diff --git a/changelogs/fragments/docs_common_error_correction.yaml b/changelogs/fragments/docs_common_error_correction.yaml new file mode 100644 index 0000000..1f47216 --- /dev/null +++ b/changelogs/fragments/docs_common_error_correction.yaml @@ -0,0 +1,3 @@ +--- +bugfixes: + - Updated docs resolving spelling typos diff --git a/docs/vyos.vyos.vyos_bgp_address_family_module.rst b/docs/vyos.vyos.vyos_bgp_address_family_module.rst index 6ba0dc2..0c463d0 100644 --- a/docs/vyos.vyos.vyos_bgp_address_family_module.rst +++ b/docs/vyos.vyos.vyos_bgp_address_family_module.rst @@ -1,2085 +1,2085 @@ .. _vyos.vyos.vyos_bgp_address_family_module: ********************************* vyos.vyos.vyos_bgp_address_family ********************************* **BGP Address Family Resource Module.** Version added: 2.1.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manages BGP address family configuration of interfaces on devices running VYOS. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
dictionary
A dict of BGP global configuration for interfaces.
address_family
list / elements=dictionary
BGP address-family parameters.
afi
string
    Choices:
  • ipv4
  • ipv6
BGP address family settings.
aggregate_address
list / elements=dictionary
BGP aggregate network.
as_set
boolean
    Choices:
  • no
  • yes
Generate AS-set path information for this aggregate address.
prefix
string
BGP aggregate network.
summary_only
boolean
    Choices:
  • no
  • yes
Announce the aggregate summary network only.
networks
list / elements=dictionary
BGP network
backdoor
boolean
    Choices:
  • no
  • yes
Network as a backdoor route.
path_limit
integer
AS path hop count limit
prefix
string
BGP network address
route_map
string
Route-map to modify route attributes
redistribute
list / elements=dictionary
Redistribute routes from other protocols into BGP
metric
integer
Metric for redistributed routes.
protocol
string
    Choices:
  • connected
  • kernel
  • ospf
  • ospfv3
  • rip
  • ripng
  • static
types of routes to be redistributed.
route_map
string
Route map to filter redistributed routes
table
string
Redistribute non-main Kernel Routing Table.
as_number
integer
AS number.
neighbors
list / elements=dictionary
BGP neighbor
address_family
list / elements=dictionary
address family.
afi
string
    Choices:
  • ipv4
  • ipv6
BGP neighbor parameters.
allowas_in
integer
Number of occurrences of AS number.
as_override
boolean
    Choices:
  • no
  • yes
AS for routes sent to this neighbor to be the local AS.
attribute_unchanged
dictionary
BGP attributes are sent unchanged.
as_path
boolean
    Choices:
  • no
  • yes
as_path attribute
med
boolean
    Choices:
  • no
  • yes
med attribute
next_hop
boolean
    Choices:
  • no
  • yes
next_hop attribute
capability
dictionary
Advertise capabilities to this neighbor.
dynamic
boolean
    Choices:
  • no
  • yes
Advertise dynamic capability to this neighbor.
orf
string
    Choices:
  • send
  • receive
Advertise ORF capability to this neighbor.
default_originate
string
Send default route to this neighbor
distribute_list
list / elements=dictionary
Access-list to filter route updates to/from this neighbor.
acl
integer
-
Acess-list number.
+
Access-list number.
action
string
    Choices:
  • export
  • import
Access-list to filter outgoing/incoming route updates to this neighbor
filter_list
list / elements=dictionary
As-path-list to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
path_list
string
As-path-list to filter
maximum_prefix
integer
Maximum number of prefixes to accept from this neighbor nexthop-self Nexthop for routes sent to this neighbor to be the local router.
nexthop_local
boolean
    Choices:
  • no
  • yes
Nexthop attributes.
nexthop_self
boolean
    Choices:
  • no
  • yes
Nexthop for routes sent to this neighbor to be the local router.
peer_group
string
IPv4 peer group for this peer
prefix_list
list / elements=dictionary
Prefix-list to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
prefix_list
string
Prefix-list to filter
remove_private_as
boolean
    Choices:
  • no
  • yes
Remove private AS numbers from AS path in outbound route updates
route_map
list / elements=dictionary
Route-map to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
route_map
string
route-map to filter
route_reflector_client
boolean
    Choices:
  • no
  • yes
Neighbor as a route reflector client
route_server_client
boolean
    Choices:
  • no
  • yes
Neighbor is route server client
soft_reconfiguration
boolean
    Choices:
  • no
  • yes
Soft reconfiguration for neighbor
unsupress_map
string
Route-map to selectively unsuppress suppressed routes
weight
integer
Default weight for routes from this neighbor
neighbor_address
string
BGP neighbor address (v4/v6).
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the IOS device by executing the command show configuration command | match bgp.
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • merged ←
  • replaced
  • deleted
  • gathered
  • parsed
  • rendered
  • purged
  • overridden
The state the configuration should be left in.

Examples -------- .. code-block:: yaml # Using merged # Before state # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ - name: Merge provided configuration with device configuration vyos.vyos.vyos_bgp_address_family: config: as_number: "100" address_family: - afi: "ipv4" redistribute: - protocol: "static" metric: 50 neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" maximum_prefix: 45 nexthop_self: True route_map: - action: "export" route_map: "map01" - action: "import" route_map: "map01" weight: 50 # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # vyos@vyos:~$ # # Module Execution: # # "after": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": {}, # "changed": true, # "commands": [ # "set protocols bgp 100 address-family ipv4-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight 50" # ], # # Using replaced: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # vyos@vyos:~$ - name: Replace provided configuration with device configuration vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv6" maximum_prefix: 45 nexthop_self: True state: replaced # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export '10' # vyos@vyos:~$ # # # # Module Execution: # "after": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self" # ], # Using overridden # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast network 35.1.1.0/24 backdoor # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast aggregate-address 6601:1:1:1::/64 summary-only # set protocols bgp 100 address-family ipv6-unicast network 5001:1:1:1::/64 route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export '10' # vyos@vyos:~$ - name: Override vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "100.11.34.12" address_family: - afi: "ipv6" maximum_prefix: 45 nexthop_self: True route_map: - action: "import" route_map: "map01" address_family: - afi: "ipv4" aggregate_address: - prefix: "60.9.2.0/24" summary_only: True - afi: "ipv6" redistribute: - protocol: "static" metric: 50 state: overridden # Aft=validate-moduleser State # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import 'map01' # vyos@vyos:~$ # Module Execution: # "after": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "prefix": "60.9.2.0/24", # "summary_only": true # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "import", # "route_map": "map01" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "networks": [ # { # "backdoor": true, # "prefix": "35.1.1.0/24" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "aggregate_address": [ # { # "prefix": "6601:1:1:1::/64", # "summary_only": true # } # ], # "networks": [ # { # "prefix": "5001:1:1:1::/64", # "route_map": "map01" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in", # "delete protocols bgp 100 address-family ipv6 aggregate-address", # "delete protocols bgp 100 address-family ipv6 network", # "delete protocols bgp 100 address-family ipv4 network", # "delete protocols bgp 100 address-family ipv4 redistribute", # "set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only", # "set protocols bgp 100 address-family ipv6-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import map01" # ], # # Using deleted: # Before State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import 'map01' # vyos@vyos:~$ - name: Delete vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv6" - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" state: deleted # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 # vyos@vyos:~$ # # # Module Execution: # # "after": { # "address_family": [ # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "prefix": "60.9.2.0/24", # "summary_only": true # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "import", # "route_map": "map01" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 address-family ipv4-unicast", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family" # ], # # using parsed: # parsed.cfg # set protocols bgp 65536 address-family ipv4-unicast aggregate-address 192.0.2.0/24 as-set # set protocols bgp 65536 address-family ipv4-unicast network 192.1.13.0/24 route-map 'map01' # set protocols bgp 65536 address-family ipv4-unicast network 192.2.13.0/24 backdoor # set protocols bgp 65536 address-family ipv6-unicast redistribute ripng metric '20' # set protocols bgp 65536 neighbor 192.0.2.25 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 65536 neighbor 192.0.2.25 address-family ipv4-unicast soft-reconfiguration inbound # set protocols bgp 65536 neighbor 203.0.113.5 address-family ipv6-unicast attribute-unchanged next-hop - name: parse configs vyos.vyos.vyos_bgp_address_family: running_config: "{{ lookup('file', './parsed.cfg') }}" state: parsed # Module Execution: # "parsed": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "as_set": true, # "prefix": "192.0.2.0/24" # } # ], # "networks": [ # { # "prefix": "192.1.13.0/24", # "route_map": "map01" # }, # { # "backdoor": true, # "prefix": "192.2.13.0/24" # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 20, # "protocol": "ripng" # } # ] # } # ], # "as_number": 65536, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "route_map": [ # { # "action": "export", # "route_map": "map01" # } # ], # "soft_reconfiguration": true # } # ], # "neighbor_address": "192.0.2.25" # }, # { # "address_family": [ # { # "afi": "ipv6", # "attribute_unchanged": { # "next_hop": true # } # } # ], # "neighbor_address": "203.0.113.5" # } # ] # # Using gathered: # Native config: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast network 35.1.1.0/24 backdoor # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast aggregate-address 6601:1:1:1::/64 summary-only # set protocols bgp 100 address-family ipv6-unicast network 5001:1:1:1::/64 route-map 'map01' # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 - name: gather configs vyos.vyos.vyos_bgp_address_family: state: gathered # Module Execution: # "gathered": { # "address_family": [ # { # "afi": "ipv4", # "networks": [ # { # "backdoor": true, # "prefix": "35.1.1.0/24" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "aggregate_address": [ # { # "prefix": "6601:1:1:1::/64", # "summary_only": true # } # ], # "networks": [ # { # "prefix": "5001:1:1:1::/64", # "route_map": "map01" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # Using rendered: - name: Render vyos.vyos.vyos_bgp_address_family: config: as_number: "100" address_family: - afi: "ipv4" redistribute: - protocol: "static" metric: 50 neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" maximum_prefix: 45 nexthop_self: True route_map: - action: "export" route_map: "map01" - action: "import" route_map: "map01" weight: 50 state: rendered # Module Execution: # "rendered": [ # "set protocols bgp 100 address-family ipv4-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight 50" # ] Status ------ Authors ~~~~~~~ - Gomathi Selvi Srinivasan (@GomathiselviS) diff --git a/docs/vyos.vyos.vyos_bgp_global_module.rst b/docs/vyos.vyos.vyos_bgp_global_module.rst index da90274..06bd918 100644 --- a/docs/vyos.vyos.vyos_bgp_global_module.rst +++ b/docs/vyos.vyos.vyos_bgp_global_module.rst @@ -1,3079 +1,3079 @@ .. _vyos.vyos.vyos_bgp_global_module: ************************* vyos.vyos.vyos_bgp_global ************************* **BGP Global Resource Module.** Version added: 2.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manages BGP global configuration of interfaces on devices running VYOS. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
dictionary
A dict of BGP global configuration for interfaces.
aggregate_address
list / elements=dictionary
BGP aggregate network.
as_set
boolean
    Choices:
  • no
  • yes
Generate AS-set path information for this aggregate address.
prefix
string
BGP aggregate network.
summary_only
boolean
    Choices:
  • no
  • yes
Announce the aggregate summary network only.
as_number
integer
AS number.
bgp_params
dictionary
BGP parameters
always_compare_med
boolean
    Choices:
  • no
  • yes
Always compare MEDs from different neighbors
bestpath
dictionary
Default bestpath selection mechanism
as_path
string
    Choices:
  • confed
  • ignore
AS-path attribute comparison parameters
compare_routerid
boolean
    Choices:
  • no
  • yes
Compare the router-id for identical EBGP paths
med
string
    Choices:
  • confed
  • missing-as-worst
MED attribute comparison parameters
cluster_id
string
Route-reflector cluster-id
confederation
list / elements=dictionary
AS confederation parameters
identifier
integer
Confederation AS identifier
peers
integer
Peer ASs in the BGP confederation
dampening
dictionary
Enable route-flap dampening
half_life
integer
Half-life penalty in seconds
max_suppress_time
integer
Maximum duration to suppress a stable route
re_use
integer
Time to start reusing a route
start_suppress_time
integer
When to start suppressing a route
default
dictionary
BGP defaults
local_pref
integer
Default local preference
no_ipv4_unicast
boolean
    Choices:
  • no
  • yes
Deactivate IPv4 unicast for a peer by default
deterministic_med
boolean
    Choices:
  • no
  • yes
Compare MEDs between different peers in the same AS
disable_network_import_check
boolean
    Choices:
  • no
  • yes
Disable IGP route check for network statements
distance
list / elements=dictionary
-
Administratives distances for BGP routes
+
Administrative distances for BGP routes
prefix
integer
Administrative distance for a specific BGP prefix
type
string
    Choices:
  • external
  • internal
  • local
Type of route
value
integer
distance
enforce_first_as
boolean
    Choices:
  • no
  • yes
Require first AS in the path to match peer's AS
graceful_restart
integer
Maximum time to hold onto restarting peer's stale paths
log_neighbor_changes
boolean
    Choices:
  • no
  • yes
Log neighbor up/down changes and reset reason
no_client_to_client_reflection
boolean
    Choices:
  • no
  • yes
Disable client to client route reflection
no_fast_external_failover
boolean
    Choices:
  • no
  • yes
 -
Disable immediate sesison reset if peer's connected link goes down
+
Disable immediate session reset if peer's connected link goes down
router_id
string
BGP router-id
scan_time
integer
BGP route scanner interval
maximum_paths
list / elements=dictionary
BGP multipaths
count
integer
No. of paths.
path
string
BGP multipaths
neighbor
list / elements=dictionary
BGP neighbor
address
string
BGP neighbor address (v4/v6).
advertisement_interval
integer
Minimum interval for sending routing updates.
allowas_in
integer
Number of occurrences of AS number.
as_override
boolean
    Choices:
  • no
  • yes
AS for routes sent to this neighbor to be the local AS.
attribute_unchanged
dictionary
BGP attributes are sent unchanged.
as_path
boolean
    Choices:
  • no
  • yes
as_path
med
boolean
    Choices:
  • no
  • yes
med
next_hop
boolean
    Choices:
  • no
  • yes
next_hop
capability
dictionary
Advertise capabilities to this neighbor.
dynamic
boolean
    Choices:
  • no
  • yes
Advertise dynamic capability to this neighbor.
orf
string
    Choices:
  • send
  • receive
Advertise ORF capability to this neighbor.
default_originate
string
Send default route to this neighbor
description
string
description text
disable_capability_negotiation
boolean
    Choices:
  • no
  • yes
Disbale capability negotiation with the neighbor
disable_connected_check
boolean
    Choices:
  • no
  • yes
Disable check to see if EBGP peer's address is a connected route.
disable_send_community
string
    Choices:
  • extended
  • standard
Disable sending community attributes to this neighbor.
distribute_list
list / elements=dictionary
Access-list to filter route updates to/from this neighbor.
acl
integer
-
Acess-list number.
+
Access-list number.
action
string
    Choices:
  • export
  • import
Access-list to filter outgoing/incoming route updates to this neighbor
ebgp_multihop
integer
Allow this EBGP neighbor to not be on a directly connected network. Specify the number hops.
filter_list
list / elements=dictionary
As-path-list to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
path_list
string
As-path-list to filter
local_as
integer
local as number not to be prepended to updates from EBGP peers
maximum_prefix
integer
Maximum number of prefixes to accept from this neighbor nexthop-self Nexthop for routes sent to this neighbor to be the local router.
nexthop_self
boolean
    Choices:
  • no
  • yes
Nexthop for routes sent to this neighbor to be the local router.
override_capability
boolean
    Choices:
  • no
  • yes
Ignore capability negotiation with specified neighbor.
passive
boolean
    Choices:
  • no
  • yes
Do not initiate a session with this neighbor
password
string
BGP MD5 password
peer_group
boolean
    Choices:
  • no
  • yes
 -
True if all the configs unde this neighbor key is for peer group template.
+
True if all the configs under this neighbor key is for peer group template.
peer_group_name
string
IPv4 peer group for this peer
port
integer
Neighbor's BGP port
prefix_list
list / elements=dictionary
Prefix-list to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
prefix_list
string
Prefix-list to filter
remote_as
integer
Neighbor BGP AS number
remove_private_as
boolean
    Choices:
  • no
  • yes
Remove private AS numbers from AS path in outbound route updates
route_map
list / elements=dictionary
Route-map to filter route updates to/from this neighbor.
action
string
    Choices:
  • export
  • import
filter outgoing/incoming route updates
route_map
string
route-map to filter
route_reflector_client
boolean
    Choices:
  • no
  • yes
Neighbor as a route reflector client
route_server_client
boolean
    Choices:
  • no
  • yes
Neighbor is route server client
shutdown
boolean
    Choices:
  • no
  • yes
Administratively shut down neighbor
soft_reconfiguration
boolean
    Choices:
  • no
  • yes
Soft reconfiguration for neighbor
strict_capability_match
boolean
    Choices:
  • no
  • yes
Enable strict capability negotiation
timers
dictionary
Neighbor timers
connect
integer
BGP connect timer for this neighbor.
holdtime
integer
BGP hold timer for this neighbor
keepalive
integer
BGP keepalive interval for this neighbor
ttl_security
integer
Ttl security mechanism for this BGP peer
unsuppress_map
string
Route-map to selectively unsuppress suppressed routes
update_source
string
Source IP of routing updates
weight
integer
Default weight for routes from this neighbor
network
list / elements=dictionary
BGP network
address
string
BGP network address
backdoor
boolean
    Choices:
  • no
  • yes
Network as a backdoor route
route_map
string
Route-map to modify route attributes
redistribute
list / elements=dictionary
Redistribute routes from other protocols into BGP
metric
integer
Metric for redistributed routes.
protocol
string
    Choices:
  • connected
  • kernel
  • ospf
  • rip
  • static
types of routes to be redistributed.
route_map
string
Route map to filter redistributed routes
timers
dictionary
BGP protocol timers
holdtime
integer
Hold time interval
keepalive
integer
Keepalive interval
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the EOS device by executing the command show running-config | section bgp.
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • deleted
  • merged ←
  • purged
  • replaced
  • gathered
  • rendered
  • parsed
The state the configuration should be left in.
State purged removes all the BGP configurations from the target device. Use caution with this state.('delete protocols bgp <x>')
State deleted only removes BGP attributes that this modules manages and does not negate the BGP process completely. Thereby, preserving address-family related configurations under BGP context.
Running states deleted and replaced will result in an error if there are address-family configuration lines present under neighbor context that is is to be removed. Please use the vyos.vyos.vyos_bgp_address_family module for prior cleanup.
Refer to examples for more details.

