Validation rule 304 does not detect identical duplicate interfaces

[marehler]

Ansible Version

ansible [core 2.16.3]

Ansible Collection Versions

Collection         Version
------------------ -------
ansible.netcommon  7.1.0  
ansible.posix      2.0.0  
ansible.utils      5.1.2  
cisco.dcnm         3.10.0 
cisco.nac_dc_vxlan 0.6.0  
cisco.nxos         9.4.0  
community.general  10.1.0

Cisco Nexus Dashboard Version

3.2(1i)

Cisco NX-OS Version

10.5(4)

Which role is this issue related to?

cisco.nac_dc_vxlan.validate

Which section of the data model is this issue related to?

vxlan.topology

Expected Behavior

Validation rule 304_topology_switch_interface_members_unique.py shall detect duplicate interface names.

Actual Behavior

The rule does not detect duplicate interface name if their config is identical.

Ansible Playbook

---
# Playbook including validate role only

- hosts:
    - marehler_vnd1_db_site1
  any_errors_fatal: true
  gather_facts: no

  roles:
    - role: cisco.nac_dc_vxlan.validate

Data Model

---
vxlan:
  topology:
    switches:
      - name: N9Kv-LEAF1
        role: leaf
        serial_number: 9PO5E6ROVPQ
        interfaces:
          - name: Ethernet1/1
            mode: access
            access_vlan: 100
          - name: Ethernet1/1
            mode: access
            access_vlan: 100

