diff --git a/api/cisco/nx/v1alpha1/bordergateway_types.go b/api/cisco/nx/v1alpha1/bordergateway_types.go
index 620cef82..556b81d5 100644
--- a/api/cisco/nx/v1alpha1/bordergateway_types.go
+++ b/api/cisco/nx/v1alpha1/bordergateway_types.go
@@ -17,6 +17,11 @@ type BorderGatewaySpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="DeviceRef is immutable"
 	DeviceRef v1alpha1.LocalObjectReference `json:"deviceRef"`
 
+	// AdminState indicates whether the BorderGateway instance is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState v1alpha1.AdminState `json:"adminState,omitempty"`
+
 	// MultisiteID is the identifier for the multisite border gateway.
 	// +required
 	// +kubebuilder:validation:Minimum=1
diff --git a/api/core/v1alpha1/bgp_peer_types.go b/api/core/v1alpha1/bgp_peer_types.go
index bfd07ff9..32215087 100644
--- a/api/core/v1alpha1/bgp_peer_types.go
+++ b/api/core/v1alpha1/bgp_peer_types.go
@@ -21,6 +21,12 @@ type BGPPeerSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether this BGP peer is administratively up or down.
+	// When Down, the BGP session with this peer is administratively shut down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// Address is the IPv4 address of the BGP peer.
 	// +required
 	// +kubebuilder:validation:Format=ipv4
diff --git a/api/core/v1alpha1/bgp_types.go b/api/core/v1alpha1/bgp_types.go
index d6de64ef..6efcad62 100644
--- a/api/core/v1alpha1/bgp_types.go
+++ b/api/core/v1alpha1/bgp_types.go
@@ -21,6 +21,11 @@ type BGPSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether this BGP router is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// ASNumber is the autonomous system number (ASN) for the BGP router.
 	// Supports both plain format (1-4294967295) and dotted notation (1-65535.0-65535) as per RFC 5396.
 	// +required
diff --git a/api/core/v1alpha1/dns_types.go b/api/core/v1alpha1/dns_types.go
index 8747d734..1b093928 100644
--- a/api/core/v1alpha1/dns_types.go
+++ b/api/core/v1alpha1/dns_types.go
@@ -20,6 +20,11 @@ type DNSSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether DNS is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// Default domain name that the device uses to complete unqualified hostnames.
 	// +required
 	// +kubebuilder:validation:MinLength=1
diff --git a/api/core/v1alpha1/interface_types.go b/api/core/v1alpha1/interface_types.go
index 4daa2181..f7df7065 100644
--- a/api/core/v1alpha1/interface_types.go
+++ b/api/core/v1alpha1/interface_types.go
@@ -95,14 +95,16 @@ type InterfaceSpec struct {
 	BFD *BFD `json:"bfd,omitempty"`
 }
 
-// AdminState represents the administrative state of the interface.
+// AdminState represents the administrative state of a resource.
+// This type is used across multiple resources including interfaces, protocols (BGP, OSPF, ISIS, PIM),
+// and system services (NTP, DNS) to indicate whether these are administratively enabled or disabled.
 // +kubebuilder:validation:Enum=Up;Down
 type AdminState string
 
 const (
-	// AdminStateUp indicates that the interface is administratively set up.
+	// AdminStateUp indicates that the resource is administratively enabled.
 	AdminStateUp AdminState = "Up"
-	// AdminStateDown indicates that the interface is administratively set down.
+	// AdminStateDown indicates that the resource is administratively disabled.
 	AdminStateDown AdminState = "Down"
 )
 