Examples -------- .. code-block:: yaml # Using merged # Before state # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ - name: Merge provided configuration with device configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" aggregate_address: - prefix: "203.0.113.0/24" as_set: true - prefix: "192.0.2.0/24" summary_only: true network: - address: "192.1.13.0/24" backdoor: true redistribute: - protocol: "kernel" metric: 45 - protocol: "connected" route_map: "map01" maximum_paths: - path: "ebgp" count: 20 - path: "ibgp" count: 55 timers: keepalive: 35 bgp_params: bestpath: as_path: "confed" compare_routerid: true default: no_ipv4_unicast: true router_id: "192.1.2.9" confederation: - peers: 20 - peers: 55 - identifier: 66 neighbor: - address: "192.0.2.25" disable_connected_check: true timers: holdtime: 30 keepalive: 10 - address: "203.0.113.5" attribute_unchanged: as_path: true med: true ebgp_multihop: 2 remote_as: 101 update_source: "192.0.2.25" - address: "5001::64" maximum_prefix: 34 distribute_list: - acl: 20 action: "export" - acl: 40 action: "import" state: merged # After State # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "before": {}, # "changed": true, # "commands": [ # "set protocols bgp 65536 neighbor 192.0.2.25 disable-connected-check", # "set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime 30", # "set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive 10", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged as-path", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged med", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged next-hop", # "set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop 2", # "set protocols bgp 65536 neighbor 203.0.113.5 remote-as 101", # "set protocols bgp 65536 neighbor 203.0.113.5 update-source 192.0.2.25", # "set protocols bgp 65536 neighbor 5001::64 maximum-prefix 34", # "set protocols bgp 65536 neighbor 5001::64 distribute-list export 20", # "set protocols bgp 65536 neighbor 5001::64 distribute-list import 40", # "set protocols bgp 65536 redistribute kernel metric 45", # "set protocols bgp 65536 redistribute connected route-map map01", # "set protocols bgp 65536 network 192.1.13.0/24 backdoor", # "set protocols bgp 65536 aggregate-address 203.0.113.0/24 as-set", # "set protocols bgp 65536 aggregate-address 192.0.2.0/24 summary-only", # "set protocols bgp 65536 parameters bestpath as-path confed", # "set protocols bgp 65536 parameters bestpath compare-routerid", # "set protocols bgp 65536 parameters default no-ipv4-unicast", # "set protocols bgp 65536 parameters router-id 192.1.2.9", # "set protocols bgp 65536 parameters confederation peers 20", # "set protocols bgp 65536 parameters confederation peers 55", # "set protocols bgp 65536 parameters confederation identifier 66", # "set protocols bgp 65536 maximum-paths ebgp 20", # "set protocols bgp 65536 maximum-paths ibgp 55", # "set protocols bgp 65536 timers keepalive 35" # ], # Using replaced: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ - name: Replace vyos.vyos.vyos_bgp_global: config: as_number: "65536" network: - address: "203.0.113.0/24" route_map: map01 redistribute: - protocol: "static" route_map: "map01" neighbor: - address: "192.0.2.40" advertisement_interval: 72 capability: orf: "receive" bgp_params: bestpath: as_path: "confed" state: replaced # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed" # } # }, # "neighbor": [ # { # "address": "192.0.2.40", # "advertisement_interval": 72, # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # "before": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536 timers", # "delete protocols bgp 65536 maximum-paths ", # "delete protocols bgp 65536 maximum-paths ", # "delete protocols bgp 65536 parameters router-id 192.1.2.9", # "delete protocols bgp 65536 parameters default", # "delete protocols bgp 65536 parameters confederation", # "delete protocols bgp 65536 parameters bestpath compare-routerid", # "delete protocols bgp 65536 aggregate-address", # "delete protocols bgp 65536 network 192.1.13.0/24", # "delete protocols bgp 65536 redistribute kernel", # "delete protocols bgp 65536 redistribute kernel", # "delete protocols bgp 65536 redistribute connected", # "delete protocols bgp 65536 redistribute connected", # "delete protocols bgp 65536 neighbor 5001::64", # "delete protocols bgp 65536 neighbor 203.0.113.5", # "delete protocols bgp 65536 neighbor 192.0.2.25", # "set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval 72", # "set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list receive", # "set protocols bgp 65536 redistribute static route-map map01", # "set protocols bgp 65536 network 203.0.113.0/24 route-map map01" # ], # Using deleted: # ------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ - name: Delete configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: deleted # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp '65536' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "as_number": 65536 # }, # "before": { # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed" # } # }, # "neighbor": [ # { # "address": "192.0.2.40", # "advertisement_interval": 72, # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536 neighbor 192.0.2.40", # "delete protocols bgp 65536 redistribute", # "delete protocols bgp 65536 network", # "delete protocols bgp 65536 parameters" # ], # Using purged: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ - name: Purge configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: purged # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ # # Module Execution: # # "after": {}, # "before": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536" # ], # Deleted in presence of address family under neighbors: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ ^C # vyos@vyos:~$ - name: Delete configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: deleted # Module Execution: # # "changed": false, # "invocation": { # "module_args": { # "config": { # "aggregate_address": null, # "as_number": 65536, # "bgp_params": null, # "maximum_paths": null, # "neighbor": null, # "network": null, # "redistribute": null, # "timers": null # }, # "running_config": null, # "state": "deleted" # } # }, # "msg": "Use the _bgp_address_family module to delete the address_family under neighbor 203.0.113.0, before replacing/deleting the neighbor." # } # using gathered: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ ^C - name: gather configs vyos.vyos.vyos_bgp_global: state: gathered # Module Execution: # "gathered": { # "as_number": 65536, # "bgp_params": { # "always_compare_med": true, # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "default": { # "no_ipv4_unicast": true # }, # "distance": [ # { # "type": "external", # "value": 66 # }, # { # "type": "internal", # "value": 20 # }, # { # "type": "local", # "value": 10 # } # ] # }, # "neighbor": [ # { # "address": "192.0.2.43", # "advertisement_interval": 72, # "capability": { # "dynamic": true # }, # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.0", # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # # Using parsed: # ------------ # parsed.cfg # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' - name: parse configs vyos.vyos.vyos_bgp_global: running_config: "{{ lookup('file', './parsed.cfg') }}" state: parsed tags: - parsed # Module execution: # "parsed": { # "as_number": 65536, # "bgp_params": { # "always_compare_med": true, # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "default": { # "no_ipv4_unicast": true # }, # "distance": [ # { # "type": "external", # "value": 66 # }, # { # "type": "internal", # "value": 20 # }, # { # "type": "local", # "value": 10 # } # ] # }, # "neighbor": [ # { # "address": "192.0.2.43", # "advertisement_interval": 72, # "capability": { # "dynamic": true # }, # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.0", # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # } # # Using rendered: # -------------- - name: Render vyos.vyos.vyos_bgp_global: config: as_number: "65536" network: - address: "203.0.113.0/24" route_map: map01 redistribute: - protocol: "static" route_map: "map01" bgp_params: always_compare_med: true dampening: start_suppress_time: 5 max_suppress_time: 20 half_life: 33 re_use: 60 distance: - type: "internal" value: 20 - type: "local" value: 10 - type: "external" value: 66 bestpath: as_path: "confed" compare_routerid: true default: no_ipv4_unicast: true neighbor: - address: "192.0.2.43" disable_connected_check: true advertisement_interval: 72 capability: dynamic: true timers: holdtime: 30 keepalive: 10 - address: "203.0.113.0" capability: orf: "receive" state: rendered # Module Execution: # "rendered": [ # "set protocols bgp 65536 neighbor 192.0.2.43 disable-connected-check", # "set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval 72", # "set protocols bgp 65536 neighbor 192.0.2.43 capability dynamic", # "set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime 30", # "set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive 10", # "set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list receive", # "set protocols bgp 65536 redistribute static route-map map01", # "set protocols bgp 65536 network 203.0.113.0/24 route-map map01", # "set protocols bgp 65536 parameters always-compare-med", # "set protocols bgp 65536 parameters dampening half-life 33", # "set protocols bgp 65536 parameters dampening max-suppress-time 20", # "set protocols bgp 65536 parameters dampening re-use 60", # "set protocols bgp 65536 parameters dampening start-suppress-time 5", # "set protocols bgp 65536 parameters distance global internal 20", # "set protocols bgp 65536 parameters distance global local 10", # "set protocols bgp 65536 parameters distance global external 66", # "set protocols bgp 65536 parameters bestpath as-path confed", # "set protocols bgp 65536 parameters bestpath compare-routerid", # "set protocols bgp 65536 parameters default no-ipv4-unicast" # ] Status ------ Authors ~~~~~~~ - Gomathi Selvi Srinivasan (@GomathiselviS) diff --git a/docs/vyos.vyos.vyos_firewall_global_module.rst b/docs/vyos.vyos.vyos_firewall_global_module.rst index b37cf02..ec84f55 100644 --- a/docs/vyos.vyos.vyos_firewall_global_module.rst +++ b/docs/vyos.vyos.vyos_firewall_global_module.rst @@ -1,1749 +1,1749 @@ .. _vyos.vyos.vyos_firewall_global_module: ****************************** vyos.vyos.vyos_firewall_global ****************************** **FIREWALL global resource module** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manage global policies or configurations for firewall on VyOS devices. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
dictionary
A dictionary of Firewall global configuration options.
config_trap
boolean
    Choices:
  • no
  • yes
SNMP trap generation on firewall configuration changes.
group
dictionary
Defines a group of objects for referencing in firewall rules.
address_group
list / elements=dictionary
Defines a group of IP addresses for referencing in firewall rules.
description
string
Allows you to specify a brief description for the address group.
members
list / elements=dictionary
Address-group members.
IPv4 address to match.
IPv4 range to match.
address
string
IP address.
name
string / required
Name of the firewall address group.
network_group
list / elements=dictionary
Defines a group of networks for referencing in firewall rules.
description
string
Allows you to specify a brief description for the network group.
members
list / elements=dictionary
Adds an IPv4 network to the specified network group.
The format is ip-address/prefix.
address
string
IP address.
name
string / required
Name of the firewall network group.
port_group
list / elements=dictionary
Defines a group of ports for referencing in firewall rules.
description
string
Allows you to specify a brief description for the port group.
members
list / elements=dictionary
Port-group member.
port
string
Defines the number.
name
string / required
Name of the firewall port group.
log_martians
boolean
    Choices:
  • no
  • yes
Specifies whether or not to record packets with invalid addresses in the log.
(True) Logs packets with invalid addresses.
(False) Does not log packets with invalid addresses.
ping
dictionary
Policy for handling of all IPv4 ICMP echo requests.
all
boolean
    Choices:
  • no
  • yes
Enables or disables response to all IPv4 ICMP Echo Request (ping) messages.
The system responds to IPv4 ICMP Echo Request messages.
broadcast
boolean
    Choices:
  • no
  • yes
Enables or disables response to broadcast IPv4 ICMP Echo Request and Timestamp Request messages.
IPv4 ICMP Echo and Timestamp Request messages are not processed.
route_redirects
list / elements=dictionary
-A dictionary of Firewall icmp redirect and source route global configuration options.
afi
string / required
    Choices:
  • ipv4
  • ipv6
Specifies IP address type
icmp_redirects
dictionary
Specifies whether to allow sending/receiving of IPv4/v6 ICMP redirect messages.
receive
boolean
    Choices:
  • no
  • yes
Permits or denies receiving packets ICMP redirect messages.
send
boolean
    Choices:
  • no
  • yes
Permits or denies transmitting packets ICMP redirect messages.
ip_src_route
boolean
    Choices:
  • no
  • yes
Specifies whether or not to process source route IP options.
state_policy
list / elements=dictionary
Specifies global firewall state-policy.
action
string
    Choices:
  • accept
  • drop
  • reject
Action for packets part of an established connection.
connection_type
string
    Choices:
  • established
  • invalid
  • related
Specifies connection type.
log
boolean
    Choices:
  • no
  • yes
Enable logging of packets part of an established connection.
syn_cookies
boolean
    Choices:
  • no
  • yes
Specifies policy for using TCP SYN cookies with IPv4.
(True) Enables TCP SYN cookies with IPv4.
(False) Disables TCP SYN cookies with IPv4.
twa_hazards_protection
boolean
    Choices:
  • no
  • yes
 -
RFC1337 TCP TIME-WAIT assasination hazards protection.
+
RFC1337 TCP TIME-WAIT assassination hazards protection.
validation
string
    Choices:
  • strict
  • loose
  • disable
Specifies a policy for source validation by reversed path, as defined in RFC 3704.
(disable) No source validation is performed.
(loose) Enable Loose Reverse Path Forwarding as defined in RFC3704.
(strict) Enable Strict Reverse Path Forwarding as defined in RFC3704.
running_config
string
The module, by default, will connect to the remote device and retrieve the current running-config to use as a base for comparing against the contents of source. There are times when it is not desirable to have the task get the current running-config for every task in a playbook. The running_config argument allows the implementer to pass in the configuration to use as the base config for comparison. This value of this option should be the output received from device by executing command show configuration commands | grep 'firewall'
state
string
    Choices:
  • merged ←
  • replaced
  • deleted
  • gathered
  • rendered
  • parsed
The state the configuration should be left in.

Notes ----- .. note:: - Tested against VyOS 1.1.8 (helium). - This module works with connection ``network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_. Examples -------- .. code-block:: yaml # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep firewall # # - - name: Merge the provided configuration with the exisiting running configuration + - name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: MGMT-HOSTS description: This group has the Management hosts address list members: - address: 192.0.1.1 - address: 192.0.1.3 - address: 192.0.1.5 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": [] # # "commands": [ # "set firewall group address-group MGMT-HOSTS address 192.0.1.1", # "set firewall group address-group MGMT-HOSTS address 192.0.1.3", # "set firewall group address-group MGMT-HOSTS address 192.0.1.5", # "set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list'", # "set firewall group address-group MGMT-HOSTS", # "set firewall group network-group MGMT network 192.0.1.0/24", # "set firewall group network-group MGMT description 'This group has the Management network addresses'", # "set firewall group network-group MGMT", # "set firewall ip-src-route 'enable'", # "set firewall receive-redirects 'disable'", # "set firewall send-redirects 'enable'", # "set firewall config-trap 'enable'", # "set firewall state-policy established action 'accept'", # "set firewall state-policy established log 'enable'", # "set firewall state-policy invalid action 'reject'", # "set firewall broadcast-ping 'enable'", # "set firewall all-ping 'enable'", # "set firewall log-martians 'enable'", # "set firewall twa-hazards-protection 'enable'", # "set firewall syn-cookies 'enable'", # "set firewall source-validation 'strict'" # ] # # "after": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # # # Using parsed # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_global: running_config: "set firewall all-ping 'enable' set firewall broadcast-ping 'enable' set firewall config-trap 'enable' set firewall group address-group ENG-HOSTS address '192.0.3.1' set firewall group address-group ENG-HOSTS address '192.0.3.2' set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' set firewall group address-group SALES-HOSTS address '192.0.2.1' set firewall group address-group SALES-HOSTS address '192.0.2.2' set firewall group address-group SALES-HOSTS address '192.0.2.3' set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' set firewall group network-group MGMT description 'This group has the Management network addresses' set firewall group network-group MGMT network '192.0.1.0/24' set firewall ip-src-route 'enable' set firewall log-martians 'enable' set firewall receive-redirects 'disable' set firewall send-redirects 'enable' set firewall source-validation 'strict' set firewall state-policy established action 'accept' set firewall state-policy established log 'enable' set firewall state-policy invalid action 'reject' set firewall syn-cookies 'enable' set firewall twa-hazards-protection 'enable'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # } # # # Using deleted # # Before state # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' - name: Delete attributes of firewall. vyos.vyos.vyos_firewall_global: config: state_policy: config_trap: log_martians: syn_cookies: twa_hazards_protection: route_redirects: ping: group: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # "commands": [ # "delete firewall source-validation", # "delete firewall group", # "delete firewall log-martians", # "delete firewall ip-src-route", # "delete firewall receive-redirects", # "delete firewall send-redirects", # "delete firewall config-trap", # "delete firewall state-policy", # "delete firewall syn-cookies", # "delete firewall broadcast-ping", # "delete firewall all-ping", # "delete firewall twa-hazards-protection" # ] # # "after": [] # After state # ------------ # vyos@192# run show configuration commands | grep firewall # set 'firewall' # # # Using replaced # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # - name: Replace firewall global attributes configuration. vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: SALES-HOSTS description: Sales office hosts address list members: - address: 192.0.2.1 - address: 192.0.2.2 - address: 192.0.2.3 - name: ENG-HOSTS description: Sales office hosts address list members: - address: 192.0.3.1 - address: 192.0.3.2 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # "commands": [ # "delete firewall group address-group MGMT-HOSTS", # "set firewall group address-group SALES-HOSTS address 192.0.2.1", # "set firewall group address-group SALES-HOSTS address 192.0.2.2", # "set firewall group address-group SALES-HOSTS address 192.0.2.3", # "set firewall group address-group SALES-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group SALES-HOSTS", # "set firewall group address-group ENG-HOSTS address 192.0.3.1", # "set firewall group address-group ENG-HOSTS address 192.0.3.2", # "set firewall group address-group ENG-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group ENG-HOSTS" # ] # # "after": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # # # Using gathered # # Before state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # - name: Gather firewall global config with provided configurations vyos.vyos.vyos_firewall_global: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": [ # { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: SALES-HOSTS description: Sales office hosts address list members: - address: 192.0.2.1 - address: 192.0.2.2 - address: 192.0.2.3 - name: ENG-HOSTS description: Sales office hosts address list members: - address: 192.0.3.1 - address: 192.0.3.2 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # "set firewall group address-group SALES-HOSTS address 192.0.2.1", # "set firewall group address-group SALES-HOSTS address 192.0.2.2", # "set firewall group address-group SALES-HOSTS address 192.0.2.3", # "set firewall group address-group SALES-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group SALES-HOSTS", # "set firewall group address-group ENG-HOSTS address 192.0.3.1", # "set firewall group address-group ENG-HOSTS address 192.0.3.2", # "set firewall group address-group ENG-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group ENG-HOSTS", # "set firewall group network-group MGMT network 192.0.1.0/24", # "set firewall group network-group MGMT description 'This group has the Management network addresses'", # "set firewall group network-group MGMT", # "set firewall ip-src-route 'enable'", # "set firewall receive-redirects 'disable'", # "set firewall send-redirects 'enable'", # "set firewall config-trap 'enable'", # "set firewall state-policy established action 'accept'", # "set firewall state-policy established log 'enable'", # "set firewall state-policy invalid action 'reject'", # "set firewall broadcast-ping 'enable'", # "set firewall all-ping 'enable'", # "set firewall log-martians 'enable'", # "set firewall twa-hazards-protection 'enable'", # "set firewall syn-cookies 'enable'", # "set firewall source-validation 'strict'" # ] # # Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: .. raw:: html
Key Returned Description
after
list
when changed
The resulting configuration model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
before
list
always
The configuration prior to the model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
commands
list
always
The set of commands pushed to the remote device.

Sample:
['set firewall group address-group ENG-HOSTS', 'set firewall group address-group ENG-HOSTS address 192.0.3.1']


Status ------ Authors ~~~~~~~ - Rohit Thakur (@rohitthakur2590) diff --git a/docs/vyos.vyos.vyos_firewall_rules_module.rst b/docs/vyos.vyos.vyos_firewall_rules_module.rst index cebe64c..7a7428d 100644 --- a/docs/vyos.vyos.vyos_firewall_rules_module.rst +++ b/docs/vyos.vyos.vyos_firewall_rules_module.rst @@ -1,2440 +1,2440 @@ .. _vyos.vyos.vyos_firewall_rules_module: ***************************** vyos.vyos.vyos_firewall_rules ***************************** **FIREWALL rules resource module** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manages firewall rule-set attributes on VyOS devices Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
list / elements=dictionary
A dictionary of Firewall rule-set options.
afi
string / required
    Choices:
  • ipv4
  • ipv6
Specifies the type of rule-set.
rule_sets
list / elements=dictionary
The Firewall rule-set list.
default_action
string
    Choices:
  • drop
  • reject
  • accept
Default action for rule-set.
drop (Drop if no prior rules are hit (default))
reject (Drop and notify source if no prior rules are hit)
accept (Accept if no prior rules are hit)
description
string
Rule set description.
enable_default_log
boolean
    Choices:
  • no
  • yes
Option to log packets hitting default-action.
name
string
Firewall rule set name.
rules
list / elements=dictionary
-
A ditionary that specifies the rule-set configurations.
+
A dictionary that specifies the rule-set configurations.
action
string
    Choices:
  • drop
  • reject
  • accept
  • inspect
Specifying the action.
description
string
Description of this rule.
destination
dictionary
Specifying the destination parameters.
address
string
Destination ip address subnet or range.
IPv4/6 address, subnet or range to match.
Match everything except the specified address, subnet or range.
Destination ip address subnet or range.
group
dictionary
Destination group.
address_group
string
Group of addresses.
network_group
string
Group of networks.
port_group
string
Group of ports.
port
string
Multiple destination ports can be specified as a comma-separated list.
The whole list can also be "negated" using '!'.
For example:'!22,telnet,http,123,1001-1005'.
disabled
boolean
    Choices:
  • no
  • yes
Option to disable firewall rule.
fragment
string
    Choices:
  • match-frag
  • match-non-frag
IP fragment match.
icmp
dictionary
ICMP type and code information.
code
integer
ICMP code.
type
integer
ICMP type.
type_name
string
    Choices:
  • any
  • echo-reply
  • destination-unreachable
  • network-unreachable
  • host-unreachable
  • protocol-unreachable
  • port-unreachable
  • fragmentation-needed
  • source-route-failed
  • network-unknown
  • host-unknown
  • network-prohibited
  • host-prohibited
  • TOS-network-unreachable
  • TOS-host-unreachable
  • communication-prohibited
  • host-precedence-violation
  • precedence-cutoff
  • source-quench
  • redirect
  • network-redirect
  • host-redirect
  • TOS-network-redirect
  • TOS-host-redirect
  • echo-request
  • router-advertisement
  • router-solicitation
  • time-exceeded
  • ttl-zero-during-transit
  • ttl-zero-during-reassembly
  • parameter-problem
  • ip-header-bad
  • required-option-missing
  • timestamp-request
  • timestamp-reply
  • address-mask-request
  • address-mask-reply
  • ping
  • pong
  • ttl-exceeded
ICMP type-name.
ipsec
string
    Choices:
  • match-ipsec
  • match-none
 -
Inboud ip sec packets.
+
Inbound ip sec packets.
limit
dictionary
Rate limit using a token bucket filter.
burst
integer
Maximum number of packets to allow in excess of rate.
rate
dictionary
format for rate (integer/time unit).
any one of second, minute, hour or day may be used to specify time unit.
eg. 1/second implies rule to be matched at an average of once per second.
number
integer
This is the integer value.
unit
string
This is the time unit.
number
integer / required
Rule number.
p2p
list / elements=dictionary
P2P application packets.
application
string
    Choices:
  • all
  • applejuice
  • bittorrent
  • directconnect
  • edonkey
  • gnutella
  • kazaa
Name of the application.
protocol
string
Protocol to match (protocol name in /etc/protocols or protocol number or all).
<text> IP protocol name from /etc/protocols (e.g. "tcp" or "udp").
<0-255> IP protocol number.
tcp_udp Both TCP and UDP.
all All IP protocols.
(!)All IP protocols except for the specified name or number.
recent
dictionary
Parameters for matching recently seen sources.
count
integer
Source addresses seen more than N times.
time
integer
Source addresses seen in the last N seconds.
source
dictionary
Source parameters.
address
string
Source ip address subnet or range.
IPv4/6 address, subnet or range to match.
Match everything except the specified address, subnet or range.
Source ip address subnet or range.
group
dictionary
Source group.
address_group
string
Group of addresses.
network_group
string
Group of networks.
port_group
string
Group of ports.
mac_address
string
<MAC address> MAC address to match.
<!MAC address> Match everything except the specified MAC address.
port
string
Multiple source ports can be specified as a comma-separated list.
The whole list can also be "negated" using '!'.
For example:'!22,telnet,http,123,1001-1005'.
state
dictionary
Session state.
established
boolean
    Choices:
  • no
  • yes
Established state.
invalid
boolean
    Choices:
  • no
  • yes
Invalid state.
new
boolean
    Choices:
  • no
  • yes
New state.
related
boolean
    Choices:
  • no
  • yes
Related state.
tcp
dictionary
TCP flags to match.
flags
string
TCP flags to be matched.
time
dictionary
Time to match rule.
monthdays
string
Monthdays to match rule on.
startdate
string
Date to start matching rule.
starttime
string
Time of day to start matching rule.
stopdate
string
Date to stop matching rule.
stoptime
string
Time of day to stop matching rule.
utc
boolean
    Choices:
  • no
  • yes
Interpret times for startdate, stopdate, starttime and stoptime to be UTC.
weekdays
string
Weekdays to match rule on.
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | grep firewall.
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • merged ←
  • replaced
  • overridden
  • deleted
  • gathered
  • rendered
  • parsed
The state the configuration should be left in

