From f0bd8a9aec89892ec4e9249c8b51b383aea8a7f2 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Tue, 6 Oct 2026 08:40:09 +1000 Subject: T9393: new roles --- .../blueprints/dmvpn_dual_hub/expected/HUB-1.txt | 46 +++ .../blueprints/dmvpn_dual_hub/expected/HUB-2.txt | 46 +++ .../blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt | 67 ++++ .../blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt | 67 ++++ .../cases/blueprints/dmvpn_dual_hub/inventory.yml | 205 ++++++++++ tests/render/cases/blueprints/dmvpn_dual_hub/roles | 1 + .../cases/blueprints/dmvpn_dual_hub/vars.yml | 15 + .../ha_walkthrough_bgp/expected/router1.txt | 32 ++ .../ha_walkthrough_bgp/expected/router2.txt | 32 ++ .../blueprints/ha_walkthrough_bgp/inventory.yml | 22 + .../cases/blueprints/ha_walkthrough_bgp/roles | 1 + .../cases/blueprints/ha_walkthrough_bgp/vars.yml | 26 ++ .../ha_walkthrough_vrrp_nat/expected/router1.txt | 34 ++ .../ha_walkthrough_vrrp_nat/expected/router2.txt | 39 ++ .../ha_walkthrough_vrrp_nat/inventory.yml | 113 ++++++ .../cases/blueprints/ha_walkthrough_vrrp_nat/roles | 1 + .../blueprints/ha_walkthrough_vrrp_nat/vars.yml | 9 + .../expected/offsite1.txt | 23 ++ .../expected/router1.txt | 49 +++ .../ha_walkthrough_wireguard_ospf/inventory.yml | 135 +++++++ .../blueprints/ha_walkthrough_wireguard_ospf/roles | 1 + .../blueprints/inter_vrf_core/expected/r1.txt | 82 ++++ tests/render/cases/blueprints/inter_vrf_core/roles | 1 + .../cases/blueprints/inter_vrf_core/vars.yml | 52 +++ .../inter_vrf_core_filtering/expected/r1.txt | 115 ++++++ .../blueprints/inter_vrf_core_filtering/roles | 1 + .../blueprints/inter_vrf_core_filtering/vars.yml | 74 ++++ .../isis_segment_routing/expected/P1-VyOS.txt | 17 + .../isis_segment_routing/expected/P2-VyOS.txt | 17 + .../blueprints/isis_segment_routing/inventory.yml | 41 ++ .../cases/blueprints/isis_segment_routing/roles | 1 + .../cases/blueprints/isis_segment_routing/vars.yml | 6 + .../cases/blueprints/l2tp_lns/expected/r1.txt | 16 + tests/render/cases/blueprints/l2tp_lns/roles | 1 + tests/render/cases/blueprints/l2tp_lns/vars.yml | 23 ++ .../l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt | 11 + .../expected/VyOS-CE1-SPOKE.txt | 10 + .../expected/VyOS-CE2-SPOKE.txt | 10 + .../l3vpn_hub_and_spoke/expected/VyOS-P1.txt | 23 ++ .../l3vpn_hub_and_spoke/expected/VyOS-P2.txt | 20 + .../l3vpn_hub_and_spoke/expected/VyOS-P3.txt | 20 + .../l3vpn_hub_and_spoke/expected/VyOS-P4.txt | 23 ++ .../l3vpn_hub_and_spoke/expected/VyOS-PE1.txt | 36 ++ .../l3vpn_hub_and_spoke/expected/VyOS-PE2.txt | 40 ++ .../l3vpn_hub_and_spoke/expected/VyOS-PE3.txt | 36 ++ .../l3vpn_hub_and_spoke/expected/VyOS-RR1.txt | 26 ++ .../l3vpn_hub_and_spoke/expected/VyOS-RR2.txt | 26 ++ .../blueprints/l3vpn_hub_and_spoke/inventory.yml | 442 +++++++++++++++++++++ .../cases/blueprints/l3vpn_hub_and_spoke/roles | 1 + .../blueprints/pppoe_ipv6_home/expected/r1.txt | 38 ++ .../render/cases/blueprints/pppoe_ipv6_home/roles | 1 + .../cases/blueprints/pppoe_ipv6_home/vars.yml | 40 ++ .../blueprints/qos_dscp_shaper/expected/vyos2.txt | 20 + .../blueprints/qos_dscp_shaper/expected/vyos3.txt | 16 + .../blueprints/qos_dscp_shaper/expected/vyos4.txt | 15 + .../cases/blueprints/qos_dscp_shaper/inventory.yml | 62 +++ .../render/cases/blueprints/qos_dscp_shaper/roles | 1 + .../wan_lb_example1_balance/expected/r1.txt | 24 ++ .../cases/blueprints/wan_lb_example1_balance/roles | 1 + .../blueprints/wan_lb_example1_balance/vars.yml | 28 ++ .../expected/r1.txt | 25 ++ .../wan_lb_example2_failover_weights/roles | 1 + .../wan_lb_example2_failover_weights/vars.yml | 29 ++ .../expected/r1.txt | 25 ++ .../wan_lb_example3_failover_rule_order/roles | 1 + .../wan_lb_example3_failover_rule_order/vars.yml | 31 ++ .../expected/r1.txt | 29 ++ .../wan_lb_example4_priority_traffic/roles | 1 + .../wan_lb_example4_priority_traffic/vars.yml | 34 ++ .../wan_lb_example5_exclude/expected/r1.txt | 32 ++ .../cases/blueprints/wan_lb_example5_exclude/roles | 1 + .../blueprints/wan_lb_example5_exclude/vars.yml | 38 ++ .../docs_gcp_ha/expected/edge1.txt | 63 +++ .../docs_gcp_ha/expected/edge2.txt | 63 +++ .../ipsec_route_based/docs_gcp_ha/inventory.yml | 75 ++++ .../cases/ipsec_route_based/docs_gcp_ha/vars.yml | 29 ++ .../cases/wireguard/keys_masked/expected/r1.txt | 9 + tests/render/cases/wireguard/keys_masked/vars.yml | 15 + tests/render/render.yml | 2 +- tests/render/run.sh | 2 +- 80 files changed, 2884 insertions(+), 2 deletions(-) create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/roles create mode 100644 tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_bgp/roles create mode 100644 tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles create mode 100644 tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt create mode 100644 tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml create mode 100644 tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles create mode 100644 tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt create mode 100644 tests/render/cases/blueprints/inter_vrf_core/roles create mode 100644 tests/render/cases/blueprints/inter_vrf_core/vars.yml create mode 100644 tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt create mode 100644 tests/render/cases/blueprints/inter_vrf_core_filtering/roles create mode 100644 tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml create mode 100644 tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt create mode 100644 tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt create mode 100644 tests/render/cases/blueprints/isis_segment_routing/inventory.yml create mode 100644 tests/render/cases/blueprints/isis_segment_routing/roles create mode 100644 tests/render/cases/blueprints/isis_segment_routing/vars.yml create mode 100644 tests/render/cases/blueprints/l2tp_lns/expected/r1.txt create mode 100644 tests/render/cases/blueprints/l2tp_lns/roles create mode 100644 tests/render/cases/blueprints/l2tp_lns/vars.yml create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml create mode 100644 tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles create mode 100644 tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt create mode 100644 tests/render/cases/blueprints/pppoe_ipv6_home/roles create mode 100644 tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml create mode 100644 tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt create mode 100644 tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt create mode 100644 tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt create mode 100644 tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml create mode 100644 tests/render/cases/blueprints/qos_dscp_shaper/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt create mode 100644 tests/render/cases/blueprints/wan_lb_example1_balance/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml create mode 100644 tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt create mode 100644 tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml create mode 100644 tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt create mode 100644 tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml create mode 100644 tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt create mode 100644 tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml create mode 100644 tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt create mode 100644 tests/render/cases/blueprints/wan_lb_example5_exclude/roles create mode 100644 tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml create mode 100644 tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt create mode 100644 tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt create mode 100644 tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml create mode 100644 tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml create mode 100644 tests/render/cases/wireguard/keys_masked/expected/r1.txt create mode 100644 tests/render/cases/wireguard/keys_masked/vars.yml (limited to 'tests/render') diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt new file mode 100644 index 0000000..09a87c7 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt @@ -0,0 +1,46 @@ +set firewall ipv4 output filter rule 10 +set firewall ipv4 output filter rule 10 action 'drop' +set firewall ipv4 output filter rule 10 ipsec 'match-none-out' +set firewall ipv4 output filter rule 10 protocol 'gre' +set interfaces ethernet eth0 address '10.0.0.2/30' +set interfaces tunnel tun100 address '10.100.100.1/32' +set interfaces tunnel tun100 enable-multicast +set interfaces tunnel tun100 encapsulation 'gre' +set interfaces tunnel tun100 ip adjust-mss '1360' +set interfaces tunnel tun100 mtu '1436' +set interfaces tunnel tun100 parameters ip key '42' +set interfaces tunnel tun100 source-interface 'eth0' +set protocols nhrp tunnel tun100 authentication '********' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast 'dynamic' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 redirect +set protocols nhrp tunnel tun100 registration-no-unique +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network point-to-multipoint +set protocols ospf interface tun100 passive disable +set protocols ospf passive-interface default +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.0.1' +set system host-name HUB-1 +set vpn ipsec esp-group ESP-HUB +set vpn ipsec esp-group ESP-HUB lifetime 1800 +set vpn ipsec esp-group ESP-HUB mode transport +set vpn ipsec esp-group ESP-HUB pfs disable +set vpn ipsec esp-group ESP-HUB proposal 1 +set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256 +set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1 +set vpn ipsec ike-group IKE-HUB +set vpn ipsec ike-group IKE-HUB key-exchange ikev1 +set vpn ipsec ike-group IKE-HUB lifetime 3600 +set vpn ipsec ike-group IKE-HUB proposal 1 +set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2 +set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256 +set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec profile NHRPVPN +set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret +set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********' +set vpn ipsec profile NHRPVPN bind tunnel tun100 +set vpn ipsec profile NHRPVPN esp-group ESP-HUB +set vpn ipsec profile NHRPVPN ike-group IKE-HUB diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt new file mode 100644 index 0000000..90fc562 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt @@ -0,0 +1,46 @@ +set firewall ipv4 output filter rule 10 +set firewall ipv4 output filter rule 10 action 'drop' +set firewall ipv4 output filter rule 10 ipsec 'match-none-out' +set firewall ipv4 output filter rule 10 protocol 'gre' +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces tunnel tun101 address '10.100.101.1/32' +set interfaces tunnel tun101 enable-multicast +set interfaces tunnel tun101 encapsulation 'gre' +set interfaces tunnel tun101 ip adjust-mss '1360' +set interfaces tunnel tun101 mtu '1436' +set interfaces tunnel tun101 parameters ip key '43' +set interfaces tunnel tun101 source-interface 'eth0' +set protocols nhrp tunnel tun101 authentication '********' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast 'dynamic' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 redirect +set protocols nhrp tunnel tun101 registration-no-unique +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network point-to-multipoint +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface default +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.1.1' +set system host-name HUB-2 +set vpn ipsec esp-group ESP-HUB +set vpn ipsec esp-group ESP-HUB lifetime 1800 +set vpn ipsec esp-group ESP-HUB mode transport +set vpn ipsec esp-group ESP-HUB pfs disable +set vpn ipsec esp-group ESP-HUB proposal 1 +set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256 +set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1 +set vpn ipsec ike-group IKE-HUB +set vpn ipsec ike-group IKE-HUB key-exchange ikev1 +set vpn ipsec ike-group IKE-HUB lifetime 3600 +set vpn ipsec ike-group IKE-HUB proposal 1 +set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2 +set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256 +set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec profile NHRPVPN +set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret +set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********' +set vpn ipsec profile NHRPVPN bind tunnel tun101 +set vpn ipsec profile NHRPVPN esp-group ESP-HUB +set vpn ipsec profile NHRPVPN ike-group IKE-HUB diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt new file mode 100644 index 0000000..21e17b6 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt @@ -0,0 +1,67 @@ +set firewall ipv4 output filter rule 10 +set firewall ipv4 output filter rule 10 action 'drop' +set firewall ipv4 output filter rule 10 ipsec 'match-none-out' +set firewall ipv4 output filter rule 10 protocol 'gre' +set interfaces ethernet eth0 address '10.0.12.2/30' +set interfaces ethernet eth1 address '192.168.12.1/24' +set interfaces tunnel tun100 address '10.100.100.12/32' +set interfaces tunnel tun100 enable-multicast +set interfaces tunnel tun100 encapsulation 'gre' +set interfaces tunnel tun100 ip adjust-mss '1360' +set interfaces tunnel tun100 mtu '1436' +set interfaces tunnel tun100 parameters ip key '42' +set interfaces tunnel tun100 source-interface 'eth0' +set interfaces tunnel tun101 address '10.100.101.12/32' +set interfaces tunnel tun101 enable-multicast +set interfaces tunnel tun101 encapsulation 'gre' +set interfaces tunnel tun101 ip adjust-mss '1360' +set interfaces tunnel tun101 mtu '1436' +set interfaces tunnel tun101 parameters ip key '43' +set interfaces tunnel tun101 source-interface 'eth0' +set protocols nhrp tunnel tun100 authentication '********' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast '10.0.0.2' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' +set protocols nhrp tunnel tun100 registration-no-unique +set protocols nhrp tunnel tun100 shortcut +set protocols nhrp tunnel tun101 authentication '********' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast '10.0.1.2' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' +set protocols nhrp tunnel tun101 registration-no-unique +set protocols nhrp tunnel tun101 shortcut +set protocols ospf interface eth1 area '0' +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network point-to-multipoint +set protocols ospf interface tun100 passive disable +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network point-to-multipoint +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface default +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.12.1' +set system host-name SPOKE-2 +set vpn ipsec esp-group ESP-HUB +set vpn ipsec esp-group ESP-HUB lifetime 1800 +set