diff --git a/api/core/v1alpha1/isis_types.go b/api/core/v1alpha1/isis_types.go
index 0399f0ec..9bcc7fab 100644
--- a/api/core/v1alpha1/isis_types.go
+++ b/api/core/v1alpha1/isis_types.go
@@ -20,6 +20,11 @@ type ISISSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether the ISIS instance is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// Instance is the name of the ISIS instance.
 	// +required
 	// +kubebuilder:validation:MinLength=1
diff --git a/api/core/v1alpha1/ntp_types.go b/api/core/v1alpha1/ntp_types.go
index 3263f445..7b950801 100644
--- a/api/core/v1alpha1/ntp_types.go
+++ b/api/core/v1alpha1/ntp_types.go
@@ -20,6 +20,11 @@ type NTPSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether NTP is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// Source interface for all NTP traffic.
 	// +required
 	// +kubebuilder:validation:MinLength=1
diff --git a/api/core/v1alpha1/ospf_types.go b/api/core/v1alpha1/ospf_types.go
index 0de718a0..b72b4a53 100644
--- a/api/core/v1alpha1/ospf_types.go
+++ b/api/core/v1alpha1/ospf_types.go
@@ -20,6 +20,11 @@ type OSPFSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether the OSPF instance is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// Instance is the process tag of the OSPF instance.
 	// +required
 	// +kubebuilder:validation:MinLength=1
diff --git a/api/core/v1alpha1/pim_types.go b/api/core/v1alpha1/pim_types.go
index 59038343..87753dc3 100644
--- a/api/core/v1alpha1/pim_types.go
+++ b/api/core/v1alpha1/pim_types.go
@@ -20,6 +20,11 @@ type PIMSpec struct {
 	// +optional
 	ProviderConfigRef *TypedLocalObjectReference `json:"providerConfigRef,omitempty"`
 
+	// AdminState indicates whether the PIM instance is administratively up or down.
+	// +optional
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
+
 	// RendezvousPoints defines the list of rendezvous points for sparse mode multicast.
 	// +optional
 	// +listType=map
diff --git a/api/core/v1alpha1/ref_types.go b/api/core/v1alpha1/ref_types.go
index ff7c576a..9a1aefdc 100644
--- a/api/core/v1alpha1/ref_types.go
+++ b/api/core/v1alpha1/ref_types.go
@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2025 SAP SE or an SAP affiliate company and IronCore contributors
 // SPDX-License-Identifier: Apache-2.0
+
 package v1alpha1
 
 // LocalObjectReference contains enough information to locate a
diff --git a/api/core/v1alpha1/vlan_types.go b/api/core/v1alpha1/vlan_types.go
index 4db8b267..e06355ab 100644
--- a/api/core/v1alpha1/vlan_types.go
+++ b/api/core/v1alpha1/vlan_types.go
@@ -37,21 +37,10 @@ type VLANSpec struct {
 
 	// AdminState indicates whether the VLAN is administratively active or inactive/suspended.
 	// +optional
-	// +kubebuilder:default=Active
-	AdminState VLANState `json:"adminState"`
+	// +kubebuilder:default=Up
+	AdminState AdminState `json:"adminState,omitempty"`
 }
 