Notes ----- .. note:: - Tested against VyOS 1.1.8 (helium). - This module works with connection ``network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_. Examples -------- .. code-block:: yaml # Using deleted to delete firewall rules based on rule-set name # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 rule_sets: - name: Downlink state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name Downlink" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # Using deleted to delete firewall rules based on afi # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name" # ] # # "after": [] # After state # ------------ # vyos@vyos:~$ show configuration commands| grep firewall # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # Using deleted to delete all the the firewall rules when provided config is empty # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # - - name: Merge the provided configuration with the exisiting running configuration + - name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept rules: - number: 1 action: accept description: Fwipv6-Rule 1 is configured by Ansible ipsec: match-ipsec - number: 2 action: accept description: Fwipv6-Rule 2 is configured by Ansible ipsec: match-ipsec - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 102 action: reject description: Rule 102 is configured by Ansible ipsec: match-ipsec - number: 103 action: accept description: Rule 103 is configured by Ansible destination: group: address_group: inbound source: address: 192.0.2.0 state: established: true new: false invalid: false related: true state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": [] # # "commands": [ # "set firewall ipv6-name UPLINK default-action 'accept'", # "set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'", # "set firewall ipv6-name UPLINK rule 1 action 'accept'", # "set firewall ipv6-name UPLINK rule 1", # "set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible'", # "set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec'", # "set firewall ipv6-name UPLINK rule 2 action 'accept'", # "set firewall ipv6-name UPLINK rule 2", # "set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible'", # "set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec'", # "set firewall name INBOUND default-action 'accept'", # "set firewall name INBOUND description 'IPv4 INBOUND rule set'", # "set firewall name INBOUND rule 101 action 'accept'", # "set firewall name INBOUND rule 101", # "set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'", # "set firewall name INBOUND rule 101 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 102 action 'reject'", # "set firewall name INBOUND rule 102", # "set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", # "set firewall name INBOUND rule 102 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'", # "set firewall name INBOUND rule 103 destination group address-group inbound", # "set firewall name INBOUND rule 103", # "set firewall name INBOUND rule 103 source address 192.0.2.0", # "set firewall name INBOUND rule 103 state established enable", # "set firewall name INBOUND rule 103 state related enable", # "set firewall name INBOUND rule 103 state invalid disable", # "set firewall name INBOUND rule 103 state new disable", # "set firewall name INBOUND rule 103 action 'accept'" # ] # # "after": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # Using replaced # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # - name: Replace device configurations of listed firewall rules with provided configurations vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 104 action: reject description: Rule 104 is configured by Ansible ipsec: match-none state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # "commands": [ # "delete firewall ipv6-name UPLINK rule 1", # "delete firewall ipv6-name UPLINK rule 2", # "delete firewall name INBOUND rule 102", # "delete firewall name INBOUND rule 103", # "set firewall name INBOUND rule 104 action 'reject'", # "set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible'", # "set firewall name INBOUND rule 104", # "set firewall name INBOUND rule 104 ipsec 'match-none'" # ] # # "after": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK" # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 104 is configured by Ansible", # "ipsec": "match-none", # "number": 104 # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 104 action 'reject' # set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible' # set firewall name INBOUND rule 104 ipsec 'match-none' # Using overridden # # Before state # -------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 104 action 'reject' # set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible' # set firewall name INBOUND rule 104 ipsec 'match-none' # - name: Overrides all device configuration with provided configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 rule_sets: - name: Downlink description: IPv4 INBOUND rule set default_action: accept rules: - number: 501 action: accept description: Rule 501 is configured by Ansible ipsec: match-ipsec - number: 502 action: reject description: Rule 502 is configured by Ansible ipsec: match-ipsec state: overridden # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK" # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 104 is configured by Ansible", # "ipsec": "match-none", # "number": 104 # } # ] # } # ] # } # ] # # "commands": [ # "delete firewall ipv6-name UPLINK", # "delete firewall name INBOUND", # "set firewall name Downlink default-action 'accept'", # "set firewall name Downlink description 'IPv4 INBOUND rule set'", # "set firewall name Downlink rule 501 action 'accept'", # "set firewall name Downlink rule 501", # "set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible'", # "set firewall name Downlink rule 501 ipsec 'match-ipsec'", # "set firewall name Downlink rule 502 action 'reject'", # "set firewall name Downlink rule 502", # "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'", # "set firewall name Downlink rule 502 ipsec 'match-ipsec'" # # # "after": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # # # After state # ------------ # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # Using gathered # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # - name: Gather listed firewall rules with provided configurations vyos.vyos.vyos_firewall_rules: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 102 action: reject description: Rule 102 is configured by Ansible ipsec: match-ipsec - number: 103 action: accept description: Rule 103 is configured by Ansible destination: group: address_group: inbound source: address: 192.0.2.0 state: established: true new: false invalid: false related: true state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # "set firewall ipv6-name UPLINK default-action 'accept'", # "set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'", # "set firewall name INBOUND default-action 'accept'", # "set firewall name INBOUND description 'IPv4 INBOUND rule set'", # "set firewall name INBOUND rule 101 action 'accept'", # "set firewall name INBOUND rule 101", # "set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'", # "set firewall name INBOUND rule 101 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 102 action 'reject'", # "set firewall name INBOUND rule 102", # "set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", # "set firewall name INBOUND rule 102 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'", # "set firewall name INBOUND rule 103 destination group address-group inbound", # "set firewall name INBOUND rule 103", # "set firewall name INBOUND rule 103 source address 192.0.2.0", # "set firewall name INBOUND rule 103 state established enable", # "set firewall name INBOUND rule 103 state related enable", # "set firewall name INBOUND rule 103 state invalid disable", # "set firewall name INBOUND rule 103 state new disable", # "set firewall name INBOUND rule 103 action 'accept'" # ] # Using parsed # # - name: Parsed the provided input commands. vyos.vyos.vyos_firewall_rules: running_config: "set firewall group address-group 'inbound' set firewall name Downlink default-action 'accept' set firewall name Downlink description 'IPv4 INBOUND rule set' set firewall name Downlink rule 501 action 'accept' set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' set firewall name Downlink rule 501 ipsec 'match-ipsec' set firewall name Downlink rule 502 action 'reject' set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' set firewall name Downlink rule 502 ipsec 'match-ipsec'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: .. raw:: html
Key Returned Description
after
list
when changed
The resulting configuration model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
before
list
always
The configuration prior to the model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
commands
list
always
The set of commands pushed to the remote device.

Sample:
["set firewall name Downlink default-action 'accept'", "set firewall name Downlink description 'IPv4 INBOUND rule set'", "set firewall name Downlink rule 501 action 'accept'", "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'", "set firewall name Downlink rule 502 ipsec 'match-ipsec'"]


Status ------ Authors ~~~~~~~ - Rohit Thakur (@rohitthakur2590) diff --git a/docs/vyos.vyos.vyos_ospfv3_module.rst b/docs/vyos.vyos.vyos_ospfv3_module.rst index 568dbab..6bad877 100644 --- a/docs/vyos.vyos.vyos_ospfv3_module.rst +++ b/docs/vyos.vyos.vyos_ospfv3_module.rst @@ -1,916 +1,916 @@ .. _vyos.vyos.vyos_ospfv3_module: ********************* vyos.vyos.vyos_ospfv3 ********************* **OSPFV3 resource module** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This resource module configures and manages attributes of OSPFv3 routes on VyOS network devices. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
dictionary
A provided OSPFv3 route configuration.
areas
list / elements=dictionary
OSPFv3 area.
area_id
string
OSPFv3 Area name/identity.
export_list
string
Name of export-list.
import_list
string
Name of import-list.
range
list / elements=dictionary
Summarize routes matching prefix (border routers only).
address
string
border router IPv4 address.
advertise
boolean
    Choices:
  • no
  • yes
Advertise this range.
not_advertise
boolean
    Choices:
  • no
  • yes
Don't advertise this range.
parameters
dictionary
OSPFv3 specific parameters.
router_id
string
Override the default router identifier.
redistribute
list / elements=dictionary
Redistribute information from another routing protocol.
route_map
string
Route map references.
route_type
string
    Choices:
  • bgp
  • connected
  • kernel
  • ripng
  • static
Route type to redistribute.
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | grep ospfv3.
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • merged ←
  • replaced
  • deleted
  • parsed
  • gathered
  • rendered
The state the configuration should be left in.

Notes ----- .. note:: - Tested against VyOS 1.1.8 (helium). - This module works with connection ``network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_. Examples -------- .. code-block:: yaml # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep ospfv3 # # - - name: Merge the provided configuration with the exisiting running configuration + - name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db20::/32 - address: 2001:db30::/32 - area_id: '3' range: - address: 2001:db40::/32 state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": {} # # "commands": [ # "set protocols ospfv3 redistribute bgp", # "set protocols ospfv3 parameters router-id '192.0.2.10'", # "set protocols ospfv3 area 2 range 2001:db10::/32", # "set protocols ospfv3 area 2 range 2001:db20::/32", # "set protocols ospfv3 area 2 range 2001:db30::/32", # "set protocols ospfv3 area '2'", # "set protocols ospfv3 area 2 export-list export1", # "set protocols ospfv3 area 2 import-list import1", # "set protocols ospfv3 area '3'", # "set protocols ospfv3 area 3 range 2001:db40::/32" # ] # # "after": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using replaced # # Before state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Replace ospfv3 routes attributes configuration. vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db30::/32 - address: 2001:db50::/32 - area_id: '4' range: - address: 2001:db60::/32 state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # "commands": [ # "delete protocols ospfv3 area 2 range 2001:db20::/32", # "delete protocols ospfv3 area 3", # "set protocols ospfv3 area 2 range 2001:db50::/32", # "set protocols ospfv3 area '4'", # "set protocols ospfv3 area 4 range 2001:db60::/32" # ] # # "after": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db30::/32" # }, # { # "address": "2001:db50::/32" # } # ] # }, # { # "area_id": "4", # "range": [ # { # "address": "2001:db60::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 2 range '2001:db50::/32' # set protocols ospfv3 area 4 range '2001:db60::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db20::/32 - address: 2001:db30::/32 - area_id: '3' range: - address: 2001:db40::/32 state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # [ # "set protocols ospfv3 redistribute bgp", # "set protocols ospfv3 parameters router-id '192.0.2.10'", # "set protocols ospfv3 area 2 range 2001:db10::/32", # "set protocols ospfv3 area 2 range 2001:db20::/32", # "set protocols ospfv3 area 2 range 2001:db30::/32", # "set protocols ospfv3 area '2'", # "set protocols ospfv3 area 2 export-list export1", # "set protocols ospfv3 area 2 import-list import1", # "set protocols ospfv3 area '3'", # "set protocols ospfv3 area 3 range 2001:db40::/32" # ] # Using parsed # # - name: Parse the commands to provide structured configuration. vyos.vyos.vyos_ospfv3: running_config: "set protocols ospfv3 area 2 export-list 'export1' set protocols ospfv3 area 2 import-list 'import1' set protocols ospfv3 area 2 range '2001:db10::/32' set protocols ospfv3 area 2 range '2001:db20::/32' set protocols ospfv3 area 2 range '2001:db30::/32' set protocols ospfv3 area 3 range '2001:db40::/32' set protocols ospfv3 parameters router-id '192.0.2.10' set protocols ospfv3 redistribute 'bgp'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # Using gathered # # Before state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Gather ospfv3 routes config with provided configurations vyos.vyos.vyos_ospfv3: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using deleted # # Before state # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Delete attributes of ospfv3 routes. vyos.vyos.vyos_ospfv3: config: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # "commands": [ # "delete protocols ospfv3" # ] # # "after": {} # After state # ------------ # vyos@192# run show configuration commands | grep ospfv3 Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: .. raw:: html
Key Returned Description
after
dictionary
when changed
The resulting configuration model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
before
dictionary
always
The configuration prior to the model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
commands
list
always
The set of commands pushed to the remote device.

Sample:
['set protocols ospf parameters router-id 192.0.1.1', "set protocols ospfv3 area 2 range '2001:db10::/32'"]


Status ------ Authors ~~~~~~~ - Rohit Thakur (@rohitthakur2590) diff --git a/docs/vyos.vyos.vyos_ping_module.rst b/docs/vyos.vyos.vyos_ping_module.rst index 2407980..59e4a74 100644 --- a/docs/vyos.vyos.vyos_ping_module.rst +++ b/docs/vyos.vyos.vyos_ping_module.rst @@ -1,422 +1,422 @@ .. _vyos.vyos.vyos_ping_module: ******************* vyos.vyos.vyos_ping ******************* **Tests reachability using ping from VyOS network devices** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - Tests reachability using ping from a VyOS device to a remote destination. - Tested against VyOS 1.1.8 (helium) - For a general purpose network module, see the :ref:`net_ping ` module. - For Windows targets, use the :ref:`win_ping ` module instead. - For targets running Python, use the :ref:`ping ` module instead. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
count
integer
Default:
5
Number of packets to send to check reachability.
dest
string / required
The IP Address or hostname (resolvable by the device) of the remote node.
interval
integer
Determines the interval (in seconds) between consecutive pings.
provider
dictionary
Deprecated
Starting with Ansible 2.5 we recommend using connection: network_cli.
For more information please see the Network Guide.
A dict object containing connection details.
host
string
Specifies the DNS host name or address for connecting to the remote device over the specified transport. The value of host is used as the destination address for the transport.
password
string
Specifies the password to use to authenticate the connection to the remote device. This value is used to authenticate the SSH session. If the value is not specified in the task, the value of environment variable ANSIBLE_NET_PASSWORD will be used instead.
port
integer
Specifies the port to use when building the connection to the remote device.
ssh_keyfile
path
Specifies the SSH key to use to authenticate the connection to the remote device. This value is the path to the key used to authenticate the SSH session. If the value is not specified in the task, the value of environment variable ANSIBLE_NET_SSH_KEYFILE will be used instead.
timeout
integer
Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands. If the timeout is exceeded before the operation is completed, the module will error.
username
string
Configures the username to use to authenticate the connection to the remote device. This value is used to authenticate the SSH session. If the value is not specified in the task, the value of environment variable ANSIBLE_NET_USERNAME will be used instead.
size
integer
Determines the size (in bytes) of the ping packet(s).
source
string
The source interface or IP Address to use while sending the ping packet(s).
state
string
    Choices:
  • absent
  • present ←
Determines if the expected result is success or fail.
ttl
integer
The time-to-live value for the ICMP packet(s).

Notes ----- .. note:: - Tested against VyOS 1.1.8 (helium). - For a general purpose network module, see the :ref:`net_ping ` module. - For Windows targets, use the :ref:`win_ping ` module instead. - For targets running Python, use the :ref:`ping ` module instead. - This module works with connection ``network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_. - For more information on using Ansible to manage network devices see the :ref:`Ansible Network Guide ` Examples -------- .. code-block:: yaml - name: Test reachability to 10.10.10.10 vyos.vyos.vyos_ping: dest: 10.10.10.10 - name: Test reachability to 10.20.20.20 using source and ttl set vyos.vyos.vyos_ping: dest: 10.20.20.20 source: eth0 ttl: 128 - - name: Test unreachability to 10.30.30.30 using interval + - name: Test reachability to 10.30.30.30 using interval vyos.vyos.vyos_ping: dest: 10.30.30.30 interval: 3 state: absent - name: Test reachability to 10.40.40.40 setting count and source vyos.vyos.vyos_ping: dest: 10.40.40.40 source: eth1 count: 20 size: 512 Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: .. raw:: html
Key Returned Description
commands
list
always
List of commands sent.

Sample:
['ping 10.8.38.44 count 10 interface eth0 ttl 128']
packet_loss
string
always
Percentage of packets lost.

Sample:
0%
packets_rx
integer
always
Packets successfully received.

Sample:
20
packets_tx
integer
always
Packets successfully transmitted.

Sample:
20
rtt
dictionary
when ping succeeds
The round trip time (RTT) stats.

Sample:
-
AnsibleMapping([('avg', 2), ('max', 8), ('min', 1), ('mdev', 24)])
+
{'avg': 2, 'max': 8, 'min': 1, 'mdev': 24}


Status ------ Authors ~~~~~~~ - Nilashish Chakraborty (@NilashishC) diff --git a/docs/vyos.vyos.vyos_route_maps_module.rst b/docs/vyos.vyos.vyos_route_maps_module.rst index 78c75b4..828ce34 100644 --- a/docs/vyos.vyos.vyos_route_maps_module.rst +++ b/docs/vyos.vyos.vyos_route_maps_module.rst @@ -1,2042 +1,2042 @@ .. _vyos.vyos.vyos_route_maps_module: ************************* vyos.vyos.vyos_route_maps ************************* **Route Map Resource Module.** Version added: 2.3.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manages route map configurations on devices running VYOS. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
list / elements=dictionary
A list of route-map configuration.
entries
list / elements=dictionary
Route Map rules.

aliases: rules
action
string
    Choices:
  • deny
  • permit
Action for matching routes
call
string
Route map name
continue_sequence
integer
Continue on a different entry within the route-map.
description
string
Description for the rule.
match
dictionary
Route parameters to match.
as_path
string
Set as-path.
community
dictionary
BGP community attribute.
community_list
string
BGP community-list to match
exact_match
boolean
    Choices:
  • no
  • yes
BGP community-list to match
extcommunity
string
Extended community name.
interface
string
First hop interface of a route to match.
ip
dictionary
IP prefix parameters to match.
address
dictionary
IP address of route to match.
list_type
string
    Choices:
  • access-list
  • prefix-list
type of list
value
string
value of access-list and prefix list
next_hop
dictionary
next hop prefix list.
list_type
string
    Choices:
  • access-list
  • prefix-list
type of list
value
string
value of access-list and prefix list
route_source
dictionary
IP route-source to match
list_type
string
    Choices:
  • access-list
  • prefix-list
type of list
value
string
value of access-list and prefix list
ipv6
dictionary
IPv6 prefix parameters to match.
address
dictionary
IPv6 address of route to match.
list_type
string
    Choices:
  • access-list
  • prefix-list
type of list
value
string
value of access-list and prefix list
next_hop
string
next-hop ipv6 address IPv6 <h:h:h:h:h:h:h:h>.
large_community_large_community_list
string
BGP large-community-list to match.
metric
integer
Route metric <1-65535>.
origin
string
    Choices:
  • ebgp
  • ibgp
  • incomplete
bgp origin.
peer
string
Peer IP address <x.x.x.x>.
rpki
string
    Choices:
  • notfound
  • invalid
  • valid
RPKI validation value.
on_match
dictionary
Exit policy on matches.
goto
integer
Rule number to goto on match <1-65535>.
next
boolean
    Choices:
  • no
  • yes
Next sequence number to goto on match.
sequence
integer
Route map rule number <1-65535>.
set
dictionary
Route parameters.
aggregator
dictionary
Border Gateway Protocol (BGP) aggregator attribute.
as
string
AS number of an aggregation.
ip
string
IP address.
as_path_exclude
string
BGP AS path exclude string ex "456 64500 45001"
as_path_prepend
string
Prepend string for a Border Gateway Protocol (BGP) AS-path attribute.
atomic_aggregate
boolean
    Choices:
  • no
  • yes
Border Gateway Protocol (BGP) atomic aggregate attribute.
bgp_extcommunity_rt
string
ExtCommunity in format AS:value
comm_list
dictionary
Border Gateway Protocol (BGP) communities matching a community-list.
comm_list
string
BGP communities with a community-list.
delete
boolean
    Choices:
  • no
  • yes
Delete BGP communities matching the community-list.
community
dictionary
-
Border Gateway Protocl (BGP) community attribute.
+
Border Gateway Protocol (BGP) community attribute.
value
string
Community in 4 octet AS:value format or it can be from local-AS, no-advertise,no-expert,internet,additive,none.
extcommunity_rt
string
Set route target value.ASN:nn_or_IP_address:nn VPN extended community.
extcommunity_soo
string
Set Site of Origin value. ASN:nn_or_IP_address:nn VPN extended community
ip_next_hop
string
IP address.
ipv6_next_hop
dictionary
Nexthop IPv6 address.
ip_type
string
    Choices:
  • global
  • local
Global or Local
value
string
ipv6 address
large_community
string
Set BGP large community value.
local_preference
string
Border Gateway Protocol (BGP) local preference attribute.Example <0-4294967295>.
metric
string
Destination routing protocol metric. Example <0-4294967295>.
metric_type
string
    Choices:
  • type-1
  • type-2
Open Shortest Path First (OSPF) external metric-type.
origin
string
    Choices:
  • egp
  • igp
  • incomplete
Set bgp origin.
originator_id
string
-
Border Gateway Protocol (BGP) originator ID attribute. Orignator IP address.
+
Border Gateway Protocol (BGP) originator ID attribute. Originator IP address.
src
string
Source address for route. Example <x.x.x.x> IP address.
tag
string
Tag value for routing protocol. Example <1-65535>
weight
string
Border Gateway Protocol (BGP) weight attribute. Example <0-4294967295>
route_map
string
Route map name.
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the VYOS device by executing the command show configuration commands | grep route-map.
The state parsed reads the configuration from show configuration commands | grep route-map option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • deleted
  • merged ←
  • overridden
  • replaced
  • gathered
  • rendered
  • parsed
The state the configuration should be left in.