vpn ipsec esp-group ESP-HUB mode transport +set vpn ipsec esp-group ESP-HUB pfs disable +set vpn ipsec esp-group ESP-HUB proposal 1 +set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256 +set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1 +set vpn ipsec ike-group IKE-HUB +set vpn ipsec ike-group IKE-HUB key-exchange ikev1 +set vpn ipsec ike-group IKE-HUB lifetime 3600 +set vpn ipsec ike-group IKE-HUB proposal 1 +set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2 +set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256 +set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec profile NHRPVPN +set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret +set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********' +set vpn ipsec profile NHRPVPN bind tunnel tun100 +set vpn ipsec profile NHRPVPN bind tunnel tun101 +set vpn ipsec profile NHRPVPN esp-group ESP-HUB +set vpn ipsec profile NHRPVPN ike-group IKE-HUB diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt new file mode 100644 index 0000000..4827566 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt @@ -0,0 +1,67 @@ +set firewall ipv4 output filter rule 10 +set firewall ipv4 output filter rule 10 action 'drop' +set firewall ipv4 output filter rule 10 ipsec 'match-none-out' +set firewall ipv4 output filter rule 10 protocol 'gre' +set interfaces ethernet eth0 address '10.0.13.2/30' +set interfaces ethernet eth1 address '192.168.13.1/24' +set interfaces tunnel tun100 address '10.100.100.13/32' +set interfaces tunnel tun100 enable-multicast +set interfaces tunnel tun100 encapsulation 'gre' +set interfaces tunnel tun100 ip adjust-mss '1360' +set interfaces tunnel tun100 mtu '1436' +set interfaces tunnel tun100 parameters ip key '42' +set interfaces tunnel tun100 source-interface 'eth0' +set interfaces tunnel tun101 address '10.100.101.13/32' +set interfaces tunnel tun101 enable-multicast +set interfaces tunnel tun101 encapsulation 'gre' +set interfaces tunnel tun101 ip adjust-mss '1360' +set interfaces tunnel tun101 mtu '1436' +set interfaces tunnel tun101 parameters ip key '43' +set interfaces tunnel tun101 source-interface 'eth0' +set protocols nhrp tunnel tun100 authentication '********' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast '10.0.0.2' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' +set protocols nhrp tunnel tun100 registration-no-unique +set protocols nhrp tunnel tun100 shortcut +set protocols nhrp tunnel tun101 authentication '********' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast '10.0.1.2' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' +set protocols nhrp tunnel tun101 registration-no-unique +set protocols nhrp tunnel tun101 shortcut +set protocols ospf interface eth1 area '0' +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network point-to-multipoint +set protocols ospf interface tun100 passive disable +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network point-to-multipoint +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface default +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.13.1' +set system host-name SPOKE-3 +set vpn ipsec esp-group ESP-HUB +set vpn ipsec esp-group ESP-HUB lifetime 1800 +set vpn ipsec esp-group ESP-HUB mode transport +set vpn ipsec esp-group ESP-HUB pfs disable +set vpn ipsec esp-group ESP-HUB proposal 1 +set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256 +set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1 +set vpn ipsec ike-group IKE-HUB +set vpn ipsec ike-group IKE-HUB key-exchange ikev1 +set vpn ipsec ike-group IKE-HUB lifetime 3600 +set vpn ipsec ike-group IKE-HUB proposal 1 +set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2 +set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256 +set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec profile NHRPVPN +set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret +set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********' +set vpn ipsec profile NHRPVPN bind tunnel tun100 +set vpn ipsec profile NHRPVPN bind tunnel tun101 +set vpn ipsec profile NHRPVPN esp-group ESP-HUB +set vpn ipsec profile NHRPVPN ike-group IKE-HUB diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml b/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml new file mode 100644 index 0000000..a8cb78d --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml @@ -0,0 +1,205 @@ +--- +# The page shows no tunnel-interface block for Spoke-3; it gets Spoke-2's +# tunnels with .13 addresses (its NHRP block on the page matches Spoke-2's). +all: + hosts: + HUB-1: + base_interfaces: + - name: eth0 + addresses: + - 10.0.0.2/30 + base_static_routes: + - dest: 0.0.0.0/0 + next_hop: 10.0.0.1 + gre_tunnel_interfaces: + - name: tun100 + addresses: + - 10.100.100.1/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 42 + source_interface: eth0 + dmvpn_nhrp_tunnels: + - name: tun100 + authentication: vyos + holdtime: 300 + multicast: dynamic + network_id: 1 + redirect: true + registration_no_unique: true + ospf_interfaces: + - name: tun100 + area: '0' + network: point-to-multipoint + passive: false + ansible_host: 192.0.2.1 + base_hostname: HUB-1 + HUB-2: + base_interfaces: + - name: eth0 + addresses: + - 10.0.1.2/30 + base_static_routes: + - dest: 0.0.0.0/0 + next_hop: 10.0.1.1 + gre_tunnel_interfaces: + - name: tun101 + addresses: + - 10.100.101.1/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 43 + source_interface: eth0 + dmvpn_nhrp_tunnels: + - name: tun101 + authentication: vyos + holdtime: 300 + multicast: dynamic + network_id: 2 + redirect: true + registration_no_unique: true + ospf_interfaces: + - name: tun101 + area: '0' + network: point-to-multipoint + passive: false + ansible_host: 192.0.2.2 + base_hostname: HUB-2 + SPOKE-2: + base_interfaces: + - name: eth0 + addresses: + - 10.0.12.2/30 + - name: eth1 + addresses: + - 192.168.12.1/24 + base_static_routes: + - dest: 0.0.0.0/0 + next_hop: 10.0.12.1 + gre_tunnel_interfaces: + - name: tun100 + addresses: + - 10.100.100.12/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 42 + source_interface: eth0 + - name: tun101 + addresses: + - 10.100.101.12/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 43 + source_interface: eth0 + dmvpn_nhrp_tunnels: + - name: tun100 + authentication: vyos + holdtime: 300 + multicast: 10.0.0.2 + network_id: 1 + nhs: + - tunnel_ip: dynamic + nbma: 10.0.0.2 + registration_no_unique: true + shortcut: true + - name: tun101 + authentication: vyos + holdtime: 300 + multicast: 10.0.1.2 + network_id: 2 + nhs: + - tunnel_ip: dynamic + nbma: 10.0.1.2 + registration_no_unique: true + shortcut: true + ospf_interfaces: + - name: eth1 + area: '0' + - name: tun100 + area: '0' + network: point-to-multipoint + passive: false + - name: tun101 + area: '0' + network: point-to-multipoint + passive: false + ansible_host: 192.0.2.3 + base_hostname: SPOKE-2 + SPOKE-3: + base_interfaces: + - name: eth0 + addresses: + - 10.0.13.2/30 + - name: eth1 + addresses: + - 192.168.13.1/24 + base_static_routes: + - dest: 0.0.0.0/0 + next_hop: 10.0.13.1 + gre_tunnel_interfaces: + - name: tun100 + addresses: + - 10.100.100.13/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 42 + source_interface: eth0 + - name: tun101 + addresses: + - 10.100.101.13/32 + enable_multicast: true + encapsulation: gre + adjust_mss: '1360' + mtu: 1436 + key: 43 + source_interface: eth0 + dmvpn_nhrp_tunnels: + - name: tun100 + authentication: vyos + holdtime: 300 + multicast: 10.0.0.2 + network_id: 1 + nhs: + - tunnel_ip: dynamic + nbma: 10.0.0.2 + registration_no_unique: true + shortcut: true + - name: tun101 + authentication: vyos + holdtime: 300 + multicast: 10.0.1.2 + network_id: 2 + nhs: + - tunnel_ip: dynamic + nbma: 10.0.1.2 + registration_no_unique: true + shortcut: true + ospf_interfaces: + - name: eth1 + area: '0' + - name: tun100 + area: '0' + network: point-to-multipoint + passive: false + - name: tun101 + area: '0' + network: point-to-multipoint + passive: false + ansible_host: 192.0.2.4 + base_hostname: SPOKE-3 + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/roles b/tests/render/cases/blueprints/dmvpn_dual_hub/roles new file mode 100644 index 0000000..09f69c9 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/roles @@ -0,0 +1 @@ +base,gre_tunnel,dmvpn,ospf diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml b/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml new file mode 100644 index 0000000..e57a5c0 --- /dev/null +++ b/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml @@ -0,0 +1,15 @@ +--- +# docs.vyos.io/en/1.5/configexamples/dmvpn-dualhub-dualcloud.html - VyOS nodes +# (Spoke-1 is the Cisco router on the page). Shared IPsec settings: +dmvpn_ipsec: + interfaces: [eth0] + ike_group: {name: IKE-HUB, key_exchange: ikev1, lifetime: 3600, proposal_id: 1, dh_group: 2, encryption: aes256, hash: sha1} + esp_group: {name: ESP-HUB, lifetime: 1800, mode: transport, pfs: disable, proposal_id: 1, encryption: aes256, hash: sha1} + profile: + name: NHRPVPN + # the page's PSK is the word "secret"; Ansible would also mask that word inside + # "pre-shared-secret", so another example value keeps the golden file readable + psk: dmvpn-example-psk + bind_tunnels: "{{ gre_tunnel_interfaces | map(attribute='name') | list }}" +dmvpn_drop_unprotected_gre: {rule: 10} +ospf_passive_interface_default: true diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt new file mode 100644 index 0000000..42b6436 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt @@ -0,0 +1,32 @@ +set policy prefix-list BGPOUT +set policy prefix-list BGPOUT description 'BGP Export List' +set policy prefix-list BGPOUT rule 10 +set policy prefix-list BGPOUT rule 10 action 'deny' +set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' +set policy prefix-list BGPOUT rule 10 ge '25' +set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' +set policy prefix-list BGPOUT rule 100 +set policy prefix-list BGPOUT rule 100 action 'permit' +set policy prefix-list BGPOUT rule 100 description 'Our network' +set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' +set policy prefix-list BGPOUT rule 10000 +set policy prefix-list BGPOUT rule 10000 action 'deny' +set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' +set policy route-map BGPOUT description 'BGP Export Filter' +set policy route-map BGPOUT rule 10 action permit +set policy route-map BGPOUT rule 10 match ip address prefix-list BGPOUT +set policy route-map BGPOUT rule 10000 action deny +set policy route-map BGPPREPENDOUT description 'BGP Export Filter' +set policy route-map BGPPREPENDOUT rule 10 action permit +set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list BGPOUT +set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' +set policy route-map BGPPREPENDOUT rule 10000 action deny +set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 +set protocols bgp address-family ipv4-unicast redistribute connected metric 50 +set protocols bgp address-family ipv4-unicast redistribute ospf metric 50 +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export BGPOUT +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 192.0.2.11 remote-as 65550 +set protocols bgp neighbor 192.0.2.11 update-source 192.0.2.21 +set protocols bgp parameters router-id 192.0.2.21 +set protocols bgp system-as 65551 diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt new file mode 100644 index 0000000..18e736f --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt @@ -0,0 +1,32 @@ +set policy prefix-list BGPOUT +set policy prefix-list BGPOUT description 'BGP Export List' +set policy prefix-list BGPOUT rule 10 +set policy prefix-list BGPOUT rule 10 action 'deny' +set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' +set policy prefix-list BGPOUT rule 10 ge '25' +set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' +set policy prefix-list BGPOUT rule 100 +set policy prefix-list BGPOUT rule 100 action 'permit' +set policy prefix-list BGPOUT rule 100 description 'Our network' +set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' +set policy prefix-list BGPOUT rule 10000 +set policy prefix-list BGPOUT rule 10000 action 'deny' +set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' +set policy route-map BGPOUT description 'BGP Export Filter' +set policy route-map BGPOUT rule 10 action permit +set policy route-map BGPOUT rule 10 match ip address prefix-list BGPOUT +set policy route-map BGPOUT rule 10000 action deny +set policy route-map BGPPREPENDOUT description 'BGP Export Filter' +set policy route-map BGPPREPENDOUT rule 10 action permit +set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list BGPOUT +set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' +set policy route-map BGPPREPENDOUT rule 10000 action deny +set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 +set protocols bgp address-family ipv4-unicast redistribute connected metric 50 +set protocols bgp address-family ipv4-unicast redistribute ospf metric 50 +set protocols bgp neighbor 192.0.2.12 address-family ipv4-unicast route-map export BGPPREPENDOUT +set protocols bgp neighbor 192.0.2.12 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 192.0.2.12 remote-as 65550 +set protocols bgp neighbor 192.0.2.12 update-source 192.0.2.22 +set protocols bgp parameters router-id 192.0.2.22 +set protocols bgp system-as 65551 diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml new file mode 100644 index 0000000..6f01355 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml @@ -0,0 +1,22 @@ +--- +# router2: the page says "identical, but use BGPPREPENDOUT". Following the +# page's Example Network (upstream 192.0.2.11/.12, ours .21/.22), router2 peers +# with 192.0.2.12 from 192.0.2.22. +all: + hosts: + router1: + ansible_host: 192.0.2.1 + bgp_router_id: 192.0.2.21 + bgp_neighbors: + - {address: 192.0.2.11, remote_as: 65550, update_source: 192.0.2.21, soft_reconfiguration_inbound: true, route_map_export: BGPOUT} + router2: + ansible_host: 192.0.2.2 + bgp_router_id: 192.0.2.22 + bgp_neighbors: + - {address: 192.0.2.12, remote_as: 65550, update_source: 192.0.2.22, soft_reconfiguration_inbound: true, route_map_export: BGPPREPENDOUT} + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/roles b/tests/render/cases/blueprints/ha_walkthrough_bgp/roles new file mode 100644 index 0000000..a7d2cfd --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/roles @@ -0,0 +1 @@ +route_policy,bgp diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml b/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml new file mode 100644 index 0000000..afda43c --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml @@ -0,0 +1,26 @@ +--- +# docs.vyos.io/en/1.5/configexamples/ha.html - "BGP" (part 3). Policies and +# AS are shared; router1 exports with BGPOUT, router2 with