diff --git a/ansible/group_vars/all b/ansible/group_vars/all
index 5c59599..24935cc 100644
--- a/ansible/group_vars/all
+++ b/ansible/group_vars/all
@@ -7,3 +7,4 @@
 debian_version: trusty
 docker_cfg: docker.cfg
 docker_cfg_dest: /etc/default/docker
+fabric: false
diff --git a/ansible/leafswitch.yml b/ansible/leafswitch.yml
new file mode 100644
index 0000000..e353fde
--- /dev/null
+++ b/ansible/leafswitch.yml
@@ -0,0 +1,8 @@
+- hosts: localhost
+  remote_user: vagrant
+  serial: 1
+  roles:
+    - common
+    - fakeswitch
+    - fakeswitch-mgmt-net
+    - leafswitch
diff --git a/ansible/roles/fakeswitch-mgmt-net/files/eth1.cfg b/ansible/roles/fakeswitch-mgmt-net/files/eth1.cfg
new file mode 100644
index 0000000..dc7756f
--- /dev/null
+++ b/ansible/roles/fakeswitch-mgmt-net/files/eth1.cfg
@@ -0,0 +1,3 @@
+# The primary network interface
+auto eth1
+iface eth1 inet dhcp
\ No newline at end of file
diff --git a/ansible/roles/fakeswitch-mgmt-net/handlers/main.yml b/ansible/roles/fakeswitch-mgmt-net/handlers/main.yml
new file mode 100644
index 0000000..65e82df
--- /dev/null
+++ b/ansible/roles/fakeswitch-mgmt-net/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: Bring up eth1
+  command: ifup eth1
diff --git a/ansible/roles/fakeswitch-mgmt-net/tasks/main.yml b/ansible/roles/fakeswitch-mgmt-net/tasks/main.yml
new file mode 100644
index 0000000..396312e
--- /dev/null
+++ b/ansible/roles/fakeswitch-mgmt-net/tasks/main.yml
@@ -0,0 +1,6 @@
+- name: Ensure DHCP on eth1
+  copy:
+    src: files/eth1.cfg
+    dest: /etc/network/interfaces.d/eth1.cfg
+  notify:
+    - Bring up eth1
diff --git a/ansible/roles/fakeswitch/tasks/main.yml b/ansible/roles/fakeswitch/tasks/main.yml
index 39879e9..bfeb789 100644
--- a/ansible/roles/fakeswitch/tasks/main.yml
+++ b/ansible/roles/fakeswitch/tasks/main.yml
@@ -18,7 +18,7 @@
 
 - name: Ensure Commands
   become: yes
-  template:
+  copy:
     src: files/{{ item }}
     dest: /usr/bin/{{ item }}
     owner: root
@@ -41,3 +41,11 @@
     name: ssh
     state: restarted
   #failed_when: false
+
+- name: Ensure /mnt/onl/data directory present
+  become: yes
+  file:
+    path: /mnt/onl/data
+    owner: root
+    group: root
+    state: directory
diff --git a/ansible/roles/leafswitch/tasks/bridge.yml b/ansible/roles/leafswitch/tasks/bridge.yml
new file mode 100644
index 0000000..1ee6a60
--- /dev/null
+++ b/ansible/roles/leafswitch/tasks/bridge.yml
@@ -0,0 +1,14 @@
+- name: Ensure brctl
+  apt:
+    name: bridge-utils
+    state: present
+
+- name: Ensure bridge
+  template:
+    src: templates/leafbr.cfg.j2
+    dest: /etc/network/interfaces.d/leafbr.cfg
+
+- name: Ensure bridge is up
+  command: ifup leafbr
+  tags:
+    - skip_ansible_lint # running a sub job
diff --git a/ansible/roles/leafswitch/tasks/fabric.yml b/ansible/roles/leafswitch/tasks/fabric.yml
new file mode 100644
index 0000000..98dc859
--- /dev/null
+++ b/ansible/roles/leafswitch/tasks/fabric.yml
@@ -0,0 +1,10 @@
+- name: Start ofdatapath
+  shell: pgrep ofdatapath || ofdatapath -i eth2,eth3,eth4,eth5 -d {{ ansible_eth1.macaddress | hwaddr('bare') }} --no-slicing -D punix:/var/run/cpqd.sock