Notes ----- .. note:: - Tested against vyos 1.2. - This module works with connection ``network_cli``. Examples -------- .. code-block:: yaml # Using merged # Before state # vyos@vyos:~$ show configuration commands | match "set policy route-map" # vyos@vyos:~$ - - name: Merge the provided configuration with the exisiting running configuration + - name: Merge the provided configuration with the existing running configuration register: result vyos.vyos.vyos_route_maps: &id001 config: - route_map: test1 entries: - sequence: 1 description: "test" action: permit continue: 2 on_match: next: True - route_map: test3 entries: - sequence: 1 action: permit match: rpki: invalid metric: 1 peer: 192.0.2.32 set: local_preference: 4 metric: 5 metric_type: "type-1" origin: egp originator_id: 192.0.2.34 tag: 5 weight: 4 state: merged # After State # vyos@vyos:~$ show configuration commands | match "set policy route-maps" # set policy route-map test1 rule 1 description test # set policy route-map test1 rule 1 action permit # set policy route-map test1 rule 1 continue 2 # set policy route-map test1 rule 1 on-match next # set policy route-map test3 rule 1 action permit # set policy route-map test3 rule 1 set local-preference 4 # set policy route-map test3 rule 1 set metric 5 # set policy route-map test3 rule 1 set metric-type type-1 # set policy route-map test3 rule 1 set origin egp # set policy route-map test3 rule 1 set originator-id 192.0.2.34 # set policy route-map test3 rule 1 set tag 5 # set policy route-map test3 rule 1 set weight 4 # set policy route-map test3 rule 1 match metric 1 # set policy route-map test3 rule 1 match peer 192.0.2.32 # set policy route-map test3 rule 1 match rpki invalid # "after": [ # { # "entries": [ # { # "action": "permit", # "continue_sequence": 2, # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # } # ], # "route_map": "test1" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 1, # "peer": "192.0.2.32", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "local_preference": "4", # "metric": "5", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "5", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ], # "before": {}, # "changed": true, # "commands": [ # "set policy route-map test1 rule 1 description test", # "set policy route-map test1 rule 1 action permit", # "set policy route-map test1 rule 1 continue 2", # "set policy route-map test1 rule 1 on-match next", # "set policy route-map test3 rule 1 action permit", # "set policy route-map test3 rule 1 set local-preference 4", # "set policy route-map test3 rule 1 set metric 5", # "set policy route-map test3 rule 1 set metric-type type-1", # "set policy route-map test3 rule 1 set origin egp", # "set policy route-map test3 rule 1 set originator-id 192.0.2.34", # "set policy route-map test3 rule 1 set tag 5", # "set policy route-map test3 rule 1 set weight 4", # "set policy route-map test3 rule 1 match metric 1", # "set policy route-map test3 rule 1 match peer 192.0.2.32", # "set policy route-map test3 rule 1 match rpki invalid" # ], # Using replaced: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set route-map policy" # set policy route-map test2 rule 1 action 'permit' # set policy route-map test2 rule 1 description 'test' # set policy route-map test2 rule 1 on-match next # set policy route-map test2 rule 2 action 'permit' # set policy route-map test2 rule 2 on-match goto '4' # set policy route-map test3 rule 1 action 'permit' # set policy route-map test3 rule 1 match metric '1' # set policy route-map test3 rule 1 match peer '192.0.2.32' # set policy route-map test3 rule 1 match rpki 'invalid' # set policy route-map test3 rule 1 set community 'internet' # set policy route-map test3 rule 1 set ip-next-hop '192.0.2.33' # set policy route-map test3 rule 1 set local-preference '4' # set policy route-map test3 rule 1 set metric '5' # set policy route-map test3 rule 1 set metric-type 'type-1' # set policy route-map test3 rule 1 set origin 'egp' # set policy route-map test3 rule 1 set originator-id '192.0.2.34' # set policy route-map test3 rule 1 set tag '5' # set policy route-map test3 rule 1 set weight '4' # - # - name: Replace the provided configuration with the exisiting running configuration + # - name: Replace the provided configuration with the existing running configuration # register: result # vyos.vyos.vyos_route_maps: &id001 # config: # - route_map: test3 # entries: # - sequence: 1 # action: permit # match: # rpki: invalid # metric: 3 # peer: 192.0.2.35 # set: # local_preference: 6 # metric: 4 # metric_type: "type-1" # origin: egp # originator_id: 192.0.2.34 # tag: 4 # weight: 4 # state: replaced # After state: # vyos@vyos:~$ show configuration commands | match "set policy route-map" # set policy route-map test3 rule 1 set local-preference 6 # set policy route-map test3 rule 1 set metric 4 # set policy route-map test3 rule 1 set tag 4 # set policy route-map test3 rule 1 match metric 3 # set policy route-map test3 rule 1 match peer 192.0.2.35 # vyos@vyos:~$ # # # Module Execution: # # "after": [ # { # "entries": [ # { # "action": "permit", # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # }, # { # "action": "permit", # "on_match": { # "goto": 4 # }, # "sequence": 2 # } # ], # "route_map": "test2" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 3, # "peer": "192.0.2.35", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "local_preference": "6", # "metric": "4", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "4", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ], # "before": [ # { # "entries": [ # { # "action": "permit", # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # }, # { # "action": "permit", # "on_match": { # "goto": 4 # }, # "sequence": 2 # } # ], # "route_map": "test2" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 1, # "peer": "192.0.2.32", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "community": { # "value": "internet" # }, # "ip_next_hop": "192.0.2.33", # "local_preference": "4", # "metric": "5", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "5", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ], # "changed": true, # "commands": [ # "delete policy route-map test3 rule 1 set ip-next-hop 192.0.2.33", # "set policy route-map test3 rule 1 set local-preference 6", # "set policy route-map test3 rule 1 set metric 4", # "set policy route-map test3 rule 1 set tag 4", # "delete policy route-map test3 rule 1 set community internet", # "set policy route-map test3 rule 1 match metric 3", # "set policy route-map test3 rule 1 match peer 192.0.2.35" # ], # # Using deleted: # ------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set policy route-map" # set policy route-map test3 rule 1 set local-preference 6 # set policy route-map test3 rule 1 set metric 4 # set policy route-map test3 rule 1 set tag 4 # set policy route-map test3 rule 1 match metric 3 # set policy route-map test3 rule 1 match peer 192.0.2.35 # vyos@vyos:~$ # # - name: Delete the provided configuration # register: result # vyos.vyos.vyos_route_maps: # config: # state: deleted # After state: # vyos@vyos:~$ show configuration commands | match "set policy route-map" # vyos@vyos:~$ # # # Module Execution: # # "after": {}, # "before": [ # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 3, # "peer": "192.0.2.35", # }, # "sequence": 1, # "set": { # "local_preference": "6", # "metric": "4", # "tag": "4", # } # } # ], # "route_map": "test3" # } # ], # "changed": true, # "commands": [ # "delete policy route-map test3" # ], # # using gathered: # -------------- # # Before state: # vyos@vyos:~$ show configuration commands | match "set policy route-maps" # set policy route-map test1 rule 1 description test # set policy route-map test1 rule 1 action permit # set policy route-map test1 rule 1 continue 2 # set policy route-map test1 rule 1 on-match next # set policy route-map test3 rule 1 action permit # set policy route-map test3 rule 1 set local-preference 4 # set policy route-map test3 rule 1 set metric 5 # set policy route-map test3 rule 1 set metric-type type-1 # set policy route-map test3 rule 1 set origin egp # set policy route-map test3 rule 1 set originator-id 192.0.2.34 # set policy route-map test3 rule 1 set tag 5 # set policy route-map test3 rule 1 set weight 4 # set policy route-map test3 rule 1 match metric 1 # set policy route-map test3 rule 1 match peer 192.0.2.32 # set policy route-map test3 rule 1 match rpki invalid # # - name: gather configs # vyos.vyos.vyos_route_maps: # state: gathered # "gathered": [ # { # "entries": [ # { # "action": "permit", # "continue_sequence": 2, # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # } # ], # "route_map": "test1" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 1, # "peer": "192.0.2.32", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "local_preference": "4", # "metric": "5", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "5", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ] # Using parsed: # ------------ # parsed.cfg # set policy route-map test1 rule 1 description test # set policy route-map test1 rule 1 action permit # set policy route-map test1 rule 1 continue 2 # set policy route-map test1 rule 1 on-match next # set policy route-map test3 rule 1 action permit # set policy route-map test3 rule 1 set local-preference 4 # set policy route-map test3 rule 1 set metric 5 # set policy route-map test3 rule 1 set metric-type type-1 # set policy route-map test3 rule 1 set origin egp # set policy route-map test3 rule 1 set originator-id 192.0.2.34 # set policy route-map test3 rule 1 set tag 5 # set policy route-map test3 rule 1 set weight 4 # set policy route-map test3 rule 1 match metric 1 # set policy route-map test3 rule 1 match peer 192.0.2.32 # set policy route-map test3 rule 1 match rpki invalid # # - name: parse configs # vyos.vyos.vyos_route_maps: # running_config: "{{ lookup('file', './parsed.cfg') }}" # state: parsed # tags: # - parsed # # Module execution: # "parsed": [ # { # "entries": [ # { # "action": "permit", # "continue_sequence": 2, # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # } # ], # "route_map": "test1" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 1, # "peer": "192.0.2.32", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "local_preference": "4", # "metric": "5", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "5", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ] # # # Using rendered: # -------------- # - name: Structure provided configuration into device specific commands # register: result # vyos.vyos.vyos_route_maps: &id001 # config: # - route_map: test1 # entries: # - sequence: 1 # description: "test" # action: permit # continue_sequence: 2 # on_match: # next: True # - route_map: test3 # entries: # - sequence: 1 # action: permit # match: # rpki: invalid # metric: 1 # peer: 192.0.2.32 # set: # local_preference: 4 # metric: 5 # metric_type: "type-1" # origin: egp # originator_id: 192.0.2.34 # tag: 5 # weight: 4 # state: rendered # Module Execution: # "rendered": [ # "set policy route-map test1 rule 1 description test", # "set policy route-map test1 rule 1 action permit", # "set policy route-map test1 rule 1 continue 2", # "set policy route-map test1 rule 1 on-match next", # "set policy route-map test3 rule 1 action permit", # "set policy route-map test3 rule 1 set local-preference 4", # "set policy route-map test3 rule 1 set metric 5", # "set policy route-map test3 rule 1 set metric-type type-1", # "set policy route-map test3 rule 1 set origin egp", # "set policy route-map test3 rule 1 set originator-id 192.0.2.34", # "set policy route-map test3 rule 1 set tag 5", # "set policy route-map test3 rule 1 set weight 4", # "set policy route-map test3 rule 1 match metric 1", # "set policy route-map test3 rule 1 match peer 192.0.2.32", # "set policy route-map test3 rule 1 match rpki invalid" # ] # # # Using overridden: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set policy route-map" # set policy route-map test2 rule 1 action 'permit' # set policy route-map test2 rule 1 description 'test' # set policy route-map test2 rule 1 on-match next # set policy route-map test2 rule 2 action 'permit' # set policy route-map test2 rule 2 on-match goto '4' # set policy route-map test3 rule 1 action 'permit' # set policy route-map test3 rule 1 match metric '1' # set policy route-map test3 rule 1 match peer '192.0.2.32' # set policy route-map test3 rule 1 match rpki 'invalid' # set policy route-map test3 rule 1 set community 'internet' # set policy route-map test3 rule 1 set ip-next-hop '192.0.2.33' # set policy route-map test3 rule 1 set local-preference '4' # set policy route-map test3 rule 1 set metric '5' # set policy route-map test3 rule 1 set metric-type 'type-1' # set policy route-map test3 rule 1 set origin 'egp' # set policy route-map test3 rule 1 set originator-id '192.0.2.34' # set policy route-map test3 rule 1 set tag '5' # set policy route-map test3 rule 1 set weight '4' # # - name: Override the existing configuration with the provided running configuration # register: result # vyos.vyos.vyos_route_maps: &id001 # config: # - route_map: test3 # entries: # - sequence: 1 # action: permit # match: # rpki: invalid # metric: 3 # peer: 192.0.2.35 # set: # local_preference: 6 # metric: 4 # metric_type: "type-1" # origin: egp # originator_id: 192.0.2.34 # tag: 4 # weight: 4 # state: overridden # After state: # vyos@vyos:~$ show configuration commands | match "set policy route-map" # set policy route-map test3 rule 1 set metric-type 'type-1' # set policy route-map test3 rule 1 set origin 'egp' # set policy route-map test3 rule 1 set originator-id '192.0.2.34' # set policy route-map test3 rule 1 set weight '4' # set policy route-map test3 rule 1 set local-preference 6 # set policy route-map test3 rule 1 set metric 4 # set policy route-map test3 rule 1 set tag 4 # set policy route-map test3 rule 1 match metric 3 # set policy route-map test3 rule 1 match peer 192.0.2.35 # set policy route-map test3 rule 1 match rpki 'invalid' # Module Execution: # "after": [ # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 3, # "peer": "192.0.2.35", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "local_preference": "6", # "metric": "4", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "4", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ], # "before": [ # { # "entries": [ # { # "action": "permit", # "description": "test", # "on_match": { # "next": true # }, # "sequence": 1 # }, # { # "action": "permit", # "on_match": { # "goto": 4 # }, # "sequence": 2 # } # ], # "route_map": "test2" # }, # { # "entries": [ # { # "action": "permit", # "match": { # "metric": 1, # "peer": "192.0.2.32", # "rpki": "invalid" # }, # "sequence": 1, # "set": { # "community": { # "value": "internet" # }, # "ip_next_hop": "192.0.2.33", # "local_preference": "4", # "metric": "5", # "metric_type": "type-1", # "origin": "egp", # "originator_id": "192.0.2.34", # "tag": "5", # "weight": "4" # } # } # ], # "route_map": "test3" # } # ], # "changed": true, # "commands": [ # "delete policy route-map test2", # "delete policy route-map test3 rule 1 set ip-next-hop 192.0.2.33", # "set policy route-map test3 rule 1 set local-preference 6", # "set policy route-map test3 rule 1 set metric 4", # "set policy route-map test3 rule 1 set tag 4", # "delete policy route-map test3 rule 1 set community internet", # "set policy route-map test3 rule 1 match metric 3", # "set policy route-map test3 rule 1 match peer 192.0.2.35" # ], # Status ------ Authors ~~~~~~~ - Ashwini Mhatre (@amhatre) diff --git a/docs/vyos.vyos.vyos_static_routes_module.rst b/docs/vyos.vyos.vyos_static_routes_module.rst index 5a6884b..889f734 100644 --- a/docs/vyos.vyos.vyos_static_routes_module.rst +++ b/docs/vyos.vyos.vyos_static_routes_module.rst @@ -1,1165 +1,1165 @@ .. _vyos.vyos.vyos_static_routes_module: **************************** vyos.vyos.vyos_static_routes **************************** **Static routes resource module** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module manages attributes of static routes on VyOS network devices. Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
config
list / elements=dictionary
A provided static route configuration.
address_families
list / elements=dictionary
A dictionary specifying the address family to which the static route(s) belong.
afi
string / required
    Choices:
  • ipv4
  • ipv6
Specifies the type of route.
routes
list / elements=dictionary
-
A ditionary that specify the static route configurations.
+
A dictionary that specify the static route configurations.
blackhole_config
dictionary
Configured to silently discard packets.
distance
integer
Distance for the route.
type
string
This is to configure only blackhole.
dest
string / required
An IPv4/v6 address in CIDR notation that specifies the destination network for the static route.
next_hops
list / elements=dictionary
Next hops to the specified destination.
admin_distance
integer
Distance value for the route.
enabled
boolean
    Choices:
  • no
  • yes
Disable IPv4/v6 next-hop static route.
forward_router_address
string / required
The IP address of the next hop that can be used to reach the destination network.
interface
string
Name of the outgoing interface.
running_config
string
This option is used only with state parsed.
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | grep static route.
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
state
string
    Choices:
  • merged ←
  • replaced
  • overridden
  • deleted
  • gathered
  • rendered
  • parsed
The state of the configuration after module completion.

Notes ----- .. note:: - Tested against VyOS 1.1.8 (helium). - This module works with connection ``network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_. Examples -------- .. code-block:: yaml # Using merged # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands | grep static # - - name: Merge the provided configuration with the exisiting running configuration + - name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_static_routes: config: - address_families: - afi: ipv4 routes: - dest: 192.0.2.32/28 blackhole_config: type: blackhole next_hops: - forward_router_address: 192.0.2.6 - forward_router_address: 192.0.2.7 - address_families: - afi: ipv6 routes: - dest: 2001:db8:1000::/36 blackhole_config: distance: 2 next_hops: - forward_router_address: 2001:db8:2000:2::1 - forward_router_address: 2001:db8:2000:2::2 state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": [] # # "commands": [ # "set protocols static route 192.0.2.32/28", # "set protocols static route 192.0.2.32/28 blackhole", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.6'", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.7'", # "set protocols static route6 2001:db8:1000::/36", # "set protocols static route6 2001:db8:1000::/36 blackhole distance '2'", # "set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1'", # "set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2'" # ] # # "after": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.6" # }, # { # "forward_router_address": "192.0.2.7" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # Using replaced # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route 192.0.2.33/28 'blackhole' # set protocols static route 192.0.2.33/28 next-hop '192.0.2.3' # set protocols static route 192.0.2.33/28 next-hop '192.0.2.4' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # - name: Replace device configurations of listed static routes with provided configurations vyos.vyos.vyos_static_routes: config: - address_families: - afi: ipv4 routes: - dest: 192.0.2.32/28 blackhole_config: distance: 2 next_hops: - forward_router_address: 192.0.2.7 enabled: false - forward_router_address: 192.0.2.9 state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.6" # }, # { # "forward_router_address": "192.0.2.7" # } # ] # }, # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.33/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.3" # }, # { # "forward_router_address": "192.0.2.4" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # # "commands": [ # "delete protocols static route 192.0.2.32/28 next-hop '192.0.2.6'", # "delete protocols static route 192.0.2.32/28 next-hop '192.0.2.7'", # "set protocols static route 192.0.2.32/28 next-hop 192.0.2.7 'disable'", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.7'", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.9'", # "set protocols static route 192.0.2.32/28 blackhole distance '2'" # ] # # "after": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "enabled": false, # "forward_router_address": "192.0.2.7" # }, # { # "forward_router_address": "192.0.2.9" # } # ] # }, # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.33/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.3" # }, # { # "forward_router_address": "192.0.2.4" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 blackhole distance '2' # set protocols static route 192.0.2.32/28 next-hop 192.0.2.7 'disable' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.9' # set protocols static route 192.0.2.33/28 'blackhole' # set protocols static route 192.0.2.33/28 next-hop '192.0.2.3' # set protocols static route 192.0.2.33/28 next-hop '192.0.2.4' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # Using overridden # # Before state # -------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 blackhole distance '2' # set protocols static route 192.0.2.32/28 next-hop 192.0.2.7 'disable' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.9' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # - name: Overrides all device configuration with provided configuration vyos.vyos.vyos_static_routes: config: - address_families: - afi: ipv4 routes: - dest: 198.0.2.48/28 next_hops: - forward_router_address: 192.0.2.18 state: overridden # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "enabled": false, # "forward_router_address": "192.0.2.7" # }, # { # "forward_router_address": "192.0.2.9" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # # "commands": [ # "delete protocols static route 192.0.2.32/28", # "delete protocols static route6 2001:db8:1000::/36", # "set protocols static route 198.0.2.48/28", # "set protocols static route 198.0.2.48/28 next-hop '192.0.2.18'" # # # "after": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "dest": "198.0.2.48/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.18" # } # ] # } # ] # } # ] # } # ] # # # After state # ------------ # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 198.0.2.48/28 next-hop '192.0.2.18' # Using deleted to delete static route based on afi # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # - name: Delete static route based on afi. vyos.vyos.vyos_static_routes: config: - address_families: - afi: ipv4 - afi: ipv6 state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.6" # }, # { # "forward_router_address": "192.0.2.7" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # "commands": [ # "delete protocols static route", # "delete protocols static route6" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep static # set protocols 'static' # Using deleted to delete all the static routes when passes config is empty # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # - name: Delete all the static routes. vyos.vyos.vyos_static_routes: config: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.6" # }, # { # "forward_router_address": "192.0.2.7" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # "commands": [ # "delete protocols static route", # "delete protocols static route6" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep static # set protocols 'static' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_static_routes: config: - address_families: - afi: ipv4 routes: - dest: 192.0.2.32/28 blackhole_config: type: blackhole next_hops: - forward_router_address: 192.0.2.6 - forward_router_address: 192.0.2.7 - address_families: - afi: ipv6 routes: - dest: 2001:db8:1000::/36 blackhole_config: distance: 2 next_hops: - forward_router_address: 2001:db8:2000:2::1 - forward_router_address: 2001:db8:2000:2::2 state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # "set protocols static route 192.0.2.32/28", # "set protocols static route 192.0.2.32/28 blackhole", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.6'", # "set protocols static route 192.0.2.32/28 next-hop '192.0.2.7'", # "set protocols static route6 2001:db8:1000::/36", # "set protocols static route6 2001:db8:1000::/36 blackhole distance '2'", # "set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1'", # "set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2'" # ] # Using parsed # # - name: Parse the provided running configuration vyos.vyos.vyos_static_routes: running_config: "set protocols static route 192.0.2.32/28 'blackhole' set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' set protocols static route6 2001:db8:1000::/36 blackhole distance '2' set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # Using gathered # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' # - name: Gather listed static routes with provided configurations vyos.vyos.vyos_static_routes: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": [ # { # "address_families": [ # { # "afi": "ipv4", # "routes": [ # { # "blackhole_config": { # "type": "blackhole" # }, # "dest": "192.0.2.32/28", # "next_hops": [ # { # "forward_router_address": "192.0.2.6" # }, # { # "forward_router_address": "192.0.2.7" # } # ] # } # ] # }, # { # "afi": "ipv6", # "routes": [ # { # "blackhole_config": { # "distance": 2 # }, # "dest": "2001:db8:1000::/36", # "next_hops": [ # { # "forward_router_address": "2001:db8:2000:2::1" # }, # { # "forward_router_address": "2001:db8:2000:2::2" # } # ] # } # ] # } # ] # } # ] # # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep static # set protocols static route 192.0.2.32/28 'blackhole' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.6' # set protocols static route 192.0.2.32/28 next-hop '192.0.2.7' # set protocols static route6 2001:db8:1000::/36 blackhole distance '2' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::1' # set protocols static route6 2001:db8:1000::/36 next-hop '2001:db8:2000:2::2' Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: .. raw:: html
Key Returned Description
after
list
when changed
The resulting configuration model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
before
list
always
The configuration prior to the model invocation.

