Cisco NX-OS / ACI — Management

Day-2 inventory, facts and config management for Cisco NX-OS / ACI data center fabrics (VXLAN/EVPN). Part of the multi-vendor Data Center automation guide.

Repository

Cisco

NX-OS

ACI / APIC

VXLAN / EVPN

Model the fabric once in a vendor-neutral inventory

Collect facts from Cisco via API/SSH

Push config from intent, never hand-edit per box

Setup, key commands & run examples

inventory/fabric.yml

Inventory

Describe each Cisco device once — role, mgmt IP and VTEP — so the same workflow targets it and every other vendor in the fabric.

inventory/fabric.yml

yaml

leaf21:
  role: leaf
  vendor: cisco
  mgmt: 10.0.0.21
  vtep: 10.255.0.21
  napalm: nxos_ssh

connect.py

Connect

Open a session to a Cisco NX-OS / ACI device. NAPALM normalizes facts across vendors using driver "nxos_ssh".

connect.py

python

import napalm

# Cisco NX-OS / ACI — NAPALM driver "nxos_ssh"
driver = napalm.get_network_driver("nxos_ssh")
dev = driver(hostname="10.0.0.21", username="admin", password="secret")
dev.open()

facts.sh

Day-2 facts

The day-2 management read-outs you will automate on Cisco: version, EVPN peers and interface state.

facts.sh

bash

# inventory & health snapshot — Cisco NX-OS / ACI
show version
show interface status
show bgp l2vpn evpn summary

Best practices

One intent model, many renderers
Keep a single fabric description and render Cisco config from it — never SSH in to edit CLI by hand.
Prefer structured APIs
Use NAPALM getters (get_facts, get_interfaces, get_bgp_neighbors) so Cisco returns the same shapes as the rest of the fleet.
Version your inventory
Treat fabric.yml as the source of truth in git; every change is a reviewable PR.
Idempotent runs
Management scripts should be safe to re-run — collect, compare, only change what drifted.

Hands-on exercises

Guided practice tasks — copy the starter snippet, run it against a lab device, and extend it to meet the goal.

Exercise 1

Cisco inventory report

Goal: Connect to the leaf, pull version + model and print one inventory row.

exercise_1

python

import napalm

# Cisco NX-OS / ACI — NAPALM driver "nxos_ssh"
driver = napalm.get_network_driver("nxos_ssh")
dev = driver(hostname="10.0.0.21", username="admin", password="secret")
dev.open()
# TODO: print hostname, model and OS version

Exercise 2

Interface drift check

Goal: Compare live interface admin/oper state against the intended list and report mismatches.

exercise_2

python

intended = {"Ethernet1", "Ethernet2"}
# TODO: read live interfaces and report any intended port that is down

Curated videos & guides

Checklist — pitfalls, gotchas & verification

Common pitfalls

•Screen-scraping Cisco CLI when a structured API exists — output formats change between releases.
•Storing credentials in the script instead of a vault / env vars.
•Editing boxes by hand so the inventory no longer matches reality.

Gotchas to watch

•NAPALM driver "nxos_ssh" must match transport — confirm SSH/API is enabled on the device.
•Management VRF: make sure your reachability is over the mgmt VRF, not the data plane.

Verify it works

•Re-run the report and confirm every device returns facts.
•Confirm the inventory row matches the physical device (model, serial, OS).