-// VLANState represents the administrative state of the VLAN.
-// +kubebuilder:validation:Enum=Active;Suspended
-type VLANState string
-
-const (
-	// VLANStateActive indicates that the VLAN is administratively active.
-	VLANStateActive VLANState = "Active"
-	// VLANStateSuspended indicates that the VLAN is administratively inactive/suspended.
-	VLANStateSuspended VLANState = "Suspended"
-)
-
 // VLANStatus defines the observed state of VLAN.
 type VLANStatus struct {
 	// The conditions are a list of status objects that describe the state of the VLAN.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgp.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgp.yaml
index f9f8d745..9c7b677f 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgp.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgp.yaml
@@ -228,6 +228,14 @@ spec:
                         type: object
                     type: object
                 type: object
+              adminState:
+                default: Up
+                description: AdminState indicates whether this BGP router is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               asNumber:
                 anyOf:
                 - type: integer
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgppeers.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgppeers.yaml
index 96389f54..0b1112d3 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgppeers.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_bgppeers.yaml
@@ -165,6 +165,15 @@ spec:
                         type: string
                     type: object
                 type: object
+              adminState:
+                default: Up
+                description: |-
+                  AdminState indicates whether this BGP peer is administratively up or down.
+                  When Down, the BGP session with this peer is administratively shut down.
+                enum:
+                - Up
+                - Down
+                type: string
               asNumber:
                 anyOf:
                 - type: integer
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_dns.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_dns.yaml
index cdf82ed3..b671c89a 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_dns.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_dns.yaml
@@ -57,6 +57,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether DNS is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_isis.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_isis.yaml
index 883d1df0..e422f251 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_isis.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_isis.yaml
@@ -71,6 +71,14 @@ spec:
                 minItems: 1
                 type: array
                 x-kubernetes-list-type: set
+              adminState:
+                default: Up
+                description: AdminState indicates whether the ISIS instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ntp.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ntp.yaml
index ea8231b6..121e10df 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ntp.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ntp.yaml
@@ -57,6 +57,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether NTP is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ospf.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ospf.yaml
index 9e4900b1..a74a7c06 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ospf.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_ospf.yaml
@@ -75,6 +75,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the OSPF instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_pim.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_pim.yaml
index 2f8b2462..bab27729 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_pim.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_pim.yaml
@@ -57,6 +57,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the PIM instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_vlans.yaml b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_vlans.yaml
index d551886f..fa876a85 100644
--- a/charts/network-operator/templates/crd/networking.metal.ironcore.dev_vlans.yaml
+++ b/charts/network-operator/templates/crd/networking.metal.ironcore.dev_vlans.yaml
@@ -72,12 +72,12 @@ spec:
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
               adminState:
-                default: Active
+                default: Up
                 description: AdminState indicates whether the VLAN is administratively
                   active or inactive/suspended.
                 enum:
-                - Active
-                - Suspended
+                - Up
+                - Down
                 type: string
               deviceRef:
                 description: |-
diff --git a/charts/network-operator/templates/crd/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml b/charts/network-operator/templates/crd/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
index 86dcd7a0..093e0963 100644
--- a/charts/network-operator/templates/crd/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
+++ b/charts/network-operator/templates/crd/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
@@ -59,6 +59,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the BorderGateway instance
+                  is administratively up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               bgpPeerRefs:
                 description: |-
                   BGPPeerRefs is a list of BGP peers that are part of the border gateway configuration.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_bgp.yaml b/config/crd/bases/networking.metal.ironcore.dev_bgp.yaml
index e1a55e45..6554c686 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_bgp.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_bgp.yaml
@@ -222,6 +222,14 @@ spec:
                         type: object
                     type: object
                 type: object
+              adminState:
+                default: Up
+                description: AdminState indicates whether this BGP router is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               asNumber:
                 anyOf:
                 - type: integer
diff --git a/config/crd/bases/networking.metal.ironcore.dev_bgppeers.yaml b/config/crd/bases/networking.metal.ironcore.dev_bgppeers.yaml
index 89c78429..ca06be8c 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_bgppeers.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_bgppeers.yaml
@@ -159,6 +159,15 @@ spec:
                         type: string
                     type: object
                 type: object
+              adminState:
+                default: Up
+                description: |-
+                  AdminState indicates whether this BGP peer is administratively up or down.
+                  When Down, the BGP session with this peer is administratively shut down.
+                enum:
+                - Up
+                - Down
+                type: string
               asNumber:
                 anyOf:
                 - type: integer
diff --git a/config/crd/bases/networking.metal.ironcore.dev_dns.yaml b/config/crd/bases/networking.metal.ironcore.dev_dns.yaml
index 09942ec0..5f1c0f37 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_dns.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_dns.yaml
@@ -51,6 +51,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether DNS is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_isis.yaml b/config/crd/bases/networking.metal.ironcore.dev_isis.yaml
index 026731ae..db0bcceb 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_isis.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_isis.yaml
@@ -65,6 +65,14 @@ spec:
                 minItems: 1
                 type: array
                 x-kubernetes-list-type: set
+              adminState:
+                default: Up
+                description: AdminState indicates whether the ISIS instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_ntp.yaml b/config/crd/bases/networking.metal.ironcore.dev_ntp.yaml
index b52b7320..f7e515c3 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_ntp.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_ntp.yaml
@@ -51,6 +51,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether NTP is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_ospf.yaml b/config/crd/bases/networking.metal.ironcore.dev_ospf.yaml
index 2ee9d8aa..f2e00807 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_ospf.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_ospf.yaml
@@ -69,6 +69,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the OSPF instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_pim.yaml b/config/crd/bases/networking.metal.ironcore.dev_pim.yaml
index 1a8bb3b2..d3209418 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_pim.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_pim.yaml
@@ -51,6 +51,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the PIM instance is administratively
+                  up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               deviceRef:
                 description: |-
                   DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace.
diff --git a/config/crd/bases/networking.metal.ironcore.dev_vlans.yaml b/config/crd/bases/networking.metal.ironcore.dev_vlans.yaml
index 08224f21..a1999a0f 100644
--- a/config/crd/bases/networking.metal.ironcore.dev_vlans.yaml
+++ b/config/crd/bases/networking.metal.ironcore.dev_vlans.yaml
@@ -66,12 +66,12 @@ spec:
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
               adminState:
-                default: Active
+                default: Up
                 description: AdminState indicates whether the VLAN is administratively
                   active or inactive/suspended.
                 enum:
-                - Active
-                - Suspended
+                - Up
+                - Down
                 type: string
               deviceRef:
                 description: |-
diff --git a/config/crd/bases/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml b/config/crd/bases/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
index 25d39027..0cfbc896 100644
--- a/config/crd/bases/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
+++ b/config/crd/bases/nx.cisco.networking.metal.ironcore.dev_bordergateways.yaml
@@ -53,6 +53,14 @@ spec:
               Specification of the desired state of the resource.
               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
             properties:
+              adminState:
+                default: Up
+                description: AdminState indicates whether the BorderGateway instance
+                  is administratively up or down.
+                enum:
+                - Up
+                - Down
+                type: string
               bgpPeerRefs:
                 description: |-
                   BGPPeerRefs is a list of BGP peers that are part of the border gateway configuration.
diff --git a/config/samples/v1alpha1_vlan.yaml b/config/samples/v1alpha1_vlan.yaml
index 0dd271ba..a253a0d4 100644
--- a/config/samples/v1alpha1_vlan.yaml
+++ b/config/samples/v1alpha1_vlan.yaml
@@ -11,4 +11,3 @@ spec:
     name: leaf1
   id: 10
   name: MonteCarlo
-  adminState: Active
diff --git a/internal/controller/core/evpninstance_controller_test.go b/internal/controller/core/evpninstance_controller_test.go
index 92628f36..78626108 100644
--- a/internal/controller/core/evpninstance_controller_test.go
+++ b/internal/controller/core/evpninstance_controller_test.go
@@ -73,7 +73,7 @@ var _ = Describe("EVPNInstance Controller", func() {
 					DeviceRef:  v1alpha1.LocalObjectReference{Name: name},
 					ID:         10,
 					Name:       "vlan-10",
-					AdminState: v1alpha1.VLANStateActive,
+					AdminState: v1alpha1.AdminStateUp,
 				},
 			}
 			Expect(k8sClient.Create(ctx, vlan)).To(Succeed())
@@ -200,7 +200,7 @@ var _ = Describe("EVPNInstance Controller", func() {
 					DeviceRef:  v1alpha1.LocalObjectReference{Name: "different-device"},
 					ID:         10,
 					Name:       "vlan-10",
-					AdminState: v1alpha1.VLANStateActive,
+					AdminState: v1alpha1.AdminStateUp,
 				},
 			}
 			Expect(k8sClient.Create(ctx, vlan)).To(Succeed())
diff --git a/internal/controller/core/interface_controller_test.go b/internal/controller/core/interface_controller_test.go
index 6a64d06d..915b852c 100644
--- a/internal/controller/core/interface_controller_test.go
+++ b/internal/controller/core/interface_controller_test.go
@@ -642,7 +642,7 @@ var _ = Describe("Interface Controller", func() {
 					DeviceRef:  v1alpha1.LocalObjectReference{Name: name},
 					ID:         100,
 					Name:       "test-vlan",
-					AdminState: v1alpha1.VLANStateActive,
+					AdminState: v1alpha1.AdminStateUp,
 				},
 			}
 			Expect(k8sClient.Create(ctx, vlan)).To(Succeed())
@@ -741,7 +741,7 @@ var _ = Describe("Interface Controller", func() {
 					DeviceRef:  v1alpha1.LocalObjectReference{Name: "different-device"},
 					ID:         100,
 					Name:       "test-vlan",
-					AdminState: v1alpha1.VLANStateActive,
+					AdminState: v1alpha1.AdminStateUp,
 				},
 			}
 			Expect(k8sClient.Create(ctx, vlan)).To(Succeed())
diff --git a/internal/controller/core/vlan_controller_test.go b/internal/controller/core/vlan_controller_test.go
index bdafac8d..9c4c3ef1 100644
--- a/internal/controller/core/vlan_controller_test.go
+++ b/internal/controller/core/vlan_controller_test.go
@@ -50,7 +50,7 @@ var _ = Describe("VLAN Controller", func() {
 						DeviceRef:  v1alpha1.LocalObjectReference{Name: name},
 						ID:         id,
 						Name:       "Scrum",
-						AdminState: v1alpha1.VLANStateActive,
+						AdminState: v1alpha1.AdminStateUp,
 					},
 				}
 				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
diff --git a/internal/provider/cisco/nxos/bgp.go b/internal/provider/cisco/nxos/bgp.go
index 1c5b27a0..00226d88 100644
--- a/internal/provider/cisco/nxos/bgp.go
+++ b/internal/provider/cisco/nxos/bgp.go
@@ -115,6 +115,7 @@ func (af *BGPDomAfItem) SetMultipath(m *v1alpha1.BGPMultipath) error {
 