Sample:
The configuration returned will always be in the same format of the parameters above.
commands
list
always
The set of commands pushed to the remote device.

Sample:
["set protocols static route 192.0.2.32/28 next-hop '192.0.2.6'", "set protocols static route 192.0.2.32/28 'blackhole'"]


Status ------ Authors ~~~~~~~ - Rohit Thakur (@rohitthakur2590) diff --git a/plugins/modules/vyos_bgp_address_family.py b/plugins/modules/vyos_bgp_address_family.py index 80c6807..782669f 100644 --- a/plugins/modules/vyos_bgp_address_family.py +++ b/plugins/modules/vyos_bgp_address_family.py @@ -1,1192 +1,1192 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # Copyright 2021 Red Hat # GNU General Public License v3.0+ # (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) ############################################# # WARNING # ############################################# # # This file is auto generated by the resource # module builder playbook. # # Do not edit this file manually. # # Changes to this file will be over written # by the resource module builder. # # Changes should be made in the model used to # generate this file or in the resource module # builder template. # ############################################# """ The module file for vyos_bgp_address_family """ from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_bgp_address_family version_added: 2.1.0 short_description: BGP Address Family Resource Module. description: - This module manages BGP address family configuration of interfaces on devices running VYOS. author: Gomathi Selvi Srinivasan (@GomathiselviS) options: config: description: A dict of BGP global configuration for interfaces. type: dict suboptions: as_number: description: - AS number. type: int address_family: description: BGP address-family parameters. type: list elements: dict suboptions: afi: description: BGP address family settings. type: str choices: ['ipv4', 'ipv6'] aggregate_address: description: - BGP aggregate network. type: list elements: dict suboptions: prefix: description: BGP aggregate network. type: str as_set: description: Generate AS-set path information for this aggregate address. type: bool summary_only: description: Announce the aggregate summary network only. type: bool networks: description: BGP network type: list elements: dict suboptions: prefix: description: BGP network address type: str path_limit: description: AS path hop count limit type: int backdoor: description: Network as a backdoor route. type: bool route_map: description: Route-map to modify route attributes type: str redistribute: description: Redistribute routes from other protocols into BGP type: list elements: dict suboptions: protocol: description: types of routes to be redistributed. type: str choices: ['connected', 'kernel', 'ospf', 'ospfv3', 'rip', 'ripng', 'static'] table: description: Redistribute non-main Kernel Routing Table. type: str route_map: description: Route map to filter redistributed routes type: str metric: description: Metric for redistributed routes. type: int neighbors: description: BGP neighbor type: list elements: dict suboptions: neighbor_address: description: BGP neighbor address (v4/v6). type: str address_family: description: address family. type: list elements: dict suboptions: afi: description: BGP neighbor parameters. type: str choices: ['ipv4', 'ipv6'] allowas_in: description: Number of occurrences of AS number. type: int as_override: description: AS for routes sent to this neighbor to be the local AS. type: bool attribute_unchanged: description: BGP attributes are sent unchanged. type: dict suboptions: as_path: description: as_path attribute type: bool med: description: med attribute type: bool next_hop: description: next_hop attribute type: bool capability: description: Advertise capabilities to this neighbor. type: dict suboptions: dynamic: description: Advertise dynamic capability to this neighbor. type: bool orf: description: Advertise ORF capability to this neighbor. type: str choices: ['send', 'receive'] default_originate: description: Send default route to this neighbor type: str distribute_list: description: Access-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: Access-list to filter outgoing/incoming route updates to this neighbor type: str choices: ['export', 'import'] acl: - description: Acess-list number. + description: Access-list number. type: int filter_list: description: As-path-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] path_list: description: As-path-list to filter type: str maximum_prefix: description: Maximum number of prefixes to accept from this neighbor nexthop-self Nexthop for routes sent to this neighbor to be the local router. type: int nexthop_local: description: Nexthop attributes. type: bool nexthop_self: description: Nexthop for routes sent to this neighbor to be the local router. type: bool peer_group: description: IPv4 peer group for this peer type: str prefix_list: description: Prefix-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] prefix_list: description: Prefix-list to filter type: str remove_private_as: description: Remove private AS numbers from AS path in outbound route updates type: bool route_map: description: Route-map to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] route_map: description: route-map to filter type: str route_reflector_client: description: Neighbor as a route reflector client type: bool route_server_client: description: Neighbor is route server client type: bool soft_reconfiguration: description: Soft reconfiguration for neighbor type: bool unsupress_map: description: Route-map to selectively unsuppress suppressed routes type: str weight: description: Default weight for routes from this neighbor type: int running_config: type: str description: - This option is used only with state I(parsed). - The value of this option should be the output received from the IOS device by executing the command B(show configuration command | match bgp). - The state I(parsed) reads the configuration from C(running_config) option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the I(parsed) key within the result. state: description: - The state the configuration should be left in. type: str choices: - merged - replaced - deleted - gathered - parsed - rendered - purged - overridden default: merged """ EXAMPLES = """ # Using merged # Before state # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ - name: Merge provided configuration with device configuration vyos.vyos.vyos_bgp_address_family: config: as_number: "100" address_family: - afi: "ipv4" redistribute: - protocol: "static" metric: 50 neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" maximum_prefix: 45 nexthop_self: True route_map: - action: "export" route_map: "map01" - action: "import" route_map: "map01" weight: 50 # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # vyos@vyos:~$ # # Module Execution: # # "after": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": {}, # "changed": true, # "commands": [ # "set protocols bgp 100 address-family ipv4-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight 50" # ], # # Using replaced: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # vyos@vyos:~$ - name: Replace provided configuration with device configuration vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv6" maximum_prefix: 45 nexthop_self: True state: replaced # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export '10' # vyos@vyos:~$ # # # # Module Execution: # "after": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self" # ], # Using overridden # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast network 35.1.1.0/24 backdoor # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast aggregate-address 6601:1:1:1::/64 summary-only # set protocols bgp 100 address-family ipv6-unicast network 5001:1:1:1::/64 route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list export '10' # vyos@vyos:~$ - name: Override vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "100.11.34.12" address_family: - afi: "ipv6" maximum_prefix: 45 nexthop_self: True route_map: - action: "import" route_map: "map01" address_family: - afi: "ipv4" aggregate_address: - prefix: "60.9.2.0/24" summary_only: True - afi: "ipv6" redistribute: - protocol: "static" metric: 50 state: overridden # Aft=validate-moduleser State # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import 'map01' # vyos@vyos:~$ # Module Execution: # "after": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "prefix": "60.9.2.0/24", # "summary_only": true # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "import", # "route_map": "map01" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "networks": [ # { # "backdoor": true, # "prefix": "35.1.1.0/24" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "aggregate_address": [ # { # "prefix": "6601:1:1:1::/64", # "summary_only": true # } # ], # "networks": [ # { # "prefix": "5001:1:1:1::/64", # "route_map": "map01" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4" # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast distribute-list", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast default-originate", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast attribute-unchanged", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast as-override", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast allowas-in", # "delete protocols bgp 100 address-family ipv6 aggregate-address", # "delete protocols bgp 100 address-family ipv6 network", # "delete protocols bgp 100 address-family ipv4 network", # "delete protocols bgp 100 address-family ipv4 redistribute", # "set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only", # "set protocols bgp 100 address-family ipv6-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import map01" # ], # # Using deleted: # Before State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast aggregate-address 60.9.2.0/24 summary-only # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map 'map01' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export '10' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import 'map01' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight '50' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast maximum-prefix '45' # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast nexthop-self # set protocols bgp 100 neighbor 100.11.34.12 address-family ipv6-unicast route-map import 'map01' # vyos@vyos:~$ - name: Delete vyos.vyos.vyos_bgp_address_family: config: as_number: "100" neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv6" - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" state: deleted # After State: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 # vyos@vyos:~$ # # # Module Execution: # # "after": { # "address_family": [ # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "before": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "prefix": "60.9.2.0/24", # "summary_only": true # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "export", # "route_map": "map01" # }, # { # "action": "import", # "route_map": "map01" # } # ], # "weight": 50 # }, # { # "afi": "ipv6", # "maximum_prefix": 45, # "nexthop_self": true, # "route_map": [ # { # "action": "import", # "route_map": "map01" # } # ] # } # ], # "neighbor_address": "100.11.34.12" # }, # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # }, # { # "afi": "ipv6", # "default_originate": "map01", # "distribute_list": [ # { # "acl": 10, # "action": "export" # } # ] # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 100 address-family ipv4-unicast", # "delete protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast", # "delete protocols bgp 100 neighbor 100.11.34.12 address-family" # ], # # using parsed: # parsed.cfg # set protocols bgp 65536 address-family ipv4-unicast aggregate-address 192.0.2.0/24 as-set # set protocols bgp 65536 address-family ipv4-unicast network 192.1.13.0/24 route-map 'map01' # set protocols bgp 65536 address-family ipv4-unicast network 192.2.13.0/24 backdoor # set protocols bgp 65536 address-family ipv6-unicast redistribute ripng metric '20' # set protocols bgp 65536 neighbor 192.0.2.25 address-family ipv4-unicast route-map export 'map01' # set protocols bgp 65536 neighbor 192.0.2.25 address-family ipv4-unicast soft-reconfiguration inbound # set protocols bgp 65536 neighbor 203.0.113.5 address-family ipv6-unicast attribute-unchanged next-hop - name: parse configs vyos.vyos.vyos_bgp_address_family: running_config: "{{ lookup('file', './parsed.cfg') }}" state: parsed # Module Execution: # "parsed": { # "address_family": [ # { # "afi": "ipv4", # "aggregate_address": [ # { # "as_set": true, # "prefix": "192.0.2.0/24" # } # ], # "networks": [ # { # "prefix": "192.1.13.0/24", # "route_map": "map01" # }, # { # "backdoor": true, # "prefix": "192.2.13.0/24" # } # ] # }, # { # "afi": "ipv6", # "redistribute": [ # { # "metric": 20, # "protocol": "ripng" # } # ] # } # ], # "as_number": 65536, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "route_map": [ # { # "action": "export", # "route_map": "map01" # } # ], # "soft_reconfiguration": true # } # ], # "neighbor_address": "192.0.2.25" # }, # { # "address_family": [ # { # "afi": "ipv6", # "attribute_unchanged": { # "next_hop": true # } # } # ], # "neighbor_address": "203.0.113.5" # } # ] # # Using gathered: # Native config: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 100 address-family ipv4-unicast network 35.1.1.0/24 backdoor # set protocols bgp 100 address-family ipv4-unicast redistribute static metric '50' # set protocols bgp 100 address-family ipv6-unicast aggregate-address 6601:1:1:1::/64 summary-only # set protocols bgp 100 address-family ipv6-unicast network 5001:1:1:1::/64 route-map 'map01' # set protocols bgp 100 address-family ipv6-unicast redistribute static metric '50' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number '4' # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override # set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med # set protocols bgp 100 neighbor 100.11.34.12 - name: gather configs vyos.vyos.vyos_bgp_address_family: state: gathered # Module Execution: # "gathered": { # "address_family": [ # { # "afi": "ipv4", # "networks": [ # { # "backdoor": true, # "prefix": "35.1.1.0/24" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # }, # { # "afi": "ipv6", # "aggregate_address": [ # { # "prefix": "6601:1:1:1::/64", # "summary_only": true # } # ], # "networks": [ # { # "prefix": "5001:1:1:1::/64", # "route_map": "map01" # } # ], # "redistribute": [ # { # "metric": 50, # "protocol": "static" # } # ] # } # ], # "as_number": 100, # "neighbors": [ # { # "address_family": [ # { # "afi": "ipv4", # "allowas_in": 4, # "as_override": true, # "attribute_unchanged": { # "med": true # } # } # ], # "neighbor_address": "20.33.1.1/24" # } # ] # Using rendered: - name: Render vyos.vyos.vyos_bgp_address_family: config: as_number: "100" address_family: - afi: "ipv4" redistribute: - protocol: "static" metric: 50 neighbors: - neighbor_address: "20.33.1.1/24" address_family: - afi: "ipv4" allowas_in: 4 as_override: True attribute_unchanged: med: True - afi: "ipv6" default_originate: "map01" distribute_list: - action: "export" acl: 10 - neighbor_address: "100.11.34.12" address_family: - afi: "ipv4" maximum_prefix: 45 nexthop_self: True route_map: - action: "export" route_map: "map01" - action: "import" route_map: "map01" weight: 50 state: rendered # Module Execution: # "rendered": [ # "set protocols bgp 100 address-family ipv4-unicast redistribute static metric 50", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast allowas-in number 4", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast as-override", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv4-unicast attribute-unchanged med", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast default-originate route-map map01", # "set protocols bgp 100 neighbor 20.33.1.1/24 address-family ipv6-unicast distribute-list export 10", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast maximum-prefix 45", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast nexthop-self", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map export map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast route-map import map01", # "set protocols bgp 100 neighbor 100.11.34.12 address-family ipv4-unicast weight 50" # ] """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.argspec.bgp_address_family.bgp_address_family import ( Bgp_address_familyArgs, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.bgp_address_family.bgp_address_family import ( Bgp_address_family, ) def main(): """ Main entry point for module execution :returns: the result form module invocation """ module = AnsibleModule( argument_spec=Bgp_address_familyArgs.argument_spec, mutually_exclusive=[], required_if=[], supports_check_mode=False, ) result = Bgp_address_family(module).execute_module() module.exit_json(**result) if __name__ == "__main__": main() diff --git a/plugins/modules/vyos_bgp_global.py b/plugins/modules/vyos_bgp_global.py index aedbae1..49e0a72 100644 --- a/plugins/modules/vyos_bgp_global.py +++ b/plugins/modules/vyos_bgp_global.py @@ -1,1440 +1,1440 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # Copyright 2021 Red Hat # GNU General Public License v3.0+ # (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) ############################################# # WARNING # ############################################# # # This file is auto generated by the resource # module builder playbook. # # Do not edit this file manually. # # Changes to this file will be over written # by the resource module builder. # # Changes should be made in the model used to # generate this file or in the resource module # builder template. # ############################################# """ The module file for vyos_bgp_global """ from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_bgp_global version_added: 2.0.0 short_description: BGP Global Resource Module. description: - This module manages BGP global configuration of interfaces on devices running VYOS. author: Gomathi Selvi Srinivasan (@GomathiselviS) options: config: description: A dict of BGP global configuration for interfaces. type: dict suboptions: as_number: description: - AS number. type: int aggregate_address: description: - BGP aggregate network. type: list elements: dict suboptions: prefix: description: BGP aggregate network. type: str as_set: description: Generate AS-set path information for this aggregate address. type: bool summary_only: description: Announce the aggregate summary network only. type: bool maximum_paths: description: BGP multipaths type: list elements: dict suboptions: path: description: BGP multipaths type: str count: description: No. of paths. type: int neighbor: description: BGP neighbor type: list elements: dict suboptions: address: description: BGP neighbor address (v4/v6). type: str advertisement_interval: description: Minimum interval for sending routing updates. type: int allowas_in: description: Number of occurrences of AS number. type: int as_override: description: AS for routes sent to this neighbor to be the local AS. type: bool attribute_unchanged: description: BGP attributes are sent unchanged. type: dict suboptions: as_path: description: as_path type: bool med: description: med type: bool next_hop: description: next_hop type: bool capability: description: Advertise capabilities to this neighbor. type: dict suboptions: dynamic: description: Advertise dynamic capability to this neighbor. type: bool orf: description: Advertise ORF capability to this neighbor. type: str choices: ['send', 'receive'] default_originate: description: Send default route to this neighbor type: str description: description: description text type: str disable_capability_negotiation: description: Disbale capability negotiation with the neighbor type: bool disable_connected_check: description: Disable check to see if EBGP peer's address is a connected route. type: bool disable_send_community: description: Disable sending community attributes to this neighbor. type: str choices: ['extended', 'standard'] distribute_list: description: Access-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: Access-list to filter outgoing/incoming route updates to this neighbor type: str choices: ['export', 'import'] acl: - description: Acess-list number. + description: Access-list number. type: int ebgp_multihop: description: Allow this EBGP neighbor to not be on a directly connected network. Specify the number hops. type: int filter_list: description: As-path-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] path_list: description: As-path-list to filter type: str local_as: description: local as number not to be prepended to updates from EBGP peers type: int maximum_prefix: description: Maximum number of prefixes to accept from this neighbor nexthop-self Nexthop for routes sent to this neighbor to be the local router. type: int nexthop_self: description: Nexthop for routes sent to this neighbor to be the local router. type: bool override_capability: description: Ignore capability negotiation with specified neighbor. type: bool passive: description: Do not initiate a session with this neighbor type: bool password: description: BGP MD5 password type: str peer_group_name: description: IPv4 peer group for this peer type: str peer_group: - description: True if all the configs unde this neighbor key is for peer group template. + description: True if all the configs under this neighbor key is for peer group template. type: bool port: description: Neighbor's BGP port type: int prefix_list: description: Prefix-list to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] prefix_list: description: Prefix-list to filter type: str remote_as: description: Neighbor BGP AS number type: int remove_private_as: description: Remove private AS numbers from AS path in outbound route updates type: bool route_map: description: Route-map to filter route updates to/from this neighbor. type: list elements: dict suboptions: action: description: filter outgoing/incoming route updates type: str choices: ['export', 'import'] route_map: description: route-map to filter type: str route_reflector_client: description: Neighbor as a route reflector client type: bool route_server_client: description: Neighbor is route server client type: bool shutdown: description: Administratively shut down neighbor type: bool soft_reconfiguration: description: Soft reconfiguration for neighbor type: bool strict_capability_match: description: Enable strict capability negotiation type: bool unsuppress_map: description: Route-map to selectively unsuppress suppressed routes type: str update_source: description: Source IP of routing updates type: str weight: description: Default weight for routes from this neighbor type: int ttl_security: description: Ttl security mechanism for this BGP peer type: int timers: description: Neighbor timers type: dict suboptions: connect: description: BGP connect timer for this neighbor. type: int holdtime: description: BGP hold timer for this neighbor type: int keepalive: description: BGP keepalive interval for this neighbor type: int network: description: BGP network type: list elements: dict suboptions: address: description: BGP network address type: str backdoor: description: Network as a backdoor route type: bool route_map: description: Route-map to modify route attributes type: str redistribute: description: Redistribute routes from other protocols into BGP type: list elements: dict suboptions: protocol: description: types of routes to be redistributed. type: str choices: ['connected', 'kernel', 'ospf', 'rip', 'static'] route_map: description: Route map to filter redistributed routes type: str metric: description: Metric for redistributed routes. type: int timers: description: BGP protocol timers type: dict suboptions: keepalive: description: Keepalive interval type: int holdtime: description: Hold time interval type: int bgp_params: description: BGP parameters type: dict suboptions: always_compare_med: description: Always compare MEDs from different neighbors type: bool bestpath: description: Default bestpath selection mechanism type: dict suboptions: as_path: description: AS-path attribute comparison parameters type: str choices: ['confed', 'ignore'] compare_routerid: description: Compare the router-id for identical EBGP paths type: bool med: description: MED attribute comparison parameters type: str choices: ['confed', 'missing-as-worst'] cluster_id: description: Route-reflector cluster-id type: str confederation: description: AS confederation parameters type: list elements: dict suboptions: identifier: description: Confederation AS identifier type: int peers: description: Peer ASs in the BGP confederation type: int dampening: description: Enable route-flap dampening type: dict suboptions: half_life: description: Half-life penalty in seconds type: int max_suppress_time: description: Maximum duration to suppress a stable route type: int re_use: description: Time to start reusing a route type: int start_suppress_time: description: When to start suppressing a route type: int default: description: BGP defaults type: dict suboptions: local_pref: description: Default local preference type: int no_ipv4_unicast: description: Deactivate IPv4 unicast for a peer by default type: bool deterministic_med: description: Compare MEDs between different peers in the same AS type: bool disable_network_import_check: description: Disable IGP route check for network statements type: bool distance: - description: Administratives distances for BGP routes + description: Administrative distances for BGP routes type: list elements: dict suboptions: type: description: Type of route type: str choices: ['external', 'internal', 'local'] value: description: distance type: int prefix: description: Administrative distance for a specific BGP prefix type: int enforce_first_as: description: Require first AS in the path to match peer's AS type: bool graceful_restart: description: Maximum time to hold onto restarting peer's stale paths type: int log_neighbor_changes: description: Log neighbor up/down changes and reset reason type: bool no_client_to_client_reflection: description: Disable client to client route reflection type: bool no_fast_external_failover: - description: Disable immediate sesison reset if peer's connected link goes down + description: Disable immediate session reset if peer's connected link goes down type: bool router_id: description: BGP router-id type: str scan_time: description: BGP route scanner interval type: int state: description: - The state the configuration should be left in. - State I(purged) removes all the BGP configurations from the target device. Use caution with this state.