Base config for switches role and play

geant/gap_ansible/playbooks/switch_base_config.yaml

+- name: Manage base config playbook
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - ../roles/switch
+

geant/gap_ansible/roles/switch/README.md

+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

geant/gap_ansible/roles/switch/defaults/main.yml

+---
+# defaults file for switch

geant/gap_ansible/roles/switch/handlers/main.yml

+---
+# handlers file for switch

geant/gap_ansible/roles/switch/meta/main.yml

+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

geant/gap_ansible/roles/switch/tasks/compile_base_config.yml

+- name: Create a folder for all the things
+  ansible.builtin.file:
+    path: "/var/tmp/ansible_run_{{ opid }}"
+    state: directory
+    mode: '0755'
+  delegate_to: localhost
+
+
+- name: Print the template in "/var/tmp/ansible_run_{{ opid }}/base_config.conf"
+  ansible.builtin.template:
+    src: "{{ subscription.switch.vendor }}/base_config.j2"
+    dest: "/var/tmp/ansible_run_{{ opid }}/base_config.conf"
+    lstrip_blocks: true
+    trim_blocks: true
+    mode: '0755'
+  delegate_to: localhost
+

geant/gap_ansible/roles/switch/tasks/deploy_base_config.yml

+- name: Deploy base_config on "{{ inventory_hostname }}" [CHECK ONLY][Juniper]
+  junipernetworks.junos.junos_config:
+    update: 'replace'
+    src: "/var/tmp/ansible_run_{{ opid }}/base_config.conf"
+    src_format: text
+    check_commit: true
+  diff: true
+  register: output
+  when: >
+    ( verb == "deploy" or verb == "verify" ) 
+    and
+    ( dry_run | ansible.builtin.bool )
+
+
+- name: Deploy base_config on "{{ inventory_hostname }}" [AND COMMIT][Juniper]
+  junipernetworks.junos.junos_config:
+    update: 'replace'
+    src: "/var/tmp/ansible_run_{{ opid }}/base_config.conf"
+    src_format: text
+    comment: "{{ commit_comment }}"
+  diff: true
+  when: >
+    verb == "deploy"
+    and
+    not ( dry_run | ansible.builtin.bool )

geant/gap_ansible/roles/switch/tasks/main.yml

+---
+# tasks file for switch
+- name: Print the usage
+  ansible.builtin.debug:
+    msg:
+      - "Allowed verbs: 'verify' and 'deploy'. Use: -e 'verb=$verb'."
+  when: (verb is not defined) or (verb not in verbs)
+
+- name: Fail if arguments are missing
+  ansible.legacy.meta: end_play
+  when: (verb is not defined) or (verb not in verbs)
+
+- name: Set ansible_host to terminal server when router is offline
+  ansible.legacy.set_fact:
+    ansible_host: "{{ subscription.switch.switch_site.site_ts_address }}"
+    ansible_port: "{{ subscription.switch.switch_ts_port }}"
+  when:
+    ( subscription.switch.switch_access_via_ts | ansible.builtin.bool ) is true
+
+- name: Generate an ID for this run
+  ansible.legacy.set_fact:
+    opid: "{{ lookup('community.general.random_string', length=18, special=false) }}"
+    config_is_different: "False"
+
+- name: Import variables from 'all'
+  ansible.builtin.include_vars:
+    dir: /Users/simone.spinelli/WORK/SWITCH_REWORK/lab_gap_ansible_inventory/group_vars/all
+
+- name: Import variables from 'switches'
+  ansible.builtin.include_vars:
+    dir: /Users/simone.spinelli/WORK/SWITCH_REWORK/lab_gap_ansible_inventory/group_vars/switches
+
+- name: Print the ID
+  ansible.builtin.debug:
+    msg: "{{ opid }}"
+
+- name: Load info for switch model
+  ansible.builtin.set_fact:
+    ports: "{{ switch_model_map[subscription.switch.switch_model].ports }}"
+    client_ports_prefix: "{{ switch_model_map[subscription.switch.switch_model].client_ports_prefix }}"
+
+- name: Include always compiling phase
+  ansible.builtin.include_tasks: compile_base_config.yml
+  when: verb in verbs
+
+- name: Include deploy phase
+  ansible.builtin.include_tasks: deploy_base_config.yml
+  when: verb == "deploy"

geant/gap_ansible/roles/switch/templates/juniper/base_config.j2

+{% include 'system/system_global.j2' %}
+
+{% if verb == "deploy" %}
+{% include './interfaces.j2' %}
+{% endif %}
+
+{% include './protocols.j2' %}
+
+{% include './fw_options.j2' %}
+
+{% include './snmp.j2' %}
+
+{% include './chassis.j2' %}
+
+{% include './routing_options.j2' %}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/chassis.j2

+replace: chassis {
+    aggregated-devices {
+        ethernet {
+            device-count {{switch_aggregated_ethernet_count}};
+        }
+    }
+}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/fw_options.j2

+replace: forwarding-options {
+    storm-control-profiles default {
+        all;
+    }
+}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/interfaces.j2

