production
  needs:
    - stage-config

# ============================================================
# Stage 5: VERIFY
# ============================================================
verify:
  stage: verify
  script:
    - ansible-playbook -i inventory.yaml verify.yaml
    - echo "Deployment verified successfully!"
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs:
    - deploy