blob: c15a101a7eb5007bef83e5dbda1f9c3385d9fa04 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
|
---
merged:
before: []
commands:
- set firewall ipv6-name UPLINK default-action 'accept'
- set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'
- set firewall ipv6-name UPLINK rule 1 action 'accept'
- set firewall ipv6-name UPLINK rule 1
- set firewall ipv6-name UPLINK rule 1 description 'Fwipv6-Rule 1 is configured
by Ansible'
- set firewall ipv6-name UPLINK rule 1 ipsec 'match-ipsec'
- set firewall ipv6-name UPLINK rule 2 action 'accept'
- set firewall ipv6-name UPLINK rule 2
- set firewall ipv6-name UPLINK rule 2 description 'Fwipv6-Rule 2 is configured
by Ansible'
- set firewall ipv6-name UPLINK rule 2 ipsec 'match-ipsec'
- set firewall name INBOUND default-action 'accept'
- set firewall name INBOUND description 'IPv4 INBOUND rule set'
- set firewall name INBOUND rule 101 action 'accept'
- set firewall name INBOUND rule 101
- set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'
- set firewall name INBOUND rule 101 ipsec 'match-ipsec'
- set firewall name INBOUND rule 102 action 'reject'
- set firewall name INBOUND rule 102
- set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'
- set firewall name INBOUND rule 102 ipsec 'match-ipsec'
- set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'
- set firewall name INBOUND rule 103 destination group address-group inbound
- set firewall name INBOUND rule 103
- set firewall name INBOUND rule 103 source address 192.0.2.0
- set firewall name INBOUND rule 103 state established enable
- set firewall name INBOUND rule 103 state related enable
- set firewall name INBOUND rule 103 state invalid disable
- set firewall name INBOUND rule 103 state new disable
- set firewall name INBOUND rule 103 action 'accept'
after:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
rules:
- number: 1
action: accept
description: Fwipv6-Rule 1 is configured by Ansible
ipsec: match-ipsec
- number: 2
action: accept
description: Fwipv6-Rule 2 is configured by Ansible
ipsec: match-ipsec
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 102
action: reject
description: Rule 102 is configured by Ansible
ipsec: match-ipsec
- number: 103
action: accept
description: Rule 103 is configured by Ansible
destination:
group:
address_group: inbound
source:
address: 192.0.2.0
state:
established: true
new: false
invalid: false
related: true
populate:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
rules:
- number: 1
action: accept
description: Fwipv6-Rule 1 is configured by Ansible
ipsec: match-ipsec
- number: 2
action: accept
description: Fwipv6-Rule 2 is configured by Ansible
ipsec: match-ipsec
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 102
action: reject
description: Rule 102 is configured by Ansible
ipsec: match-ipsec
- number: 103
action: accept
description: Rule 103 is configured by Ansible
destination:
group:
address_group: inbound
source:
address: 192.0.2.0
state:
established: true
new: false
invalid: false
related: true
replaced:
commands:
- delete firewall ipv6-name UPLINK rule 1
- delete firewall ipv6-name UPLINK rule 2
- delete firewall name INBOUND rule 102
- delete firewall name INBOUND rule 103
- set firewall name INBOUND rule 104 action 'reject'
- set firewall name INBOUND rule 104 description 'Rule 104 is configured by Ansible'
- set firewall name INBOUND rule 104
- set firewall name INBOUND rule 104 ipsec 'match-none'
after:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 104
action: reject
description: Rule 104 is configured by Ansible
ipsec: match-none
overridden:
before:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 104
action: reject
description: Rule 104 is configured by Ansible
ipsec: match-none
commands:
- delete firewall ipv6-name UPLINK
- delete firewall name INBOUND
- set firewall name Downlink default-action 'accept'
- set firewall name Downlink description 'IPv4 INBOUND rule set'
- set firewall name Downlink rule 501 action 'accept'
- set firewall name Downlink rule 501
- set firewall name Downlink rule 501 description 'Rule 501 is configured by Ansible'
- set firewall name Downlink rule 501 ipsec 'match-ipsec'
- set firewall name Downlink rule 502 action 'reject'
- set firewall name Downlink rule 502
- set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'
- set firewall name Downlink rule 502 ipsec 'match-ipsec'
after:
- afi: ipv4
rule_sets:
- name: Downlink
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 501
action: accept
description: Rule 501 is configured by Ansible
ipsec: match-ipsec
- number: 502
action: reject
description: Rule 502 is configured by Ansible
ipsec: match-ipsec
rendered:
commands:
- set firewall ipv6-name UPLINK default-action 'accept'
- set firewall ipv6-name UPLINK description 'This is ipv6 specific rule-set'
- set firewall name INBOUND default-action 'accept'
- set firewall name INBOUND description 'IPv4 INBOUND rule set'
- set firewall name INBOUND rule 101 action 'accept'
- set firewall name INBOUND rule 101
- set firewall name INBOUND rule 101 description 'Rule 101 is configured by Ansible'
- set firewall name INBOUND rule 101 ipsec 'match-ipsec'
- set firewall name INBOUND rule 102 action 'reject'
- set firewall name INBOUND rule 102
- set firewall name INBOUND rule 102 description 'Rule 102 is configured by Ansible'
- set firewall name INBOUND rule 102 ipsec 'match-ipsec'
- set firewall name INBOUND rule 103 description 'Rule 103 is configured by Ansible'
- set firewall name INBOUND rule 103 destination group address-group inbound
- set firewall name INBOUND rule 103
- set firewall name INBOUND rule 103 source address 192.0.2.0
- set firewall name INBOUND rule 103 state established enable
- set firewall name INBOUND rule 103 state related enable
- set firewall name INBOUND rule 103 state invalid disable
- set firewall name INBOUND rule 103 state new disable
- set firewall name INBOUND rule 103 action 'accept'
deleted_rs:
commands:
- delete firewall ipv6-name UPLINK
- delete firewall name INBOUND
after: []
deleted_afi_all:
commands:
- delete firewall ipv6-name
- delete firewall name
after: []
deleted_r:
commands:
- delete firewall ipv6-name UPLINK rule 1
after:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
rules:
- number: 2
action: accept
description: Fwipv6-Rule 2 is configured by Ansible
ipsec: match-ipsec
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 102
action: reject
description: Rule 102 is configured by Ansible
ipsec: match-ipsec
- number: 103
action: accept
description: Rule 103 is configured by Ansible
destination:
group:
address_group: inbound
source:
address: 192.0.2.0
state:
established: true
new: false
invalid: false
related: true
round_trip:
after:
- afi: ipv6
rule_sets:
- name: UPLINK
description: This is ipv6 specific rule-set
default_action: accept
rules:
- number: 1
action: accept
description: Fwipv6-Rule 1 is configured by Ansible
ipsec: match-ipsec
- number: 2
action: accept
description: Fwipv6-Rule 2 is configured by Ansible
ipsec: match-ipsec
- afi: ipv4
rule_sets:
- name: INBOUND
description: IPv4 INBOUND rule set
default_action: accept
rules:
- number: 101
action: accept
description: Rule 101 is configured by Ansible
ipsec: match-ipsec
- number: 102
action: reject
description: Rule 102 is configured by Ansible
ipsec: match-ipsec
- number: 103
action: accept
description: Rule 103 is configured by Ansible
source:
address: 192.0.2.0
state:
established: true
new: false
invalid: false
related: true
|
