Ansible on Cisco NX-OS 10.4 Automation Complete Guide

By Luca Berton · Published 2024-01-01 · Category: installation

Automate Cisco NX-OS 10.4 (Nexus 9000) with Ansible: cisco.nxos collection, NX-API, VXLAN/EVPN, vPC, OSPF/BGP, and configuration drift.

Cisco NX-OS 10.4 runs on Nexus 9000 data-center switches. Ansible's cisco.nxos collection (≥ 6.0) drives day-0 provisioning, VXLAN/EVPN fabrics, vPC, BGP/OSPF, telemetry, and drift detection over NX-API CLI or NETCONF. This is the master Ansible guide for NX-OS 10.4.

NX-OS 10.4 release facts

Item	Value
Release	2024 (10.4.x train)
Platforms	Nexus 9300/9500 (Cloud Scale ASIC, Silicon One)
Programmability	NX-API CLI, NETCONF, gNMI, YANG, MTX
Default fabric	VXLAN/EVPN

Ansible-core compatibility

Use ansible-core 2.18 LTS with cisco.nxos >= 6.0 and ansible.netcommon >= 6.1.

Inventory

[nxos]
leaf01 ansible_host=10.1.1.1
leaf02 ansible_host=10.1.1.2
spine01 ansible_host=10.1.1.10

[nxos:vars]
ansible_network_os=cisco.nxos.nxos
ansible_connection=ansible.netcommon.httpapi
ansible_httpapi_use_ssl=true
ansible_httpapi_validate_certs=false
ansible_user=admin
ansible_password='{{ vault_nxos_password }}'

Backup running-config

- name: Backup NX-OS configs
  hosts: nxos
  gather_facts: false
  tasks:
    - name: Save running-config
      cisco.nxos.nxos_config:
        backup: true
        backup_options:
          dir_path: ./backups
          filename: "{{ inventory_hostname }}-{{ ansible_date_time.iso8601_basic_short }}.cfg"

VXLAN/EVPN leaf

- name: Configure VXLAN/EVPN leaf
  hosts: leaf01
  gather_facts: false
  tasks:
    - name: Enable features
      cisco.nxos.nxos_feature:
        feature: "{{ item }}"
        state: enabled
      loop:
        - bgp
        - vn-segment-vlan-based
        - nv overlay
        - interface-vlan
        - lacp
        - vpc

    - name: Configure NVE1
      cisco.nxos.nxos_config:
        lines:
          - interface nve1
          - source-interface loopback1
          - host-reachability protocol bgp
          - member vni 10010 associate-vrf
          - mcast-group 239.1.1.1

    - name: BGP EVPN
      cisco.nxos.nxos_bgp_global:
        config:
          as_number: 65001
          router_id: 10.0.0.1
          neighbors:
            - neighbor_address: 10.0.0.10
              remote_as: 65000
              update_source: loopback0
        state: merged

vPC peering

- name: vPC config
  hosts: leaf01
  gather_facts: false
  tasks:
    - name: vPC domain
      cisco.nxos.nxos_config:
        lines:
          - vpc domain 10
          - peer-keepalive destination 10.0.0.2 source 10.0.0.1
          - peer-switch
          - peer-gateway
          - ip arp synchronize

OSPF underlay

- name: OSPFv2 underlay
  hosts: nxos
  gather_facts: false
  tasks:
    - name: Configure OSPFv2
      cisco.nxos.nxos_ospfv2:
        config:
          processes:
            - process_id: 1
              router_id: "{{ rid }}"
              areas:
                - area_id: '0.0.0.0'
        state: merged

Drift detection against templates

- name: NXOS drift check
  hosts: nxos
  gather_facts: false
  tasks:
    - name: Compare to intended
      cisco.nxos.nxos_config:
        src: "templates/{{ inventory_hostname }}.j2"
        diff_against: intended
      register: drift

Best practices

Prefer *cisco.nxos.nxos_ resource modules over nxos_config for declarative VXLAN/EVPN.

Use httpapi (NX-API) transport for fast batch runs; keep network_cli as fallback.

Use gather_facts: false** + cisco.nxos.nxos_facts for selective fact gathering.
Run drift checks via AAP daily and feed results into your config-management dashboard.

Conclusion

NX-OS 10.4 with cisco.nxos 6.x and ansible-core 2.18 makes data-center fabric automation deterministic. VXLAN/EVPN, vPC, BGP, and OSPF all have first-class resource modules — embrace them over CLI scraping.

Connecting to NX-OS

[nxos]
nexus1 ansible_host=10.0.0.20

[nxos:vars]
ansible_connection=ansible.netcommon.network_cli
ansible_network_os=cisco.nxos.nxos
ansible_user=admin
ansible_password="{{ vault_nxos_password }}"

Common NX-OS Tasks

- name: Manage Cisco NX-OS switches
  hosts: nxos
  gather_facts: false
  tasks:
    - name: Gather NX-OS facts
      cisco.nxos.nxos_facts:
        gather_subset: all

    - name: Configure VLANs
      cisco.nxos.nxos_vlans:
        config:
          - vlan_id: 100
            name: Production
            state: active
          - vlan_id: 200
            name: Development
            state: active

    - name: Configure L3 interfaces
      cisco.nxos.nxos_l3_interfaces:
        config:
          - name: Ethernet1/1
            ipv4:
              - address: 10.0.100.1/24

    - name: Configure OSPF
      cisco.nxos.nxos_ospfv2:
        config:
          processes:
            - process_id: "1"
              router_id: 10.0.0.20
              areas:
                - area_id: "0.0.0.0"
                  ranges:
                    - prefix: 10.0.0.0/16

    - name: Save running config
      cisco.nxos.nxos_config:
        save_when: always

    - name: Backup configuration
      cisco.nxos.nxos_config:
        backup: true

FAQ

Which collection do I need for NX-OS?

cisco.nxos: ansible-galaxy collection install cisco.nxos. It supports both CLI and NX-API connections.

Can I use NX-API instead of SSH?

Yes. Set ansible_connection=ansible.netcommon.httpapi for NX-API access, which provides structured JSON responses.

Category: installation

Browse all Ansible tutorials · AnsiblePilot Home

AnsiblePilot — Master Ansible Automation

Popular Topics

About Luca Berton