Can templates use custom variables defined on a system level?

[eekman]

I would like to create templates that have some sensitive information hidden. Let's take a SNMP community string as an example. Besides the System-wide global community string saved in the system settings of DNAC, I have several other community strings that I would like to use in templates - but not visible to the template editor directly in the template hub. Using normal variables is not an option. 

Is it possible to define some sort of environmental variable and use that in templates, something like this:

snmp-server community {{ __some_variable }} RO accesslist MYACL

[pieterh]

when defining variables, possible values and default values
you have the option "Sensitive Value" , which makes the default hidden

is this what you are looking for ?

[eekman]

No, the that means someone have to manually enter a value.

[pieterh]

you can combine this with a default value, resulting in the value will not be shown
plus when deploying you can still manually enter a different value

[Preston Chilcote]

The SNMP credentials used by Cisco DNA (aka Catalyst Center) should be configured in Design->Network Settings-> Device Credentials, not in a template.  But your question is still valid for SNMP configs needed for other network management systems.

A lot of IOS commands let you configure passwords not in clear text by specifying the password level.  Unfortunately, this doesn't apply to snmp v2, so the best answer for you is to move to snmp v3 for better security.

[eekman]

That is another topic really. SNMP was just an example, the same problem exists for SNMP v3 or any other configuration that you would like to hide, used in a lot of sites, should be dynamic but not visible in a template.

As I understand it DNAC does not have the functionality I'm looking for right now.

[pieterh]

If you switch to Velocity templates you can read a variable from a file
Note, you need to upload this file to the Template directory on the DNA center server

[eekman]

OK, interesting. Thanks!

[Preston Chilcote]

@eekman The point I made about passwords in IOS-XE is still relevant for you.  You don't have to confgure passwords in clear text.  For example: 

enable secret 5 $1$iUjJ$cDZ03KKGh7mHfX2RSbDqP.   

 You won't be able to do this for SNMP v2 though.  For that you need to leverage v3.  If you go down this route, you will need to read up on the different encryption types available in IOS-XE and which is recommended for your security needs.

[eekman]

That is not the problem. The question is if it is possible to put data in a variable that is defined outside the scope of the template.