Query Cisco Catalyst Center with cnspec

Discover and query the network devices managed by Cisco Catalyst Center (formerly Cisco DNA Center). Use the Catalyst Center provider inside your own policies to check inventory and software versions across the fleet Catalyst Center manages.

Catalyst Center is one of the network targets cnspec can reach. For the full list of supported devices, see the network device scanning overview. New to cnspec? Start with the quickstart.

Prerequisites

To connect to Cisco Catalyst Center with cnspec, you must have:

• cnspec installed on your workstation
• Network access to the Catalyst Center management interface
• Valid credentials (username and password) for API authentication
• A user account with appropriate permissions to access the Catalyst Center APIs

Give cnspec access to your Catalyst Center

To scan a Catalyst Center instance, cnspec connects through the Catalyst Center REST API. Ensure that your user account has API access.

Test your connection

Before running a full scan, verify that cnspec can connect by opening a cnspec shell:

cnspec shell ciscocatalyst catalyst.example.com --user admin --ask-pass

If cnspec connects successfully and shows a prompt, you're ready to scan.

Connection options

Scan Cisco Catalyst Center

Catalyst Center is a discovery target. cnspec asks it for the network devices it manages and then scans each device as its own asset. Use the devices discovery option:

cnspec scan ciscocatalyst catalyst.example.com --user admin --ask-pass --discover devices

Provide the password when prompted.

You can also create your own policies to meet your specific requirements.

Discover managed devices

Unlike most cnspec providers, connecting to Catalyst Center doesn't give you a ciscocatalyst MQL resource to query. Instead, cnspec uses the Catalyst Center API to discover every device it manages (--discover devices), and turns each one into its own separate cnspec scan asset, connected through Catalyst Center instead of directly over SSH.

To list the devices Catalyst Center manages without running any queries:

cnspec discover ciscocatalyst catalyst.example.com --user admin --ask-pass --discover devices

Query managed devices

Once discovered, each managed device is a regular scan target: query it with the same cisco.iosxe, cisco.iosxr, or cisco.nxos resources you'd use connecting directly, described in Query Cisco IOS XE, IOS XR, and NX-OS Devices. The cnspec scan command above scans every discovered device against your policies in one pass.

For the full set of resources available on each device, see Query Cisco Devices with cnspec.

Learn more

• To scan multiple Cisco Catalyst Center deployments at once instead of one at a time, read Remote Scanning with Inventory Files.

• To learn more about how the MQL query language works, read Write Effective MQL.

• For more information about Cisco Catalyst Center, see the Cisco Catalyst Center documentation.