+{% for interface in range(ports|int) %}
+interfaces {
+replace: {{client_ports_prefix}}/{{interface}} {
+        description "PHY SPARE";
+        disable;
+    }
+}
+{% endfor %}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/protocols.j2

+replace: protocols {
+    router-advertisement {
+        interface vme.0;
+        interface irb.0;
+    }
+    lldp {
+        interface all;
+    }
+    lldp-med {                          
+        interface all;
+    }
+    igmp-snooping {
+        vlan default;
+    }
+    rstp {
+        interface all;
+    }
+    layer2-control {
+       nonstop-bridging;
+   }
+}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/routing_options.j2

+merge: routing-options {
+    nonstop-routing;
+}
\ No newline at end of file

geant/gap_ansible/roles/switch/templates/juniper/snmp.j2

+replace: snmp {
+    location "{{ snmp_location }}";
+    contact "{{ snmp_contact }}";
+    {% if snmp_views is defined %}
+    {% for snmp_view in snmp_views() %}
+    view {{ snmp_view.name }} {
+      {% for oid_name, oid in snmp_view.oids.items() %}
+      oid {{ oid_name }} {% if oid.state is defined %}{{ oid.state }}{% endif %};
+      {% endfor %}
+    }
+    {% endfor %}
+    {% endif %}
+    {% for community in snmp_communities %}
+    community {{ community.name }} {
+        authorization {{ community.authorization }};
+    {% if community.clients is defined %}
+        clients {
+        {% for client in community.clients %}
+            {{ client.client }};
+        {% endfor %}
+        }
+    {% endif %}
+    {% if community.view is defined %}
+        view {{ community.view }};
+    {% endif %}
+  }
+    {% endfor %}
+    {% if snmp_trap_options is defined %}
+    trap-options {
+        {% for option, value in snmp_trap_options.items() %}
+        {{ option }} {{ value }};
+        {% endfor %}
+    }
+    {% endif %}
+
+    {% for trap_group in snmp_trap_groups %}
+    trap-group {{ trap_group.name }} {
+        {% if trap_group.version is defined %}
+        version {{trap_group.version}};
+        {% endif %}
+        {% if trap_group.categories is defined %}
+        categories {
+        {% for category in trap_group.categories %}
+            {{ category }};
+        {% endfor %}
+        }
+        {% endif %}
+        targets {
+        {% for target in trap_group.targets %}
+            {{ target.target }};
+        {% endfor %}
+        }
+    }
+    {% endfor %}
+    {% if snmp_routing_instance_access is defined %}
+    routing-instance-access;    
+    {% endif %}
+}

geant/gap_ansible/roles/switch/templates/juniper/system/general.j2

+{% set hostname_as_a_list= subscription.switch.switch_fqdn.split('.')%}
+{% set short_hostname= hostname_as_a_list[:3] | join('.')%}
+system {
+  replace: host-name {{ short_hostname }};
+  replace: authentication-order [ radius password ];
+  {% if system_root_pwd is defined %}
+  replace:  root-authentication {
+  encrypted-password {{ system_root_pwd }} ;
+  }
+  {% endif %}
+  auto-snapshot
+  {% if system_domain_name is defined %}
+  replace:  domain-name {{ system_domain_name }} ;
+  {% endif %}
+  {% if system_time_zone is defined %}
+  replace:  time-zone {{ system_time_zone }} ;
+  {% endif %}
+  dump-on-panic;
+  {% if system_time_zone is defined %}
+  replace:  location country-code {{ site_country_code }} ;
+  {% endif %}
+  {% if system_domain_search is defined %}
+  replace: domain-search [ {% for domain in system_domain_search %}{{ domain }} {% endfor %} ];
+  {% endif %}
+  {% if system_name_servers is defined %}
+  replace: name-server {
+  {% for name_server in system_name_servers %}
+    {{ name_server }};
+  {% endfor %}
+  {% endif %}
+  }
+}

