i've been labbing provisioning of C9Ks as TCs for SDA-transit (there are basic AAA in vrf Mgmt-vrf with single Lo0 in GRT configured manually nothing else except of Day0 stuff after discovery on switch) . CatC integrated with ISE (inc TACACS service for NADs) as mgmt authority. before transit is implemented ISE NAD store had IPs of planned TCs as g0/0 IPs (vrf Mgmt-vrf) as needed & previously programmed by CatC in ISE (on the switches TACACS-relevant stuff was configured w/o vrf-awareness but it's different feature i'll talk later maybe - so i had to fix it on switches with templates :0) Other words everything is good & green & ready for deployment bu eventually i notice that ISE starts to fail AuthC for switches under deployment w/ diagnosis "unknown NAD". surprisingly in the NADs store in #workcenters/workcenter_device_administration/workcenter_device_administration_network_resources/network_devices_device_administration i found TC-switches with IPs of Loopbacks i've configured previously via templates to enable Transits provisioning.
just be aware of the feature :0)
UPD. it happened (DNAC reprograms NAD's IPs in ISE) not exactly with Transit deployment but seemingly during provisioning switches with Loopbacks via templates.