BGPPREPENDOUT. +route_policy_prefix_lists: + - name: BGPOUT + description: BGP Export List + rules: + - {sequence: 10, action: deny, description: Do not advertise short masks, ge: 25, prefix: 0.0.0.0/0} + - {sequence: 100, action: permit, description: Our network, prefix: 203.0.113.0/24} + - {sequence: 10000, action: deny, prefix: 0.0.0.0/0} +route_policy_route_maps: + - name: BGPOUT + description: BGP Export Filter + rules: + - {sequence: 10, action: permit, match_prefix_list: BGPOUT} + - {sequence: 10000, action: deny} + - name: BGPPREPENDOUT + description: BGP Export Filter + rules: + - {sequence: 10, action: permit, set_as_path_prepend: "65551 65551 65551", match_prefix_list: BGPOUT} + - {sequence: 10000, action: deny} +bgp_asn: 65551 +bgp_networks: [192.0.2.0/24] +bgp_redistribute: + - {type: connected, metric: 50} + - {type: ospf, metric: 50} diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt new file mode 100644 index 0000000..45b0cc8 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt @@ -0,0 +1,34 @@ +delete system conntrack modules +set high-availability vrrp group int address 10.200.201.1/24 +set high-availability vrrp group int hello-source-address 10.200.201.2 +set high-availability vrrp group int interface eth0.201 +set high-availability vrrp group int no-preempt +set high-availability vrrp group int peer-address 10.200.201.3 +set high-availability vrrp group int priority 200 +set high-availability vrrp group int vrid 201 +set high-availability vrrp group public address 203.0.113.1/24 +set high-availability vrrp group public hello-source-address 203.0.113.2 +set high-availability vrrp group public interface eth0.100 +set high-availability vrrp group public no-preempt +set high-availability vrrp group public peer-address 203.0.113.3 +set high-availability vrrp group public priority 200 +set high-availability vrrp group public vrid 113 +set high-availability vrrp sync-group sync member int +set interfaces ethernet eth0 vif 100 address '203.0.113.2/24' +set interfaces ethernet eth0 vif 201 address '10.200.201.2/24' +set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' +set nat source rule 10 destination address !192.0.2.0/24 +set nat source rule 10 outbound-interface name eth0.50 +set nat source rule 10 source address 10.200.201.0/24 +set nat source rule 10 translation address 203.0.113.1 +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '192.0.2.11' +set service conntrack-sync accept-protocol 'icmp' +set service conntrack-sync accept-protocol 'tcp' +set service conntrack-sync accept-protocol 'udp' +set service conntrack-sync event-listen-queue-size '8' +set service conntrack-sync failover-mechanism vrrp sync-group 'sync' +set service conntrack-sync interface eth0.201 +set service conntrack-sync mcast-group '224.0.0.50' +set service conntrack-sync sync-queue-size '8' +set system host-name router1 diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt new file mode 100644 index 0000000..79a820b --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt @@ -0,0 +1,39 @@ +delete system conntrack modules +set high-availability vrrp group int address 10.200.201.1/24 +set high-availability vrrp group int hello-source-address 10.200.201.3 +set high-availability vrrp group int interface bond0.201 +set high-availability vrrp group int no-preempt +set high-availability vrrp group int peer-address 10.200.201.2 +set high-availability vrrp group int priority 100 +set high-availability vrrp group int vrid 201 +set high-availability vrrp group public address 203.0.113.1/24 +set high-availability vrrp group public hello-source-address 203.0.113.3 +set high-availability vrrp group public interface bond0.100 +set high-availability vrrp group public no-preempt +set high-availability vrrp group public peer-address 203.0.113.2 +set high-availability vrrp group public priority 100 +set high-availability vrrp group public vrid 113 +set high-availability vrrp sync-group sync member int +set interfaces bonding bond0 description 'Switch Port-Channel' +set interfaces bonding bond0 hash-policy 'layer2' +set interfaces bonding bond0 member interface 'eth0' +set interfaces bonding bond0 member interface 'eth1' +set interfaces bonding bond0 mode '802.3ad' +set interfaces bonding bond0 vif 100 address '203.0.113.3/24' +set interfaces bonding bond0 vif 201 address '10.200.201.3/24' +set interfaces bonding bond0 vif 50 address '192.0.2.22/24' +set nat source rule 10 destination address !192.0.2.0/24 +set nat source rule 10 outbound-interface name bond0.50 +set nat source rule 10 source address 10.200.201.0/24 +set nat source rule 10 translation address 203.0.113.1 +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '192.0.2.11' +set service conntrack-sync accept-protocol 'icmp' +set service conntrack-sync accept-protocol 'tcp' +set service conntrack-sync accept-protocol 'udp' +set service conntrack-sync event-listen-queue-size '8' +set service conntrack-sync failover-mechanism vrrp sync-group 'sync' +set service conntrack-sync interface bond0.201 +set service conntrack-sync mcast-group '224.0.0.50' +set service conntrack-sync sync-queue-size '8' +set system host-name router2 diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml new file mode 100644 index 0000000..28e997d --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml @@ -0,0 +1,113 @@ +--- +all: + children: + routers: + hosts: + router1: + ansible_host: 192.0.2.1 + base_interfaces: + - name: eth0.50 + addresses: + - 192.0.2.21/24 + - name: eth0.100 + addresses: + - 203.0.113.2/24 + - name: eth0.201 + addresses: + - 10.200.201.2/24 + ha_vrrp_priority: 200 + ha_vrrp_groups: + - name: int + vrid: 201 + interface: eth0.201 + address: + - 10.200.201.1/24 + - name: public + vrid: 113 + interface: eth0.100 + address: + - 203.0.113.1/24 + ha_vrrp_local_addresses: + int: 10.200.201.2 + public: 203.0.113.2 + ha_vrrp_conntrack_sync: + interface: eth0.201 + accept_protocols: + - tcp + - udp + - icmp + event_listen_queue_size: 8 + mcast_group: 224.0.0.50 + sync_queue_size: 8 + disable_helpers: true + nat_source_rules: + - id: 10 + outbound_interface: + name: eth0.50 + source: + address: 10.200.201.0/24 + destination: + address: '!192.0.2.0/24' + translation: + address: 203.0.113.1 + router2: + ansible_host: 192.0.2.2 + base_interfaces: + - name: bond0.50 + addresses: + - 192.0.2.22/24 + - name: bond0.100 + addresses: + - 203.0.113.3/24 + - name: bond0.201 + addresses: + - 10.200.201.3/24 + ha_vrrp_priority: 100 + ha_vrrp_groups: + - name: int + vrid: 201 + interface: bond0.201 + address: + - 10.200.201.1/24 + - name: public + vrid: 113 + interface: bond0.100 + address: + - 203.0.113.1/24 + ha_vrrp_local_addresses: + int: 10.200.201.3 + public: 203.0.113.3 + ha_vrrp_conntrack_sync: + interface: bond0.201 + accept_protocols: + - tcp + - udp + - icmp + event_listen_queue_size: 8 + mcast_group: 224.0.0.50 + sync_queue_size: 8 + disable_helpers: true + nat_source_rules: + - id: 10 + outbound_interface: + name: bond0.50 + source: + address: 10.200.201.0/24 + destination: + address: '!192.0.2.0/24' + translation: + address: 203.0.113.1 + bonding_interfaces: + - name: bond0 + description: Switch Port-Channel + hash_policy: layer2 + members: + - eth0 + - eth1 + mode: 802.3ad + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles new file mode 100644 index 0000000..2f26d06 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles @@ -0,0 +1 @@ +bonding,base,ha_vrrp,nat diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml new file mode 100644 index 0000000..7e46f82 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml @@ -0,0 +1,9 @@ +--- +# docs.vyos.io/en/1.5/configexamples/ha.html - Basic Setup, VRRP, NAT and +# conntrack-sync (part 1 of the page). router1 is a VM trunked on eth0, +# router2 hardware with an LACP bond0; the page uses the same commands with +# eth0 replaced by bond0 on router2. +ha_vrrp_pair_group: routers +ha_vrrp_sync_group: {name: sync, members: [int]} +base_static_routes: + - {dest: 0.0.0.0/0, next_hop: 192.0.2.11} diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt new file mode 100644 index 0000000..ad16ff5 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt @@ -0,0 +1,23 @@ +set interfaces wireguard wg01 address '10.254.60.2/30' +set interfaces wireguard wg01 description 'offsite1-to-router1' +set interfaces wireguard wg01 peer ROUTER1 address '192.0.2.21' +set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' +set interfaces wireguard wg01 peer ROUTER1 port '50001' +set interfaces wireguard wg01 peer ROUTER1 public-key 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' +set interfaces wireguard wg01 port '50001' +set protocols ospf area '0.0.0.0' +set protocols ospf area 0.0.0.0 authentication md5 +set protocols ospf area 0.0.0.0 network 10.254.60.0/24 +set protocols ospf auto-cost reference-bandwidth '10000' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key ******** +set protocols ospf interface wg01 cost 11 +set protocols ospf interface wg01 dead-interval 5 +set protocols ospf interface wg01 hello-interval 1 +set protocols ospf interface wg01 network point-to-point +set protocols ospf interface wg01 priority 1 +set protocols ospf interface wg01 retransmit-interval 5 +set protocols ospf interface wg01 transmit-delay 1 +set protocols ospf log-adjacency-changes +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.254.60.2' diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt new file mode 100644 index 0000000..127fc7c --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt @@ -0,0 +1,49 @@ +set interfaces wireguard wg01 address '10.254.60.1/30' +set interfaces wireguard wg01 description 'router1-to-offsite1' +set interfaces wireguard wg01 peer OFFSITE1 address '203.0.113.3' +set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' +set interfaces wireguard wg01 peer OFFSITE1 port '50001' +set interfaces wireguard wg01 peer OFFSITE1 public-key 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' +set interfaces wireguard wg01 port '50001' +set policy access-list 100 description 'Inbound OSPF Routes from Peers' +set policy access-list 100 rule 10 action 'deny' +set policy access-list 100 rule 10 destination any +set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' +set policy access-list 100 rule 10 source network '10.201.0.0' +set policy access-list 100 rule 100 action 'permit' +set policy access-list 100 rule 100 destination any +set policy access-list 100 rule 100 source any +set policy access-list 150 description 'Outbound OSPF Redistribution' +set policy access-list 150 rule 10 action 'permit' +set policy access-list 150 rule 10 destination any +set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 10 source network '10.200.201.0' +set policy access-list 150 rule 100 action 'deny' +set policy access-list 150 rule 100 destination any +set policy access-list 150 rule 100 source any +set policy access-list 150 rule 20 action 'permit' +set policy access-list 150 rule 20 destination any +set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 20 source network '203.0.113.0' +set policy route-map PUBOSPF rule 100 action deny +set policy route-map PUBOSPF rule 100 match ip address access-list 100 +set policy route-map PUBOSPF rule 500 action permit +set protocols ospf access-list 150 export 'connected' +set protocols ospf area '0.0.0.0' +set protocols ospf area 0.0.0.0 authentication md5 +set protocols ospf area 0.0.0.0 network 10.254.60.0/24 +set protocols ospf auto-cost reference-bandwidth '10000' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key ******** +set protocols ospf interface wg01 cost 11 +set protocols ospf interface wg01 dead-interval 5 +set protocols ospf interface wg01 hello-interval 1 +set protocols ospf interface wg01 network point-to-point +set protocols ospf interface wg01 priority 1 +set protocols ospf interface wg01 retransmit-interval 5 +set protocols ospf interface wg01 transmit-delay 1 +set protocols ospf log-adjacency-changes +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.254.60.1' +set protocols ospf redistribute connected +set system ip protocol ospf route-map 'PUBOSPF' diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml new file mode 100644 index 0000000..503f210 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml @@ -0,0 +1,135 @@ +--- +# docs.vyos.io/en/1.5/configexamples/ha.html - "OSPF Over WireGuard" and +# "Advertise connected routes" (part 2), for router1 and the remote offsite1. +# The page's "Enable OSPF" block shows router-id 10.254.60.2 (offsite1's +# tunnel address); router1 uses 10.254.60.1, since every router needs a unique id. +# The route filters are applied on router1, as the page describes for "our" routers. +all: + hosts: + router1: + ansible_host: 192.0.2.1 + wireguard_interfaces: + - name: wg01 + addresses: + - 10.254.60.1/30 + description: router1-to-offsite1 + port: 50001 + peers: + - name: OFFSITE1 + allowed_ips: + - 0.0.0.0/0 + address: 203.0.113.3 + port: 50001 + persistent_keepalive: 15 + public_key: GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o= + route_policy_access_lists: + - number: 150 + description: Outbound OSPF Redistribution + rules: + - number: 10 + action: permit + destination: + any: true + source: + network: 10.200.201.0 + inverse_mask: 0.0.0.255 + - number: 20 + action: permit + destination: + any: true + source: + network: 203.0.113.0 + inverse_mask: 0.0.0.255 + - number: 100 + action: deny + destination: + any: true + source: + any: true + - number: 100 + description: Inbound OSPF Routes from Peers + rules: + - number: 10 + action: deny + destination: + any: true + source: + network: 10.201.0.0 + inverse_mask: 0.0.255.255 + - number: 100 + action: permit + destination: + any: true + source: + any: true + route_policy_route_maps: + - name: PUBOSPF + rules: + - sequence: 100 + action: deny + match_access_list: '100' + - sequence: 500 + action: permit + ospf_router_id: 10.254.60.1 + ospf_interfaces: + - name: wg01 + md5_key: i360KoCwUGZvPq7e + md5_key_id: 1 + cost: 11 + dead_interval: 5 + hello_interval: 1 + network: point-to-point + priority: 1 + retransmit_interval: 5 + transmit_delay: 1 + ospf_redistribute: + - type: connected + ospf_redistribute_access_lists: + connected: 150 + ospf_import_route_map: PUBOSPF + ospf_areas: &id001 + - id: 0.0.0.0 + authentication: md5 + networks: + - 10.254.60.0/24 + ospf_reference_bandwidth: 10000 + ospf_log_adjacency_changes: true + ospf_abr_type: cisco + offsite1: + ansible_host: 192.0.2.2 + wireguard_interfaces: + - name: wg01 + addresses: + - 10.254.60.2/30 + description: offsite1-to-router1 + port: 50001 + peers: + - name: ROUTER1 + allowed_ips: + - 0.0.0.0/0 + address: 192.0.2.21 + port: 50001 + persistent_keepalive: 15 + public_key: CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q= + ospf_router_id: 