 type BGPPeer struct {
 	Addr                string      `json:"addr"`
+	AdminSt             AdminSt     `json:"adminSt"`
 	Asn                 string      `json:"asn"`
 	AsnType             PeerAsnType `json:"asnType"`
 	Name                string      `json:"name,omitempty"`
diff --git a/internal/provider/cisco/nxos/bgp_test.go b/internal/provider/cisco/nxos/bgp_test.go
index 50c156e1..7f2fb008 100644
--- a/internal/provider/cisco/nxos/bgp_test.go
+++ b/internal/provider/cisco/nxos/bgp_test.go
@@ -20,6 +20,7 @@ func init() {
 
 	bgpPeer := &BGPPeer{
 		Addr:    "1.1.1.1",
+		AdminSt: AdminStEnabled,
 		Asn:     "65000",
 		AsnType: PeerAsnTypeNone,
 		Name:    "EVPN peering with spine",
diff --git a/internal/provider/cisco/nxos/ntp.go b/internal/provider/cisco/nxos/ntp.go
index 438ee927..a4b297bf 100644
--- a/internal/provider/cisco/nxos/ntp.go
+++ b/internal/provider/cisco/nxos/ntp.go
@@ -28,6 +28,7 @@ func (*NTP) XPath() string {
 
 func (n *NTP) Default() {
 	n.AdminSt = AdminStDisabled
+	n.Logging = AdminStDisabled
 }
 
 type NTPProvider struct {
diff --git a/internal/provider/cisco/nxos/pim.go b/internal/provider/cisco/nxos/pim.go
index 046608d1..49c3191f 100644
--- a/internal/provider/cisco/nxos/pim.go
+++ b/internal/provider/cisco/nxos/pim.go
@@ -6,11 +6,35 @@ package nxos
 import "github.com/ironcore-dev/network-operator/internal/provider/cisco/gnmiext/v2"
 
 var (
+	_ gnmiext.Configurable = (*PIM)(nil)
+	_ gnmiext.Configurable = (*PIMDom)(nil)
 	_ gnmiext.Configurable = (*StaticRPItems)(nil)
 	_ gnmiext.Configurable = (*AnycastPeerItems)(nil)
 	_ gnmiext.Configurable = (*PIMIfItems)(nil)
 )
 