Steps to Reproduce

ansible-playbook -i inventory.yaml validate.yaml -v

Relevant Debug Output

TASK [cisco.nac_dc_vxlan.validate : Perform Required Syntax and Semantic Model Validation] **********************************************************
ok: [marehler_vnd1_db_site1 -> localhost] => {"changed": false, "data": {"vxlan": {"fabric": {"name": "DB-VXLAN-BGP1", "type": "eBGP_VXLAN"}, "global": {"ebgp": {"anycast_gateway_mac": "20:20:00:00:00:aa", "auth_proto": "MD5", "bgp_asn_mode": "Multi-AS", "dns_servers": [{"ip_address": "10.200.253.13", "vrf": "management"}], "enable_l3_vni_no_vlan": true, "enable_nxapi_http": false, "enable_nxapi_https": true, "layer2_vlan_range": {"from": 2300, "to": 2999}, "layer2_vni_range": {"from": 30000, "to": 49000}, "layer3_vlan_range": {"from": 2000, "to": 2299}, "layer3_vni_range": {"from": 50000, "to": 59000}, "leaf_bgp_asn": "65000.2", "leaf_same_bgp_asn": true, "ntp_servers": [{"ip_address": "10.200.253.13", "vrf": "management"}], "snmp_server_host_trap": true, "spine_bgp_asn": "65000.3", "super_spine_bgp_asn": "65000.1", "syslog_servers": [{"ip_address": "10.200.253.19", "severity": 4, "vrf": "management"}], "vpc": {"advertise_pip": true, "advertise_pip_border_gateway": true, "advertise_pip_border_only": false, "auto_recovery_time": 360, "delay_restore_time": 150, "domain_id_range": "1-1000", "fabric_vpc_qos": false, "ipv6_nd_sync": false, "peer_keep_alive": "loopback", "peer_link_port_channel_id": 500, "peer_link_vlan": 3600}}}, "policy": {"groups": [{"name": "leaf_group1", "policies": [{"name": "bgp_as_policy_leaf", "priority": 500}, {"name": "Duplicate_Detection"}], "priority": 500}, {"name": "BL_group", "policies": [{"name": "bgp_as_policy_BL", "priority": 500}, {"name": "Duplicate_Detection"}], "priority": 500}, {"name": "BGW_group", "policies": [{"name": "bgp_as_policy_BGW", "priority": 500}, {"name": "Duplicate_Detection"}], "priority": 500}, {"name": "all", "policies": [{"name": "alias"}], "priority": 500}, {"name": "QCLAB001_DB_specific_policy", "policies": [{"name": "QCLAB001_v1_0_0"}], "priority": 500}], "policies": [{"name": "bgp_as_policy_leaf", "template_name": "leaf_bgp_asn", "template_vars": {"BGP_AS": "65000.2"}}, {"name": "bgp_as_policy_BL", "template_name": "leaf_bgp_asn", "template_vars": {"BGP_AS": "65000.4"}}, {"name": "bgp_as_policy_BGW", "template_name": "leaf_bgp_asn", "template_vars": {"BGP_AS": "65000.22"}}, {"name": "Duplicate_Detection", "template_name": "switch_freeform", "template_vars": {"CONF": "fabric forwarding dup-host-ip-addr-detection 100 10\nl2rib dup-host-mac-detection 100 10"}}, {"filename": "./policies/alias.cfg", "name": "alias"}, {"name": "QCLAB001_v1_0_0", "template_name": "QCLAB001_v1_0_0"}], "switches": [{"groups": ["leaf_group1", "all", "QCLAB001_DB_specific_policy"], "name": "N9Kv-LEAF1"}, {"groups": ["leaf_group1", "all"], "name": "N9Kv-LEAF2"}, {"groups": ["all"], "name": "N9Kv-SPINE1"}, {"groups": ["all"], "name": "N9Kv-SPINE2"}, {"groups": ["BGW_group", "all"], "name": "N9Kv-BGW1"}, {"groups": ["BGW_group", "all"], "name": "N9Kv-BGW2"}]}, "topology": {"switches": [{"management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.65"}, "name": "N9Kv-SPINE1", "role": "spine", "serial_number": "9ST89MNF3SJ"}, {"management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.66"}, "name": "N9Kv-SPINE2", "role": "spine", "serial_number": "9CJADGH8PE6"}, {"interfaces": [{"access_vlan": 100, "mode": "access", "name": "Ethernet1/1"}], "management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.71"}, "name": "N9Kv-LEAF1", "role": "leaf", "serial_number": "9PO5E6ROVPQ"}, {"management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.72"}, "name": "N9Kv-LEAF2", "role": "leaf", "serial_number": "90FJVB1X63A"}, {"management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.81"}, "name": "N9Kv-BGW1", "role": "border_gateway", "serial_number": "9MOP0EOZP0B"}, {"management": {"default_gateway_v4": "10.0.90.1", "management_ipv4_address": "10.0.90.82"}, "name": "N9Kv-BGW2", "role": "border_gateway", "serial_number": "9UXJTO5S1NW"}], "vpc_peers": [{"fabric_peering": true, "peer1": "N9Kv-LEAF1", "peer2": "N9Kv-LEAF2"}]}, "underlay": {"bgp": {"authentication_enable": true, "authentication_key": "a2e119f499e9529b", "authentication_key_type": 3, "max_paths": 4}, "general": {"intra_fabric_interface_mtu": 9100, "layer2_host_interface_mtu": 9000, "replication_mode": "multicast", "underlay_routing_protocol_tag": "54321"}, "ipv4": {"fabric_interface_numbering": "p2p", "subnet_mask": 31, "underlay_routing_loopback_ip_range": "10.22.0.0/22", "underlay_rp_loopback_ip_range": "10.254.254.0/24", "underlay_subnet_ip_range": "10.24.0.0/16", "underlay_vtep_loopback_ip_range": "10.23.0.0/22"}, "multicast": {"ipv4": {"authentication_enable": false, "group_subnet": "239.239.0.0/25", "trm_default_group": "239.239.0.1", "trm_enable": true}, "rendezvous_points": 2, "rp_mode": "asm"}}}}, "msg": null}

[marehler]

Root Cause Analysis

In summary, the YAML merge process has a deduplication function that removes duplicates before rule 304 is executed.

The data loading function in nac_yaml/yaml.py, load_yaml_files() has a deduplication step (deduplicate=True by default) that runs before any validation rules execute. Call chain:

1. nac_dc_validate.py line 95: results['data'] = load_yaml_files([mdata]) — loads all YAML from host_vars
2. nac_yaml/yaml.py line 89–90: if deduplicate: result = deduplicate_list_items(result) — silently merges duplicate list items
3. nac_validate/validator.py, validate_semantics() line 128: self.data = load_yaml_files(input_paths) — again loads with dedup=True
4. Rule 304 runs on the already-deduplicated data — sees only one Ethernet1/1, not two

The deduplication feature has the side effect of masking genuinely erroneous duplicates — which is what rule 304 should catch.

[marehler]

Closed PR #732 as the proposed fix, i.e. removing deduplication, does not work in case of configurations split across multiple data files.