T9393: new rolesmain

3 files changed, 89 insertions, 0 deletions

diff --git a/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
new file mode 100644
index 0000000..2dbd927
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
@@ -0,0 +1,42 @@
+set interfaces tunnel tun1 encapsulation 'gre'
+set interfaces tunnel tun1 ip adjust-mss '1336'
+set interfaces tunnel tun1 mtu '1376'
+set interfaces tunnel tun1 remote '10.1.1.6'
+set interfaces tunnel tun1 source-address '198.51.100.1'
+set vpn ipsec authentication psk vyos_cisco_l
+set vpn ipsec authentication psk vyos_cisco_l ******** '********'
+set vpn ipsec authentication psk vyos_cisco_l id cisco.hub.net
+set vpn ipsec authentication psk vyos_cisco_l id vyos.net
+set vpn ipsec esp-group e1
+set vpn ipsec esp-group e1 lifetime 3600
+set vpn ipsec esp-group e1 mode tunnel
+set vpn ipsec esp-group e1 pfs disable
+set vpn ipsec esp-group e1 proposal 1
+set vpn ipsec esp-group e1 proposal 1 encryption aes128
+set vpn ipsec esp-group e1 proposal 1 hash sha256
+set vpn ipsec ike-group i1
+set vpn ipsec ike-group i1 key-exchange ikev2
+set vpn ipsec ike-group i1 lifetime 28800
+set vpn ipsec ike-group i1 proposal 1
+set vpn ipsec ike-group i1 proposal 1 dh-group 5
+set vpn ipsec ike-group i1 proposal 1 encryption aes256
+set vpn ipsec ike-group i1 proposal 1 hash sha256
+set vpn ipsec interface eth2
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec options flexvpn
+set vpn ipsec options interface tun1
+set vpn ipsec options virtual-ip
+set vpn ipsec site-to-site peer cisco_hub
+set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
+set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
+set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
+set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
+set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
+set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
+set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
+set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/roles b/tests/render/cases/blueprints/flexvpn_cisco/roles
new file mode 100644
index 0000000..2a14e05
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/roles
@@ -0,0 +1 @@
+gre_tunnel,ipsec_policy_based
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/vars.yml b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
new file mode 100644
index 0000000..ed7c51b
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
@@ -0,0 +1,46 @@
+---
+# docs.vyos.io/en/1.5/configexamples/site-2-site-cisco.html - VyOS side
+# The page's PSK is the word "secret". Ansible masks every occurrence of a
+# no_log value, so the golden file shows the PSK line as "******** ********".
+gre_tunnel_interfaces:
+  - name: tun1
+    encapsulation: gre
+    adjust_mss: "1336"
+    mtu: 1376
+    remote: 10.1.1.6
+    source_address: 198.51.100.1
+
+ipsec_policy_based_peers:
+  - name: cisco_hub
+    psk_name: vyos_cisco_l
+    psk: secret
+    local_address: 198.51.100.1
+    remote_address: 10.1.1.6
+    local_id: vyos.net
+    remote_id: cisco.hub.net
+    connection_type: initiate
+    virtual_address: 0.0.0.0
+    tunnels:
+      - {id: 1, local_prefix: 198.51.100.1/32, remote_prefix: 10.1.1.6/32, protocol: gre}
+ipsec_policy_based_ike_group:
+  name: i1
+  key_exchange: ikev2
+  lifetime: 28800
+  proposal_id: 1
+  dh_group: 5
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_esp_group:
+  name: e1
+  lifetime: 3600
+  mode: tunnel
+  pfs: disable
+  proposal_id: 1
+  encryption: aes128
+  hash: sha256
+ipsec_policy_based_interfaces: [eth2]
+ipsec_policy_based_options:
+  disable_route_autoinstall: true
+  flexvpn: true
+  interface: tun1
+  virtual_ip: true