3 files changed, 83 insertions, 0 deletions
diff --git a/roles/vrf_firewall/templates/firewall_rules.yml.j2 b/roles/vrf_firewall/templates/firewall_rules.yml.j2
new file mode 100644
index 0000000..71f5ae0
--- /dev/null
+++ b/roles/vrf_firewall/templates/firewall_rules.yml.j2
@@ -0,0 +1,45 @@
+{% macro rules(lst) %}
+{%   for r in lst %}
+        - number: {{ r.number | int }}
+          action: {{ r.action | default('accept') }}
+{%     if r.description is defined %}
+          description: {{ r.description | to_json }}
+{%     endif %}
+{%     if r.protocol is defined %}
+          protocol: {{ r.protocol | to_json }}
+{%     endif %}
+{%     if r.log | default(false) | bool %}
+          log: enable
+{%     endif %}
+{%     for side in ['inbound_interface', 'outbound_interface'] if r[side] is defined %}
+          {{ side }}:
+            name: {{ r[side] | to_json }}
+{%     endfor %}
+{%     for side in ['source', 'destination'] if r[side] is defined and r[side] %}
+          {{ side }}:
+{%       for k in ['address', 'port'] if r[side][k] is defined %}
+            {{ k }}: {{ r[side][k] | string | to_json }}
+{%       endfor %}
+{%     endfor %}
+{%   endfor %}
+{% endmacro %}
+- afi: ipv4
+  rule_sets:
+    - filter: forward
+      default_action: {{ vrf_firewall_forward_default_action }}
+{% if vrf_firewall_default_log | bool %}
+      enable_default_log: true
+{% endif %}
+{% if vrf_firewall_forward_rules %}
+      rules:
+{{ rules(vrf_firewall_forward_rules) -}}
+{% endif %}
+    - filter: input
+      default_action: {{ vrf_firewall_input_default_action }}
+{% if vrf_firewall_default_log | bool %}
+      enable_default_log: true
+{% endif %}
+{% if vrf_firewall_input_rules %}
+      rules:
+{{ rules(vrf_firewall_input_rules) -}}
+{% endif %}
diff --git a/roles/vrf_firewall/templates/vrf.yml.j2 b/roles/vrf_firewall/templates/vrf.yml.j2
new file mode 100644
index 0000000..808dde2
--- /dev/null
+++ b/roles/vrf_firewall/templates/vrf.yml.j2
@@ -0,0 +1,23 @@
+bind_to_all: {{ vrf_firewall_bind_to_all | bool }}
+instances:
+{% for v in vrf_firewall_vrfs %}
+  - name: {{ v.name | to_json }}
+    table_id: {{ v.table | int }}
+{%   if v.description is defined %}
+    description: {{ v.description | to_json }}
+{%   endif %}
+{%   set plain = v.routes | default([]) | rejectattr('vrf', 'defined') | list %}
+{%   if plain %}
+    protocols:
+      static:
+        - address_families:
+            - afi: ipv4
+              routes:
+{%     for r in plain %}
+                - dest: {{ r.dest | to_json }}
+                  next_hops:
+                    - {% if r.next_hop is defined %}forward_router_address: {{ r.next_hop | to_json }}{% else %}interface: {{ r.interface | to_json }}{% endif %}
+
+{%     endfor %}
+{%   endif %}
+{% endfor %}
diff --git a/roles/vrf_firewall/templates/vrf_cli.j2 b/roles/vrf_firewall/templates/vrf_cli.j2
new file mode 100644
index 0000000..2470e4b
--- /dev/null
+++ b/roles/vrf_firewall/templates/vrf_cli.j2
@@ -0,0 +1,15 @@
+{# VRF bindings for non-plain-ethernet interfaces, and inter-VRF leak routes. #}
+{% for v in vrf_firewall_vrfs %}
+{%   for i in v.interfaces | default([]) if i is not match('^eth\d+$') %}
+{%     set m = i | regex_search('^([a-z]+)(\d+)(?:\.(\d+))?$', '\\1', '\\2', '\\3') %}
+{%     set kind = _vrf_firewall_iftypes[m[0]] %}
+{%     if m[2] %}
+set interfaces {{ kind }} {{ m[0] ~ m[1] }} vif {{ m[2] }} vrf '{{ v.name }}'
+{%     else %}
+set interfaces {{ kind }} {{ i }} vrf '{{ v.name }}'
+{%     endif %}
+{%   endfor %}
+{%   for r in v.routes | default([]) if r.vrf is defined %}
+set vrf name {{ v.name }} protocols static route {{ r.dest }} interface {{ r.interface }} vrf '{{ r.vrf }}'
+{%   endfor %}
+{% endfor %}