Cisco NX-OS / ACI — Deployment

Stage, diff, commit and roll back fabric changes for Cisco NX-OS / ACI data center fabrics (VXLAN/EVPN). Part of the multi-vendor Data Center automation guide.

Repository

Cisco

NX-OS

ACI / APIC

VXLAN / EVPN

Render per-vendor config from the intent model

Stage as a candidate on Cisco, then diff

Commit only the expected diff — roll back on failure

Setup, key commands & run examples

deploy.sh

Stage / diff / commit

The Cisco NX-OS / ACI change workflow. NX-OS leaf/spine switches use checkpoints + rollback rather than a true candidate config. ACI is intent-driven through the APIC REST API (managed objects), not CLI — model the tenant/EPG/contract objects and POST them.

deploy.sh

bash

# 1. stage:   configure terminal + checkpoint (or APIC REST for ACI)
# 2. diff:    show running-config diff / rollback running-config checkpoint <name>
# 3. commit:  copy running-config startup-config
# 4. revert:  rollback running-config checkpoint <name>

deploy.py

Guarded commit

Render config from intent, stage it on Cisco, preview the diff and only commit when it matches what you expect.

deploy.py

python

dev.load_merge_candidate(config=rendered)   # configure terminal + checkpoint (or APIC REST for ACI)
diff = dev.compare_config()                 # show running-config diff / rollback running-config checkpoint <name>
print(diff)
if diff and "vlan 120" in diff:
    dev.commit_config()                     # copy running-config startup-config
else:
    dev.discard_config()

Best practices

Diff before every commit
Always review show running-config diff / rollback running-config checkpoint <name> (or gate it in CI) so no Cisco change is applied blind.
Deploy leaf-pairs, not rows
Roll one MLAG/ESI pair at a time and verify before moving on, so redundancy survives a bad change.
Confirmed commits
Cisco has no confirmed-commit — keep a rollback (rollback running-config checkpoint <name>) one command away and watch the session.
Post-change verification
Re-read EVPN/VTEP state after each commit and abort the rollout if anything regressed.

Hands-on exercises

Guided practice tasks — copy the starter snippet, run it against a lab device, and extend it to meet the goal.

Exercise 1

Guarded VLAN rollout

Goal: Add an L2VNI to one Cisco leaf pair: stage, print the diff, commit only if it contains the expected VLAN id.

exercise_1

python

rendered = render_l2vni(vlan=120, vni=10120)
# TODO: stage -> diff -> commit only if "120" in diff, else discard

Exercise 2

Rollback drill

Goal: Apply a bad change, detect the EVPN peer drop, and roll back with: rollback running-config checkpoint <name>

exercise_2

bash

# apply change, then on failure:
rollback running-config checkpoint <name>

Curated videos & guides

Checklist — pitfalls, gotchas & verification

Common pitfalls

•Committing without reviewing the diff first.
•Deploying both leaves of an MLAG/ESI pair at once and dropping the redundant path.
•Treating ACI like a CLI box — it is intent/controller-driven via APIC REST.

Gotchas to watch

•compare_config() returns an empty string (not None) when there is no change — test truthiness.
•Losing your management session mid-commit can lock you out without confirmed-commit.

Verify it works

•After deploy, re-read EVPN neighbors and confirm every peer returned to up.
•Diff running-config against intent post-change to prove zero unexpected drift.