+  tags:
+    - skip_ansible_lint # running a sub job
+
+# /etc/resolv.conf not set up correctly in switches, use controller IP addr instead
+- name: Start ofprotocol
+  shell: pgrep ofprotocol || ofprotocol -D --log-file=/var/log/ofprotocol.log unix:/var/run/cpqd.sock tcp:10.1.0.1:6653
+  tags:
+    - skip_ansible_lint # running a sub job
\ No newline at end of file
diff --git a/ansible/roles/leafswitch/tasks/main.yml b/ansible/roles/leafswitch/tasks/main.yml
new file mode 100644
index 0000000..5cc3a15
--- /dev/null
+++ b/ansible/roles/leafswitch/tasks/main.yml
@@ -0,0 +1,28 @@
+- name: Ensure interface config files
+  template:
+    src: templates/ethX.cfg.j2
+    dest: /etc/network/interfaces.d/{{ item }}.cfg
+  with_items:
+  - eth2
+  - eth3
+  - eth4
+  - eth5
+
+- name: Ensure interfaces are up
+  command: ifup {{ item }}
+  with_items:
+  - eth2
+  - eth3
+  - eth4
+  - eth5
+  tags:
+    - skip_ansible_lint # running a sub job
+
+- name: Ensure fabric configuration
+  include: fabric.yml
+  when: fabric
+
+- name: Ensure bridge configuration
+  include: bridge.yml
+  when: not fabric
+
diff --git a/ansible/roles/leafswitch/templates/ethX.cfg.j2 b/ansible/roles/leafswitch/templates/ethX.cfg.j2
new file mode 100644
index 0000000..424746b
--- /dev/null
+++ b/ansible/roles/leafswitch/templates/ethX.cfg.j2
@@ -0,0 +1,3 @@
+auto {{ item }}
+iface {{ item }} inet manual
+up ifconfig {{ item }} up
\ No newline at end of file
diff --git a/ansible/roles/leafswitch/templates/leafbr.cfg.j2 b/ansible/roles/leafswitch/templates/leafbr.cfg.j2
new file mode 100644
index 0000000..26a8caf
--- /dev/null
+++ b/ansible/roles/leafswitch/templates/leafbr.cfg.j2
@@ -0,0 +1,7 @@
+auto leafbr
+iface leafbr inet static
+    address {{ net_prefix }}.254
+    network {{ net_prefix }}.0
+    netmask 255.255.255.0
+    broadcast {{ net_prefix }}.255
+    bridge_ports eth2 eth3 eth4 eth5
diff --git a/ansible/roles/prod/files/fabric.cfg b/ansible/roles/prod/files/fabric.cfg
new file mode 100644
index 0000000..531ae6a
--- /dev/null
+++ b/ansible/roles/prod/files/fabric.cfg
@@ -0,0 +1,18 @@
+auto fabric
+iface fabric inet static
+    address 10.6.1.1
+    network 10.6.1.0
+    netmask 255.255.255.0
+    broadcast 10.6.1.255
+    gateway 10.6.1.1
+    bridge_ports eth3
+
+auto fabric:0
+iface fabric:0 inet static
+    address 10.6.1.129
+    netmask 255.255.255.0
+
+auto fabric:1
+iface fabric:1 inet static
+    address 10.6.1.193
+    netmask 255.255.255.0
diff --git a/ansible/roles/prod/tasks/main.yml b/ansible/roles/prod/tasks/main.yml
index 1cd9f61..fb160cc 100644
--- a/ansible/roles/prod/tasks/main.yml
+++ b/ansible/roles/prod/tasks/main.yml
@@ -16,3 +16,18 @@
   command: ifup mgmtbr
   changed_when: true
 
+- name: Ensure fabric bridge
+  copy:
+    src: fabric.cfg
+    dest: /etc/network/interfaces.d/fabric.cfg
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Ensure fabric bridge
+  command: ifup {{ item }}
+  changed_when: true
+  with_items:
+  - fabric
+  - fabric:0
+  - fabric:1