geant/gap_ansible/roles/switch/templates/juniper/system/login.j2

+system {
+replace: login {
+     idle-timeout 15;
+{# classes #}
+    {% if system_login_classes is defined %}
+      {% for login_class in system_login_classes %}
+     class {{ login_class.name }} {
+      {% if login_class.idle_timeout is defined %}
+          idle-timeout {{ login_class.idle_timeout }};
+      {% endif %}
+      {% if login_class.login_alarms is defined and login_class.login_alarms is sameas true %}
+          login-alarms;
+      {% endif %}
+      {% if login_class.permissions is defined %}
+          permissions [{% for permission in login_class.permissions %} {{ permission }}{% endfor %} ];
+      {% endif %}
+      {% if login_class.allow_commands is defined %}
+          allow-commands "{{ login_class.allow_commands }}";
+      {% endif %}
+      {% if login_class.deny_commands is defined %}
+          deny-commands "{{ login_class.deny_commands }}";
+      {% endif %}
+      {% if login_class.allow_configuration_regexps is defined %}
+          allow-configuration-regexps [ {% for regex in login_class.allow_configuration_regexps %} "{{ regex }}"{% endfor %} ];
+      {% endif %}
+      {% if login_class.deny_configuration_regexps is defined %}
+          deny-configuration-regexps [ {% for regex in login_class.deny_configuration_regexps %} "{{ regex }}"{% endfor %} ];
+      {% endif %}
+      }
+      {% endfor %}
+    {% endif %}
+{# users #}
+    {% if system_login_users is defined %}
+      {% for login_user in system_login_users %}
+      user {{ login_user.name }} {
+      {% if login_user.full_name is defined %}
+          full-name "{{ login_user.full_name }}";
+      {% endif %}
+      {% if login_user.uid is defined %}
+          uid {{ login_user.uid }};
+      {% endif %}
+          class {{ login_user.class }};
+      {% if ( login_user.authentication is defined ) and ( ( login_user.authentication.ssh_dsa is defined )
+      or ( login_user.authentication.ssh_ed25519 is defined ) or ( login_user.authentication.ssh_ecdsa is defined ) 
+      or ( login_user.authentication.ssh_rsa is defined ) or ( login_user.authentication.encrypted_password is defined ) ) %}
+          authentication {
+        {% if login_user.authentication.ssh_dsa is defined  %} {% for dsa_key in login_user.authentication.ssh_dsa %}
+            ssh-dsa "{{ dsa_key }}";
+          {% endfor %}
+        {% endif %}
+        {% if login_user.authentication.ssh_ecdsa is defined  %} {% for ecdsa_key in login_user.authentication.ssh_ecdsa %}
+            ssh-ecdsa "{{ ecdsa_key }}";
+          {% endfor %}
+        {% endif %}
+        {% if login_user.authentication.ssh_rsa is defined  %} {% for rsa_key in login_user.authentication.ssh_rsa %}
+            ssh-rsa "{{ rsa_key }}";
+          {% endfor %}
+        {% endif %}
+        {% if login_user.authentication.ssh_ed25519 is defined  %} {% for ed25519_key in login_user.authentication.ssh_ed25519 %}
+            ssh-ed25519 "{{ ed25519_key }}";
+          {% endfor %}
+        {% endif %}
+        {% if login_user.authentication.encrypted_password is defined  %}
+            encrypted-password "{{ login_user.authentication.encrypted_password }}";
+        {% endif %}
+        }
+       {% endif %}
+      }
+      {% endfor %}
+      {% endif %}
+{# options #}
+    {% if system_login_password_policies is defined %}
+      password {
+      {% for option in system_login_password_policies %}
+        {{ option.option }} {{ option.value }} ;
+      {% endfor %}
+      }
+    {% endif %}
+ }
+}
+

geant/gap_ansible/roles/switch/templates/juniper/system/ntp.j2

+system {
+replace: ntp {
+    {% if system_switches_ntp.ntp_keys is defined %}
+      {% for ntp_key in system_switches_ntp.ntp_keys %}
+        authentication-key {{ ntp_key.id }} type {{ ntp_key.type }} value {{ ntp_key.value }} ;
+      {% endfor %}
+    {% endif %}
+    {% if system_switches_ntp.servers is defined %}
+      {% for ntp_server in system_switches_ntp.servers %}
+        server {{ ntp_server.address }} {% if ntp_server.key is defined %} key {{ ntp_server.key }} {% endif %};
+      {% endfor %}
+    {% endif %}
+    {% if system_switches_ntp.trusted_keys is defined %}
+      {% for trusted_key in system_switches_ntp.trusted_keys %}
+         trusted-key {{ trusted_key }} ;
+      {% endfor %}
+    {% endif %}
+  }
+}

geant/gap_ansible/roles/switch/templates/juniper/system/radius-server.j2

+system {
+{% if system_radius_servers is defined %}
+   replace: radius-server { 
+      {%- for radius_server in system_radius_servers %} 
+      {{ radius_server.host }} {
+         secret "{{ radius_server.secret }}"; 
+      {% if radius_server.timeout is defined %}
+         timeout {{ radius_server.timeout }};
+      {% endif %}
+      {% if radius_server.source_address is defined %}
+         source-address {{ radius_server.source_address }};
+      {% endif %}
+      }
+      {%- endfor %}
+   {% endif %}
+   }
+}
+

geant/gap_ansible/roles/switch/templates/juniper/system/services.j2

+system {
+replace: services {
+    ssh {
+        root-login deny;
+        no-tcp-forwarding;
+        protocol-version v2;
+        sftp-server;
+{% if system_services_ssh_conf is defined %}
+        max-sessions-per-connection {{ system_services_ssh_conf.max_sessions_per_connection }} ;
+    {% if system_services_ssh_conf.ciphers is defined %}
+        ciphers [ {% for cipher in system_services_ssh_conf.ciphers %}"{{cipher}}" {% endfor %}]; 
+    {% endif %}
+    {% if system_services_ssh_conf.key_exchanges is defined %}
+        key-exchange [ {% for key_exchange in system_services_ssh_conf.key_exchanges %}"{{key_exchange}}" {% endfor %}]; 
+    {% endif %}
+        connection-limit {{ system_services_ssh_conf.connection_limit }};
+        rate-limit {{ system_services_ssh_conf.rate_limit }};
+{% endif %}
+    } 
+    netconf {
+        ssh;
+    }
+  }
+}