Totally off-topic, and I have brought it up with our Cisco account team, but figured that I would mentioned it here for lack of an additional forum to gain exposure.   It is really an issue for NSO customers that Cisco has made DNA Center subscriptions mandatory for new router and switch hardware purchases as they are essentially being billed for two automation solutions - one which they are not using (DNA Center) and one which they are (NSO). The business folks really need to update the ordering options so that NSO device licenses can be purchased as an alternative to DNA Center licenses.   Is anyone in the NSO BU working on this? ... View more

Is it a best practice to test for the presence of a variable and include a tags="delete" in device templates, or just rely on NSO to remove leafs that were deployed with a service when there are no more refcounters to that leaf?   For example, lets say I create a leaf called "multicast-enable" and have the following in a device template as I only want this configuration deployed when "multicast-enable" is defined.   <pim when="{multicast-enable}"> </pim>   NSO is pretty reliable at removing this configuration section when the leaf is not defined, however I am sure there are some corner cases for which I am not aware. Is it a best practice to have a when="not" for every when defined to cover for these?   For example, should I also have an equivalent delete for every when?? <pim when="{not(multicast-eanble)}" tags="delete"> </pim> ... View more

I am seeing a difference between the way NSO is treating device interface configurations and just want to make sure this is intential.   For example, a user adds the following command to Cisco router interfaces GigabitEthernet0/0 and BDI10 using the router CLI. ip tcp adjust-mss 1400   Both interfaces have other parameters which were configured with an NSO service (ip address, no ip proxy-arp, etc). BDI10 is a virtual interface that was created by the service, however GigabitEthernet0/0 was not since it is a "built-in" physical interface on the device.   When a user makes a service modification with NSO, NSO wants to remove ip tcp adjust-mss 1400 from BDI10, but not GigabitEthernet0/0.   I assume this has something to do with NSO having created BDI10 and all parameters under that interface (container?) are then considered managed by NSO? The service model is being updated to account for additional configuration parameters such as this, but I was surprised to see the difference in behavior and would like to understand the undelying functional difference. ... View more

Looking for suggestions to support multi-factor authentication via Yubikey/RSA SecureID for the Web UI. The customer is currently using PAM authentication with NSO. Network devices use multi-factor authentication (through Cisco ISE) for direct CLI logins, but NSO users are mapped to a common network device user which does not require multi-factor as an interim solution. So that multi-factor is still in the "path" to device access the customer wants to ensure that the Web UI supports it in some fashion. Any suggestions are greatly appreciated.   Somewhat related: Cisco has some pretty good documentation for setting up multi-factor device authentication using ISE using RADIUS RFC-3865 Compliant token servers for Yubikey/RSA SecureID... https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120   ... View more

I am running a service that use id-pools which return 'false' when a 'request services check-sync' is performed because my username is running 'check-sync', but a different username was used to deploy the service and assign an id-pool. A re-deploy dry-run shows the differences below. What is the recommended fix for this, as its not really an un-synchronized service. Should my service just be using a generic 'username' when assigning id-pool values as I do not really care if the username of the assigning user is stored in CDB, or is there a way to exempt the resource-pool tree from the service compliance check, or are both bad ideas? Thanks in advance. resource-pools {   id-pool VLAN-CUSTOMERX_RP       allocation   SITEX/SERVERS1 {          - username joe.smith          + username jim.hall     } } ... View more