+type PIM struct {
+	AdminSt   AdminSt `json:"adminSt"`
+	InstItems struct {
+		AdminSt AdminSt `json:"adminSt"`
+	} `json:"inst-items"`
+}
+
+func (*PIM) XPath() string {
+	return "System/pim-items"
+}
+
+type PIMDom struct {
+	Name    string  `json:"name"`
+	AdminSt AdminSt `json:"adminSt"`
+}
+
+func (*PIMDom) IsListItem() {}
+
+func (p *PIMDom) XPath() string {
+	return "System/pim-items/inst-items/dom-items/Dom-list[name=" + p.Name + "]"
+}
+
 type StaticRPItems struct {
 	StaticRPList gnmiext.List[string, *StaticRP] `json:"StaticRP-list,omitzero"`
 }
diff --git a/internal/provider/cisco/nxos/provider.go b/internal/provider/cisco/nxos/provider.go
index 5041da60..5bf12ace 100644
--- a/internal/provider/cisco/nxos/provider.go
+++ b/internal/provider/cisco/nxos/provider.go
@@ -222,6 +222,9 @@ func (p *Provider) EnsureBGP(ctx context.Context, req *provider.EnsureBGPRequest
 
 	b := new(BGP)
 	b.AdminSt = AdminStEnabled
+	if req.BGP.Spec.AdminState == v1alpha1.AdminStateDown {
+		b.AdminSt = AdminStDisabled
+	}
 	b.Asn = req.BGP.Spec.ASNumber.String()
 
 	var asf AsFormat
@@ -297,6 +300,10 @@ func (p *Provider) EnsureBGPPeer(ctx context.Context, req *provider.EnsureBGPPee
 
 	pe := new(BGPPeer)
 	pe.Addr = req.BGPPeer.Spec.Address
+	pe.AdminSt = AdminStEnabled
+	if req.BGPPeer.Spec.AdminState == v1alpha1.AdminStateDown {
+		pe.AdminSt = AdminStDisabled
+	}
 	pe.Asn = req.BGPPeer.Spec.ASNumber.String()
 	pe.AsnType = PeerAsnTypeNone
 	pe.Name = req.BGPPeer.Spec.Description
@@ -408,6 +415,9 @@ func (p *Provider) DeleteCertificate(ctx context.Context, req *provider.DeleteCe
 func (p *Provider) EnsureDNS(ctx context.Context, req *provider.EnsureDNSRequest) error {
 	d := new(DNS)
 	d.AdminSt = AdminStEnabled
+	if req.DNS.Spec.AdminState == v1alpha1.AdminStateDown {
+		d.AdminSt = AdminStDisabled
+	}
 
 	pf := new(DNSProf)
 	pf.Name = DefaultVRFName
@@ -1106,6 +1116,9 @@ func (p *Provider) EnsureISIS(ctx context.Context, req *provider.EnsureISISReque
 
 	i := new(ISIS)
 	i.AdminSt = AdminStEnabled
+	if req.ISIS.Spec.AdminState == v1alpha1.AdminStateDown {
+		i.AdminSt = AdminStDisabled
+	}
 	i.Name = req.ISIS.Spec.Instance
 
 	dom := new(ISISDom)
@@ -1285,6 +1298,9 @@ func (p *Provider) EnsureNTP(ctx context.Context, req *provider.EnsureNTPRequest
 
 	n := new(NTP)
 	n.AdminSt = AdminStEnabled
+	if req.NTP.Spec.AdminState == v1alpha1.AdminStateDown {
+		n.AdminSt = AdminStDisabled
+	}
 	n.Logging = AdminStDisabled
 	if cfg.Log.Enable {
 		n.Logging = AdminStEnabled
@@ -1439,6 +1455,9 @@ func (p *Provider) EnsureOSPF(ctx context.Context, req *provider.EnsureOSPFReque
 
 	o := new(OSPF)
 	o.AdminSt = AdminStEnabled
+	if req.OSPF.Spec.AdminState == v1alpha1.AdminStateDown {
+		o.AdminSt = AdminStDisabled
+	}
 	o.Name = req.OSPF.Spec.Instance
 	conf = append(conf, o)
 