10.254.60.2 + ospf_interfaces: + - name: wg01 + md5_key: i360KoCwUGZvPq7e + md5_key_id: 1 + cost: 11 + dead_interval: 5 + hello_interval: 1 + network: point-to-point + priority: 1 + retransmit_interval: 5 + transmit_delay: 1 + ospf_areas: *id001 + ospf_reference_bandwidth: 10000 + ospf_log_adjacency_changes: true + ospf_abr_type: cisco + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles new file mode 100644 index 0000000..95db747 --- /dev/null +++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles @@ -0,0 +1 @@ +wireguard,route_policy,ospf diff --git a/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt b/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt new file mode 100644 index 0000000..c77a6cc --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt @@ -0,0 +1,82 @@ +delete vrf bind-to-all +set interfaces ethernet eth0 address '10.1.1.1/30' +set interfaces ethernet eth0 address '2001:db8::/127' +set interfaces ethernet eth0 vrf 'LAN1' +set interfaces ethernet eth1 address '172.16.2.1/30' +set interfaces ethernet eth1 address '2001:db8::2/127' +set interfaces ethernet eth1 vrf 'LAN2' +set interfaces ethernet eth2 address '192.168.3.1/30' +set interfaces ethernet eth2 address '2001:db8::4/127' +set interfaces ethernet eth2 vrf 'Management' +set interfaces ethernet eth3 address '10.2.2.1/30' +set interfaces ethernet eth3 address '2001:db8::6/127' +set interfaces ethernet eth3 vrf 'Internet' +set protocols bgp system-as 64496 +set system host-name r1 +set vrf name Internet protocols bgp address-family ipv4-unicast export vpn +set vrf name Internet protocols bgp address-family ipv4-unicast import vpn +set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp address-family ipv6-unicast export vpn +set vrf name Internet protocols bgp address-family ipv6-unicast import vpn +set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast +set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as 64497 +set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast +set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as 64497 +set vrf name Internet protocols bgp system-as 64496 +set vrf name Internet table 104 +set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols static route 10.0.0.0/24 +set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop '10.1.1.2' +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop '2001:db8::1' +set vrf name LAN1 table 101 +set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols static route 172.16.0.0/24 +set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop '172.16.2.2' +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop '2001:db8::3' +set vrf name LAN2 table 102 +set vrf name Management protocols bgp address-family ipv4-unicast export vpn +set vrf name Management protocols bgp address-family ipv4-unicast import vpn +set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast redistribute static +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols bgp address-family ipv6-unicast export vpn +set vrf name Management protocols bgp address-family ipv6-unicast import vpn +set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast redistribute static +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols static route 192.168.0.0/24 +set vrf name Management protocols static route 192.168.0.0/24 next-hop '192.168.3.2' +set vrf name Management protocols static route6 2001:db8:0:3::/64 +set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop '2001:db8::5' +set vrf name Management table 103 diff --git a/tests/render/cases/blueprints/inter_vrf_core/roles b/tests/render/cases/blueprints/inter_vrf_core/roles new file mode 100644 index 0000000..83026c0 --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core/roles @@ -0,0 +1 @@ +base,vrf_lite diff --git a/tests/render/cases/blueprints/inter_vrf_core/vars.yml b/tests/render/cases/blueprints/inter_vrf_core/vars.yml new file mode 100644 index 0000000..71a83d9 --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core/vars.yml @@ -0,0 +1,52 @@ +--- +# docs.vyos.io/en/1.5/configexamples/inter-vrf-routing-vrf-lite.html - Core router, Appendix-A +base_interfaces: + - name: eth0 + addresses: [10.1.1.1/30, '2001:db8::/127'] + - name: eth1 + addresses: [172.16.2.1/30, '2001:db8::2/127'] + - name: eth2 + addresses: [192.168.3.1/30, '2001:db8::4/127'] + - name: eth3 + addresses: [10.2.2.1/30, '2001:db8::6/127'] +vrf_lite_asn: 64496 +vrf_lite_vrfs: + - name: Internet + table: 104 + interfaces: [eth3] + rd: 64496:100 + route_targets_export: ['64496:100'] + route_targets_import: ['64496:1', '64496:2'] + neighbors: + - {address: 10.2.2.2, remote_as: 64497} + - {address: '2001:db8::7', remote_as: 64497} + - name: LAN1 + table: 101 + interfaces: [eth0] + routes: + - {dest: 10.0.0.0/24, next_hop: 10.1.1.2} + - {dest: '2001:db8:0:1::/64', next_hop: '2001:db8::1'} + rd: '64496:1' + route_targets_export: ['64496:1'] + route_targets_import: ['64496:100', '64496:50', '64496:2'] + redistribute: [static] + - name: LAN2 + table: 102 + interfaces: [eth1] + routes: + - {dest: 172.16.0.0/24, next_hop: 172.16.2.2} + - {dest: '2001:db8:0:2::/64', next_hop: '2001:db8::3'} + rd: '64496:2' + route_targets_export: ['64496:2'] + route_targets_import: ['64496:100', '64496:50', '64496:1'] + redistribute: [static] + - name: Management + table: 103 + interfaces: [eth2] + routes: + - {dest: 192.168.0.0/24, next_hop: 192.168.3.2} + - {dest: '2001:db8:0:3::/64', next_hop: '2001:db8::5'} + rd: '64496:50' + route_targets_export: ['64496:50'] + route_targets_import: ['64496:1', '64496:2'] + redistribute: [static] diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt b/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt new file mode 100644 index 0000000..8c00913 --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt @@ -0,0 +1,115 @@ +delete vrf bind-to-all +set interfaces ethernet eth0 address '10.1.1.1/30' +set interfaces ethernet eth0 address '2001:db8::/127' +set interfaces ethernet eth0 vrf 'LAN1' +set interfaces ethernet eth1 address '172.16.2.1/30' +set interfaces ethernet eth1 address '2001:db8::2/127' +set interfaces ethernet eth1 vrf 'LAN2' +set interfaces ethernet eth2 address '192.168.3.1/30' +set interfaces ethernet eth2 address '2001:db8::4/127' +set interfaces ethernet eth2 vrf 'Management' +set interfaces ethernet eth3 address '10.2.2.1/30' +set interfaces ethernet eth3 address '2001:db8::6/127' +set interfaces ethernet eth3 vrf 'Internet' +set policy prefix-list LAN2-Internet +set policy prefix-list LAN2-Internet rule 1 +set policy prefix-list LAN2-Internet rule 1 action 'permit' +set policy prefix-list LAN2-Internet rule 1 le '24' +set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' +set policy prefix-list LAN2-Internet rule 2 +set policy prefix-list LAN2-Internet rule 2 action 'permit' +set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' +set policy prefix-list LAN2-Internet rule 3 +set policy prefix-list LAN2-Internet rule 3 action 'permit' +set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' +set policy prefix-list LAN2-Internet rule 4 +set policy prefix-list LAN2-Internet rule 4 action 'permit' +set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' +set policy prefix-list6 LAN2-Internet-v6 +set policy prefix-list6 LAN2-Internet-v6 rule 1 +set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 2 +set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 3 +set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' +set policy prefix-list6 LAN2-Internet-v6 rule 4 +set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +set policy route-map LAN2-Internet rule 1 action permit +set policy route-map LAN2-Internet rule 1 match ip address prefix-list LAN2-Internet +set policy route-map LAN2-Internet-v6 rule 1 action permit +set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list LAN2-Internet-v6 +set protocols bgp system-as 64496 +set system host-name r1 +set vrf name Internet protocols bgp address-family ipv4-unicast export vpn +set vrf name Internet protocols bgp address-family ipv4-unicast import vpn +set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp address-family ipv6-unicast export vpn +set vrf name Internet protocols bgp address-family ipv6-unicast import vpn +set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast +set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as 64497 +set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast +set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as 64497 +set vrf name Internet protocols bgp system-as 64496 +set vrf name Internet table 104 +set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols static route 10.0.0.0/24 +set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop '10.1.1.2' +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop '2001:db8::1' +set vrf name LAN1 table 101 +set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols static route 172.16.0.0/24 +set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop '172.16.2.2' +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop '2001:db8::3' +set vrf name LAN2 table 102 +set vrf name Management protocols bgp address-family ipv4-unicast export vpn +set vrf name Management protocols bgp address-family ipv4-unicast import vpn +set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast redistribute static +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols bgp address-family ipv6-unicast export vpn +set vrf name Management protocols bgp address-family ipv6-unicast import vpn +set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast redistribute static +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols static route 192.168.0.0/24 +set vrf name Management protocols static route 192.168.0.0/24 next-hop '192.168.3.2' +set vrf name Management protocols static route6 2001:db8:0:3::/64 +set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop '2001:db8::5' +set vrf name Management table 103 diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/roles b/tests/render/cases/blueprints/inter_vrf_core_filtering/roles new file mode 100644 index 0000000..e7486ab --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/roles @@ -0,0 +1 @@ +base,route_policy,vrf_lite diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml b/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml new file mode 100644 index 0000000..dc3b396 --- /dev/null +++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml @@ -0,0 +1,74 @@ +--- +# docs.vyos.io/en/1.5/configexamples/inter-vrf-routing-vrf-lite.html - Core router, Appendix-A plus Appendix-B route filtering +base_interfaces: + - name: eth0 + addresses: [10.1.1.1/30, '2001:db8::/127'] + - name: eth1 + addresses: [172.16.2.1/30, '2001:db8::2/127'] + - name: eth2 + addresses: [192.168.3.1/30, '2001:db8::4/127'] + - name: eth3 + addresses: [10.2.2.1/30, '2001:db8::6/127'] +vrf_lite_asn: 64496 +vrf_lite_vrfs: + - name: Internet + table: 104 + interfaces: [eth3] + rd: 64496:100 + route_targets_export: ['64496:100'] + route_targets_import: ['64496:1', '64496:2'] + neighbors: + - {address: 10.2.2.2, remote_as: 64497} + - {address: '2001:db8::7', remote_as: 64497} + - name: LAN1 + table: 101 + interfaces: [eth0] + routes: + - {dest: 10.0.0.0/24, next_hop: 10.1.1.2} + - {dest: '2001:db8:0:1::/64', next_hop: '2001:db8::1'} + rd: '64496:1' + route_targets_export: ['64496:1'] + route_targets_import: ['64496:100', '64496:50', '64496:2'] + redistribute: [static] + - name: LAN2 + table: 102 + interfaces: [eth1] + routes: + - {dest: 172.16.0.0/24, next_hop: 172.16.2.2} + - {dest: '2001:db8:0:2::/64', next_hop: '2001:db8::3'} + rd: '64496:2' + route_targets_export: ['64496:2'] + route_targets_import: ['64496:100', '64496:50', '64496:1'] + redistribute: [static] + import_route_map: {ipv4: LAN2-Internet, ipv6: LAN2-Internet-v6} + - name: Management + table: 103 + interfaces: [eth2] + routes: + - {dest: 192.168.0.0/24, next_hop: 192.168.3.2} + - {dest: '2001:db8:0:3::/64', next_hop: '2001:db8::5'} + rd: '64496:50' + route_targets_export: ['64496:50'] + route_targets_import: ['64496:1', '64496:2'] + redistribute: [static] +route_policy_prefix_lists: + - name: LAN2-Internet + rules: + - {sequence: 1, action: permit, le: 24, prefix: 198.51.0.0/16} + - {sequence: 2, action: permit, prefix: 192.0.2.0/24} + - {sequence: 3, action: permit, prefix: 192.168.0.0/24} + - {sequence: 4, action: permit, prefix: 10.0.0.0/24} + - name: LAN2-Internet-v6 + afi: ipv6 + rules: + - {sequence: 1, action: permit, prefix: '2001:db8:1::/48'} + - {sequence: 2, action: permit, prefix: '2001:db8:2::/48'} + - {sequence: 3, action: permit, prefix: '2001:db8:0:3::/64'} + - {sequence: 4, action: permit, prefix: '2001:db8:0:1::/64'} +route_policy_route_maps: + - name: LAN2-Internet + rules: + - {sequence: 1, action: permit, match_prefix_list: LAN2-Internet} + - name: LAN2-Internet-v6 + rules: + - {sequence: 1, action: permit, match_prefix_list6: LAN2-Internet-v6} diff --git a/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt b/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt new file mode 100644 index 0000000..ffe017d --- /dev/null +++ b/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt @@ -0,0 +1,17 @@ +set interfaces dummy dum0 address '192.0.2.1/32' +set interfaces ethernet eth1 address '192.0.2.5/30' +set interfaces ethernet eth1 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.21/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth1 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0001.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth3' +set system host-name P1-VyOS diff --git a/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt b/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt new file mode 100644 index 0000000..8eb49d3 --- /dev/null +++ b/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt @@ -0,0 +1,17 @@ +set interfaces dummy dum0 address '192.0.2.2/32' +set interfaces ethernet eth2 address '192.0.2.17/30' +set interfaces ethernet eth2 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.26/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth2 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0002.