summaryrefslogtreecommitdiff
path: root/docs/configexamples
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configexamples')
-rw-r--r--docs/configexamples/ansible.rst264
-rw-r--r--docs/configexamples/fwall-and-bridge.rst12
-rw-r--r--docs/configexamples/nmp.rst18
-rw-r--r--docs/configexamples/site-2-site-cisco.rst10
4 files changed, 162 insertions, 142 deletions
diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst
index 0f4dbbda..4241c706 100644
--- a/docs/configexamples/ansible.rst
+++ b/docs/configexamples/ansible.rst
@@ -9,7 +9,8 @@ Ansible example
Setting up Ansible on a server running the Debian operating system.
===================================================================
-In this example, we will set up a simple use of Ansible to configure multiple VyoS routers.
+In this example, we will set up a simple use of Ansible to configure
+multiple VyOS routers.
We have four pre-configured routers with this configuration:
Using the general schema for example:
@@ -23,10 +24,10 @@ We have four pre-configured routers with this configuration:
.. code-block:: none
- set interfaces ethernet eth0 address dhcp
- set service ssh
- commit
- save
+ set interfaces ethernet eth0 address dhcp
+ set service ssh
+ commit
+ save
* vyos7 - 192.0.2.105
* vyos8 - 192.0.2.106
@@ -37,180 +38,189 @@ Install Ansible:
====================
.. code-block:: none
- # apt-get install ansible
- Do you want to continue? [Y/n] y
+ # apt-get install ansible
+ Do you want to continue? [Y/n] y
Install Paramiko:
=====================
.. code-block:: none
- #apt-get install -y python3-paramiko
+ #apt-get install -y python3-paramiko
Check the version:
==================
.. code-block:: none
- # ansible --version
- ansible 2.10.8
- config file = None
- configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
- ansible python module location = /usr/lib/python3/dist-packages/ansible
- executable location = /usr/bin/ansible
- python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
+ # ansible --version
+ ansible 2.10.8
+ config file = None
+ configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
+ ansible python module location = /usr/lib/python3/dist-packages/ansible
+ executable location = /usr/bin/ansible
+ python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
Basic configuration of ansible.cfg:
=======================================
.. code-block:: none
- # nano /root/ansible.cfg
- [defaults]
- host_key_checking = no
+ # nano /root/ansible.cfg
+ [defaults]
+ host_key_checking = no
Add all the VyOS hosts:
=======================
.. code-block:: none
- # nano /root/hosts
- [vyos_hosts]
- vyos7 ansible_ssh_host=192.0.2.105
- vyos8 ansible_ssh_host=192.0.2.106
- vyos9 ansible_ssh_host=192.0.2.107
- vyos10 ansible_ssh_host=192.0.2.108
+ # nano /root/hosts
+ [vyos_hosts]
+ vyos7 ansible_ssh_host=192.0.2.105
+ vyos8 ansible_ssh_host=192.0.2.106
+ vyos9 ansible_ssh_host=192.0.2.107
+ vyos10 ansible_ssh_host=192.0.2.108
Add general variables:
======================
.. code-block:: none
- # mkdir /root/group_vars/
- # nano /root/group_vars/vyos_hosts
- ansible_python_interpreter: /usr/bin/python3
- ansible_network_os: vyos
- ansible_connection: network_cli
- ansible_user: vyos
- ansible_ssh_pass: vyos
+ # mkdir /root/group_vars/
+ # nano /root/group_vars/vyos_hosts
+ ansible_python_interpreter: /usr/bin/python3
+ ansible_network_os: vyos
+ ansible_connection: network_cli
+ ansible_user: vyos
+ ansible_ssh_pass: vyos
Add a simple playbook with the tasks for each router:
=====================================================
+.. stop_vyoslinter
+
.. code-block:: none
- # nano /root/main.yml
-
- ---
- - hosts: vyos_hosts
- gather_facts: 'no'
- tasks:
- - name: Configure general settings for the vyos hosts group
- vyos_config:
- lines:
- - set system name-server 8.8.8.8
- - set interfaces ethernet eth0 description '#WAN#'
- - set interfaces ethernet eth1 description '#LAN#'
- - set interfaces ethernet eth2 disable
- - set interfaces ethernet eth3 disable
- - set system host-name {{ inventory_hostname }}
- save:
- true
-
+ # nano /root/main.yml
+
+ ---
+ - hosts: vyos_hosts
+ gather_facts: 'no'
+ tasks:
+ - name: Configure general settings for the vyos hosts group
+ vyos_config:
+ lines:
+ - set system name-server 8.8.8.8
+ - set interfaces ethernet eth0 description '#WAN#'
