diff options
Diffstat (limited to 'extensions/molecule/ipsec_route_based')
5 files changed, 157 insertions, 0 deletions
diff --git a/extensions/molecule/ipsec_route_based/converge.yml b/extensions/molecule/ipsec_route_based/converge.yml new file mode 100644 index 0000000..0fb7a50 --- /dev/null +++ b/extensions/molecule/ipsec_route_based/converge.yml @@ -0,0 +1,7 @@ +--- +- name: Converge + hosts: vpn + gather_facts: false + roles: + - vyos.blueprints.base + - vyos.blueprints.ipsec_route_based diff --git a/extensions/molecule/ipsec_route_based/inventory.yml b/extensions/molecule/ipsec_route_based/inventory.yml new file mode 100644 index 0000000..92b460c --- /dev/null +++ b/extensions/molecule/ipsec_route_based/inventory.yml @@ -0,0 +1,61 @@ +--- +all: + children: + vyos: + children: + vpn: + hosts: + r1: + ansible_host: clab-bp-ipsec-vyos + base_interfaces: + - {name: eth1, addresses: [10.0.1.2/30]} + - {name: eth2, addresses: [192.168.0.1/24]} + ipsec_route_based_peers: + - name: CISCO + local_address: 10.0.1.2 + remote_address: 10.0.2.2 + psk: molecule-psk + connection_type: initiate + vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438} + ipsec_route_based_ospf: + router_id: 2.2.2.2 + networks: [10.100.100.0/30, 192.168.0.0/24] + passive_interfaces: [eth2] + ipsec_route_based_default_gateway: 10.0.1.1 + r2: + ansible_host: clab-bp-ipsec-cisco + base_interfaces: + - {name: eth1, addresses: [10.0.2.2/30]} + - {name: eth2, addresses: [192.168.10.1/24]} + ipsec_route_based_peers: + - name: VYOS + local_address: 10.0.2.2 + remote_address: 10.0.1.2 + psk: molecule-psk + connection_type: none + vti: {interface: vti1, address: 10.100.100.2/30, mtu: 1438} + ipsec_route_based_ospf: + router_id: 1.1.1.1 + networks: [10.100.100.0/30, 192.168.10.0/24] + passive_interfaces: [eth2] + ipsec_route_based_default_gateway: 10.0.2.1 + vars: + # proposals from the page's IKE and IPsec parameter tables + ipsec_route_based_ike_group: + name: IKE-GROUP + key_exchange: ikev1 + lifetime: 28800 + dh_group: 14 + encryption: aes128 + hash: sha1 + ipsec_route_based_esp_group: + name: ESP-GROUP + lifetime: 3600 + pfs: disable + encryption: aes256 + hash: sha256 + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: admin + ansible_password: admin diff --git a/extensions/molecule/ipsec_route_based/molecule.yml b/extensions/molecule/ipsec_route_based/molecule.yml new file mode 100644 index 0000000..9fa905c --- /dev/null +++ b/extensions/molecule/ipsec_route_based/molecule.yml @@ -0,0 +1,28 @@ +--- +# VyOS runs as a container (containerlab kind vyosnetworks_vyos); +# the lab is deployed in prepare and destroyed in cleanup. +dependency: + name: galaxy + enabled: false +driver: + name: default + options: + managed: false +platforms: + - name: r1 + - name: r2 +provisioner: + name: ansible + config_options: + defaults: + host_key_checking: false + persistent_connection: + command_timeout: 60 + inventory: + links: + hosts: inventory.yml + playbooks: + prepare: ../_shared/lab_up.yml + cleanup: ../_shared/lab_down.yml +verifier: + name: ansible diff --git a/extensions/molecule/ipsec_route_based/topology.clab.yml b/extensions/molecule/ipsec_route_based/topology.clab.yml new file mode 100644 index 0000000..f6b9b29 --- /dev/null +++ b/extensions/molecule/ipsec_route_based/topology.clab.yml @@ -0,0 +1,32 @@ +name: bp-ipsec +topology: + kinds: + vyosnetworks_vyos: + image: ${VYOS_IMAGE:=vyos:blueprints-ci} + nodes: + vyos: + kind: vyosnetworks_vyos + # second VyOS standing in for the page's Cisco router + cisco: + kind: vyosnetworks_vyos + isp: + kind: linux + image: alpine:3 + exec: + - sysctl -w net.ipv4.ip_forward=1 + - ip addr add 10.0.1.1/30 dev eth1 + - ip addr add 10.0.2.1/30 dev eth2 + pc1: + kind: linux + image: alpine:3 + exec: ["ip addr add 192.168.0.2/24 dev eth1", "ip route replace default via 192.168.0.1"] + pc3: + kind: linux + image: alpine:3 + exec: ["ip addr add 192.168.10.2/24 dev eth1", "ip route replace default via 192.168.10.1"] + links: + # WAN is eth1 here (eth0 on the page; eth0 is containerlab management) + - endpoints: ["vyos:eth1", "isp:eth1"] + - endpoints: ["cisco:eth1", "isp:eth2"] + - endpoints: ["vyos:eth2", "pc1:eth1"] + - endpoints: ["cisco:eth2", "pc3:eth1"] diff --git a/extensions/molecule/ipsec_route_based/verify.yml b/extensions/molecule/ipsec_route_based/verify.yml new file mode 100644 index 0000000..e190a90 --- /dev/null +++ b/extensions/molecule/ipsec_route_based/verify.yml @@ -0,0 +1,29 @@ +--- +- name: Verify role state + hosts: vpn + gather_facts: false + tasks: + - name: Wait for IKE, IPsec and OSPF + ansible.builtin.pause: + seconds: 45 + run_once: true + + - name: Run role checks + ansible.builtin.include_role: + name: vyos.blueprints.ipsec_route_based + tasks_from: verify + +- name: Verify traffic through the tunnel, as in the page's "Checking Connectivity" + hosts: localhost + gather_facts: false + tasks: + - name: Ping across the VPN in both directions + ansible.builtin.command: + cmd: docker exec clab-bp-ipsec-{{ item.from }} ping -c 3 -W 2 {{ item.to }} + become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}" + changed_when: false + loop: + - {from: pc1, to: 192.168.10.2} + - {from: pc3, to: 192.168.0.2} + loop_control: + label: "{{ item.from }} -> {{ item.to }}" |