T9393: new rolesmain

1 files changed, 54 insertions, 0 deletions

diff --git a/extensions/molecule/vrf_firewall/inventory.yml b/extensions/molecule/vrf_firewall/inventory.yml
new file mode 100644
index 0000000..4d3b6f7
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/inventory.yml
@@ -0,0 +1,54 @@
+---
+all:
+  children:
+    vyos:
+      hosts:
+        r1:
+          ansible_host: clab-bp-vrf-r1
+      vars:
+        ansible_network_os: vyos.vyos.vyos
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_user: admin
+        ansible_password: admin
+        base_interfaces:
+          - {name: eth1, addresses: [10.100.100.1/24]}
+          - {name: eth2}
+          - {name: eth2.150, addresses: [10.150.150.1/24]}
+          - {name: eth2.3500, addresses: [172.16.20.1/24]}
+          - {name: eth3, addresses: [203.0.113.1/24]}
+        vrf_firewall_vrfs:
+          - name: MGMT
+            table: 102
+            interfaces: [eth1]
+            routes:
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: WAN
+            table: 101
+            interfaces: [eth3]
+            routes:
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: LAN
+            table: 103
+            interfaces: [eth2.150]
+            routes:
+              - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+              - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: PROD
+            table: 104
+            interfaces: [eth2.3500]
+            routes:
+              - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+              - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+        vrf_firewall_forward_rules:
+          - {number: 10, description: MGMT - Allow to LAN and PROD, inbound_interface: MGMT, outbound_interface: eth2*}
+          - {number: 99, action: drop, description: MGMT - Drop all going to mgmt, outbound_interface: eth1}
+          - {number: 120, description: LAN - Allow to PROD, inbound_interface: LAN, outbound_interface: eth2.3500}
+          - {number: 130, description: LAN - Allow internet, inbound_interface: LAN, outbound_interface: eth3}
+        vrf_firewall_input_rules:
+          # containerlab management; keeps Ansible's SSH session working
+          - {number: 5, description: containerlab management, inbound_interface: eth0}
+          - {number: 10, description: MGMT - Allow input, inbound_interface: MGMT}