@@ -1449,6 +1468,9 @@ func (p *Provider) EnsureOSPF(ctx context.Context, req *provider.EnsureOSPFReque
 		dom.AdjChangeLogLevel = AdjChangeLogLevelBrief
 	}
 	dom.AdminSt = AdminStEnabled
+	if req.OSPF.Spec.AdminState == v1alpha1.AdminStateDown {
+		dom.AdminSt = AdminStDisabled
+	}
 	dom.BwRef = DefaultBwRef // default 40 Gbps
 	dom.BwRefUnit = BwRefUnitMbps
 	if cfg.ReferenceBandwidthMbps != 0 {
@@ -1590,6 +1612,25 @@ func (p *Provider) EnsurePIM(ctx context.Context, req *provider.EnsurePIMRequest
 	f.Name = "pim"
 	f.AdminSt = AdminStEnabled
 
+	pim := new(PIM)
+	pim.AdminSt = AdminStEnabled
+	pim.InstItems.AdminSt = AdminStEnabled
+	if req.PIM.Spec.AdminState == v1alpha1.AdminStateDown {
+		pim.AdminSt = AdminStDisabled
+		pim.InstItems.AdminSt = AdminStDisabled
+	}
+
+	dom := new(PIMDom)
+	dom.Name = DefaultVRFName
+	dom.AdminSt = AdminStEnabled
+	if req.PIM.Spec.AdminState == v1alpha1.AdminStateDown {
+		dom.AdminSt = AdminStDisabled
+	}
+
+	if err := p.client.Patch(ctx, pim, dom); err != nil {
+		return err
+	}
+
 	rpItems := new(StaticRPItems)
 	apItems := new(AnycastPeerItems)
 
@@ -2014,10 +2055,8 @@ func (p *Provider) EnsureVLAN(ctx context.Context, req *provider.VLANRequest) er
 	v := new(VLAN)
 	v.FabEncap = fmt.Sprintf("vlan-%d", req.VLAN.Spec.ID)
 	v.AdminSt = BdStateActive
-	switch req.VLAN.Spec.AdminState {
-	case v1alpha1.VLANStateActive:
-		v.BdState = BdStateActive
-	case v1alpha1.VLANStateSuspended:
+	v.BdState = BdStateActive
+	if req.VLAN.Spec.AdminState == v1alpha1.AdminStateDown {
 		v.BdState = BdStateInactive
 	}
 	if req.VLAN.Spec.Name != "" {
@@ -2234,6 +2273,9 @@ func (p *Provider) EnsureBorderGatewaySettings(ctx context.Context, req *BorderG
 
 	bg := new(MultisiteItems)
 	bg.AdminSt = AdminStEnabled
+	if req.BorderGateway.Spec.AdminState == v1alpha1.AdminStateDown {
+		bg.AdminSt = AdminStDisabled
+	}
 	bg.SiteID = strconv.FormatInt(req.BorderGateway.Spec.MultisiteID, 10)
 	bg.DelayRestoreSeconds = int64(math.Round(req.BorderGateway.Spec.DelayRestoreTime.Seconds()))
 	if bg.DelayRestoreSeconds < 30 || bg.DelayRestoreSeconds > 1000 {
diff --git a/internal/provider/cisco/nxos/testdata/bgp_peer.json b/internal/provider/cisco/nxos/testdata/bgp_peer.json
index edd22c75..71439f08 100644
--- a/internal/provider/cisco/nxos/testdata/bgp_peer.json
+++ b/internal/provider/cisco/nxos/testdata/bgp_peer.json
@@ -9,6 +9,7 @@
               "Peer-list": [
                 {
                   "addr": "1.1.1.1",
+                  "adminSt": "enabled",
                   "asn": "65000",
                   "asnType": "none",
                   "name": "EVPN peering with spine",