T9393: new rolesmain

5 files changed, 128 insertions, 0 deletions

diff --git a/examples/vrf-firewall/group_vars/router.yml b/examples/vrf-firewall/group_vars/router.yml
new file mode 100644
index 0000000..3045bce
--- /dev/null
+++ b/examples/vrf-firewall/group_vars/router.yml
@@ -0,0 +1,51 @@
+---
+# The page's WAN is PPPoE (pppoe0); this example uses eth3 instead, because
+# PPPoE needs an access concentrator. Swap eth3 back to pppoe0 on a real router.
+base_interfaces:
+  - {name: eth1, addresses: [10.100.100.1/24]}
+  - {name: eth2}
+  - {name: eth2.150, addresses: [10.150.150.1/24]}
+  - {name: eth2.160, addresses: [10.160.160.1/24]}
+  - {name: eth2.3500, addresses: [172.16.20.1/24]}
+  - {name: eth3, addresses: [203.0.113.1/24]}
+vrf_firewall_vrfs:
+  - name: MGMT
+    table: 102
+    interfaces: [eth1]
+    routes:
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: WAN
+    table: 101
+    interfaces: [eth3]
+    routes:
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: LAN
+    table: 103
+    interfaces: [eth2.150, eth2.160]
+    routes:
+      - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+      - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: PROD
+    table: 104
+    interfaces: [eth2.3500]
+    routes:
+      - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+      - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+
+vrf_firewall_forward_rules:
+  - {number: 10, description: MGMT - Allow to LAN and PROD, inbound_interface: MGMT, outbound_interface: eth2*}
+  - {number: 99, action: drop, description: MGMT - Drop all going to mgmt, outbound_interface: eth1}
+  - {number: 120, description: LAN - Allow to PROD, inbound_interface: LAN, outbound_interface: eth2.3500}
+  - {number: 130, description: LAN - Allow internet, inbound_interface: LAN, outbound_interface: eth3}
+
+vrf_firewall_input_rules:
+  # containerlab management only - on a real router the page allows input from MGMT only
+  - {number: 5, description: containerlab management, inbound_interface: eth0}
+  - {number: 10, description: MGMT - Allow input, inbound_interface: MGMT}
diff --git a/examples/vrf-firewall/inventory.yml b/examples/vrf-firewall/inventory.yml
new file mode 100644
index 0000000..f3e6b10
--- /dev/null
+++ b/examples/vrf-firewall/inventory.yml
@@ -0,0 +1,13 @@
+---
+# docs.vyos.io/en/1.5/configexamples/fwall-and-vrf.html
+all:
+  children:
+    router:
+      hosts:
+        r1:
+          ansible_host: clab-vrf-firewall-r1   # your router's address
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: admin
+    ansible_password: admin                 # use ansible-vault for real devices
diff --git a/examples/vrf-firewall/site.yml b/examples/vrf-firewall/site.yml
new file mode 100644
index 0000000..0f0b66a
--- /dev/null
+++ b/examples/vrf-firewall/site.yml
@@ -0,0 +1,12 @@
+---
+- name: VRFs and firewall
+  hosts: router
+  gather_facts: false
+  roles:
+    - vyos.blueprints.base
+    - vyos.blueprints.vrf_firewall
+  post_tasks:
+    - name: Show rendered commands
+      ansible.builtin.debug:
+        var: vyos_blueprints_rendered
+      when: show_rendered | default(false) | bool
diff --git a/examples/vrf-firewall/topology.clab.yml b/examples/vrf-firewall/topology.clab.yml
new file mode 100644
index 0000000..0612a1f
--- /dev/null
+++ b/examples/vrf-firewall/topology.clab.yml
@@ -0,0 +1,43 @@
+name: vrf-firewall
+topology:
+  nodes:
+    r1:
+      kind: vyosnetworks_vyos
+      image: ${VYOS_IMAGE:=vyos:latest}
+    mgmt:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 10.100.100.10/24 dev eth1", "ip route replace default via 10.100.100.1"]
+    # VLAN-aware bridge for the eth2 trunk (vif 150 = LAN, vif 3500 = PROD)
+    sw:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip link add br0 type bridge vlan_filtering 1
+        - ip link set eth1 master br0
+        - ip link set eth2 master br0
+        - ip link set eth3 master br0
+        - bridge vlan add dev eth1 vid 150
+        - bridge vlan add dev eth1 vid 3500
+        - bridge vlan add dev eth2 vid 150 pvid untagged
+        - bridge vlan add dev eth3 vid 3500 pvid untagged
+        - ip link set br0 up
+    lan:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 10.150.150.10/24 dev eth1", "ip route replace default via 10.150.150.1"]
+    prod:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 172.16.20.10/24 dev eth1", "ip route replace default via 172.16.20.1"]
+    # stands in for the page's PPPoE uplink
+    wan:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 203.0.113.100/24 dev eth1", "ip route replace default via 203.0.113.1"]
+  links:
+    - endpoints: ["r1:eth1", "mgmt:eth1"]
+    - endpoints: ["r1:eth2", "sw:eth1"]
+    - endpoints: ["sw:eth2", "lan:eth1"]
+    - endpoints: ["sw:eth3", "prod:eth1"]
+    - endpoints: ["r1:eth3", "wan:eth1"]
diff --git a/examples/vrf-firewall/verify.yml b/examples/vrf-firewall/verify.yml
new file mode 100644
index 0000000..6a66c8f
--- /dev/null
+++ b/examples/vrf-firewall/verify.yml
@@ -0,0 +1,9 @@
+---
+- name: Check the VRFs
+  hosts: router
+  gather_facts: false
+  tasks:
+    - name: VRF checks
+      ansible.builtin.include_role:
+        name: vyos.blueprints.vrf_firewall
+        tasks_from: verify