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set system host-name P2-VyOS diff --git a/tests/render/cases/blueprints/isis_segment_routing/inventory.yml b/tests/render/cases/blueprints/isis_segment_routing/inventory.yml new file mode 100644 index 0000000..8367320 --- /dev/null +++ b/tests/render/cases/blueprints/isis_segment_routing/inventory.yml @@ -0,0 +1,41 @@ +--- +all: + hosts: + P1-VyOS: + ansible_host: 192.0.2.1 + base_hostname: P1-VyOS + base_interfaces: + - {name: dum0, addresses: [192.0.2.1/32]} + - {name: eth1, mtu: 8000, addresses: [192.0.2.5/30]} + - {name: eth3, mtu: 8000, addresses: [192.0.2.21/30]} + isis_net: 49.0000.0000.0000.0001.00 + isis_interfaces: + - {name: dum0, passive: true} + - {name: eth1, network: point-to-point} + - {name: eth3, network: point-to-point} + isis_segment_routing: + maximum_label_depth: 8 + prefixes: [{prefix: 192.0.2.1/32, index: 1}] + isis_mpls_interfaces: [eth1, eth3] + P2-VyOS: + ansible_host: 192.0.2.2 + base_hostname: P2-VyOS + base_interfaces: + - {name: dum0, addresses: [192.0.2.2/32]} + - {name: eth2, mtu: 8000, addresses: [192.0.2.17/30]} + - {name: eth3, mtu: 8000, addresses: [192.0.2.26/30]} + isis_net: 49.0000.0000.0000.0002.00 + isis_interfaces: + - {name: dum0, passive: true} + - {name: eth2, network: point-to-point} + - {name: eth3, network: point-to-point} + isis_segment_routing: + maximum_label_depth: 8 + prefixes: [{prefix: 192.0.2.2/32, index: 2}] + isis_mpls_interfaces: [eth2, eth3] + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/isis_segment_routing/roles b/tests/render/cases/blueprints/isis_segment_routing/roles new file mode 100644 index 0000000..0fe18c3 --- /dev/null +++ b/tests/render/cases/blueprints/isis_segment_routing/roles @@ -0,0 +1 @@ +base,isis diff --git a/tests/render/cases/blueprints/isis_segment_routing/vars.yml b/tests/render/cases/blueprints/isis_segment_routing/vars.yml new file mode 100644 index 0000000..2913e17 --- /dev/null +++ b/tests/render/cases/blueprints/isis_segment_routing/vars.yml @@ -0,0 +1,6 @@ +--- +# docs.vyos.io/en/1.5/configexamples/segment-routing-isis.html - shared by +# VyOS-P1 and VyOS-P2 (XRv-P3 is the Cisco side of the page) +isis_level: level-2 +isis_log_adjacency_changes: true +isis_metric_style: wide diff --git a/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt b/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt new file mode 100644 index 0000000..5aedf43 --- /dev/null +++ b/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt @@ -0,0 +1,16 @@ +set interfaces ethernet eth0 address '192.168.139.100/24' +set nat source rule 100 outbound-interface name eth0 +set nat source rule 100 source address 10.0.0.0/24 +set nat source rule 100 translation address masquerade +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '192.168.139.2' +set system host-name vyos +set vpn l2tp remote-access authentication mode 'radius' +set vpn l2tp remote-access authentication radius server 192.168.139.110 key '********' +set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' +set vpn l2tp remote-access default-pool 'TEST-POOL' +set vpn l2tp remote-access gateway-address '10.0.0.1' +set vpn l2tp remote-access lns host-name 'LAC' +set vpn l2tp remote-access lns shared-secret '********' +set vpn l2tp remote-access name-server '8.8.8.8' +set vpn l2tp remote-access ppp-options disable-ccp diff --git a/tests/render/cases/blueprints/l2tp_lns/roles b/tests/render/cases/blueprints/l2tp_lns/roles new file mode 100644 index 0000000..2f7f1f2 --- /dev/null +++ b/tests/render/cases/blueprints/l2tp_lns/roles @@ -0,0 +1 @@ +base,nat,l2tp_lns diff --git a/tests/render/cases/blueprints/l2tp_lns/vars.yml b/tests/render/cases/blueprints/l2tp_lns/vars.yml new file mode 100644 index 0000000..fcc984d --- /dev/null +++ b/tests/render/cases/blueprints/l2tp_lns/vars.yml @@ -0,0 +1,23 @@ +--- +# docs.vyos.io/en/1.5/configexamples/lac-lns.html - the VyOS LNS (the LAC is +# the Cisco router on the page) +base_hostname: vyos +base_interfaces: + - {name: eth0, addresses: [192.168.139.100/24]} +base_static_routes: + - {dest: 0.0.0.0/0, next_hop: 192.168.139.2} +nat_source_rules: + - {id: 100, outbound_interface: {name: eth0}, source: {address: 10.0.0.0/24}, translation: {address: masquerade}} +l2tp_lns_authentication: + mode: radius + radius_servers: + - {address: 192.168.139.110, key: radiustest} +l2tp_lns_pools: + - {name: TEST-POOL, range: 10.0.0.2-10.0.0.100} +l2tp_lns_default_pool: TEST-POOL +l2tp_lns_gateway_address: 10.0.0.1 +l2tp_lns_lac_host_name: LAC +l2tp_lns_shared_secret: test123 +l2tp_lns_name_servers: [8.8.8.8] +l2tp_lns_ppp_options: + disable_ccp: true diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt new file mode 100644 index 0000000..327aeef --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt @@ -0,0 +1,11 @@ +set interfaces dummy dum20 address '10.0.0.100/32' +set interfaces ethernet eth0 address '10.80.80.2/24' +set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp neighbor 10.80.80.1 ebgp-multihop 2 +set protocols bgp neighbor 10.80.80.1 remote-as 65001 +set protocols bgp neighbor 10.80.80.1 update-source eth0 +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.80.80.2 +set protocols bgp system-as 65035 +set system host-name VyOS-CE1-HUB diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt new file mode 100644 index 0000000..9d1ccf8 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt @@ -0,0 +1,10 @@ +set interfaces dummy dum20 address '10.0.0.80/32' +set interfaces ethernet eth0 address '10.50.50.2/24' +set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 +set protocols bgp neighbor 10.50.50.1 ebgp-multihop 2 +set protocols bgp neighbor 10.50.50.1 remote-as 65001 +set protocols bgp neighbor 10.50.50.1 update-source eth0 +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.50.50.2 +set protocols bgp system-as 65035 +set system host-name VyOS-CE1-SPOKE diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt new file mode 100644 index 0000000..02c87d4 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt @@ -0,0 +1,10 @@ +set interfaces dummy dum20 address '10.0.0.90/32' +set interfaces ethernet eth0 address '10.60.60.2/24' +set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 +set protocols bgp neighbor 10.60.60.1 ebgp-multihop 2 +set protocols bgp neighbor 10.60.60.1 remote-as 65001 +set protocols bgp neighbor 10.60.60.1 update-source eth0 +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.60.60.2 +set protocols bgp system-as 65035 +set system host-name VyOS-CE2-SPOKE diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt new file mode 100644 index 0000000..aaec548 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt @@ -0,0 +1,23 @@ +set interfaces dummy dum10 address '10.0.0.3/32' +set interfaces ethernet eth0 address '172.16.30.1/24' +set interfaces ethernet eth1 address '172.16.40.1/24' +set interfaces ethernet eth2 address '172.16.90.1/24' +set interfaces ethernet eth3 address '172.16.10.1/24' +set interfaces ethernet eth5 address '172.16.100.1/24' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth5' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.3' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.3' +set system host-name VyOS-P1 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt new file mode 100644 index 0000000..e2cf3cb --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt @@ -0,0 +1,20 @@ +set interfaces dummy dum10 address '10.0.0.4/32' +set interfaces ethernet eth0 address '172.16.30.2/24' +set interfaces ethernet eth1 address '172.16.20.1/24' +set interfaces ethernet eth2 address '172.16.120.1/24' +set interfaces ethernet eth3 address '172.16.60.1/24' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.4' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.4' +set system host-name VyOS-P2 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt new file mode 100644 index 0000000..7b4001d --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt @@ -0,0 +1,20 @@ +set interfaces dummy dum10 address '10.0.0.5/32' +set interfaces ethernet eth0 address '172.16.110.1/24' +set interfaces ethernet eth1 address '172.16.40.2/24' +set interfaces ethernet eth2 address '172.16.50.1/24' +set interfaces ethernet eth3 address '172.16.70.1/24' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.5' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.5' +set system host-name VyOS-P3 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt new file mode 100644 index 0000000..096e395 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt @@ -0,0 +1,23 @@ +set interfaces dummy dum10 address '10.0.0.6/32' +set interfaces ethernet eth0 address '172.16.80.2/24' +set interfaces ethernet eth1 address '172.16.130.1/24' +set interfaces ethernet eth2 address '172.16.50.2/24' +set interfaces ethernet eth3 address '172.16.60.2/24' +set interfaces ethernet eth5 address '172.16.140.1/24' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth5' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.6' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.6' +set system host-name VyOS-P4 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt new file mode 100644 index 0000000..49f81fb --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt @@ -0,0 +1,36 @@ +delete vrf bind-to-all +set interfaces dummy dum10 address '10.0.0.7/32' +set interfaces ethernet eth0 address '172.16.90.2/24' +set interfaces ethernet eth3 address '10.50.50.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.0.0.7 +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +set protocols bgp system-as 65001 +set protocols bgp system-as 65001 +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.7' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.7' +set system host-name VyOS-PE1 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as 65035 +set vrf name BLUE_SPOKE protocols bgp system-as 65001 +set vrf name BLUE_SPOKE table 200 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt new file mode 100644 index 0000000..529108b --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt @@ -0,0 +1,40 @@ +delete vrf bind-to-all +set interfaces dummy dum10 address '10.0.0.8/32' +set interfaces ethernet eth0 address '172.16.110.2/24' +set interfaces ethernet eth1 address '172.16.100.2/24' +set interfaces ethernet eth2 address '172.16.80.1/24' +set interfaces ethernet eth3 address '10.80.80.1/24' +set interfaces ethernet eth3 vrf 'BLUE_HUB' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.0.0.8 +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +set protocols bgp system-as 65001 +set protocols bgp system-as 65001 +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp router-id '10.0.0.8' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.8' +set system host-name VyOS-PE2 +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as 65035 +set vrf name BLUE_HUB protocols bgp system-as 65001 +set vrf name BLUE_HUB table 400 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt new file mode 100644 index 0000000..0ff62b4 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt @@ -0,0 +1,36 @@ +delete vrf bind-to-all +set interfaces dummy dum10 address '10.0.0.10/32' +set interfaces ethernet eth0 address '172.16.140.2/24' +set interfaces ethernet eth3 address '10.60.60.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.0.0.10 +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +set protocols bgp system-as 65001 +set protocols bgp system-as 65001 +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.10' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.10' +set system host-name VyOS-PE3 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as 65035 +set vrf name BLUE_SPOKE protocols bgp system-as 65001 +set vrf name BLUE_SPOKE table 200 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt new file mode 100644 index 0000000..20336f8 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt @@ -0,0 +1,26 @@ +set interfaces dummy dum10 address '10.0.0.1/32' +set interfaces ethernet eth1 address '172.16.20.2/24' +set interfaces ethernet eth2 address '172.16.10.2/24' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id 10.0.0.1 +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.0.0.1 +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +set protocols bgp system-as 65001 +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp router-id '10.0.0.1' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.1' +set system host-name VyOS-RR1 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt new file mode 100644 index 0000000..ad065f7 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt @@ -0,0 +1,26 @@ +set interfaces dummy dum10 address '10.0.0.2/32' +set interfaces ethernet eth0 address '172.16.80.1/24' +set interfaces ethernet eth1 address '172.16.70.2/24' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id 10.0.0.1 +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id 10.0.0.2 +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +set protocols bgp system-as 65001 +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp router-id '10.0.0.2' +set protocols ospf area '0' +set protocols ospf area 0 network 0.0.0.0/0 +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.2' +set system host-name VyOS-RR2 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml new file mode 100644 index 0000000..e1c1157 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml @@ -0,0 +1,442 @@ +--- +# docs.vyos.io/en/1.5/configexamples/l3vpn-hub-and-spoke.html - all twelve +# routers (steps 1-4). The page's configs carry no host-name; base sets one per +# inventory name. +all: + hosts: + VyOS-P1: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.3/32 + - name: eth0 + addresses: + - 172.16.30.1/24 + - name: eth1 + addresses: + - 172.16.40.1/24 + - name: eth2 + addresses: + - 172.16.90.1/24 + - name: eth3 + addresses: + - 172.16.10.1/24 + - name: eth5 + addresses: + - 172.16.100.1/24 + ospf_router_id: 10.0.0.3 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.3 + mpls_ldp_interfaces: + - eth0 + - eth1 + - eth2 + - eth3 + - eth5 + ansible_host: 192.0.2.1 + base_hostname: VyOS-P1 + VyOS-P2: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.4/32 + - name: eth0 + addresses: + - 172.16.30.2/24 + - name: eth1 + addresses: + - 172.16.20.1/24 + - name: eth2 + addresses: + - 172.16.120.1/24 + - name: eth3 + addresses: + - 172.16.60.1/24 + ospf_router_id: 10.0.0.4 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.4 + mpls_ldp_interfaces: + - eth0 + - eth1 + - eth2 + - eth3 + ansible_host: 192.0.2.2 + base_hostname: VyOS-P2 + VyOS-P3: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.5/32 + - name: eth0 + addresses: + - 172.16.110.1/24 + - name: eth1 + addresses: + - 172.16.40.2/24 + - name: eth2 + addresses: + - 172.16.50.1/24 + - name: eth3 + addresses: + - 172.16.70.1/24 + ospf_router_id: 10.0.0.5 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.5 + mpls_ldp_interfaces: + - eth0 + - eth1 + - eth2 + - eth3 + ansible_host: 192.0.2.3 + base_hostname: VyOS-P3 + VyOS-P4: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.6/32 + - name: eth0 + addresses: + - 172.16.80.2/24 + - name: eth1 + addresses: + - 172.16.130.1/24 + - name: eth2 + addresses: + - 172.16.50.2/24 + - name: eth3 + addresses: + - 172.16.60.2/24 + - name: eth5 + addresses: + - 172.16.140.1/24 + ospf_router_id: 10.0.0.6 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.6 + mpls_ldp_interfaces: + - eth0 + - eth1 + - eth2 + - eth3 + - eth5 + ansible_host: 192.0.2.4 + base_hostname: VyOS-P4 + VyOS-PE1: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.7/32 + - name: eth0 + addresses: + - 172.16.90.2/24 + - name: eth3 + addresses: + - 10.50.50.1/24 + ospf_router_id: 10.0.0.7 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.7 + mpls_ldp_interfaces: + - eth0 + l3vpn_asn: 65001 + l3vpn_router_id: 10.0.0.7 + l3vpn_peer_group: &id001 + name: RR_VPNv4 + remote_as: 65001 + update_source: dum10 + l3vpn_neighbors: + - address: 10.0.0.1 + nexthop_self: true + - address: 10.0.0.2 + nexthop_self: true + vrf_lite_asn: 65001 + vrf_lite_vrfs: + - name: BLUE_SPOKE + table: 200 + interfaces: + - eth3 + families: + - ipv4 + label_vpn_export: auto + networks: + - 10.50.50.0/24 + rd: 10.50.50.1:1011 + route_targets_export: + - 65035:1011 + route_targets_import: + - 65035:1030 + redistribute: + - connected + neighbors: + - address: 10.50.50.2 + remote_as: 65035 + as_override: true + ansible_host: 192.0.2.5 + base_hostname: VyOS-PE1 + VyOS-PE2: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.8/32 + - name: eth0 + addresses: + - 172.16.110.2/24 + - name: eth1 + addresses: + - 172.16.100.2/24 + - name: eth2 + addresses: + - 172.16.80.1/24 + - name: eth3 + addresses: + - 10.80.80.1/24 + ospf_router_id: 10.0.0.8 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.8 + mpls_ldp_interfaces: + - eth0 + - eth1 + l3vpn_asn: 65001 + l3vpn_router_id: 10.0.0.8 + l3vpn_peer_group: *id001 + l3vpn_neighbors: + - address: 10.0.0.1 + nexthop_self: true + - address: 10.0.0.2 + nexthop_self: true + vrf_lite_asn: 65001 + vrf_lite_vrfs: + - name: BLUE_HUB + table: 400 + interfaces: + - eth3 + families: + - ipv4 + label_vpn_export: auto + networks: + - 10.80.80.0/24 + rd: 10.80.80.1:1011 + route_targets_export: + - 65035:1030 + route_targets_import: + - 65035:1011 + - 65050:2011 + - 65035:1030 + redistribute: + - connected + neighbors: + - address: 10.80.80.2 + remote_as: 65035 + as_override: true + ansible_host: 192.0.2.6 + base_hostname: VyOS-PE2 + VyOS-PE3: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.10/32 + - name: eth0 + addresses: + - 172.16.140.2/24 + - name: eth3 + addresses: + - 10.60.60.1/24 + ospf_router_id: 10.0.0.10 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.10 + mpls_ldp_interfaces: + - eth0 + l3vpn_asn: 65001 + l3vpn_router_id: 10.0.0.10 + l3vpn_peer_group: *id001 + l3vpn_neighbors: + - address: 10.0.0.1 + nexthop_self: true + - address: 10.0.0.2 + nexthop_self: true + vrf_lite_asn: 65001 + vrf_lite_vrfs: + - name: BLUE_SPOKE + table: 200 + interfaces: + - eth3 + families: + - ipv4 + label_vpn_export: auto + networks: + - 10.60.60.0/24 + rd: 10.60.60.1:1011 + route_targets_export: + - 65035:1011 + route_targets_import: + - 65035:1030 + redistribute: + - connected + neighbors: + - address: 10.60.60.2 + remote_as: 65035 + as_override: true + ansible_host: 192.0.2.7 + base_hostname: VyOS-PE3 + VyOS-RR1: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.1/32 + - name: eth1 + addresses: + - 172.16.20.2/24 + - name: eth2 + addresses: + - 172.16.10.2/24 + ospf_router_id: 10.0.0.1 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.1 + mpls_ldp_interfaces: + - eth1 + - eth2 + l3vpn_asn: 65001 + l3vpn_router_id: 10.0.0.1 + l3vpn_cluster_id: 10.0.0.1 + l3vpn_peer_group: *id001 + l3vpn_neighbors: + - address: 10.0.0.7 + route_reflector_client: true + - address: 10.0.0.8 + route_reflector_client: true + - address: 10.0.0.10 + route_reflector_client: true + ansible_host: 192.0.2.8 + base_hostname: VyOS-RR1 + VyOS-RR2: + base_interfaces: + - name: dum10 + addresses: + - 10.0.0.2/32 + - name: eth0 + addresses: + - 172.16.80.1/24 + - name: eth1 + addresses: + - 172.16.70.2/24 + ospf_router_id: 10.0.0.2 + ospf_areas: + - id: '0' + networks: + - 0.0.0.0/0 + ospf_abr_type: cisco + mpls_ldp_router_id: 10.0.0.2 + mpls_ldp_interfaces: + - eth0 + - eth1 + l3vpn_asn: 65001 + l3vpn_router_id: 10.0.0.2 + l3vpn_cluster_id: 10.0.0.1 + l3vpn_peer_group: *id001 + l3vpn_neighbors: + - address: 10.0.0.7 + route_reflector_client: true + - address: 10.0.0.8 + route_reflector_client: true + - address: 10.0.0.10 + route_reflector_client: true + ansible_host: 192.0.2.9 + base_hostname: VyOS-RR2 + VyOS-CE1-SPOKE: + base_interfaces: + - name: dum20 + addresses: + - 10.0.0.80/32 + - name: eth0 + addresses: + - 10.50.50.2/24 + bgp_asn: 65035 + bgp_router_id: 10.50.50.2 + bgp_networks: + - 10.0.0.80/32 + bgp_log_neighbor_changes: true + bgp_neighbors: + - address: 10.50.50.1 + remote_as: 65001 + ebgp_multihop: 2 + update_source: eth0 + ansible_host: 192.0.2.10 + base_hostname: VyOS-CE1-SPOKE + VyOS-CE1-HUB: + base_interfaces: + - name: dum20 + addresses: + - 10.0.0.100/32 + - name: eth0 + addresses: + - 10.80.80.2/24 + bgp_asn: 65035 + bgp_router_id: 10.80.80.2 + bgp_networks: + - 10.0.0.100/32 + bgp_log_neighbor_changes: true + bgp_neighbors: + - address: 10.80.80.1 + remote_as: 65001 + ebgp_multihop: 2 + update_source: eth0 + bgp_redistribute: + - type: connected + ansible_host: 192.0.2.11 + base_hostname: VyOS-CE1-HUB + VyOS-CE2-SPOKE: + base_interfaces: + - name: dum20 + addresses: + - 10.0.0.90/32 + - name: eth0 + addresses: + - 10.60.60.2/24 + bgp_asn: 65035 + bgp_router_id: 10.60.60.2 + bgp_networks: + - 10.0.0.90/32 + bgp_log_neighbor_changes: true + bgp_neighbors: + - address: 10.60.60.1 + remote_as: 65001 + ebgp_multihop: 2 + update_source: eth0 + ansible_host: 192.0.2.12 + base_hostname: VyOS-CE2-SPOKE + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles new file mode 100644 index 0000000..4ccd8a2 --- /dev/null +++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles @@ -0,0 +1 @@ +base,ospf,mpls_ldp,l3vpn,vrf_lite,bgp diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt b/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt new file mode 100644 index 0000000..2ea973f --- /dev/null +++ b/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt @@ -0,0 +1,38 @@ +set firewall ipv6 forward filter rule 10 +set firewall ipv6 forward filter rule 10 action 'jump' +set firewall ipv6 forward filter rule 10 inbound-interface name pppoe0 +set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' +set firewall ipv6 input filter rule 10 +set firewall ipv6 input filter rule 10 action 'jump' +set firewall ipv6 input filter rule 10 inbound-interface name pppoe0 +set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' +set firewall ipv6 name WAN_IN default-action 'drop' +set firewall ipv6 name WAN_IN rule 10 +set firewall ipv6 name WAN_IN rule 10 action 'accept' +set firewall ipv6 name WAN_IN rule 10 state established +set firewall ipv6 name WAN_IN rule 10 state related +set firewall ipv6 name WAN_IN rule 20 +set firewall ipv6 name WAN_IN rule 20 action 'accept' +set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL default-action 'drop' +set firewall ipv6 name WAN_LOCAL rule 10 +set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 10 state established +set firewall ipv6 name WAN_LOCAL rule 10 state related +set firewall ipv6 name WAN_LOCAL rule 20 +set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL rule 30 +set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 30 destination port 546 +set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' +set firewall ipv6 name WAN_LOCAL rule 30 source port 547 +set interfaces pppoe pppoe0 authentication password '********' +set interfaces pppoe pppoe0 authentication username 'example-user' +set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +set interfaces pppoe pppoe0 ipv6 address autoconf +set interfaces pppoe pppoe0 service-name 'example-isp' +set interfaces pppoe pppoe0 source-interface 'eth0' +set service router-advert interface eth1 link-mtu '1492' +set service router-advert interface eth1 name-server '2001:db8::53' +set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/roles b/tests/render/cases/blueprints/pppoe_ipv6_home/roles new file mode 100644 index 0000000..e52bef3 --- /dev/null +++ b/tests/render/cases/blueprints/pppoe_ipv6_home/roles @@ -0,0 +1 @@ +pppoe,router_advert,firewall diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml b/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml new file mode 100644 index 0000000..8b5e06b --- /dev/null +++ b/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml @@ -0,0 +1,40 @@ +--- +# docs.vyos.io/en/1.5/configexamples/pppoe-ipv6-basic.html +# The page's placeholders are filled with example values: , +# , and . +pppoe_interfaces: + - name: pppoe0 + source_interface: eth0 + username: example-user + password: example-password + service_name: example-isp + ipv6_autoconf: true + prefix_delegation: + - id: 0 + interfaces: + - {name: eth1, address: "100"} +router_advert_interfaces: + - name: eth1 + link_mtu: 1492 + name_servers: ["2001:db8::53"] + prefixes: + - {prefix: "::/64", valid_lifetime: 172800} +firewall_ipv6: + names: + WAN_IN: + default_action: drop + rules: + - {number: 10, action: accept, state: {established: true, related: true}} + - {number: 20, action: accept, protocol: icmpv6} + WAN_LOCAL: + default_action: drop + rules: + - {number: 10, action: accept, state: {established: true, related: true}} + - {number: 20, action: accept, protocol: icmpv6} + - {number: 30, action: accept, protocol: udp, source: {port: "547"}, destination: {port: "546"}} + forward: + rules: + - {number: 10, action: jump, jump_target: WAN_IN, inbound_interface: {name: pppoe0}} + input: + rules: + - {number: 10, action: jump, jump_target: WAN_LOCAL, inbound_interface: {name: pppoe0}} diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt new file mode 100644 index 0000000..8373e9a --- /dev/null +++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt @@ -0,0 +1,20 @@ +set interfaces ethernet eth0 address '10.1.1.1/24' +set interfaces ethernet eth1 address '10.2.1.1/24' +set interfaces ethernet eth2 address '10.9.9.1/24' +set protocols static route 172.17.1.0/24 +set protocols static route 172.17.1.0/24 next-hop '10.1.1.100' +set qos interface eth2 egress 'vyos2' +set qos policy shaper vyos2 class 10 bandwidth '100%' +set qos policy shaper vyos2 class 10 burst '15k' +set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' +set qos policy shaper vyos2 class 10 queue-type 'fair-queue' +set qos policy shaper vyos2 class 10 set-dscp 'CS5' +set qos policy shaper vyos2 class 20 bandwidth '5mbit' +set qos policy shaper vyos2 class 20 description 'for VyOS3 eth0' +set qos policy shaper vyos2 class 20 match VyOS3 ip source address '10.1.1.100/32' +set qos policy shaper vyos2 default bandwidth '100%' +set qos policy shaper vyos2 default burst '15k' +set qos policy shaper vyos2 default ceiling '100%' +set qos policy shaper vyos2 default priority '7' +set qos policy shaper vyos2 default queue-type 'fair-queue' +set system host-name vyos2 diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt new file mode 100644 index 0000000..2274b1d --- /dev/null +++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt @@ -0,0 +1,16 @@ +set interfaces ethernet eth0 address '10.1.1.100/24' +set interfaces ethernet eth1 address '172.17.1.1/24' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.1.1.1' +set qos interface eth0 egress 'vyos3' +set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' +set qos policy shaper vyos3 class 10 set-dscp 'CS4' +set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' +set qos policy shaper vyos3 class 20 set-dscp 'CS5' +set qos policy shaper vyos3 class 30 match ADDRESS30 ip source address '172.17.1.4/32' +set qos policy shaper vyos3 class 30 set-dscp 'CS6' +set qos policy shaper vyos3 default bandwidth '10%' +set qos policy shaper vyos3 default ceiling '100%' +set qos policy shaper vyos3 default priority '7' +set qos policy shaper vyos3 default queue-type 'fair-queue' +set system host-name vyos3 diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt new file mode 100644 index 0000000..e55343f --- /dev/null +++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt @@ -0,0 +1,15 @@ +set interfaces ethernet eth0 address '10.2.1.100/24' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.2.1.1' +set qos interface eth0 egress 'vyos4' +set qos policy shaper vyos4 class 10 bandwidth '100%' +set qos policy shaper vyos4 class 10 burst '15k' +set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' +set qos policy shaper vyos4 class 10 queue-type 'fair-queue' +set qos policy shaper vyos4 class 10 set-dscp 'CS4' +set qos policy shaper vyos4 default bandwidth '10%' +set qos policy shaper vyos4 default burst '15k' +set qos policy shaper vyos4 default ceiling '100%' +set qos policy shaper vyos4 default priority '7' +set qos policy shaper vyos4 default queue-type 'fair-queue' +set system host-name vyos4 diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml b/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml new file mode 100644 index 0000000..e4617d4 --- /dev/null +++ b/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml @@ -0,0 +1,62 @@ +--- +# docs.vyos.io/en/1.5/configexamples/qos.html +# vyos2's class 20 (5 Mbit/s for 10.1.1.100) is shown on the page as "show" +# output; it is translated to the equivalent settings here. The page's text +# says vyos2 re-marks "CS4 -> CS6" once, but its configuration sets CS5 (as the +# introduction says); the configuration is followed. +all: + hosts: + vyos3: + ansible_host: 192.0.2.3 + base_hostname: vyos3 + base_interfaces: + - {name: eth0, addresses: [10.1.1.100/24]} + - {name: eth1, addresses: [172.17.1.1/24]} + base_static_routes: + - {dest: 0.0.0.0/0, next_hop: 10.1.1.1} + qos_shapers: + - name: vyos3 + classes: + - {id: 10, set_dscp: CS4, matches: [{name: ADDRESS10, ip: {source: {address: 172.17.1.2/32}}}]} + - {id: 20, set_dscp: CS5, matches: [{name: ADDRESS20, ip: {source: {address: 172.17.1.3/32}}}]} + - {id: 30, set_dscp: CS6, matches: [{name: ADDRESS30, ip: {source: {address: 172.17.1.4/32}}}]} + default: {bandwidth: 10%, ceiling: 100%, priority: 7, queue_type: fair-queue} + qos_interfaces: + - {name: eth0, egress: vyos3} + vyos4: + ansible_host: 192.0.2.4 + base_hostname: vyos4 + base_interfaces: + - {name: eth0, addresses: [10.2.1.100/24]} + base_static_routes: + - {dest: 0.0.0.0/0, next_hop: 10.2.1.1} + qos_shapers: + - name: vyos4 + classes: + - {id: 10, bandwidth: 100%, burst: 15k, queue_type: fair-queue, set_dscp: CS4, matches: [{name: ALL, ether: {protocol: all}}]} + default: {bandwidth: 10%, burst: 15k, ceiling: 100%, priority: 7, queue_type: fair-queue} + qos_interfaces: + - {name: eth0, egress: vyos4} + vyos2: + ansible_host: 192.0.2.2 + base_hostname: vyos2 + base_interfaces: + - {name: eth0, addresses: [10.1.1.1/24]} + - {name: eth1, addresses: [10.2.1.1/24]} + - {name: eth2, addresses: [10.9.9.1/24]} + base_static_routes: + - {dest: 172.17.1.0/24, next_hop: 10.1.1.100} + qos_shapers: + - name: vyos2 + classes: + - {id: 10, bandwidth: 100%, burst: 15k, queue_type: fair-queue, set_dscp: CS5, matches: [{name: VYOS2, ip: {dscp: CS4}}]} + - {id: 20, bandwidth: 5mbit, description: for VyOS3 eth0, matches: [{name: VyOS3, ip: {source: {address: 10.1.1.100/32}}}]} + default: {bandwidth: 100%, burst: 15k, ceiling: 100%, priority: 7, queue_type: fair-queue} + qos_interfaces: + - {name: eth2, egress: vyos2} + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/roles b/tests/render/cases/blueprints/qos_dscp_shaper/roles new file mode 100644 index 0000000..e9825df --- /dev/null +++ b/tests/render/cases/blueprints/qos_dscp_shaper/roles @@ -0,0 +1 @@ +base,qos diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt new file mode 100644 index 0000000..bd4bd98 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt @@ -0,0 +1,24 @@ +set load-balancing wan interface-health eth0 failure-count '5' +set load-balancing wan interface-health eth0 nexthop '11.22.33.1' +set load-balancing wan interface-health eth0 test 10 target '33.44.55.66' +set load-balancing wan interface-health eth0 test 10 type 'ping' +set load-balancing wan interface-health eth0 test 20 target '44.55.66.77' +set load-balancing wan interface-health eth0 test 20 type 'ping' +set load-balancing wan interface-health eth1 failure-count '4' +set load-balancing wan interface-health eth1 nexthop '22.33.44.1' +set load-balancing wan interface-health eth1 test 10 target '55.66.77.88' +set load-balancing wan interface-health eth1 test 10 type 'ping' +set load-balancing wan interface-health eth1 test 20 target '66.77.88.99' +set load-balancing wan interface-health eth1 test 20 type 'ping' +set load-balancing wan rule 10 inbound-interface 'eth2' +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 10 interface eth1 +set protocols static route 33.44.55.66/32 +set protocols static route 33.44.55.66/32 next-hop '11.22.33.1' +set protocols static route 44.55.66.77/32 +set protocols static route 44.55.66.77/32 next-hop '11.22.33.1' +set protocols static route 55.66.77.88/32 +set protocols static route 55.66.77.88/32 next-hop '22.33.44.1' +set protocols static route 66.77.88.99/32 +set protocols static route 66.77.88.99/32 next-hop '22.33.44.1' +set system host-name r1 diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/roles b/tests/render/cases/blueprints/wan_lb_example1_balance/roles new file mode 100644 index 0000000..c9221fb --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example1_balance/roles @@ -0,0 +1 @@ +base,wan_load_balance diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml b/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml new file mode 100644 index 0000000..7baacf4 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml @@ -0,0 +1,28 @@ +--- +# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 1: Distributing load evenly +# (the end state after applying the page's steps up to this example) +base_hostname: r1 +base_static_routes: + - {dest: 33.44.55.66/32, next_hop: 11.22.33.1} + - {dest: 44.55.66.77/32, next_hop: 11.22.33.1} + - {dest: 55.66.77.88/32, next_hop: 22.33.44.1} + - {dest: 66.77.88.99/32, next_hop: 22.33.44.1} +wan_load_balance_interfaces: + - name: eth0 + failure_count: 5 + nexthop: 11.22.33.1 + tests: + - {id: 10, type: ping, target: 33.44.55.66} + - {id: 20, type: ping, target: 44.55.66.77} + - name: eth1 + failure_count: 4 + nexthop: 22.33.44.1 + tests: + - {id: 10, type: ping, target: 55.66.77.88} + - {id: 20, type: ping, target: 66.77.88.99} +wan_load_balance_rules: + - number: 10 + inbound_interface: eth2 + interfaces: + - {name: eth0} + - {name: eth1} diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt new file mode 100644 index 0000000..f9b1689 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt @@ -0,0 +1,25 @@ +set load-balancing wan interface-health eth0 failure-count '5' +set load-balancing wan interface-health eth0 nexthop '11.22.33.1' +set load-balancing wan interface-health eth0 test 10 target '33.44.55.66' +set load-balancing wan interface-health eth0 test 10 type 'ping' +set load-balancing wan interface-health eth0 test 20 target '44.55.66.77' +set load-balancing wan interface-health eth0 test 20 type 'ping' +set load-balancing wan interface-health eth1 failure-count '4' +set load-balancing wan interface-health eth1 nexthop '22.33.44.1' +set load-balancing wan interface-health eth1 test 10 target '55.66.77.88' +set load-balancing wan interface-health eth1 test 10 type 'ping' +set load-balancing wan interface-health eth1 test 20 target '66.77.88.99' +set load-balancing wan interface-health eth1 test 20 type 'ping' +set load-balancing wan rule 10 failover +set load-balancing wan rule 10 inbound-interface 'eth2' +set load-balancing wan rule 10 interface eth0 weight '10' +set load-balancing wan rule 10 interface eth1 weight '1' +set protocols static route 33.44.55.66/32 +set protocols static route 33.44.55.66/32 next-hop '11.22.33.1' +set protocols static route 44.55.66.77/32 +set protocols static route 44.55.66.77/32 next-hop '11.22.33.1' +set protocols static route 55.66.77.88/32 +set protocols static route 55.66.77.88/32 next-hop '22.33.44.1' +set protocols static route 66.77.88.99/32 +set protocols static route 66.77.88.99/32 next-hop '22.33.44.1' +set system host-name r1 diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles new file mode 100644 index 0000000..c9221fb --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles @@ -0,0 +1 @@ +base,wan_load_balance diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml new file mode 100644 index 0000000..6b89539 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml @@ -0,0 +1,29 @@ +--- +# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 2: Failover based on interface weights +# (the end state after applying the page's steps up to this example) +base_hostname: r1 +base_static_routes: + - {dest: 33.44.55.66/32, next_hop: 11.22.33.1} + - {dest: 44.55.66.77/32, next_hop: 11.22.33.1} + - {dest: 55.66.77.88/32, next_hop: 22.33.44.1} + - {dest: 66.77.88.99/32, next_hop: 22.33.44.1} +wan_load_balance_interfaces: + - name: eth0 + failure_count: 5 + nexthop: 11.22.33.1 + tests: + - {id: 10, type: ping, target: 33.44.55.66} + - {id: 20, type: ping, target: 44.55.66.77} + - name: eth1 + failure_count: 4 + nexthop: 22.33.44.1 + tests: + - {id: 10, type: ping, target: 55.66.77.88} + - {id: 20, type: ping, target: 66.77.88.99} +wan_load_balance_rules: + - number: 10 + failover: true + inbound_interface: eth2 + interfaces: + - {name: eth0, weight: 10} + - {name: eth1, weight: 1} diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt new file mode 100644 index 0000000..a291c08 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt @@ -0,0 +1,25 @@ +set load-balancing wan interface-health eth0 failure-count '5' +set load-balancing wan interface-health eth0 nexthop '11.22.33.1' +set load-balancing wan interface-health eth0 test 10 target '33.44.55.66' +set load-balancing wan interface-health eth0 test 10 type 'ping' +set load-balancing wan interface-health eth0 test 20 target '44.55.66.77' +set load-balancing wan interface-health eth0 test 20 type 'ping' +set load-balancing wan interface-health eth1 failure-count '4' +set load-balancing wan interface-health eth1 nexthop '22.33.44.1' +set load-balancing wan interface-health eth1 test 10 target '55.66.77.88' +set load-balancing wan interface-health eth1 test 10 type 'ping' +set load-balancing wan interface-health eth1 test 20 target '66.77.88.99' +set load-balancing wan interface-health eth1 test 20 type 'ping' +set load-balancing wan rule 10 inbound-interface 'eth2' +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 20 inbound-interface 'eth2' +set load-balancing wan rule 20 interface eth1 +set protocols static route 33.44.55.66/32 +set protocols static route 33.44.55.66/32 next-hop '11.22.33.1' +set protocols static route 44.55.66.77/32 +set protocols static route 44.55.66.77/32 next-hop '11.22.33.1' +set protocols static route 55.66.77.88/32 +set protocols static route 55.66.77.88/32 next-hop '22.33.44.1' +set protocols static route 66.77.88.99/32 +set protocols static route 66.77.88.99/32 next-hop '22.33.44.1' +set system host-name r1 diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles new file mode 100644 index 0000000..c9221fb --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles @@ -0,0 +1 @@ +base,wan_load_balance diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml new file mode 100644 index 0000000..f646e74 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml @@ -0,0 +1,31 @@ +--- +# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 3: Failover based on rule order +# (the end state after applying the page's steps up to this example) +base_hostname: r1 +base_static_routes: + - {dest: 33.44.55.66/32, next_hop: 11.22.33.1} + - {dest: 44.55.66.77/32, next_hop: 11.22.33.1} + - {dest: 55.66.77.88/32, next_hop: 22.33.44.1} + - {dest: 66.77.88.99/32, next_hop: 22.33.44.1} +wan_load_balance_interfaces: + - name: eth0 + failure_count: 5 + nexthop: 11.22.33.1 + tests: + - {id: 10, type: ping, target: 33.44.55.66} + - {id: 20, type: ping, target: 44.55.66.77} + - name: eth1 + failure_count: 4 + nexthop: 22.33.44.1 + tests: + - {id: 10, type: ping, target: 55.66.77.88} + - {id: 20, type: ping, target: 66.77.88.99} +wan_load_balance_rules: + - number: 10 + inbound_interface: eth2 + interfaces: + - {name: eth0} + - number: 20 + inbound_interface: eth2 + interfaces: + - {name: eth1} diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt new file mode 100644 index 0000000..2f4b9f2 --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt @@ -0,0 +1,29 @@ +set load-balancing wan interface-health eth0 failure-count '5' +set load-balancing wan interface-health eth0 nexthop '11.22.33.1' +set load-balancing wan interface-health eth0 test 10 target '33.44.55.66' +set load-balancing wan interface-health eth0 test 10 type 'ping' +set load-balancing wan interface-health eth0 test 20 target '44.55.66.77' +set load-balancing wan interface-health eth0 test 20 type 'ping' +set load-balancing wan interface-health eth1 failure-count '4' +set load-balancing wan interface-health eth1 nexthop '22.33.44.1' +set load-balancing wan interface-health eth1 test 10 target '55.66.77.88' +set load-balancing wan interface-health eth1 test 10 type 'ping' +set load-balancing wan interface-health eth1 test 20 target '66.77.88.99' +set load-balancing wan interface-health eth1 test 20 type 'ping' +set load-balancing wan rule 10 inbound-interface 'eth2' +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 20 destination port 'sip' +set load-balancing wan rule 20 inbound-interface 'eth2' +set load-balancing wan rule 20 interface eth1 +set load-balancing wan rule 20 protocol 'tcp' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '11.22.33.1' +set protocols static route 33.44.55.66/32 +set protocols static route 33.44.55.66/32 next-hop '11.22.33.1' +set protocols static route 44.55.66.77/32 +set protocols static route 44.55.66.77/32 next-hop '11.22.33.1' +set protocols static route 55.66.77.88/32 +set protocols static route 55.66.77.88/32 next-hop '22.33.44.1' +set protocols static route 66.77.88.99/32 +set protocols static route 66.77.88.99/32 next-hop '22.33.44.1' +set system host-name r1 diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles new file mode 100644 index 0000000..c9221fb --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles @@ -0,0 +1 @@ +base,wan_load_balance diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml new file mode 100644 index 0000000..ac14a1d --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml @@ -0,0 +1,34 @@ +--- +# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 4: Failover based on rule order - priority traffic +# (the end state after applying the page's steps up to this example) +base_hostname: r1 +base_static_routes: + - {dest: 33.44.55.66/32, next_hop: 11.22.33.1} + - {dest: 44.55.66.77/32, next_hop: 11.22.33.1} + - {dest: 55.66.77.88/32, next_hop: 22.33.44.1} + - {dest: 66.77.88.99/32, next_hop: 22.33.44.1} + - {dest: 0.0.0.0/0, next_hop: 11.22.33.1} +wan_load_balance_interfaces: + - name: eth0 + failure_count: 5 + nexthop: 11.22.33.1 + tests: + - {id: 10, type: ping, target: 33.44.55.66} + - {id: 20, type: ping, target: 44.55.66.77} + - name: eth1 + failure_count: 4 + nexthop: 22.33.44.1 + tests: + - {id: 10, type: ping, target: 55.66.77.88} + - {id: 20, type: ping, target: 66.77.88.99} +wan_load_balance_rules: + - number: 10 + inbound_interface: eth2 + interfaces: + - {name: eth0} + - number: 20 + inbound_interface: eth2 + interfaces: + - {name: eth1} + destination: {port: sip} + protocol: tcp diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt new file mode 100644 index 0000000..0fb7e5b --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt @@ -0,0 +1,32 @@ +set load-balancing wan interface-health eth0 failure-count '5' +set load-balancing wan interface-health eth0 nexthop '11.22.33.1' +set load-balancing wan interface-health eth0 test 10 target '33.44.55.66' +set load-balancing wan interface-health eth0 test 10 type 'ping' +set load-balancing wan interface-health eth0 test 20 target '44.55.66.77' +set load-balancing wan interface-health eth0 test 20 type 'ping' +set load-balancing wan interface-health eth1 failure-count '4' +set load-balancing wan interface-health eth1 nexthop '22.33.44.1' +set load-balancing wan interface-health eth1 test 10 target '55.66.77.88' +set load-balancing wan interface-health eth1 test 10 type 'ping' +set load-balancing wan interface-health eth1 test 20 target '66.77.88.99' +set load-balancing wan interface-health eth1 test 20 type 'ping' +set load-balancing wan rule 10 inbound-interface 'eth2' +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 20 destination port 'sip' +set load-balancing wan rule 20 inbound-interface 'eth2' +set load-balancing wan rule 20 interface eth1 +set load-balancing wan rule 20 protocol 'tcp' +set load-balancing wan rule 5 destination address '10.0.0.0/8' +set load-balancing wan rule 5 exclude +set load-balancing wan rule 5 inbound-interface 'eth+' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '11.22.33.1' +set protocols static route 33.44.55.66/32 +set protocols static route 33.44.55.66/32 next-hop '11.22.33.1' +set protocols static route 44.55.66.77/32 +set protocols static route 44.55.66.77/32 next-hop '11.22.33.1' +set protocols static route 55.66.77.88/32 +set protocols static route 55.66.77.88/32 next-hop '22.33.44.1' +set protocols static route 66.77.88.99/32 +set protocols static route 66.77.88.99/32 next-hop '22.33.44.1' +set system host-name r1 diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/roles b/tests/render/cases/blueprints/wan_lb_example5_exclude/roles new file mode 100644 index 0000000..c9221fb --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/roles @@ -0,0 +1 @@ +base,wan_load_balance diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml b/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml new file mode 100644 index 0000000..06ac0ea --- /dev/null +++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml @@ -0,0 +1,38 @@ +--- +# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 5: Exclude traffic from load balancing +# (the end state after applying the page's steps up to this example) +base_hostname: r1 +base_static_routes: + - {dest: 33.44.55.66/32, next_hop: 11.22.33.1} + - {dest: 44.55.66.77/32, next_hop: 11.22.33.1} + - {dest: 55.66.77.88/32, next_hop: 22.33.44.1} + - {dest: 66.77.88.99/32, next_hop: 22.33.44.1} + - {dest: 0.0.0.0/0, next_hop: 11.22.33.1} +wan_load_balance_interfaces: + - name: eth0 + failure_count: 5 + nexthop: 11.22.33.1 + tests: + - {id: 10, type: ping, target: 33.44.55.66} + - {id: 20, type: ping, target: 44.55.66.77} + - name: eth1 + failure_count: 4 + nexthop: 22.33.44.1 + tests: + - {id: 10, type: ping, target: 55.66.77.88} + - {id: 20, type: ping, target: 66.77.88.99} +wan_load_balance_rules: + - number: 5 + exclude: true + inbound_interface: eth+ + destination: {address: 10.0.0.0/8} + - number: 10 + inbound_interface: eth2 + interfaces: + - {name: eth0} + - number: 20 + inbound_interface: eth2 + interfaces: + - {name: eth1} + destination: {port: sip} + protocol: tcp diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt new file mode 100644 index 0000000..b30e862 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt @@ -0,0 +1,63 @@ +set interfaces vti vti10 address '169.254.10.1/30' +set interfaces vti vti10 description 'Google Cloud HA VPN tunnel 0' +set interfaces vti vti10 ip adjust-mss '1350' +set policy prefix-list GCP-IN +set policy prefix-list GCP-IN rule 10 +set policy prefix-list GCP-IN rule 10 action 'permit' +set policy prefix-list GCP-IN rule 10 prefix '10.70.0.0/20' +set policy prefix-list GCP-OUT +set policy prefix-list GCP-OUT rule 10 +set policy prefix-list GCP-OUT rule 10 action 'permit' +set policy prefix-list GCP-OUT rule 10 prefix '10.80.0.0/24' +set policy route-map GCP-IN rule 10 action permit +set policy route-map GCP-IN rule 10 match ip address prefix-list GCP-IN +set policy route-map GCP-IN rule 20 action deny +set policy route-map GCP-OUT rule 10 action permit +set policy route-map GCP-OUT rule 10 match ip address prefix-list GCP-OUT +set policy route-map GCP-OUT rule 20 action deny +set protocols bgp address-family ipv4-unicast network 10.80.0.0/24 +set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast route-map export GCP-OUT +set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast route-map import GCP-IN +set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 169.254.10.2 disable-connected-check +set protocols bgp neighbor 169.254.10.2 remote-as 64514 +set protocols bgp neighbor 169.254.10.2 timers holdtime 30 +set protocols bgp neighbor 169.254.10.2 timers keepalive 10 +set protocols bgp parameters router-id 10.80.0.11 +set protocols bgp system-as 65010 +set protocols static route 169.254.10.2/32 +set protocols static route 169.254.10.2/32 interface 'vti10' +set vpn ipsec authentication psk gcp-ha-vpn-0 +set vpn ipsec authentication psk gcp-ha-vpn-0 id 198.51.100.10 +set vpn ipsec authentication psk gcp-ha-vpn-0 id 203.0.113.10 +set vpn ipsec authentication psk gcp-ha-vpn-0 secret '********' +set vpn ipsec esp-group GCP-ESP +set vpn ipsec esp-group GCP-ESP lifetime 10800 +set vpn ipsec esp-group GCP-ESP mode tunnel +set vpn ipsec esp-group GCP-ESP pfs dh-group14 +set vpn ipsec esp-group GCP-ESP proposal 10 +set vpn ipsec esp-group GCP-ESP proposal 10 encryption aes256 +set vpn ipsec esp-group GCP-ESP proposal 10 hash sha256 +set vpn ipsec ike-group GCP-IKE +set vpn ipsec ike-group GCP-IKE dead-peer-detection action restart +set vpn ipsec ike-group GCP-IKE dead-peer-detection interval 30 +set vpn ipsec ike-group GCP-IKE key-exchange ikev2 +set vpn ipsec ike-group GCP-IKE lifetime 36000 +set vpn ipsec ike-group GCP-IKE proposal 10 +set vpn ipsec ike-group GCP-IKE proposal 10 dh-group 14 +set vpn ipsec ike-group GCP-IKE proposal 10 encryption aes256 +set vpn ipsec ike-group GCP-IKE proposal 10 hash sha256 +set vpn ipsec ike-group GCP-IKE proposal 10 prf 'prfsha256' +set vpn ipsec interface eth0 +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer gcp-ha-vpn-0 +set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication local-id '198.51.100.10' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication remote-id '203.0.113.10' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 connection-type 'initiate' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 description 'Google Cloud HA VPN tunnel 0' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 ike-group 'GCP-IKE' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 local-address '198.51.100.10' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 remote-address '203.0.113.10' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 vti bind 'vti10' +set vpn ipsec site-to-site peer gcp-ha-vpn-0 vti esp-group 'GCP-ESP' diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt new file mode 100644 index 0000000..746a937 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt @@ -0,0 +1,63 @@ +set interfaces vti vti11 address '169.254.10.5/30' +set interfaces vti vti11 description 'Google Cloud HA VPN tunnel 1' +set interfaces vti vti11 ip adjust-mss '1350' +set policy prefix-list GCP-IN +set policy prefix-list GCP-IN rule 10 +set policy prefix-list GCP-IN rule 10 action 'permit' +set policy prefix-list GCP-IN rule 10 prefix '10.70.0.0/20' +set policy prefix-list GCP-OUT +set policy prefix-list GCP-OUT rule 10 +set policy prefix-list GCP-OUT rule 10 action 'permit' +set policy prefix-list GCP-OUT rule 10 prefix '10.80.0.0/24' +set policy route-map GCP-IN rule 10 action permit +set policy route-map GCP-IN rule 10 match ip address prefix-list GCP-IN +set policy route-map GCP-IN rule 20 action deny +set policy route-map GCP-OUT rule 10 action permit +set policy route-map GCP-OUT rule 10 match ip address prefix-list GCP-OUT +set policy route-map GCP-OUT rule 20 action deny +set protocols bgp address-family ipv4-unicast network 10.80.0.0/24 +set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast route-map export GCP-OUT +set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast route-map import GCP-IN +set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 169.254.10.6 disable-connected-check +set protocols bgp neighbor 169.254.10.6 remote-as 64514 +set protocols bgp neighbor 169.254.10.6 timers holdtime 30 +set protocols bgp neighbor 169.254.10.6 timers keepalive 10 +set protocols bgp parameters router-id 10.80.0.12 +set protocols bgp system-as 65010 +set protocols static route 169.254.10.6/32 +set protocols static route 169.254.10.6/32 interface 'vti11' +set vpn ipsec authentication psk gcp-ha-vpn-1 +set vpn ipsec authentication psk gcp-ha-vpn-1 id 198.51.100.11 +set vpn ipsec authentication psk gcp-ha-vpn-1 id 203.0.113.11 +set vpn ipsec authentication psk gcp-ha-vpn-1 secret '********' +set vpn ipsec esp-group GCP-ESP +set vpn ipsec esp-group GCP-ESP lifetime 10800 +set vpn ipsec esp-group GCP-ESP mode tunnel +set vpn ipsec esp-group GCP-ESP pfs dh-group14 +set vpn ipsec esp-group GCP-ESP proposal 10 +set vpn ipsec esp-group GCP-ESP proposal 10 encryption aes256 +set vpn ipsec esp-group GCP-ESP proposal 10 hash sha256 +set vpn ipsec ike-group GCP-IKE +set vpn ipsec ike-group GCP-IKE dead-peer-detection action restart +set vpn ipsec ike-group GCP-IKE dead-peer-detection interval 30 +set vpn ipsec ike-group GCP-IKE key-exchange ikev2 +set vpn ipsec ike-group GCP-IKE lifetime 36000 +set vpn ipsec ike-group GCP-IKE proposal 10 +set vpn ipsec ike-group GCP-IKE proposal 10 dh-group 14 +set vpn ipsec ike-group GCP-IKE proposal 10 encryption aes256 +set vpn ipsec ike-group GCP-IKE proposal 10 hash sha256 +set vpn ipsec ike-group GCP-IKE proposal 10 prf 'prfsha256' +set vpn ipsec interface eth0 +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer gcp-ha-vpn-1 +set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication local-id '198.51.100.11' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication remote-id '203.0.113.11' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 connection-type 'initiate' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 description 'Google Cloud HA VPN tunnel 1' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 ike-group 'GCP-IKE' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 local-address '198.51.100.11' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 remote-address '203.0.113.11' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 vti bind 'vti11' +set vpn ipsec site-to-site peer gcp-ha-vpn-1 vti esp-group 'GCP-ESP' diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml b/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml new file mode 100644 index 0000000..fd64fa2 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml @@ -0,0 +1,75 @@ +--- +all: + hosts: + edge1: + ansible_host: 192.0.2.1 + ipsec_route_based_peers: + - name: gcp-ha-vpn-0 + description: Google Cloud HA VPN tunnel 0 + psk_name: gcp-ha-vpn-0 + psk: example-gcp-ha-vpn-psk-0 + local_address: 198.51.100.10 + remote_address: 203.0.113.10 + connection_type: initiate + esp_group_on_vti: true + vti: + interface: vti10 + address: 169.254.10.1/30 + description: Google Cloud HA VPN tunnel 0 + adjust_mss: '1350' + ipsec_route_based_interface_routes: + - dest: 169.254.10.2/32 + interface: vti10 + ipsec_route_based_bgp: + asn: 65010 + router_id: 10.80.0.11 + networks: + - 10.80.0.0/24 + neighbors: + - address: 169.254.10.2 + remote_as: 64514 + holdtime: 30 + keepalive: 10 + disable_connected_check: true + soft_reconfiguration_inbound: true + route_map_import: GCP-IN + route_map_export: GCP-OUT + edge2: + ansible_host: 192.0.2.2 + ipsec_route_based_peers: + - name: gcp-ha-vpn-1 + description: Google Cloud HA VPN tunnel 1 + psk_name: gcp-ha-vpn-1 + psk: example-gcp-ha-vpn-psk-1 + local_address: 198.51.100.11 + remote_address: 203.0.113.11 + connection_type: initiate + esp_group_on_vti: true + vti: + interface: vti11 + address: 169.254.10.5/30 + description: Google Cloud HA VPN tunnel 1 + adjust_mss: '1350' + ipsec_route_based_interface_routes: + - dest: 169.254.10.6/32 + interface: vti11 + ipsec_route_based_bgp: + asn: 65010 + router_id: 10.80.0.12 + networks: + - 10.80.0.0/24 + neighbors: + - address: 169.254.10.6 + remote_as: 64514 + holdtime: 30 + keepalive: 10 + disable_connected_check: true + soft_reconfiguration_inbound: true + route_map_import: GCP-IN + route_map_export: GCP-OUT + vars: + ansible_network_os: vyos.vyos.vyos + ansible_connection: ansible.netcommon.network_cli + ansible_user: vyos + ansible_connect_timeout: 5 + ansible_command_timeout: 5 diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml b/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml new file mode 100644 index 0000000..d84ed63 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml @@ -0,0 +1,29 @@ +--- +# docs.vyos.io/en/1.5/configexamples/gcp-ha-vpn-bgp.html - shared by both edges +ipsec_route_based_ike_group: + name: GCP-IKE + key_exchange: ikev2 + lifetime: 36000 + proposal_id: 10 + dh_group: 14 + encryption: aes256 + hash: sha256 + prf: prfsha256 + dead_peer_detection: {action: restart, interval: 30} +ipsec_route_based_esp_group: + name: GCP-ESP + lifetime: 10800 + mode: tunnel + pfs: dh-group14 + proposal_id: 10 + encryption: aes256 + hash: sha256 +ipsec_route_based_interfaces: [eth0] +ipsec_route_based_disable_route_autoinstall: true +ipsec_route_based_policy: + prefix_lists: + - {name: GCP-IN, rules: [{sequence: 10, action: permit, prefix: 10.70.0.0/20}]} + - {name: GCP-OUT, rules: [{sequence: 10, action: permit, prefix: 10.80.0.0/24}]} + route_maps: + - {name: GCP-IN, rules: [{sequence: 10, action: permit, prefix_list: GCP-IN}, {sequence: 20, action: deny}]} + - {name: GCP-OUT, rules: [{sequence: 10, action: permit, prefix_list: GCP-OUT}, {sequence: 20, action: deny}]} diff --git a/tests/render/cases/wireguard/keys_masked/expected/r1.txt b/tests/render/cases/wireguard/keys_masked/expected/r1.txt new file mode 100644 index 0000000..12418d7 --- /dev/null +++ b/tests/render/cases/wireguard/keys_masked/expected/r1.txt @@ -0,0 +1,9 @@ +set interfaces wireguard wg01 address '10.254.60.1/30' +set interfaces wireguard wg01 peer OFFSITE1 address '203.0.113.3' +set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' +set interfaces wireguard wg01 peer OFFSITE1 port '50001' +set interfaces wireguard wg01 peer OFFSITE1 preshared-key '********' +set interfaces wireguard wg01 peer OFFSITE1 public-key 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' +set interfaces wireguard wg01 port '50001' +set interfaces wireguard wg01 private-key '********' diff --git a/tests/render/cases/wireguard/keys_masked/vars.yml b/tests/render/cases/wireguard/keys_masked/vars.yml new file mode 100644 index 0000000..03b0277 --- /dev/null +++ b/tests/render/cases/wireguard/keys_masked/vars.yml @@ -0,0 +1,15 @@ +--- +# Guards key masking: private and preshared keys must render as '********'. +wireguard_interfaces: + - name: wg01 + addresses: [10.254.60.1/30] + port: 50001 + private_key: LAB-ONLY-NOT-A-REAL-PRIVATE-KEY + peers: + - name: OFFSITE1 + public_key: GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o= + allowed_ips: [0.0.0.0/0] + address: 203.0.113.3 + port: 50001 + persistent_keepalive: 15 + preshared_key: LAB-ONLY-NOT-A-REAL-PSK diff --git a/tests/render/render.yml b/tests/render/render.yml index 3c86b41..1e0bd21 100644 --- a/tests/render/render.yml +++ b/tests/render/render.yml @@ -10,7 +10,7 @@ name: "vyos.blueprints.{{ item }}" vars: vyos_blueprints_render_only: true - loop: "{{ roles.split(',') if roles | default('') | length > 0 else [role] }}" + loop: "{{ render_roles.split(',') if render_roles | default('') | length > 0 else [role] }}" - name: Normalise rendered commands ansible.builtin.set_fact: diff --git a/tests/render/run.sh b/tests/render/run.sh index eaad5f6..ed8af74 100755 --- a/tests/render/run.sh +++ b/tests/render/run.sh @@ -26,7 +26,7 @@ for case_dir in "$here"/cases/*/*/; do -e "role=$role" -e "case_dir=$case_dir" -e "update_golden=$update") [[ -f "$case_dir/vars.yml" ]] && args+=(-e "@$case_dir/vars.yml") # Blueprints that combine roles list them, comma-separated, in a "roles" file. - [[ -f "$case_dir/roles" ]] && args+=(-e "roles=$(tr -d '[:space:]' < "$case_dir/roles")") + [[ -f "$case_dir/roles" ]] && args+=(-e "render_roles=$(tr -d '[:space:]' < "$case_dir/roles")") mkdir -p "$case_dir/expected" echo "=== $role/$name" if ! ansible-playbook "${args[@]}"; then -- cgit v1.2.3