+ - set interfaces ethernet eth1 description '#LAN#'
+ - set interfaces ethernet eth2 disable
+ - set interfaces ethernet eth3 disable
+ - set system host-name {{ inventory_hostname }}
+ save: true
+
+.. start_vyoslinter
+
Start the playbook:
===================
.. code-block:: none
- ansible-playbook -i hosts main.yml
- PLAY [vyos_hosts] **************************************************************
-
- TASK [Configure general settings for the vyos hosts group] *********************
- ok: [vyos9]
- ok: [vyos10]
- ok: [vyos7]
- ok: [vyos8]
-
- PLAY RECAP *********************************************************************
- vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ ansible-playbook -i hosts main.yml
+ PLAY [vyos_hosts] **************************************************************
+
+ TASK [Configure general settings for the vyos hosts group] *********************
+ ok: [vyos9]
+ ok: [vyos10]
+ ok: [vyos7]
+ ok: [vyos8]
+
+ PLAY RECAP *********************************************************************
+ vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Check the result on the vyos10 router:
======================================
+.. stop_vyoslinter
+
.. code-block:: none
- vyos@vyos10:~$ show interfaces
- Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
- Interface IP Address S/L Description
- --------- ---------- --- -----------
- eth0 192.0.2.108/24 u/u WAN
- eth1 - u/u LAN
- eth2 - A/D
- eth3 - A/D
- lo 127.0.0.1/8 u/u
- ::1/128
-
- vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8
- set system name-server '8.8.8.8'
+ vyos@vyos10:~$ show interfaces
+ Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+ Interface IP Address S/L Description
+ --------- ---------- --- -----------
+ eth0 192.0.2.108/24 u/u WAN
+ eth1 - u/u LAN
+ eth2 - A/D
+ eth3 - A/D
+ lo 127.0.0.1/8 u/u
+ ::1/128
+
+ vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8
+ set system name-server '8.8.8.8'
+
+.. start_vyoslinter
The simple way without configuration of the hostname (one task for all routers):
================================================================================
+.. stop_vyoslinter
+
.. code-block:: none
- # nano /root/hosts_v2
- [vyos_hosts_group]
- vyos7 ansible_ssh_host=192.0.2.105
- vyos8 ansible_ssh_host=192.0.2.106
- vyos9 ansible_ssh_host=192.0.2.107
- vyos10 ansible_ssh_host=192.0.2.108
- [vyos_hosts_group:vars]
- ansible_python_interpreter=/usr/bin/python3
- ansible_user=vyos
- ansible_ssh_pass=vyos
- ansible_network_os=vyos
- ansible_connection=network_cli
-
- # nano /root/main_v2.yml
- ---
- - hosts: vyos_hosts_group
-
- connection: network_cli
- gather_facts: 'no'
-
- tasks:
- - name: Configure remote vyos_hosts_group
- vyos_config:
- lines:
- - set system name-server 8.8.8.8
- - set interfaces ethernet eth0 description WAN
- - set interfaces ethernet eth1 description LAN
- - set interfaces ethernet eth2 disable
- - set interfaces ethernet eth3 disable
- save:
- true
-
+ # nano /root/hosts_v2
+ [vyos_hosts_group]
+ vyos7 ansible_ssh_host=192.0.2.105
+ vyos8 ansible_ssh_host=192.0.2.106
+ vyos9 ansible_ssh_host=192.0.2.107
+ vyos10 ansible_ssh_host=192.0.2.108
+ [vyos_hosts_group:vars]
+ ansible_python_interpreter=/usr/bin/python3
+ ansible_user=vyos
+ ansible_ssh_pass=vyos
+ ansible_network_os=vyos
+ ansible_connection=network_cli
+
+ # nano /root/main_v2.yml
+ ---
+ - hosts: vyos_hosts_group
+ connection: network_cli
+ gather_facts: 'no'
+ tasks:
+ - name: Configure remote vyos_hosts_group
+ vyos_config:
+ lines:
+ - set system name-server 8.8.8.8
+ - set interfaces ethernet eth0 description WAN
+ - set interfaces ethernet eth1 description LAN
+ - set interfaces ethernet eth2 disable
+ - set interfaces ethernet eth3 disable
+ save: true
+
+.. start_vyoslinter
+
.. code-block:: none
-
- # ansible-playbook -i hosts_v2 main_v2.yml
-
- PLAY [vyos_hosts_group] ********************************************************
-
- TASK [Configure remote vyos_hosts_group] ***************************************
- ok: [vyos8]
- ok: [vyos7]
- ok: [vyos9]
- ok: [vyos10]
-
- PLAY RECAP *********************************************************************
- vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-
-
-In the next chapter of the example, we'll use Ansible with jinja2 templates and variables.