('delete protocols bgp ') - State I(deleted) only removes BGP attributes that this modules manages and does not negate the BGP process completely. Thereby, preserving address-family related configurations under BGP context. - Running states I(deleted) and I(replaced) will result in an error if there are address-family configuration lines present under neighbor context that is is to be removed. Please use the M(vyos.vyos.vyos_bgp_address_family) module for prior cleanup. - Refer to examples for more details. type: str choices: [deleted, merged, purged, replaced, gathered, rendered, parsed] default: merged running_config: description: - This option is used only with state I(parsed). - The value of this option should be the output received from the EOS device by executing the command B(show running-config | section bgp). - The state I(parsed) reads the configuration from C(running_config) option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the I(parsed) key within the result. type: str """ EXAMPLES = """ # Using merged # Before state # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ - name: Merge provided configuration with device configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" aggregate_address: - prefix: "203.0.113.0/24" as_set: true - prefix: "192.0.2.0/24" summary_only: true network: - address: "192.1.13.0/24" backdoor: true redistribute: - protocol: "kernel" metric: 45 - protocol: "connected" route_map: "map01" maximum_paths: - path: "ebgp" count: 20 - path: "ibgp" count: 55 timers: keepalive: 35 bgp_params: bestpath: as_path: "confed" compare_routerid: true default: no_ipv4_unicast: true router_id: "192.1.2.9" confederation: - peers: 20 - peers: 55 - identifier: 66 neighbor: - address: "192.0.2.25" disable_connected_check: true timers: holdtime: 30 keepalive: 10 - address: "203.0.113.5" attribute_unchanged: as_path: true med: true ebgp_multihop: 2 remote_as: 101 update_source: "192.0.2.25" - address: "5001::64" maximum_prefix: 34 distribute_list: - acl: 20 action: "export" - acl: 40 action: "import" state: merged # After State # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "before": {}, # "changed": true, # "commands": [ # "set protocols bgp 65536 neighbor 192.0.2.25 disable-connected-check", # "set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime 30", # "set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive 10", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged as-path", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged med", # "set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged next-hop", # "set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop 2", # "set protocols bgp 65536 neighbor 203.0.113.5 remote-as 101", # "set protocols bgp 65536 neighbor 203.0.113.5 update-source 192.0.2.25", # "set protocols bgp 65536 neighbor 5001::64 maximum-prefix 34", # "set protocols bgp 65536 neighbor 5001::64 distribute-list export 20", # "set protocols bgp 65536 neighbor 5001::64 distribute-list import 40", # "set protocols bgp 65536 redistribute kernel metric 45", # "set protocols bgp 65536 redistribute connected route-map map01", # "set protocols bgp 65536 network 192.1.13.0/24 backdoor", # "set protocols bgp 65536 aggregate-address 203.0.113.0/24 as-set", # "set protocols bgp 65536 aggregate-address 192.0.2.0/24 summary-only", # "set protocols bgp 65536 parameters bestpath as-path confed", # "set protocols bgp 65536 parameters bestpath compare-routerid", # "set protocols bgp 65536 parameters default no-ipv4-unicast", # "set protocols bgp 65536 parameters router-id 192.1.2.9", # "set protocols bgp 65536 parameters confederation peers 20", # "set protocols bgp 65536 parameters confederation peers 55", # "set protocols bgp 65536 parameters confederation identifier 66", # "set protocols bgp 65536 maximum-paths ebgp 20", # "set protocols bgp 65536 maximum-paths ibgp 55", # "set protocols bgp 65536 timers keepalive 35" # ], # Using replaced: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ - name: Replace vyos.vyos.vyos_bgp_global: config: as_number: "65536" network: - address: "203.0.113.0/24" route_map: map01 redistribute: - protocol: "static" route_map: "map01" neighbor: - address: "192.0.2.40" advertisement_interval: 72 capability: orf: "receive" bgp_params: bestpath: as_path: "confed" state: replaced # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed" # } # }, # "neighbor": [ # { # "address": "192.0.2.40", # "advertisement_interval": 72, # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # "before": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536 timers", # "delete protocols bgp 65536 maximum-paths ", # "delete protocols bgp 65536 maximum-paths ", # "delete protocols bgp 65536 parameters router-id 192.1.2.9", # "delete protocols bgp 65536 parameters default", # "delete protocols bgp 65536 parameters confederation", # "delete protocols bgp 65536 parameters bestpath compare-routerid", # "delete protocols bgp 65536 aggregate-address", # "delete protocols bgp 65536 network 192.1.13.0/24", # "delete protocols bgp 65536 redistribute kernel", # "delete protocols bgp 65536 redistribute kernel", # "delete protocols bgp 65536 redistribute connected", # "delete protocols bgp 65536 redistribute connected", # "delete protocols bgp 65536 neighbor 5001::64", # "delete protocols bgp 65536 neighbor 203.0.113.5", # "delete protocols bgp 65536 neighbor 192.0.2.25", # "set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval 72", # "set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list receive", # "set protocols bgp 65536 redistribute static route-map map01", # "set protocols bgp 65536 network 203.0.113.0/24 route-map map01" # ], # Using deleted: # ------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.40 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.40 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ - name: Delete configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: deleted # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp '65536' # vyos@vyos:~$ # # # Module Execution: # # "after": { # "as_number": 65536 # }, # "before": { # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed" # } # }, # "neighbor": [ # { # "address": "192.0.2.40", # "advertisement_interval": 72, # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536 neighbor 192.0.2.40", # "delete protocols bgp 65536 redistribute", # "delete protocols bgp 65536 network", # "delete protocols bgp 65536 parameters" # ], # Using purged: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 aggregate-address 192.0.2.0/24 'summary-only' # set protocols bgp 65536 aggregate-address 203.0.113.0/24 'as-set' # set protocols bgp 65536 maximum-paths ebgp '20' # set protocols bgp 65536 maximum-paths ibgp '55' # set protocols bgp 65536 neighbor 192.0.2.25 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.25 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.25 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'as-path' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'med' # set protocols bgp 65536 neighbor 203.0.113.5 attribute-unchanged 'next-hop' # set protocols bgp 65536 neighbor 203.0.113.5 ebgp-multihop '2' # set protocols bgp 65536 neighbor 203.0.113.5 remote-as '101' # set protocols bgp 65536 neighbor 203.0.113.5 update-source '192.0.2.25' # set protocols bgp 65536 neighbor 5001::64 distribute-list export '20' # set protocols bgp 65536 neighbor 5001::64 distribute-list import '40' # set protocols bgp 65536 neighbor 5001::64 maximum-prefix '34' # set protocols bgp 65536 network 192.1.13.0/24 'backdoor' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters confederation identifier '66' # set protocols bgp 65536 parameters confederation peers '20' # set protocols bgp 65536 parameters confederation peers '55' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters router-id '192.1.2.9' # set protocols bgp 65536 redistribute connected route-map 'map01' # set protocols bgp 65536 redistribute kernel metric '45' # set protocols bgp 65536 timers keepalive '35' # vyos@vyos:~$ - name: Purge configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: purged # After state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # vyos@vyos:~$ # # Module Execution: # # "after": {}, # "before": { # "aggregate_address": [ # { # "prefix": "192.0.2.0/24", # "summary_only": true # }, # { # "prefix": "203.0.113.0/24", # "as_set": true # } # ], # "as_number": 65536, # "bgp_params": { # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "confederation": [ # { # "identifier": 66 # }, # { # "peers": 20 # }, # { # "peers": 55 # } # ], # "default": { # "no_ipv4_unicast": true # }, # "router_id": "192.1.2.9" # }, # "maximum_paths": [ # { # "count": 20, # "path": "ebgp" # }, # { # "count": 55, # "path": "ibgp" # } # ], # "neighbor": [ # { # "address": "192.0.2.25", # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.5", # "attribute_unchanged": { # "as_path": true, # "med": true, # "next_hop": true # }, # "ebgp_multihop": 2, # "remote_as": 101, # "update_source": "192.0.2.25" # }, # { # "address": "5001::64", # "distribute_list": [ # { # "acl": 20, # "action": "export" # }, # { # "acl": 40, # "action": "import" # } # ], # "maximum_prefix": 34 # } # ], # "network": [ # { # "address": "192.1.13.0/24", # "backdoor": true # } # ], # "redistribute": [ # { # "protocol": "connected", # "route_map": "map01" # }, # { # "metric": 45, # "protocol": "kernel" # } # ], # "timers": { # "keepalive": 35 # } # }, # "changed": true, # "commands": [ # "delete protocols bgp 65536" # ], # Deleted in presence of address family under neighbors: # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ ^C # vyos@vyos:~$ - name: Delete configuration vyos.vyos.vyos_bgp_global: config: as_number: "65536" state: deleted # Module Execution: # # "changed": false, # "invocation": { # "module_args": { # "config": { # "aggregate_address": null, # "as_number": 65536, # "bgp_params": null, # "maximum_paths": null, # "neighbor": null, # "network": null, # "redistribute": null, # "timers": null # }, # "running_config": null, # "state": "deleted" # } # }, # "msg": "Use the _bgp_address_family module to delete the address_family under neighbor 203.0.113.0, before replacing/deleting the neighbor." # } # using gathered: # -------------- # Before state: # vyos@vyos:~$ show configuration commands | match "set protocols bgp" # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' # vyos@vyos:~$ ^C - name: gather configs vyos.vyos.vyos_bgp_global: state: gathered # Module Execution: # "gathered": { # "as_number": 65536, # "bgp_params": { # "always_compare_med": true, # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "default": { # "no_ipv4_unicast": true # }, # "distance": [ # { # "type": "external", # "value": 66 # }, # { # "type": "internal", # "value": 20 # }, # { # "type": "local", # "value": 10 # } # ] # }, # "neighbor": [ # { # "address": "192.0.2.43", # "advertisement_interval": 72, # "capability": { # "dynamic": true # }, # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.0", # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # }, # # Using parsed: # ------------ # parsed.cfg # set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval '72' # set protocols bgp 65536 neighbor 192.0.2.43 capability 'dynamic' # set protocols bgp 65536 neighbor 192.0.2.43 'disable-connected-check' # set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime '30' # set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive '10' # set protocols bgp 65536 neighbor 203.0.113.0 address-family 'ipv6-unicast' # set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list 'receive' # set protocols bgp 65536 network 203.0.113.0/24 route-map 'map01' # set protocols bgp 65536 parameters 'always-compare-med' # set protocols bgp 65536 parameters bestpath as-path 'confed' # set protocols bgp 65536 parameters bestpath 'compare-routerid' # set protocols bgp 65536 parameters dampening half-life '33' # set protocols bgp 65536 parameters dampening max-suppress-time '20' # set protocols bgp 65536 parameters dampening re-use '60' # set protocols bgp 65536 parameters dampening start-suppress-time '5' # set protocols bgp 65536 parameters default 'no-ipv4-unicast' # set protocols bgp 65536 parameters distance global external '66' # set protocols bgp 65536 parameters distance global internal '20' # set protocols bgp 65536 parameters distance global local '10' # set protocols bgp 65536 redistribute static route-map 'map01' - name: parse configs vyos.vyos.vyos_bgp_global: running_config: "{{ lookup('file', './parsed.cfg') }}" state: parsed tags: - parsed # Module execution: # "parsed": { # "as_number": 65536, # "bgp_params": { # "always_compare_med": true, # "bestpath": { # "as_path": "confed", # "compare_routerid": true # }, # "default": { # "no_ipv4_unicast": true # }, # "distance": [ # { # "type": "external", # "value": 66 # }, # { # "type": "internal", # "value": 20 # }, # { # "type": "local", # "value": 10 # } # ] # }, # "neighbor": [ # { # "address": "192.0.2.43", # "advertisement_interval": 72, # "capability": { # "dynamic": true # }, # "disable_connected_check": true, # "timers": { # "holdtime": 30, # "keepalive": 10 # } # }, # { # "address": "203.0.113.0", # "capability": { # "orf": "receive" # } # } # ], # "network": [ # { # "address": "203.0.113.0/24", # "route_map": "map01" # } # ], # "redistribute": [ # { # "protocol": "static", # "route_map": "map01" # } # ] # } # # Using rendered: # -------------- - name: Render vyos.vyos.vyos_bgp_global: config: as_number: "65536" network: - address: "203.0.113.0/24" route_map: map01 redistribute: - protocol: "static" route_map: "map01" bgp_params: always_compare_med: true dampening: start_suppress_time: 5 max_suppress_time: 20 half_life: 33 re_use: 60 distance: - type: "internal" value: 20 - type: "local" value: 10 - type: "external" value: 66 bestpath: as_path: "confed" compare_routerid: true default: no_ipv4_unicast: true neighbor: - address: "192.0.2.43" disable_connected_check: true advertisement_interval: 72 capability: dynamic: true timers: holdtime: 30 keepalive: 10 - address: "203.0.113.0" capability: orf: "receive" state: rendered # Module Execution: # "rendered": [ # "set protocols bgp 65536 neighbor 192.0.2.43 disable-connected-check", # "set protocols bgp 65536 neighbor 192.0.2.43 advertisement-interval 72", # "set protocols bgp 65536 neighbor 192.0.2.43 capability dynamic", # "set protocols bgp 65536 neighbor 192.0.2.43 timers holdtime 30", # "set protocols bgp 65536 neighbor 192.0.2.43 timers keepalive 10", # "set protocols bgp 65536 neighbor 203.0.113.0 capability orf prefix-list receive", # "set protocols bgp 65536 redistribute static route-map map01", # "set protocols bgp 65536 network 203.0.113.0/24 route-map map01", # "set protocols bgp 65536 parameters always-compare-med", # "set protocols bgp 65536 parameters dampening half-life 33", # "set protocols bgp 65536 parameters dampening max-suppress-time 20", # "set protocols bgp 65536 parameters dampening re-use 60", # "set protocols bgp 65536 parameters dampening start-suppress-time 5", # "set protocols bgp 65536 parameters distance global internal 20", # "set protocols bgp 65536 parameters distance global local 10", # "set protocols bgp 65536 parameters distance global external 66", # "set protocols bgp 65536 parameters bestpath as-path confed", # "set protocols bgp 65536 parameters bestpath compare-routerid", # "set protocols bgp 65536 parameters default no-ipv4-unicast" # ] """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.argspec.bgp_global.bgp_global import ( Bgp_globalArgs, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.bgp_global.bgp_global import ( Bgp_global, ) def main(): """ Main entry point for module execution :returns: the result form module invocation """ module = AnsibleModule( argument_spec=Bgp_globalArgs.argument_spec, mutually_exclusive=[], required_if=[], supports_check_mode=False, ) result = Bgp_global(module).execute_module() module.exit_json(**result) if __name__ == "__main__": main() diff --git a/plugins/modules/vyos_firewall_global.py b/plugins/modules/vyos_firewall_global.py index 6ff3071..71dc4a6 100644 --- a/plugins/modules/vyos_firewall_global.py +++ b/plugins/modules/vyos_firewall_global.py @@ -1,1202 +1,1202 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # Copyright 2019 Red Hat # GNU General Public License v3.0+ # (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) ############################################# # WARNING # ############################################# # # This file is auto generated by the resource # module builder playbook. # # Do not edit this file manually. # # Changes to this file will be over written # by the resource module builder. # # Changes should be made in the model used to # generate this file or in the resource module # builder template. # ############################################# """ The module file for vyos_firewall_global """ from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_firewall_global short_description: FIREWALL global resource module description: This module manage global policies or configurations for firewall on VyOS devices. version_added: 1.0.0 notes: - Tested against VyOS 1.1.8 (helium). - This module works with connection C(network_cli). See L(the VyOS OS Platform Options,../network/user_guide/platform_vyos.html). author: - Rohit Thakur (@rohitthakur2590) options: config: description: - A dictionary of Firewall global configuration options. type: dict suboptions: route_redirects: description: -A dictionary of Firewall icmp redirect and source route global configuration options. type: list elements: dict suboptions: afi: description: - Specifies IP address type type: str choices: - ipv4 - ipv6 required: true icmp_redirects: description: - Specifies whether to allow sending/receiving of IPv4/v6 ICMP redirect messages. type: dict suboptions: send: description: - Permits or denies transmitting packets ICMP redirect messages. type: bool receive: description: - Permits or denies receiving packets ICMP redirect messages. type: bool ip_src_route: description: - Specifies whether or not to process source route IP options. type: bool ping: description: - Policy for handling of all IPv4 ICMP echo requests. type: dict suboptions: all: description: - Enables or disables response to all IPv4 ICMP Echo Request (ping) messages. - The system responds to IPv4 ICMP Echo Request messages. type: bool broadcast: description: - Enables or disables response to broadcast IPv4 ICMP Echo Request and Timestamp Request messages. - IPv4 ICMP Echo and Timestamp Request messages are not processed. type: bool config_trap: description: - SNMP trap generation on firewall configuration changes. type: bool validation: description: - Specifies a policy for source validation by reversed path, as defined in RFC 3704. - (disable) No source validation is performed. - (loose) Enable Loose Reverse Path Forwarding as defined in RFC3704. - (strict) Enable Strict Reverse Path Forwarding as defined in RFC3704. type: str choices: - strict - loose - disable group: description: - Defines a group of objects for referencing in firewall rules. type: dict suboptions: address_group: description: - Defines a group of IP addresses for referencing in firewall rules. type: list elements: dict suboptions: name: description: - Name of the firewall address group. type: str required: true description: description: - Allows you to specify a brief description for the address group. type: str members: description: - Address-group members. - IPv4 address to match. - IPv4 range to match. type: list elements: dict suboptions: address: description: IP address. type: str network_group: description: - Defines a group of networks for referencing in firewall rules. type: list elements: dict suboptions: name: description: - Name of the firewall network group. type: str required: true description: description: - Allows you to specify a brief description for the network group. type: str members: description: - Adds an IPv4 network to the specified network group. - The format is ip-address/prefix. type: list elements: dict suboptions: address: description: IP address. type: str port_group: description: - Defines a group of ports for referencing in firewall rules. type: list elements: dict suboptions: name: description: - Name of the firewall port group. type: str required: true description: description: - Allows you to specify a brief description for the port group. type: str members: description: - Port-group member. type: list elements: dict suboptions: port: description: Defines the number. type: str log_martians: description: - Specifies whether or not to record packets with invalid addresses in the log. - (True) Logs packets with invalid addresses. - (False) Does not log packets with invalid addresses. type: bool syn_cookies: description: - Specifies policy for using TCP SYN cookies with IPv4. - (True) Enables TCP SYN cookies with IPv4. - (False) Disables TCP SYN cookies with IPv4. type: bool twa_hazards_protection: description: - - RFC1337 TCP TIME-WAIT assasination hazards protection. + - RFC1337 TCP TIME-WAIT assassination hazards protection. type: bool state_policy: description: - Specifies global firewall state-policy. type: list elements: dict suboptions: connection_type: description: Specifies connection type. type: str choices: - established - invalid - related action: description: - Action for packets part of an established connection. type: str choices: - accept - drop - reject log: description: - Enable logging of packets part of an established connection. type: bool running_config: description: - The module, by default, will connect to the remote device and retrieve the current running-config to use as a base for comparing against the contents of source. There are times when it is not desirable to have the task get the current running-config for every task in a playbook. The I(running_config) argument allows the implementer to pass in the configuration to use as the base config for comparison. This value of this option should be the output received from device by executing command C(show configuration commands | grep 'firewall') type: str state: description: - The state the configuration should be left in. type: str choices: - merged - replaced - deleted - gathered - rendered - parsed default: merged """ EXAMPLES = """ # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep firewall # # -- name: Merge the provided configuration with the exisiting running configuration +- name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: MGMT-HOSTS description: This group has the Management hosts