diff options
Diffstat (limited to 'extensions/molecule/vrf_firewall')
| -rw-r--r-- | extensions/molecule/vrf_firewall/converge.yml | 7 | ||||
| -rw-r--r-- | extensions/molecule/vrf_firewall/inventory.yml | 54 | ||||
| -rw-r--r-- | extensions/molecule/vrf_firewall/molecule.yml | 27 | ||||
| -rw-r--r-- | extensions/molecule/vrf_firewall/topology.clab.yml | 43 | ||||
| -rw-r--r-- | extensions/molecule/vrf_firewall/verify.yml | 36 |
5 files changed, 167 insertions, 0 deletions
diff --git a/extensions/molecule/vrf_firewall/converge.yml b/extensions/molecule/vrf_firewall/converge.yml new file mode 100644 index 0000000..bdf90f7 --- /dev/null +++ b/extensions/molecule/vrf_firewall/converge.yml @@ -0,0 +1,7 @@ +--- +- name: Converge + hosts: vyos + gather_facts: false + roles: + - vyos.blueprints.base + - vyos.blueprints.vrf_firewall diff --git a/extensions/molecule/vrf_firewall/inventory.yml b/extensions/molecule/vrf_firewall/inventory.yml new file mode 100644 index 0000000..4d3b6f7 --- /dev/null +++ b/extensions/molecule/vrf_firewall/inventory.yml @@ -0,0 +1,54 @@ +--- +all: + children: + vyos: + hosts: + r1: + ansible_host: clab-bp-vrf-r1 + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: admin + ansible_password: admin + base_interfaces: + - {name: eth1, addresses: [10.100.100.1/24]} + - {name: eth2} + - {name: eth2.150, addresses: [10.150.150.1/24]} + - {name: eth2.3500, addresses: [172.16.20.1/24]} + - {name: eth3, addresses: [203.0.113.1/24]} + vrf_firewall_vrfs: + - name: MGMT + table: 102 + interfaces: [eth1] + routes: + - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN} + - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD} + - name: WAN + table: 101 + interfaces: [eth3] + routes: + - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN} + - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD} + - name: LAN + table: 103 + interfaces: [eth2.150] + routes: + - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN} + - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT} + - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD} + - name: PROD + table: 104 + interfaces: [eth2.3500] + routes: + - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN} + - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT} + - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN} + vrf_firewall_forward_rules: + - {number: 10, description: MGMT - Allow to LAN and PROD, inbound_interface: MGMT, outbound_interface: eth2*} + - {number: 99, action: drop, description: MGMT - Drop all going to mgmt, outbound_interface: eth1} + - {number: 120, description: LAN - Allow to PROD, inbound_interface: LAN, outbound_interface: eth2.3500} + - {number: 130, description: LAN - Allow internet, inbound_interface: LAN, outbound_interface: eth3} + vrf_firewall_input_rules: + # containerlab management; keeps Ansible's SSH session working + - {number: 5, description: containerlab management, inbound_interface: eth0} + - {number: 10, description: MGMT - Allow input, inbound_interface: MGMT} diff --git a/extensions/molecule/vrf_firewall/molecule.yml b/extensions/molecule/vrf_firewall/molecule.yml new file mode 100644 index 0000000..612af0a --- /dev/null +++ b/extensions/molecule/vrf_firewall/molecule.yml @@ -0,0 +1,27 @@ +--- +# VyOS runs as a container (containerlab kind vyosnetworks_vyos); +# the lab is deployed in prepare and destroyed in cleanup. +dependency: + name: galaxy + enabled: false +driver: + name: default + options: + managed: false +platforms: + - name: r1 +provisioner: + name: ansible + config_options: + defaults: + host_key_checking: false + persistent_connection: + command_timeout: 60 + inventory: + links: + hosts: inventory.yml + playbooks: + prepare: ../_shared/lab_up.yml + cleanup: ../_shared/lab_down.yml +verifier: + name: ansible diff --git a/extensions/molecule/vrf_firewall/topology.clab.yml b/extensions/molecule/vrf_firewall/topology.clab.yml new file mode 100644 index 0000000..567cd56 --- /dev/null +++ b/extensions/molecule/vrf_firewall/topology.clab.yml @@ -0,0 +1,43 @@ +name: bp-vrf +topology: + nodes: + r1: + kind: vyosnetworks_vyos + image: ${VYOS_IMAGE:=vyos:blueprints-ci} + mgmt: + kind: linux + image: alpine:3 + exec: ["ip addr add 10.100.100.10/24 dev eth1", "ip route replace default via 10.100.100.1"] + # VLAN-aware bridge for the eth2 trunk (vif 150 = LAN, vif 3500 = PROD) + sw: + kind: linux + image: alpine:3 + exec: + - ip link add br0 type bridge vlan_filtering 1 + - ip link set eth1 master br0 + - ip link set eth2 master br0 + - ip link set eth3 master br0 + - bridge vlan add dev eth1 vid 150 + - bridge vlan add dev eth1 vid 3500 + - bridge vlan add dev eth2 vid 150 pvid untagged + - bridge vlan add dev eth3 vid 3500 pvid untagged + - ip link set br0 up + lan: + kind: linux + image: alpine:3 + exec: ["ip addr add 10.150.150.10/24 dev eth1", "ip route replace default via 10.150.150.1"] + prod: + kind: linux + image: alpine:3 + exec: ["ip addr add 172.16.20.10/24 dev eth1", "ip route replace default via 172.16.20.1"] + # stands in for the page's PPPoE uplink + wan: + kind: linux + image: alpine:3 + exec: ["ip addr add 203.0.113.100/24 dev eth1", "ip route replace default via 203.0.113.1"] + links: + - endpoints: ["r1:eth1", "mgmt:eth1"] + - endpoints: ["r1:eth2", "sw:eth1"] + - endpoints: ["sw:eth2", "lan:eth1"] + - endpoints: ["sw:eth3", "prod:eth1"] + - endpoints: ["r1:eth3", "wan:eth1"] diff --git a/extensions/molecule/vrf_firewall/verify.yml b/extensions/molecule/vrf_firewall/verify.yml new file mode 100644 index 0000000..82989cc --- /dev/null +++ b/extensions/molecule/vrf_firewall/verify.yml @@ -0,0 +1,36 @@ +--- +- name: Verify role state + hosts: vyos + gather_facts: false + tasks: + - name: Run role checks + ansible.builtin.include_role: + name: vyos.blueprints.vrf_firewall + tasks_from: verify + +- name: Verify traffic between VRFs against the page's requirements + hosts: localhost + gather_facts: false + vars: + _flows: + - {from: mgmt, to: 10.150.150.10, allowed: true, why: "MGMT may connect to LAN"} + - {from: mgmt, to: 172.16.20.10, allowed: true, why: "MGMT may connect to PROD"} + - {from: mgmt, to: 203.0.113.100, allowed: false, why: "MGMT may not reach the internet"} + - {from: lan, to: 172.16.20.10, allowed: true, why: "LAN may connect to PROD"} + - {from: lan, to: 203.0.113.100, allowed: true, why: "LAN may reach the internet"} + - {from: lan, to: 10.100.100.10, allowed: false, why: "nothing may connect to MGMT"} + - {from: prod, to: 10.150.150.10, allowed: false, why: "PROD only accepts connections"} + # The page's text says WAN may connect to PROD, but its configuration has + # no rule for it, so the configuration (default drop) is what is tested. + - {from: wan, to: 172.16.20.10, allowed: false, why: "no WAN->PROD rule in the page's configuration"} + tasks: + - name: Ping across VRFs + ansible.builtin.command: + cmd: docker exec clab-bp-vrf-{{ item.from }} ping -c 2 -W 2 {{ item.to }} + become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}" + register: _ping + changed_when: false + failed_when: (_ping.rc == 0) != item.allowed + loop: "{{ _flows }}" + loop_control: + label: "{{ item.from }} -> {{ item.to }} ({{ item.why }})" |