+
+ # ansible-playbook -i hosts_v2 main_v2.yml
+
+ PLAY [vyos_hosts_group] ********************************************************
+
+ TASK [Configure remote vyos_hosts_group] ***************************************
+ ok: [vyos8]
+ ok: [vyos7]
+ ok: [vyos9]
+ ok: [vyos10]
+
+ PLAY RECAP *********************************************************************
+ vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+ vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+
+
+In the next chapter of the example, we'll use Ansible with jinja2
+templates and variables.
diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/fwall-and-bridge.rst
index 32c53fa5..34744a5d 100644
--- a/docs/configexamples/fwall-and-bridge.rst
+++ b/docs/configexamples/fwall-and-bridge.rst
@@ -353,12 +353,16 @@ For example, while a host tries to get an IP address from a DHCP server in
br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from
untrusted servers are dropped:
+.. stop_vyoslinter
+
.. code-block:: none
- vyos@bridge:~$ show log firewall bridge
- Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
- Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
- Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+ vyos@bridge:~$ show log firewall bridge
+ Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
+ Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+ Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+
+.. start_vyoslinter
And with operational mode commands, we can check rules matchers, actions, and
diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst
index 913e7107..318e9a91 100644
--- a/docs/configexamples/nmp.rst
+++ b/docs/configexamples/nmp.rst
@@ -7,19 +7,25 @@ NMP example
###########
Consider how to quickly set up NMP and VyOS for monitoring.
-NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network.
+NMP is multi-vendor network monitoring from 'SolarWinds' built to
+scale and expand with the needs of your network.
Configuration 'VyOS'
====================
-First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP.
+First prepare our VyOS router for connection to NMP. We have to set
+up the SNMP protocol and connectivity between the router and NMP.
+
+.. stop_vyoslinter
.. code-block:: none
- set interfaces ethernet eth0 address 'dhcp'
- set system name-server '8.8.8.8'
- set service snmp community router authorization 'test'
- set service snmp community router network '0.0.0.0/0'
+ set interfaces ethernet eth0 address 'dhcp'
+ set system name-server '8.8.8.8'
+ set service snmp community router authorization 'test'
+ set service snmp community router network '0.0.0.0/0'
+
+.. start_vyoslinter
Configuration 'NMP'
diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/site-2-site-cisco.rst
index 96e48d07..5b5f1fd7 100644
--- a/docs/configexamples/site-2-site-cisco.rst
+++ b/docs/configexamples/site-2-site-cisco.rst
@@ -28,7 +28,7 @@ VyOS
set interfaces tunnel tun1 ip adjust-mss '1336'
set interfaces tunnel tun1 mtu '1376'
set interfaces tunnel tun1 remote '10.1.1.6'
- set interfaces tunnel tun1 source-address '88.2.2.1'
+ set interfaces tunnel tun1 source-address '198.51.100.1'
- IPsec:
@@ -59,9 +59,9 @@ VyOS
set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
- set vpn ipsec site-to-site peer cisco_hub local-address '88.2.2.1'
+ set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
- set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '88.2.2.1/32'
+ set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
@@ -141,7 +141,7 @@ Verification
--------- ---------- --- -----------
eth0 - u/u
eth1 - u/u
- eth2 88.2.2.1/24 u/u
+ eth2 198.51.100.1/24 u/u
eth3 172.16.1.2/24 u/u
lo 127.0.0.1/8 u/u
::1/128
@@ -157,7 +157,7 @@ Verification
IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status
- 5 10.1.1.6/4500 88.2.2.1/4500 none/none READY
+ 5 10.1.1.6/4500 198.51.100.1/4500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/2694 sec
CE id: 0, Session-id: 2
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 09:05:16 +0000