address list members: - address: 192.0.1.1 - address: 192.0.1.3 - address: 192.0.1.5 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": [] # # "commands": [ # "set firewall group address-group MGMT-HOSTS address 192.0.1.1", # "set firewall group address-group MGMT-HOSTS address 192.0.1.3", # "set firewall group address-group MGMT-HOSTS address 192.0.1.5", # "set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list'", # "set firewall group address-group MGMT-HOSTS", # "set firewall group network-group MGMT network 192.0.1.0/24", # "set firewall group network-group MGMT description 'This group has the Management network addresses'", # "set firewall group network-group MGMT", # "set firewall ip-src-route 'enable'", # "set firewall receive-redirects 'disable'", # "set firewall send-redirects 'enable'", # "set firewall config-trap 'enable'", # "set firewall state-policy established action 'accept'", # "set firewall state-policy established log 'enable'", # "set firewall state-policy invalid action 'reject'", # "set firewall broadcast-ping 'enable'", # "set firewall all-ping 'enable'", # "set firewall log-martians 'enable'", # "set firewall twa-hazards-protection 'enable'", # "set firewall syn-cookies 'enable'", # "set firewall source-validation 'strict'" # ] # # "after": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # # # Using parsed # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_global: running_config: "set firewall all-ping 'enable' set firewall broadcast-ping 'enable' set firewall config-trap 'enable' set firewall group address-group ENG-HOSTS address '192.0.3.1' set firewall group address-group ENG-HOSTS address '192.0.3.2' set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' set firewall group address-group SALES-HOSTS address '192.0.2.1' set firewall group address-group SALES-HOSTS address '192.0.2.2' set firewall group address-group SALES-HOSTS address '192.0.2.3' set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' set firewall group network-group MGMT description 'This group has the Management network addresses' set firewall group network-group MGMT network '192.0.1.0/24' set firewall ip-src-route 'enable' set firewall log-martians 'enable' set firewall receive-redirects 'disable' set firewall send-redirects 'enable' set firewall source-validation 'strict' set firewall state-policy established action 'accept' set firewall state-policy established log 'enable' set firewall state-policy invalid action 'reject' set firewall syn-cookies 'enable' set firewall twa-hazards-protection 'enable'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # } # # # Using deleted # # Before state # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' - name: Delete attributes of firewall. vyos.vyos.vyos_firewall_global: config: state_policy: config_trap: log_martians: syn_cookies: twa_hazards_protection: route_redirects: ping: group: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # "commands": [ # "delete firewall source-validation", # "delete firewall group", # "delete firewall log-martians", # "delete firewall ip-src-route", # "delete firewall receive-redirects", # "delete firewall send-redirects", # "delete firewall config-trap", # "delete firewall state-policy", # "delete firewall syn-cookies", # "delete firewall broadcast-ping", # "delete firewall all-ping", # "delete firewall twa-hazards-protection" # ] # # "after": [] # After state # ------------ # vyos@192# run show configuration commands | grep firewall # set 'firewall' # # # Using replaced # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group MGMT-HOSTS address '192.0.1.1' # set firewall group address-group MGMT-HOSTS address '192.0.1.3' # set firewall group address-group MGMT-HOSTS address '192.0.1.5' # set firewall group address-group MGMT-HOSTS description 'This group has the Management hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # - name: Replace firewall global attributes configuration. vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: SALES-HOSTS description: Sales office hosts address list members: - address: 192.0.2.1 - address: 192.0.2.2 - address: 192.0.2.3 - name: ENG-HOSTS description: Sales office hosts address list members: - address: 192.0.3.1 - address: 192.0.3.2 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "This group has the Management hosts address list", # "members": [ # { # "address": "192.0.1.1" # }, # { # "address": "192.0.1.3" # }, # { # "address": "192.0.1.5" # } # ], # "name": "MGMT-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # "commands": [ # "delete firewall group address-group MGMT-HOSTS", # "set firewall group address-group SALES-HOSTS address 192.0.2.1", # "set firewall group address-group SALES-HOSTS address 192.0.2.2", # "set firewall group address-group SALES-HOSTS address 192.0.2.3", # "set firewall group address-group SALES-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group SALES-HOSTS", # "set firewall group address-group ENG-HOSTS address 192.0.3.1", # "set firewall group address-group ENG-HOSTS address 192.0.3.2", # "set firewall group address-group ENG-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group ENG-HOSTS" # ] # # "after": { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # # # Using gathered # # Before state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # - name: Gather firewall global config with provided configurations vyos.vyos.vyos_firewall_global: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": [ # { # "config_trap": true, # "group": { # "address_group": [ # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.3.1" # }, # { # "address": "192.0.3.2" # } # ], # "name": "ENG-HOSTS" # }, # { # "description": "Sales office hosts address list", # "members": [ # { # "address": "192.0.2.1" # }, # { # "address": "192.0.2.2" # }, # { # "address": "192.0.2.3" # } # ], # "name": "SALES-HOSTS" # } # ], # "network_group": [ # { # "description": "This group has the Management network addresses", # "members": [ # { # "address": "192.0.1.0/24" # } # ], # "name": "MGMT" # } # ] # }, # "log_martians": true, # "ping": { # "all": true, # "broadcast": true # }, # "route_redirects": [ # { # "afi": "ipv4", # "icmp_redirects": { # "receive": false, # "send": true # }, # "ip_src_route": true # } # ], # "state_policy": [ # { # "action": "accept", # "connection_type": "established", # "log": true # }, # { # "action": "reject", # "connection_type": "invalid" # } # ], # "syn_cookies": true, # "twa_hazards_protection": true, # "validation": "strict" # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep firewall # set firewall all-ping 'enable' # set firewall broadcast-ping 'enable' # set firewall config-trap 'enable' # set firewall group address-group ENG-HOSTS address '192.0.3.1' # set firewall group address-group ENG-HOSTS address '192.0.3.2' # set firewall group address-group ENG-HOSTS description 'Sales office hosts address list' # set firewall group address-group SALES-HOSTS address '192.0.2.1' # set firewall group address-group SALES-HOSTS address '192.0.2.2' # set firewall group address-group SALES-HOSTS address '192.0.2.3' # set firewall group address-group SALES-HOSTS description 'Sales office hosts address list' # set firewall group network-group MGMT description 'This group has the Management network addresses' # set firewall group network-group MGMT network '192.0.1.0/24' # set firewall ip-src-route 'enable' # set firewall log-martians 'enable' # set firewall receive-redirects 'disable' # set firewall send-redirects 'enable' # set firewall source-validation 'strict' # set firewall state-policy established action 'accept' # set firewall state-policy established log 'enable' # set firewall state-policy invalid action 'reject' # set firewall syn-cookies 'enable' # set firewall twa-hazards-protection 'enable' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_global: config: validation: strict config_trap: true log_martians: true syn_cookies: true twa_hazards_protection: true ping: all: true broadcast: true state_policy: - connection_type: established action: accept log: true - connection_type: invalid action: reject route_redirects: - afi: ipv4 ip_src_route: true icmp_redirects: send: true receive: false group: address_group: - name: SALES-HOSTS description: Sales office hosts address list members: - address: 192.0.2.1 - address: 192.0.2.2 - address: 192.0.2.3 - name: ENG-HOSTS description: Sales office hosts address list members: - address: 192.0.3.1 - address: 192.0.3.2 network_group: - name: MGMT description: This group has the Management network addresses members: - address: 192.0.1.0/24 state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # "set firewall group address-group SALES-HOSTS address 192.0.2.1", # "set firewall group address-group SALES-HOSTS address 192.0.2.2", # "set firewall group address-group SALES-HOSTS address 192.0.2.3", # "set firewall group address-group SALES-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group SALES-HOSTS", # "set firewall group address-group ENG-HOSTS address 192.0.3.1", # "set firewall group address-group ENG-HOSTS address 192.0.3.2", # "set firewall group address-group ENG-HOSTS description 'Sales office hosts address list'", # "set firewall group address-group ENG-HOSTS", # "set firewall group network-group MGMT network 192.0.1.0/24", # "set firewall group network-group MGMT description 'This group has the Management network addresses'", # "set firewall group network-group MGMT", # "set firewall ip-src-route 'enable'", # "set firewall receive-redirects 'disable'", # "set firewall send-redirects 'enable'", # "set firewall config-trap 'enable'", # "set firewall state-policy established action 'accept'", # "set firewall state-policy established log 'enable'", # "set firewall state-policy invalid action 'reject'", # "set firewall broadcast-ping 'enable'", # "set firewall all-ping 'enable'", # "set firewall log-martians 'enable'", # "set firewall twa-hazards-protection 'enable'", # "set firewall syn-cookies 'enable'", # "set firewall source-validation 'strict'" # ] # # """ RETURN = """ before: description: The configuration prior to the model invocation. returned: always type: list sample: > The configuration returned will always be in the same format of the parameters above. after: description: The resulting configuration model invocation. returned: when changed type: list sample: > The configuration returned will always be in the same format of the parameters above. commands: description: The set of commands pushed to the remote device. returned: always type: list sample: ['set firewall group address-group ENG-HOSTS', 'set firewall group address-group ENG-HOSTS address 192.0.3.1'] """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.argspec.firewall_global.firewall_global import ( Firewall_globalArgs, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.firewall_global.firewall_global import ( Firewall_global, ) def main(): """ Main entry point for module execution :returns: the result form module invocation """ required_if = [ ("state", "merged", ("config",)), ("state", "replaced", ("config",)), ("state", "parsed", ("running_config",)), ] mutually_exclusive = [("config", "running_config")] module = AnsibleModule( argument_spec=Firewall_globalArgs.argument_spec, required_if=required_if, supports_check_mode=True, mutually_exclusive=mutually_exclusive, ) result = Firewall_global(module).execute_module() module.exit_json(**result) if __name__ == "__main__": main() diff --git a/plugins/modules/vyos_firewall_rules.py b/plugins/modules/vyos_firewall_rules.py index 3bd6451..b6ed81b 100644 --- a/plugins/modules/vyos_firewall_rules.py +++ b/plugins/modules/vyos_firewall_rules.py @@ -1,1514 +1,1514 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # Copyright 2019 Red Hat # GNU General Public License v3.0+ # (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) ############################################# # WARNING # ############################################# # # This file is auto generated by the resource # module builder playbook. # # Do not edit this file manually. # # Changes to this file will be over written # by the resource module builder. # # Changes should be made in the model used to # generate this file or in the resource module # builder template. # ############################################# """ The module file for vyos_firewall_rules """ from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_firewall_rules short_description: FIREWALL rules resource module description: This module manages firewall rule-set attributes on VyOS devices version_added: 1.0.0 notes: - Tested against VyOS 1.1.8 (helium). - This module works with connection C(network_cli). See L(the VyOS OS Platform Options,../network/user_guide/platform_vyos.html). author: - Rohit Thakur (@rohitthakur2590) options: config: description: A dictionary of Firewall rule-set options. type: list elements: dict suboptions: afi: description: - Specifies the type of rule-set. type: str choices: - ipv4 - ipv6 required: true rule_sets: description: - The Firewall rule-set list. type: list elements: dict suboptions: name: description: - Firewall rule set name. type: str default_action: description: - Default action for rule-set. - drop (Drop if no prior rules are hit (default)) - reject (Drop and notify source if no prior rules are hit) - accept (Accept if no prior rules are hit) type: str choices: - drop - reject - accept description: description: - Rule set description. type: str enable_default_log: description: - Option to log packets hitting default-action. type: bool rules: description: - - A ditionary that specifies the rule-set configurations. + - A dictionary that specifies the rule-set configurations. type: list elements: dict suboptions: number: description: - Rule number. type: int required: true description: description: - Description of this rule. type: str action: description: - Specifying the action. type: str choices: - drop - reject - accept - inspect destination: description: - Specifying the destination parameters. type: dict suboptions: address: description: - Destination ip address subnet or range. - IPv4/6 address, subnet or range to match. - Match everything except the specified address, subnet or range. - Destination ip address subnet or range. type: str group: description: - Destination group. type: dict suboptions: address_group: description: - Group of addresses. type: str network_group: description: - Group of networks. type: str port_group: description: - Group of ports. type: str port: description: - Multiple destination ports can be specified as a comma-separated list. - The whole list can also be "negated" using '!'. - For example:'!22,telnet,http,123,1001-1005'. type: str disabled: description: - Option to disable firewall rule. type: bool fragment: description: - IP fragment match. type: str choices: - match-frag - match-non-frag icmp: description: - ICMP type and code information. type: dict suboptions: type_name: description: - ICMP type-name. type: str choices: - any - echo-reply - destination-unreachable - network-unreachable - host-unreachable - protocol-unreachable - port-unreachable - fragmentation-needed - source-route-failed - network-unknown - host-unknown - network-prohibited - host-prohibited - TOS-network-unreachable - TOS-host-unreachable - communication-prohibited - host-precedence-violation - precedence-cutoff - source-quench - redirect - network-redirect - host-redirect - TOS-network-redirect - TOS-host-redirect - echo-request - router-advertisement - router-solicitation - time-exceeded - ttl-zero-during-transit - ttl-zero-during-reassembly - parameter-problem - ip-header-bad - required-option-missing - timestamp-request - timestamp-reply - address-mask-request - address-mask-reply - ping - pong - ttl-exceeded code: description: - ICMP code. type: int type: description: - ICMP type. type: int ipsec: description: - - Inboud ip sec packets. + - Inbound ip sec packets. type: str choices: - match-ipsec - match-none limit: description: - Rate limit using a token bucket filter. type: dict suboptions: burst: description: - Maximum number of packets to allow in excess of rate. type: int rate: description: - format for rate (integer/time unit). - any one of second, minute, hour or day may be used to specify time unit. - eg. 1/second implies rule to be matched at an average of once per second. type: dict suboptions: number: description: - This is the integer value. type: int unit: description: - This is the time unit. type: str p2p: description: - P2P application packets. type: list elements: dict suboptions: application: description: - Name of the application. type: str choices: - all - applejuice - bittorrent - directconnect - edonkey - gnutella - kazaa protocol: description: - Protocol to match (protocol name in /etc/protocols or protocol number or all). - IP protocol name from /etc/protocols (e.g. "tcp" or "udp"). - <0-255> IP protocol number. - tcp_udp Both TCP and UDP. - all All IP protocols. - (!)All IP protocols except for the specified name or number. type: str recent: description: - Parameters for matching recently seen sources. type: dict suboptions: count: description: - Source addresses seen more than N times. type: int time: description: - Source addresses seen in the last N seconds. type: int source: description: - Source parameters. type: dict suboptions: address: description: - Source ip address subnet or range. - IPv4/6 address, subnet or range to match. - Match everything except the specified address, subnet or range. - Source ip address subnet or range. type: str group: description: - Source group. type: dict suboptions: address_group: description: - Group of addresses. type: str network_group: description: - Group of networks. type: str port_group: description: - Group of ports. type: str port: description: - Multiple source ports can be specified as a comma-separated list. - The whole list can also be "negated" using '!'. - For example:'!22,telnet,http,123,1001-1005'. type: str mac_address: description: - MAC address to match. - Match everything except the specified MAC address. type: str state: description: - Session state. type: dict suboptions: established: description: - Established state. type: bool invalid: description: - Invalid state. type: bool new: description: - New state. type: bool related: description: - Related state. type: bool tcp: description: - TCP flags to match. type: dict suboptions: flags: description: - TCP flags to be matched. type: str time: description: - Time to match rule. type: dict suboptions: utc: description: - Interpret times for startdate, stopdate, starttime and stoptime to be UTC. type: bool monthdays: description: - Monthdays to match rule on. type: str startdate: description: - Date to start matching rule. type: str starttime: description: - Time of day to start matching rule. type: str stopdate: description: - Date to stop matching rule. type: str stoptime: description: - Time of day to stop matching rule. type: str weekdays: description: - Weekdays to match rule on. type: str running_config: description: - This option is used only with state I(parsed). - The value of this option should be the output received from the VyOS device by executing the command B(show configuration commands | grep firewall). - The state I(parsed) reads the configuration from C(running_config) option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the I(parsed) key within the result. type: str state: description: - The state the configuration should be left in type: str choices: - merged - replaced - overridden - deleted - gathered - rendered - parsed default: merged """ EXAMPLES = """ # Using deleted to delete firewall rules based on rule-set name # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 rule_sets: - name: Downlink state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name Downlink" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # Using deleted to delete firewall rules based on afi # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name" # ] # # "after": [] # After state # ------------ # vyos@vyos:~$ show configuration commands| grep firewall # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # Using deleted to delete all the the firewall rules when provided config is empty # # Before state # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # - name: Delete attributes of given firewall rules. vyos.vyos.vyos_firewall_rules: config: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # "commands": [ # "delete firewall name" # ] # # "after": [] # After state # ------------ # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep firewall # set firewall group address-group 'inbound' # -- name: Merge the provided configuration with the exisiting running configuration +- name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept rules: - number: 1 action: accept description: Fwipv6-Rule 1 is configured by Ansible ipsec: match-ipsec - number: 2 action: accept description: Fwipv6-Rule 2 is configured by Ansible ipsec: match-ipsec - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 102 action: reject description: Rule 102 is configured by Ansible ipsec: match-ipsec - number: 103 action: accept description: Rule 103 is configured by Ansible destination: group: address_group: inbound source: address: 192.0.2.0 state: established: true new: false invalid: false related: true state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": [] # # "commands": [ # "set firewall ipv6-name UPLINK default-action 'accept'", # "set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'", # "set firewall ipv6-name UPLINK rule 1 action 'accept'", # "set firewall ipv6-name UPLINK rule 1", # "set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible'", # "set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec'", # "set firewall ipv6-name UPLINK rule 2 action 'accept'", # "set firewall ipv6-name UPLINK rule 2", # "set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible'", # "set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec'", # "set firewall name INBOUND default-action 'accept'", # "set firewall name INBOUND description 'IPv4 INBOUND rule set'", # "set firewall name INBOUND rule 101 action 'accept'", # "set firewall name INBOUND rule 101", # "set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'", # "set firewall name INBOUND rule 101 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 102 action 'reject'", # "set firewall name INBOUND rule 102", # "set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", # "set firewall name INBOUND rule 102 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'", # "set firewall name INBOUND rule 103 destination group address-group inbound", # "set firewall name INBOUND rule 103", # "set firewall name INBOUND rule 103 source address 192.0.2.0", # "set firewall name INBOUND rule 103 state established enable", # "set firewall name INBOUND rule 103 state related enable", # "set firewall name INBOUND rule 103 state invalid disable", # "set firewall name INBOUND rule 103 state new disable", # "set firewall name INBOUND rule 103 action 'accept'" # ] # # "after": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # Using replaced # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # - name: Replace device configurations of listed firewall rules with provided configurations vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 104 action: reject description: Rule 104 is configured by Ansible ipsec: match-none state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # "commands": [ # "delete firewall ipv6-name UPLINK rule 1", # "delete firewall ipv6-name UPLINK rule 2", # "delete firewall name INBOUND rule 102", # "delete firewall name INBOUND rule 103", # "set firewall name INBOUND rule 104 action 'reject'", # "set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible'", # "set firewall name INBOUND rule 104", # "set firewall name INBOUND rule 104 ipsec 'match-none'" # ] # # "after": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK" # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 104 is configured by Ansible", # "ipsec": "match-none", # "number": 104 # } # ] # } # ] # } # ] # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 104 action 'reject' # set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible' # set firewall name INBOUND rule 104 ipsec 'match-none' # Using overridden # # Before state # -------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 104 action 'reject' # set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible' # set firewall name INBOUND rule 104 ipsec 'match-none' # - name: Overrides all device configuration with provided configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv4 