T9393: new rolesmain

5 files changed, 157 insertions, 0 deletions

diff --git a/extensions/molecule/ipsec_route_based/converge.yml b/extensions/molecule/ipsec_route_based/converge.yml
new file mode 100644
index 0000000..0fb7a50
--- /dev/null
+++ b/extensions/molecule/ipsec_route_based/converge.yml
@@ -0,0 +1,7 @@
+---
+- name: Converge
+  hosts: vpn
+  gather_facts: false
+  roles:
+    - vyos.blueprints.base
+    - vyos.blueprints.ipsec_route_based
diff --git a/extensions/molecule/ipsec_route_based/inventory.yml b/extensions/molecule/ipsec_route_based/inventory.yml
new file mode 100644
index 0000000..92b460c
--- /dev/null
+++ b/extensions/molecule/ipsec_route_based/inventory.yml
@@ -0,0 +1,61 @@
+---
+all:
+  children:
+    vyos:
+      children:
+        vpn:
+          hosts:
+            r1:
+              ansible_host: clab-bp-ipsec-vyos
+              base_interfaces:
+                - {name: eth1, addresses: [10.0.1.2/30]}
+                - {name: eth2, addresses: [192.168.0.1/24]}
+              ipsec_route_based_peers:
+                - name: CISCO
+                  local_address: 10.0.1.2
+                  remote_address: 10.0.2.2
+                  psk: molecule-psk
+                  connection_type: initiate
+                  vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438}
+              ipsec_route_based_ospf:
+                router_id: 2.2.2.2
+                networks: [10.100.100.0/30, 192.168.0.0/24]
+                passive_interfaces: [eth2]
+              ipsec_route_based_default_gateway: 10.0.1.1
+            r2:
+              ansible_host: clab-bp-ipsec-cisco
+              base_interfaces:
+                - {name: eth1, addresses: [10.0.2.2/30]}
+                - {name: eth2, addresses: [192.168.10.1/24]}
+              ipsec_route_based_peers:
+                - name: VYOS
+                  local_address: 10.0.2.2
+                  remote_address: 10.0.1.2
+                  psk: molecule-psk
+                  connection_type: none
+                  vti: {interface: vti1, address: 10.100.100.2/30, mtu: 1438}
+              ipsec_route_based_ospf:
+                router_id: 1.1.1.1
+                networks: [10.100.100.0/30, 192.168.10.0/24]
+                passive_interfaces: [eth2]
+              ipsec_route_based_default_gateway: 10.0.2.1
+          vars:
+            # proposals from the page's IKE and IPsec parameter tables
+            ipsec_route_based_ike_group:
+              name: IKE-GROUP
+              key_exchange: ikev1
+              lifetime: 28800
+              dh_group: 14
+              encryption: aes128
+              hash: sha1
+            ipsec_route_based_esp_group:
+              name: ESP-GROUP
+              lifetime: 3600
+              pfs: disable
+              encryption: aes256
+              hash: sha256
+      vars:
+        ansible_network_os: vyos.vyos.vyos
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_user: admin
+        ansible_password: admin
diff --git a/extensions/molecule/ipsec_route_based/molecule.yml b/extensions/molecule/ipsec_route_based/molecule.yml
new file mode 100644
index 0000000..9fa905c
--- /dev/null
+++ b/extensions/molecule/ipsec_route_based/molecule.yml
@@ -0,0 +1,28 @@
+---
+# VyOS runs as a container (containerlab kind vyosnetworks_vyos);
+# the lab is deployed in prepare and destroyed in cleanup.
+dependency:
+  name: galaxy
+  enabled: false
+driver:
+  name: default
+  options:
+    managed: false
+platforms:
+  - name: r1
+  - name: r2
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      host_key_checking: false
+    persistent_connection:
+      command_timeout: 60
+  inventory:
+    links:
+      hosts: inventory.yml
+  playbooks:
+    prepare: ../_shared/lab_up.yml
+    cleanup: ../_shared/lab_down.yml
+verifier:
+  name: ansible
diff --git a/extensions/molecule/ipsec_route_based/topology.clab.yml b/extensions/molecule/ipsec_route_based/topology.clab.yml
new file mode 100644
index 0000000..f6b9b29
--- /dev/null
+++ b/extensions/molecule/ipsec_route_based/topology.clab.yml
@@ -0,0 +1,32 @@
+name: bp-ipsec
+topology:
+  kinds:
+    vyosnetworks_vyos:
+      image: ${VYOS_IMAGE:=vyos:blueprints-ci}
+  nodes:
+    vyos:
+      kind: vyosnetworks_vyos
+    # second VyOS standing in for the page's Cisco router
+    cisco:
+      kind: vyosnetworks_vyos
+    isp:
+      kind: linux
+      image: alpine:3
+      exec:
+        - sysctl -w net.ipv4.ip_forward=1
+        - ip addr add 10.0.1.1/30 dev eth1
+        - ip addr add 10.0.2.1/30 dev eth2
+    pc1:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 192.168.0.2/24 dev eth1", "ip route replace default via 192.168.0.1"]
+    pc3:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 192.168.10.2/24 dev eth1", "ip route replace default via 192.168.10.1"]
+  links:
+    # WAN is eth1 here (eth0 on the page; eth0 is containerlab management)
+    - endpoints: ["vyos:eth1", "isp:eth1"]
+    - endpoints: ["cisco:eth1", "isp:eth2"]
+    - endpoints: ["vyos:eth2", "pc1:eth1"]
+    - endpoints: ["cisco:eth2", "pc3:eth1"]
diff --git a/extensions/molecule/ipsec_route_based/verify.yml b/extensions/molecule/ipsec_route_based/verify.yml
new file mode 100644
index 0000000..e190a90
--- /dev/null
+++ b/extensions/molecule/ipsec_route_based/verify.yml
@@ -0,0 +1,29 @@
+---
+- name: Verify role state
+  hosts: vpn
+  gather_facts: false
+  tasks:
+    - name: Wait for IKE, IPsec and OSPF
+      ansible.builtin.pause:
+        seconds: 45
+      run_once: true
+
+    - name: Run role checks
+      ansible.builtin.include_role:
+        name: vyos.blueprints.ipsec_route_based
+        tasks_from: verify
+
+- name: Verify traffic through the tunnel, as in the page's "Checking Connectivity"
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Ping across the VPN in both directions
+      ansible.builtin.command:
+        cmd: docker exec clab-bp-ipsec-{{ item.from }} ping -c 3 -W 2 {{ item.to }}
+      become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}"
+      changed_when: false
+      loop:
+        - {from: pc1, to: 192.168.10.2}
+        - {from: pc3, to: 192.168.0.2}
+      loop_control:
+        label: "{{ item.from }} -> {{ item.to }}"