Once your fabric has been created, with the correct type and settings, you can start to add switches to the fabric.
In this step you will create a new file named topology.nac.yml to define the switches that will be added to the fabric including their roles and management IP addresses.
The roles set for the switches in this file will determine which configuration templates get applied to them later when you deploy the configuration to the switches in Nexus Dashboard.
Additionally, for the border leaf switch you will also define POAP pre-provisioning settings to ensure that when the switch boots up for the first time it will automatically get discovered by ND and provisioned with any pre-staged configuration.
touch ~/workspace/ndlab/nac/host_vars/site1-fabric/topology.nac.yml
code-server -r ~/workspace/ndlab/nac/host_vars/site1-fabric/topology.nac.yml
---
vxlan:
topology:
switches:
- name: site1-s1
serial_number: 9RU4HDYCH3I
role: spine
management:
management_ipv4_address: 10.15.30.11
default_gateway_v4: 10.15.30.1
- name: site1-l1
serial_number: 9AG4VMSA335
role: leaf
management:
management_ipv4_address: 10.15.30.12
default_gateway_v4: 10.15.30.1
- name: site1-l2
serial_number: 92QFOH4M36R
role: leaf
management:
management_ipv4_address: 10.15.30.13
default_gateway_v4: 10.15.30.1
- name: site1-bl1
# Placeholder serial number
serial_number: FGE20360RRX
role: border
management:
management_ipv4_address: 10.15.30.14
subnet_mask_ipv4: 24
default_gateway_v4: 10.15.30.1
poap:
preprovision:
model: N9K-C9300v
# Match serial number above
serial_number: FGE20360RRX
version: 10.6(2)
modulesModel: [N9K-X9364v, N9K-vSUP]
- name: site1-bgw1
serial_number: 9BV7KYBQBIS
role: border_gateway
management:
management_ipv4_address: 10.15.30.15
default_gateway_v4: 10.15.30.1
Make sure you are in your root Ansible directory.
cd ~/workspace/ndlab/nac
From the root Ansible project directory execute the following command:
ansible-playbook -i hosts.site1.yml vxlan.yml --tags cr_manage_switches
Again, the actual configuration deployment will not take place yet. The execution is performing the following:
Later in the lab you will deploy the configuration to the switches all at once which will take a little bit longer.
Go ahead and move to the next step while the Ansible playbook is running so you can see the switches getting added into ND.
In your ND browser, access site1-fabric and navigate to the switches view.
Here you will start to see the spine and leaf switches being discovered and added to the site1-fabric fabric.
You will see the switches transition to different states during discovery (you may need to scroll to the right to see all the columns):
This might be a good time for a cup of coffee or tea while the switches get added to your Site1 fabric!
Upon a successful run of the playbook your output should look as follows:
<... SNIP ...> PLAY RECAP ********************************************************************************************************************************************************************** site1-fabric : ok=222 changed=34 unreachable=0 failed=0 skipped=767 rescued=0 ignored=0 PLAYBOOK RECAP ****************************************************************************************************************************************************************** Playbook run took 0 days, 0 hours, 7 minutes, 21 seconds TASKS RECAP ********************************************************************************************************************************************************************* Tuesday 27 January 2026 03:16:44 +0000 (0:00:00.608) 0:07:21.579 ******* =============================================================================== cisco.nac_dc_vxlan.create : Add Fabric Devices in Nexus Dashboard ------------------------------------------------------------------------------------------------------ 347.99s cisco.nac_dc_vxlan.create : Build Switch Hostname Policy Payload from Data Model Update ---------------------------------------------------------------------------------- 3.23s cisco.nac_dc_vxlan.common : Display Flag Values -------------------------------------------------------------------------------------------------------------------------- 2.14s cisco.nac_dc_vxlan.common : Get POAP Data From POAP Enabled Devices ------------------------------------------------------------------------------------------------------ 2.01s cisco.nac_dc_vxlan.connectivity_check : Get Cisco Nexus Dashboard Fabric Controller Version ------------------------------------------------------------------------------ 1.77s cisco.nac_dc_vxlan.common : Get Multisite Fabric Associations in Nexus Dashboard ----------------------------------------------------------------------------------------- 1.37s cisco.nac_dc_vxlan.common : Build Fabric Creation Parameters From Template ----------------------------------------------------------------------------------------------- 0.95s cisco.nac_dc_vxlan.validate : Copy Service Model Data to Host ------------------------------------------------------------------------------------------------------------ 0.91s cisco.nac_dc_vxlan.common : Retrieve NDFC Device Username and Password from Group Vars and update inv_config ------------------------------------------------------------- 0.88s cisco.nac_dc_vxlan.common : Retrieve NDFC Device Username and Password from Group Vars and update inv_config ------------------------------------------------------------- 0.85s cisco.nac_dc_vxlan.connectivity_check : Verify Authorization to Nexus Dashboard ------------------------------------------------------------------------------------------ 0.79s cisco.nac_dc_vxlan.common : Build vPC interface -------------------------------------------------------------------------------------------------------------------------- 0.77s cisco.nac_dc_vxlan.common : Build Fabric Switch Inventory List From Template --------------------------------------------------------------------------------------------- 0.74s cisco.nac_dc_vxlan.common : Build Policy List From Template -------------------------------------------------------------------------------------------------------------- 0.74s cisco.nac_dc_vxlan.common : Build Interface ------------------------------------------------------------------------------------------------------------------------------ 0.72s cisco.nac_dc_vxlan.common : Build sub_interface -------------------------------------------------------------------------------------------------------------------------- 0.72s cisco.nac_dc_vxlan.common : Build Fabric Links --------------------------------------------------------------------------------------------------------------------------- 0.70s cisco.nac_dc_vxlan.common : Build Interface ------------------------------------------------------------------------------------------------------------------------------ 0.70s cisco.nac_dc_vxlan.common : Build Interface ------------------------------------------------------------------------------------------------------------------------------ 0.69s cisco.nac_dc_vxlan.common : Build VRFs Attach List From Template --------------------------------------------------------------------------------------------------------- 0.69s ROLES RECAP ********************************************************************************************************************************************************************* Tuesday 27 January 2026 03:16:44 +0000 (0:00:00.614) 0:07:21.583 ******* =============================================================================== create ---------------------------------------------------------------- 355.55s common ----------------------------------------------------------------- 70.08s validate ---------------------------------------------------------------- 6.08s connectivity_check ------------------------------------------------------ 3.96s common_global ----------------------------------------------------------- 0.04s ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ total ----------------------------------------------------------------- 435.70s
In this particular lab example it took around 5-6 minutes to add the switches to the fabric but next time you execute the role it will be much quicker because the switches are already added and are in the correct state.
It's also important to note here, that it only took 5-6 minutes because the deploy role was not executed. You will perform the configuration deployment from ND to the actual switches a little bit later in the lab, all at one time by calling the deploy role. Again, you are building things out in ND first, then will push everything to the switches all at once.
Check ND again and make sure the switches are added. The Mode should show as Normal and the Discovery Status should show as Ok, except for your pre-provisioned border leaf switch which will show as Unreachable.
You may have noticed that this time we ran the playbook with the --tags cr_manage_switches option to limit the tasks that were executed.
In this case we limited execution to only the tasks that manage switches in the fabric.
To see a full list of supported tags in this collection, run the playbook command with --tags help
ansible-playbook -i hosts.site1.yml vxlan.yml -vvvv --tags help
You will see a list of supported tags in the output. The cr_manage_switches tag is used to manage switches in the fabric.
<... SNIP ...>
TASK [cisco.nac_dc_vxlan.common_global : Verify User Tags] **********************************************************************************************************************
task path: /home/pod01/workspace/ndlab/nac/collections/ansible_collections/cisco/nac_dc_vxlan/roles/common_global/tasks/main.yml:23
Monday 26 January 2026 16:43:32 +0000 (0:00:05.493) 0:00:05.493 ********
Monday 26 January 2026 16:43:32 +0000 (0:00:05.492) 0:00:05.492 ********
fatal: [site1-fabric -> localhost]: FAILED! => {
"changed": false,
"msg": "Tag 'help' not found in list of supported tags",
"supported_tags": [
"cc_verify",
"cr_manage_fabric",
"cr_manage_switches",
"cr_manage_vpc_peers",
"cr_manage_interfaces",
"cr_manage_vrfs_networks",
"cr_manage_policy",
"cr_manage_links",
"cr_manage_edge_connections",
"rr_manage_interfaces",
"rr_manage_networks",
"rr_manage_vrfs",
"rr_manage_vpc_peers",
"rr_manage_links",
"rr_manage_edge_connections",
"rr_manage_switches",
"rr_manage_policy",
"role_validate",
"role_create",
"role_deploy",
"role_remove"
]
}
PLAY RECAP **********************************************************************************************************************************************************************
site1-fabric : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0
<... SNIP ...>
KEY: cr_* prefix == create_role, rr_* prefix == remove_role
cr_manage_fabric - Create and manage the fabric
cr_manage_switches - Create and manage switches in the fabric
cr_manage_vpc_peers - Create and manage vPC peers
cr_manage_interfaces - Create and manage interfaces
cr_manage_vrfs_networks - Create and manage VRFs and networks
cr_manage_policy - Create and manage policies
cr_manage_links - Create and manage links
cr_manage_edge_connections - Create and manage edge connections
rr_manage_switches - Remove switches in the fabric
rr_manage_vpc_peers - Remove vPC peering
rr_manage_interfaces - Remove and/or put interfaces into a default state
rr_manage_vrfs - Remove VRFs
rr_manage_networks - Remove Networks
rr_manage_policy - Remove policies
rr_manage_links - Remove links
rr_manage_edge_connections - Remove edge connections
role_validate - Run the Validate role
role_create - Run the Create role
role_deploy - Run the Deploy role
role_remove - Run the Remove role
Navigate back to your VSCode application.
Continue to the next section to set up a vPC domain between leaf switches.