rule_sets: - name: Downlink description: IPv4 INBOUND rule set default_action: accept rules: - number: 501 action: accept description: Rule 501 is configured by Ansible ipsec: match-ipsec - number: 502 action: reject description: Rule 502 is configured by Ansible ipsec: match-ipsec state: overridden # # # ------------------------- # Module Execution Result # ------------------------- # # "before": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK" # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 104 is configured by Ansible", # "ipsec": "match-none", # "number": 104 # } # ] # } # ] # } # ] # # "commands": [ # "delete firewall ipv6-name UPLINK", # "delete firewall name INBOUND", # "set firewall name Downlink default-action 'accept'", # "set firewall name Downlink description 'IPv4 INBOUND rule set'", # "set firewall name Downlink rule 501 action 'accept'", # "set firewall name Downlink rule 501", # "set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible'", # "set firewall name Downlink rule 501 ipsec 'match-ipsec'", # "set firewall name Downlink rule 502 action 'reject'", # "set firewall name Downlink rule 502", # "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'", # "set firewall name Downlink rule 502 ipsec 'match-ipsec'" # # # "after": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] # # # After state # ------------ # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall name Downlink default-action 'accept' # set firewall name Downlink description 'IPv4 INBOUND rule set' # set firewall name Downlink rule 501 action 'accept' # set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' # set firewall name Downlink rule 501 ipsec 'match-ipsec' # set firewall name Downlink rule 502 action 'reject' # set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' # set firewall name Downlink rule 502 ipsec 'match-ipsec' # Using gathered # # Before state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # - name: Gather listed firewall rules with provided configurations vyos.vyos.vyos_firewall_rules: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": [ # { # "afi": "ipv6", # "rule_sets": [ # { # "default_action": "accept", # "description": "This is ipv6 specific rule-set", # "name": "UPLINK", # "rules": [ # { # "action": "accept", # "description": "Fwipv6-Rule 1 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 1 # }, # { # "action": "accept", # "description": "Fwipv6-Rule 2 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 2 # } # ] # } # ] # }, # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "INBOUND", # "rules": [ # { # "action": "accept", # "description": "Rule 101 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 101 # }, # { # "action": "reject", # "description": "Rule 102 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 102 # }, # { # "action": "accept", # "description": "Rule 103 is configured by Ansible", # "destination": { # "group": { # "address_group": "inbound" # } # }, # "number": 103, # "source": { # "address": "192.0.2.0" # }, # "state": { # "established": true, # "invalid": false, # "new": false, # "related": true # } # } # ] # } # ] # } # ] # # # After state: # ------------- # # vyos@vyos:~$ show configuration commands| grep firewall # set firewall group address-group 'inbound' # set firewall ipv6-name UPLINK default-action 'accept' # set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set' # set firewall ipv6-name UPLINK rule 1 action 'accept' # set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured by Ansible' # set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec' # set firewall ipv6-name UPLINK rule 2 action 'accept' # set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured by Ansible' # set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec' # set firewall name INBOUND default-action 'accept' # set firewall name INBOUND description 'IPv4 INBOUND rule set' # set firewall name INBOUND rule 101 action 'accept' # set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible' # set firewall name INBOUND rule 101 ipsec 'match-ipsec' # set firewall name INBOUND rule 102 action 'reject' # set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible' # set firewall name INBOUND rule 102 ipsec 'match-ipsec' # set firewall name INBOUND rule 103 action 'accept' # set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible' # set firewall name INBOUND rule 103 destination group address-group 'inbound' # set firewall name INBOUND rule 103 source address '192.0.2.0' # set firewall name INBOUND rule 103 state established 'enable' # set firewall name INBOUND rule 103 state invalid 'disable' # set firewall name INBOUND rule 103 state new 'disable' # set firewall name INBOUND rule 103 state related 'enable' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_firewall_rules: config: - afi: ipv6 rule_sets: - name: UPLINK description: This is ipv6 specific rule-set default_action: accept - afi: ipv4 rule_sets: - name: INBOUND description: IPv4 INBOUND rule set default_action: accept rules: - number: 101 action: accept description: Rule 101 is configured by Ansible ipsec: match-ipsec - number: 102 action: reject description: Rule 102 is configured by Ansible ipsec: match-ipsec - number: 103 action: accept description: Rule 103 is configured by Ansible destination: group: address_group: inbound source: address: 192.0.2.0 state: established: true new: false invalid: false related: true state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # "set firewall ipv6-name UPLINK default-action 'accept'", # "set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'", # "set firewall name INBOUND default-action 'accept'", # "set firewall name INBOUND description 'IPv4 INBOUND rule set'", # "set firewall name INBOUND rule 101 action 'accept'", # "set firewall name INBOUND rule 101", # "set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'", # "set firewall name INBOUND rule 101 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 102 action 'reject'", # "set firewall name INBOUND rule 102", # "set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", # "set firewall name INBOUND rule 102 ipsec 'match-ipsec'", # "set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'", # "set firewall name INBOUND rule 103 destination group address-group inbound", # "set firewall name INBOUND rule 103", # "set firewall name INBOUND rule 103 source address 192.0.2.0", # "set firewall name INBOUND rule 103 state established enable", # "set firewall name INBOUND rule 103 state related enable", # "set firewall name INBOUND rule 103 state invalid disable", # "set firewall name INBOUND rule 103 state new disable", # "set firewall name INBOUND rule 103 action 'accept'" # ] # Using parsed # # - name: Parsed the provided input commands. vyos.vyos.vyos_firewall_rules: running_config: "set firewall group address-group 'inbound' set firewall name Downlink default-action 'accept' set firewall name Downlink description 'IPv4 INBOUND rule set' set firewall name Downlink rule 501 action 'accept' set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible' set firewall name Downlink rule 501 ipsec 'match-ipsec' set firewall name Downlink rule 502 action 'reject' set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible' set firewall name Downlink rule 502 ipsec 'match-ipsec'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": [ # { # "afi": "ipv4", # "rule_sets": [ # { # "default_action": "accept", # "description": "IPv4 INBOUND rule set", # "name": "Downlink", # "rules": [ # { # "action": "accept", # "description": "Rule 501 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 501 # }, # { # "action": "reject", # "description": "Rule 502 is configured by Ansible", # "ipsec": "match-ipsec", # "number": 502 # } # ] # } # ] # } # ] """ RETURN = """ before: description: The configuration prior to the model invocation. returned: always type: list sample: > The configuration returned will always be in the same format of the parameters above. after: description: The resulting configuration model invocation. returned: when changed type: list sample: > The configuration returned will always be in the same format of the parameters above. commands: description: The set of commands pushed to the remote device. returned: always type: list sample: - "set firewall name Downlink default-action 'accept'" - "set firewall name Downlink description 'IPv4 INBOUND rule set'" - "set firewall name Downlink rule 501 action 'accept'" - "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'" - "set firewall name Downlink rule 502 ipsec 'match-ipsec'" """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.argspec.firewall_rules.firewall_rules import ( Firewall_rulesArgs, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.firewall_rules.firewall_rules import ( Firewall_rules, ) def main(): """ Main entry point for module execution :returns: the result form module invocation """ required_if = [ ("state", "merged", ("config",)), ("state", "replaced", ("config",)), ("state", "rendered", ("config",)), ("state", "overridden", ("config",)), ("state", "parsed", ("running_config",)), ] mutually_exclusive = [("config", "running_config")] module = AnsibleModule( argument_spec=Firewall_rulesArgs.argument_spec, required_if=required_if, supports_check_mode=True, mutually_exclusive=mutually_exclusive, ) result = Firewall_rules(module).execute_module() module.exit_json(**result) if __name__ == "__main__": main() diff --git a/plugins/modules/vyos_ospfv3.py b/plugins/modules/vyos_ospfv3.py index ca5bc93..9954ac7 100644 --- a/plugins/modules/vyos_ospfv3.py +++ b/plugins/modules/vyos_ospfv3.py @@ -1,667 +1,667 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # Copyright 2019 Red Hat # GNU General Public License v3.0+ # (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) ############################################# # WARNING # ############################################# # # This file is auto generated by the resource # module builder playbook. # # Do not edit this file manually. # # Changes to this file will be over written # by the resource module builder. # # Changes should be made in the model used to # generate this file or in the resource module # builder template. # ############################################# """ The module file for vyos_ospfv3 """ from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_ospfv3 short_description: OSPFV3 resource module description: This resource module configures and manages attributes of OSPFv3 routes on VyOS network devices. version_added: 1.0.0 notes: - Tested against VyOS 1.1.8 (helium). - This module works with connection C(network_cli). See L(the VyOS OS Platform Options,../network/user_guide/platform_vyos.html). author: - Rohit Thakur (@rohitthakur2590) options: config: description: A provided OSPFv3 route configuration. type: dict suboptions: areas: description: OSPFv3 area. type: list elements: dict suboptions: area_id: description: OSPFv3 Area name/identity. type: str export_list: description: Name of export-list. type: str import_list: description: Name of import-list. type: str range: description: Summarize routes matching prefix (border routers only). type: list elements: dict suboptions: address: description: border router IPv4 address. type: str advertise: description: Advertise this range. type: bool not_advertise: description: Don't advertise this range. type: bool parameters: description: OSPFv3 specific parameters. type: dict suboptions: router_id: description: Override the default router identifier. type: str redistribute: description: Redistribute information from another routing protocol. type: list elements: dict suboptions: route_type: description: Route type to redistribute. type: str choices: [bgp, connected, kernel, ripng, static] route_map: description: Route map references. type: str running_config: description: - This option is used only with state I(parsed). - The value of this option should be the output received from the VyOS device by executing the command B(show configuration commands | grep ospfv3). - The state I(parsed) reads the configuration from C(running_config) option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the I(parsed) key within the result. type: str state: description: - The state the configuration should be left in. type: str choices: - merged - replaced - deleted - parsed - gathered - rendered default: merged """ EXAMPLES = """ # Using merged # # Before state: # ------------- # # vyos@vyos# run show configuration commands | grep ospfv3 # # -- name: Merge the provided configuration with the exisiting running configuration +- name: Merge the provided configuration with the existing running configuration vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db20::/32 - address: 2001:db30::/32 - area_id: '3' range: - address: 2001:db40::/32 state: merged # # # ------------------------- # Module Execution Result # ------------------------- # # before": {} # # "commands": [ # "set protocols ospfv3 redistribute bgp", # "set protocols ospfv3 parameters router-id '192.0.2.10'", # "set protocols ospfv3 area 2 range 2001:db10::/32", # "set protocols ospfv3 area 2 range 2001:db20::/32", # "set protocols ospfv3 area 2 range 2001:db30::/32", # "set protocols ospfv3 area '2'", # "set protocols ospfv3 area 2 export-list export1", # "set protocols ospfv3 area 2 import-list import1", # "set protocols ospfv3 area '3'", # "set protocols ospfv3 area 3 range 2001:db40::/32" # ] # # "after": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using replaced # # Before state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Replace ospfv3 routes attributes configuration. vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db30::/32 - address: 2001:db50::/32 - area_id: '4' range: - address: 2001:db60::/32 state: replaced # # # ------------------------- # Module Execution Result # ------------------------- # # "before": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # "commands": [ # "delete protocols ospfv3 area 2 range 2001:db20::/32", # "delete protocols ospfv3 area 3", # "set protocols ospfv3 area 2 range 2001:db50::/32", # "set protocols ospfv3 area '4'", # "set protocols ospfv3 area 4 range 2001:db60::/32" # ] # # "after": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db30::/32" # }, # { # "address": "2001:db50::/32" # } # ] # }, # { # "area_id": "4", # "range": [ # { # "address": "2001:db60::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 2 range '2001:db50::/32' # set protocols ospfv3 area 4 range '2001:db60::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using rendered # # - name: Render the commands for provided configuration vyos.vyos.vyos_ospfv3: config: redistribute: - route_type: bgp parameters: router_id: 192.0.2.10 areas: - area_id: '2' export_list: export1 import_list: import1 range: - address: 2001:db10::/32 - address: 2001:db20::/32 - address: 2001:db30::/32 - area_id: '3' range: - address: 2001:db40::/32 state: rendered # # # ------------------------- # Module Execution Result # ------------------------- # # # "rendered": [ # [ # "set protocols ospfv3 redistribute bgp", # "set protocols ospfv3 parameters router-id '192.0.2.10'", # "set protocols ospfv3 area 2 range 2001:db10::/32", # "set protocols ospfv3 area 2 range 2001:db20::/32", # "set protocols ospfv3 area 2 range 2001:db30::/32", # "set protocols ospfv3 area '2'", # "set protocols ospfv3 area 2 export-list export1", # "set protocols ospfv3 area 2 import-list import1", # "set protocols ospfv3 area '3'", # "set protocols ospfv3 area 3 range 2001:db40::/32" # ] # Using parsed # # - name: Parse the commands to provide structured configuration. vyos.vyos.vyos_ospfv3: running_config: "set protocols ospfv3 area 2 export-list 'export1' set protocols ospfv3 area 2 import-list 'import1' set protocols ospfv3 area 2 range '2001:db10::/32' set protocols ospfv3 area 2 range '2001:db20::/32' set protocols ospfv3 area 2 range '2001:db30::/32' set protocols ospfv3 area 3 range '2001:db40::/32' set protocols ospfv3 parameters router-id '192.0.2.10' set protocols ospfv3 redistribute 'bgp'" state: parsed # # # ------------------------- # Module Execution Result # ------------------------- # # # "parsed": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # Using gathered # # Before state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Gather ospfv3 routes config with provided configurations vyos.vyos.vyos_ospfv3: config: state: gathered # # # ------------------------- # Module Execution Result # ------------------------- # # "gathered": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # # After state: # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # Using deleted # # Before state # ------------- # # vyos@192# run show configuration commands | grep ospfv3 # set protocols ospfv3 area 2 export-list 'export1' # set protocols ospfv3 area 2 import-list 'import1' # set protocols ospfv3 area 2 range '2001:db10::/32' # set protocols ospfv3 area 2 range '2001:db20::/32' # set protocols ospfv3 area 2 range '2001:db30::/32' # set protocols ospfv3 area 3 range '2001:db40::/32' # set protocols ospfv3 parameters router-id '192.0.2.10' # set protocols ospfv3 redistribute 'bgp' # - name: Delete attributes of ospfv3 routes. vyos.vyos.vyos_ospfv3: config: state: deleted # # # ------------------------ # Module Execution Results # ------------------------ # # "before": { # "areas": [ # { # "area_id": "2", # "export_list": "export1", # "import_list": "import1", # "range": [ # { # "address": "2001:db10::/32" # }, # { # "address": "2001:db20::/32" # }, # { # "address": "2001:db30::/32" # } # ] # }, # { # "area_id": "3", # "range": [ # { # "address": "2001:db40::/32" # } # ] # } # ], # "parameters": { # "router_id": "192.0.2.10" # }, # "redistribute": [ # { # "route_type": "bgp" # } # ] # } # "commands": [ # "delete protocols ospfv3" # ] # # "after": {} # After state # ------------ # vyos@192# run show configuration commands | grep ospfv3 """ RETURN = """ before: description: The configuration prior to the model invocation. returned: always type: dict sample: > The configuration returned will always be in the same format of the parameters above. after: description: The resulting configuration model invocation. returned: when changed type: dict sample: > The configuration returned will always be in the same format of the parameters above. commands: description: The set of commands pushed to the remote device. returned: always type: list sample: - "set protocols ospf parameters router-id 192.0.1.1" - "set protocols ospfv3 area 2 range '2001:db10::/32'" """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.argspec.ospfv3.ospfv3 import ( Ospfv3Args, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.ospfv3.ospfv3 import ( Ospfv3, ) def main(): """ Main entry point for module execution :returns: the result form module invocation """ required_if = [ ("state", "merged", ("config",)), ("state", "replaced", ("config",)), ("state", "rendered", ("config",)), ("state", "parsed", ("running_config",)), ] mutually_exclusive = [("config", "running_config")] module = AnsibleModule( argument_spec=Ospfv3Args.argument_spec, required_if=required_if, supports_check_mode=True, mutually_exclusive=mutually_exclusive, ) result = Ospfv3(module).execute_module() module.exit_json(**result) if __name__ == "__main__": main() diff --git a/plugins/modules/vyos_ping.py b/plugins/modules/vyos_ping.py index 64509fb..90aa6d3 100644 --- a/plugins/modules/vyos_ping.py +++ b/plugins/modules/vyos_ping.py @@ -1,261 +1,261 @@ #!/usr/bin/python # -*- coding: utf-8 -*- # (c) 2017, Ansible by Red Hat, inc # # This file is part of Ansible by Red Hat # # Ansible is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # Ansible is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with Ansible. If not, see . # from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ module: vyos_ping short_description: Tests reachability using ping from VyOS network devices description: - Tests reachability using ping from a VyOS device to a remote destination. - Tested against VyOS 1.1.8 (helium) - For a general purpose network module, see the M(net_ping) module. - For Windows targets, use the M(win_ping) module instead. - For targets running Python, use the M(ping) module instead. version_added: 1.0.0 author: - Nilashish Chakraborty (@NilashishC) options: dest: description: - The IP Address or hostname (resolvable by the device) of the remote node. required: true type: str count: description: - Number of packets to send to check reachability. type: int default: 5 source: description: - The source interface or IP Address to use while sending the ping packet(s). type: str ttl: description: - The time-to-live value for the ICMP packet(s). type: int size: description: - Determines the size (in bytes) of the ping packet(s). type: int interval: description: - Determines the interval (in seconds) between consecutive pings. type: int state: description: - Determines if the expected result is success or fail. type: str choices: - absent - present default: present notes: - Tested against VyOS 1.1.8 (helium). - For a general purpose network module, see the M(net_ping) module. - For Windows targets, use the M(win_ping) module instead. - For targets running Python, use the M(ping) module instead. - This module works with connection C(network_cli). See L(the VyOS OS Platform Options,../network/user_guide/platform_vyos.html). extends_documentation_fragment: - vyos.vyos.vyos """ EXAMPLES = """ - name: Test reachability to 10.10.10.10 vyos.vyos.vyos_ping: dest: 10.10.10.10 - name: Test reachability to 10.20.20.20 using source and ttl set vyos.vyos.vyos_ping: dest: 10.20.20.20 source: eth0 ttl: 128 -- name: Test unreachability to 10.30.30.30 using interval +- name: Test reachability to 10.30.30.30 using interval vyos.vyos.vyos_ping: dest: 10.30.30.30 interval: 3 state: absent - name: Test reachability to 10.40.40.40 setting count and source vyos.vyos.vyos_ping: dest: 10.40.40.40 source: eth1 count: 20 size: 512 """ RETURN = """ commands: description: List of commands sent. returned: always type: list sample: ["ping 10.8.38.44 count 10 interface eth0 ttl 128"] packet_loss: description: Percentage of packets lost. returned: always type: str sample: "0%" packets_rx: description: Packets successfully received. returned: always type: int sample: 20 packets_tx: description: Packets successfully transmitted. returned: always type: int sample: 20 rtt: description: The round trip time (RTT) stats. returned: when ping succeeds type: dict sample: {"avg": 2, "max": 8, "min": 1, "mdev": 24} """ from ansible.module_utils.basic import AnsibleModule from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.vyos import ( run_commands, ) from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.vyos import ( vyos_argument_spec, ) import re def main(): """main entry point for module execution""" argument_spec = dict( count=dict(type="int", default=5), dest=dict(type="str", required=True), source=dict(type="str"), ttl=dict(type="int"), size=dict(type="int"), interval=dict(type="int"), state=dict( type="str", choices=["absent", "present"], default="present" ), ) argument_spec.update(vyos_argument_spec) module = AnsibleModule(argument_spec=argument_spec) count = module.params["count"] dest = module.params["dest"] source = module.params["source"] size = module.params["size"] ttl = module.params["ttl"] interval = module.params["interval"] warnings = list() results = {} if warnings: results["warnings"] = warnings results["commands"] = [ build_ping(dest, count, size, interval, source, ttl) ] ping_results = run_commands(module, commands=results["commands"]) ping_results_list = ping_results[0].split("\n") rtt_info, rate_info = None, None for line in ping_results_list: if line.startswith("rtt"): rtt_info = line if line.startswith("%s packets transmitted" % count): rate_info = line if rtt_info: rtt = parse_rtt(rtt_info) for k, v in rtt.items(): if rtt[k] is not None: rtt[k] = int(v) results["rtt"] = rtt pkt_loss, rx, tx = parse_rate(rate_info) results["packet_loss"] = str(pkt_loss) + "%" results["packets_rx"] = int(rx) results["packets_tx"] = int(tx) validate_results(module, pkt_loss, results) module.exit_json(**results) def build_ping(dest, count, size=None, interval=None, source=None, ttl=None): cmd = "ping {0} count {1}".format(dest, str(count)) if source: cmd += " interface {0}".format(source) if ttl: cmd += " ttl {0}".format(str(ttl)) if size: cmd += " size {0}".format(str(size)) if interval: cmd += " interval {0}".format(str(interval)) return cmd def parse_rate(rate_info): rate_re = re.compile( r"(?P\d+) (?:\w+) (?:\w+), (?P\d+) (?:\w+), (?P\d+)% (?:\w+) (?:\w+), (?:\w+) (?P