diff --git a/ansible/roles/spineswitch/tasks/bridge.yml b/ansible/roles/spineswitch/tasks/bridge.yml
new file mode 100644
index 0000000..3e2cbfc
--- /dev/null
+++ b/ansible/roles/spineswitch/tasks/bridge.yml
@@ -0,0 +1,14 @@
+- name: Ensure brctl
+  apt:
+    name: bridge-utils
+    state: present
+
+- name: Ensure bridge
+  template:
+    src: templates/spinebr.cfg.j2
+    dest: /etc/network/interfaces.d/spinebr.cfg
+
+- name: Ensure bridge is up
+  command: ifup spinebr
+  tags:
+    - skip_ansible_lint # running a sub job
diff --git a/ansible/roles/spineswitch/tasks/fabric.yml b/ansible/roles/spineswitch/tasks/fabric.yml
new file mode 100644
index 0000000..02f2737
--- /dev/null
+++ b/ansible/roles/spineswitch/tasks/fabric.yml
@@ -0,0 +1,10 @@
+- name: Start ofdatapath
+  command: pgrep ofdatapath || ofdatapath -i eth2,eth3 -d {{ ansible_eth1.macaddress | hwaddr('bare') }} --no-slicing -D punix:/var/run/cpqd.sock
+  tags:
+    - skip_ansible_lint # running a sub job
+
+# /etc/resolv.conf not set up correctly in switches, use controller IP addr instead
+- name: Start ofprotocol
+  command: pgrep ofprotocol || ofprotocol -D --log-file=/var/log/ofprotocol.log unix:/var/run/cpqd.sock tcp:10.1.0.1:6653
+  tags:
+    - skip_ansible_lint # running a sub job
diff --git a/ansible/roles/spineswitch/tasks/main.yml b/ansible/roles/spineswitch/tasks/main.yml
new file mode 100644
index 0000000..ea25a5a
--- /dev/null
+++ b/ansible/roles/spineswitch/tasks/main.yml
@@ -0,0 +1,24 @@
+- name: Ensure interface config files
+  template:
+    src: templates/ethX.cfg.j2
+    dest: /etc/network/interfaces.d/{{ item }}.cfg
+  with_items:
+  - eth2
+  - eth3
+
+- name: Ensure interfaces are up
+  command: ifup {{ item }}
+  with_items:
+  - eth2
+  - eth3
+  tags:
+    - skip_ansible_lint # running a sub job
+
+- name: Ensure fabric configuration
+  include: fabric.yml
+  when: fabric
+
+- name: Ensure bridge configuration
+  include: bridge.yml
+  when: not fabric
+
diff --git a/ansible/roles/spineswitch/templates/ethX.cfg.j2 b/ansible/roles/spineswitch/templates/ethX.cfg.j2
new file mode 100644
index 0000000..424746b
--- /dev/null
+++ b/ansible/roles/spineswitch/templates/ethX.cfg.j2
@@ -0,0 +1,3 @@
+auto {{ item }}
+iface {{ item }} inet manual
+up ifconfig {{ item }} up
\ No newline at end of file
diff --git a/ansible/roles/spineswitch/templates/spinebr.cfg.j2 b/ansible/roles/spineswitch/templates/spinebr.cfg.j2
new file mode 100644
index 0000000..4f0ebe4
--- /dev/null
+++ b/ansible/roles/spineswitch/templates/spinebr.cfg.j2
@@ -0,0 +1,7 @@
+auto spinebr
+iface spinebr inet static
+    address {{ net_prefix }}.253
+    network {{ net_prefix }}.0
+    netmask 255.255.255.0
+    broadcast {{ net_prefix }}.255
+    bridge_ports eth2 eth3
diff --git a/ansible/spineswitch.yml b/ansible/spineswitch.yml
new file mode 100644
index 0000000..ab7b5e4
--- /dev/null
+++ b/ansible/spineswitch.yml
@@ -0,0 +1,8 @@
+- hosts: localhost
+  remote_user: vagrant
+  serial: 1
+  roles:
+    - common
+    - fakeswitch
+    - fakeswitch-mgmt-net
+    - spineswitch