diff options
Diffstat (limited to 'extensions/molecule/ipsec_route_based_bgp')
5 files changed, 178 insertions, 0 deletions
diff --git a/extensions/molecule/ipsec_route_based_bgp/converge.yml b/extensions/molecule/ipsec_route_based_bgp/converge.yml new file mode 100644 index 0000000..0fb7a50 --- /dev/null +++ b/extensions/molecule/ipsec_route_based_bgp/converge.yml @@ -0,0 +1,7 @@ +--- +- name: Converge + hosts: vpn + gather_facts: false + roles: + - vyos.blueprints.base + - vyos.blueprints.ipsec_route_based diff --git a/extensions/molecule/ipsec_route_based_bgp/inventory.yml b/extensions/molecule/ipsec_route_based_bgp/inventory.yml new file mode 100644 index 0000000..dff75f1 --- /dev/null +++ b/extensions/molecule/ipsec_route_based_bgp/inventory.yml @@ -0,0 +1,86 @@ +--- +# Values from docs.vyos.io/en/1.5/configexamples/azure-vpn-bgp.html, except: +# - no NAT in the lab, so local_address is the public IP 198.51.100.3; +# - disable-route-autoinstall is set (the page does not set it): without it +# IPsec installs a route for the VTI's catch-all selector that would also +# capture containerlab management traffic; +# - both sides announce a LAN so the test can ping across BGP-learned routes. +all: + children: + vyos: + children: + vpn: + hosts: + r1: + ansible_host: clab-bp-azure-vyos + base_interfaces: + - {name: eth1, addresses: [198.51.100.3/24]} + - {name: eth2, addresses: [10.10.2.1/24]} + ipsec_route_based_peers: + - name: 203.0.113.2 + description: AZURE PRIMARY TUNNEL + psk_name: azure + psk: molecule-psk + local_address: 198.51.100.3 + remote_address: 203.0.113.2 + connection_type: initiate + ikev2_reauth: inherit + esp_group_on_vti: true + vti: {interface: vti1, address: 10.10.1.5/32, description: Azure Tunnel, adjust_mss: "1350"} + ipsec_route_based_interfaces: [eth1] + ipsec_route_based_interface_routes: + - {dest: 10.0.0.4/32, interface: vti1} + ipsec_route_based_bgp: + asn: 64499 + networks: [10.10.2.0/24] + neighbors: + - {address: 10.0.0.4, remote_as: 65540, holdtime: 30, keepalive: 10, soft_reconfiguration_inbound: true} + ipsec_route_based_default_gateway: 198.51.100.1 + r2: + ansible_host: clab-bp-azure-azure + base_interfaces: + - {name: eth1, addresses: [203.0.113.2/24]} + - {name: eth2, addresses: [10.0.1.1/24]} + ipsec_route_based_peers: + - name: 198.51.100.3 + psk_name: onprem + psk: molecule-psk + local_address: 203.0.113.2 + remote_address: 198.51.100.3 + connection_type: none + esp_group_on_vti: true + vti: {interface: vti1, address: 10.0.0.4/32} + ipsec_route_based_interfaces: [eth1] + ipsec_route_based_interface_routes: + - {dest: 10.10.1.5/32, interface: vti1} + ipsec_route_based_bgp: + asn: 65540 + networks: [10.0.1.0/24] + neighbors: + - {address: 10.10.1.5, remote_as: 64499, holdtime: 30, keepalive: 10} + ipsec_route_based_default_gateway: 203.0.113.1 + vars: + ipsec_route_based_ike_group: + name: AZURE + key_exchange: ikev2 + ikev2_reauth: true + lifetime: 28800 + proposal_id: 1 + dh_group: 2 + encryption: aes256 + hash: sha1 + dead_peer_detection: {action: restart, interval: 15, timeout: 30} + ipsec_route_based_esp_group: + name: AZURE + lifetime: 3600 + mode: tunnel + pfs: dh-group2 + proposal_id: 1 + encryption: aes256 + hash: sha1 + ipsec_route_based_disable_route_autoinstall: true + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: admin + ansible_password: admin diff --git a/extensions/molecule/ipsec_route_based_bgp/molecule.yml b/extensions/molecule/ipsec_route_based_bgp/molecule.yml new file mode 100644 index 0000000..9fa905c --- /dev/null +++ b/extensions/molecule/ipsec_route_based_bgp/molecule.yml @@ -0,0 +1,28 @@ +--- +# VyOS runs as a container (containerlab kind vyosnetworks_vyos); +# the lab is deployed in prepare and destroyed in cleanup. +dependency: + name: galaxy + enabled: false +driver: + name: default + options: + managed: false +platforms: + - name: r1 + - name: r2 +provisioner: + name: ansible + config_options: + defaults: + host_key_checking: false + persistent_connection: + command_timeout: 60 + inventory: + links: + hosts: inventory.yml + playbooks: + prepare: ../_shared/lab_up.yml + cleanup: ../_shared/lab_down.yml +verifier: + name: ansible diff --git a/extensions/molecule/ipsec_route_based_bgp/topology.clab.yml b/extensions/molecule/ipsec_route_based_bgp/topology.clab.yml new file mode 100644 index 0000000..e8ba878 --- /dev/null +++ b/extensions/molecule/ipsec_route_based_bgp/topology.clab.yml @@ -0,0 +1,28 @@ +name: bp-azure +topology: + kinds: + vyosnetworks_vyos: + image: ${VYOS_IMAGE:=vyos:blueprints-ci} + nodes: + vyos: + kind: vyosnetworks_vyos + # second VyOS standing in for the Azure VNet gateway + azure: + kind: vyosnetworks_vyos + isp: + kind: linux + image: alpine:3 + exec: ["sysctl -w net.ipv4.ip_forward=1", "ip addr add 198.51.100.1/24 dev eth1", "ip addr add 203.0.113.1/24 dev eth2"] + onprem: + kind: linux + image: alpine:3 + exec: ["ip addr add 10.10.2.10/24 dev eth1", "ip route replace default via 10.10.2.1"] + vm: + kind: linux + image: alpine:3 + exec: ["ip addr add 10.0.1.10/24 dev eth1", "ip route replace default via 10.0.1.1"] + links: + - endpoints: ["vyos:eth1", "isp:eth1"] + - endpoints: ["azure:eth1", "isp:eth2"] + - endpoints: ["vyos:eth2", "onprem:eth1"] + - endpoints: ["azure:eth2", "vm:eth1"] diff --git a/extensions/molecule/ipsec_route_based_bgp/verify.yml b/extensions/molecule/ipsec_route_based_bgp/verify.yml new file mode 100644 index 0000000..04ad7c2 --- /dev/null +++ b/extensions/molecule/ipsec_route_based_bgp/verify.yml @@ -0,0 +1,29 @@ +--- +- name: Verify role state + hosts: vpn + gather_facts: false + tasks: + - name: Wait for IKE, IPsec and BGP + ansible.builtin.pause: + seconds: 60 + run_once: true + + - name: Run role checks + ansible.builtin.include_role: + name: vyos.blueprints.ipsec_route_based + tasks_from: verify + +- name: Verify traffic over BGP-learned routes through the tunnel + hosts: localhost + gather_facts: false + tasks: + - name: Ping between on-premises and the "Azure" LAN + ansible.builtin.command: + cmd: docker exec clab-bp-azure-{{ item.from }} ping -c 3 -W 2 {{ item.to }} + become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}" + changed_when: false + loop: + - {from: onprem, to: 10.0.1.10} + - {from: vm, to: 10.10.2.10} + loop_control: + label: "{{ item.from }} -> {{ item.to }}" |