-
Notifications
You must be signed in to change notification settings - Fork 231
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feat(eos_designs): Add support for Zscaler internet-exit policy (#3833)
Co-authored-by: Claus Holbech <[email protected]>
- Loading branch information
1 parent
dbbab4d
commit 0ec7c0c
Showing
48 changed files
with
4,505 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
ansible_collections/arista/avd/docs/plugins/Lookup_plugins/cv_zscaler_endpoints.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| --- | ||
| # This title is used for search results | ||
| title: arista.avd.cv_zscaler_endpoints | ||
| --- | ||
| <!-- | ||
| ~ Copyright (c) 2023-2024 Arista Networks, Inc. | ||
| ~ Use of this source code is governed by the Apache License 2.0 | ||
| ~ that can be found in the LICENSE file. | ||
| --> | ||
|
|
||
| # cv_zscaler_endpoints | ||
|
|
||
| !!! note | ||
| Always use the FQCN (Fully Qualified Collection Name) `arista.avd.cv_zscaler_endpoints` when using this plugin. | ||
|
|
||
| PREVIEW - Fetch Zscaler endpoints used for CV Pathfinder internet-exit integration. | ||
|
|
||
| ## Synopsis | ||
|
|
||
| Use this to autofill the `zscaler_endpoints` data model. | ||
|
|
||
| The arguments are optional. If not set the same vars must be set. | ||
|
|
||
| ## Requirements | ||
|
|
||
| The below requirements are needed on the host that executes this module. | ||
|
|
||
| - md_toc | ||
|
|
||
| ## Parameters | ||
|
|
||
| | Argument | Type | Required | Default | Value Restrictions | Description | | ||
| | -------- | ---- | -------- | ------- | ------------------ | ----------- | | ||
| | <samp>cv_server</samp> | str | True | None | | CV server. | | ||
| | <samp>cv_token</samp> | str | True | None | | CV token. | | ||
| | <samp>cv_verify_certs</samp> | bool | optional | True | | Verify SSL certificates. | | ||
| | <samp>serial_number</samp> | str | True | None | | Device serial number. | | ||
| | <samp>inventory_hostname</samp> | str | True | None | | Device inventory hostname. | | ||
|
|
||
| ## Examples | ||
|
|
||
| ```yaml | ||
| --- | ||
| zscaler_endpoints: "{{ lookup('arista.avd.cv_zscaler_endpoints') }}" | ||
| ``` | ||
| ## Return Values | ||
| | Name | Type | Description | | ||
| | ---- | ---- | ----------- | | ||
| | _value | dict | Dict according to the `zscaler_endpoints` data model. | | ||
|
|
||
| ## Authors | ||
|
|
||
| - Arista Ansible Team (@aristanetworks) |
144 changes: 144 additions & 0 deletions
144
...igns_negative_unit_tests/inventory/host_vars/duplicate-tunnel-interface-internet-exit.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| --- | ||
| wan_mode: cv-pathfinder | ||
| # Disabling underlay for tests | ||
| underlay_routing_protocol: none | ||
|
|
||
| type: wan_router | ||
|
|
||
| bgp_as: 65000 | ||
|
|
||
| cv_pathfinder_regions: | ||
| - name: AVD_Land_West | ||
| id: 42 | ||
| description: AVD Region | ||
| sites: | ||
| - name: Site422 | ||
| id: 422 | ||
| location: Somewhere | ||
|
|
||
| bgp_peer_groups: | ||
| wan_overlay_peers: | ||
| password: "htm4AZe9mIQOO1uiMuGgYQ==" | ||
| listen_range_prefixes: | ||
| - 192.168.255.0/24 | ||
|
|
||
| wan_route_servers: | ||
| - hostname: cv-pathfinder-pathfinder | ||
| vtep_ip: 10.10.10.10 | ||
| path_groups: | ||
| - name: INET | ||
| interfaces: | ||
| - name: Ethernet1 | ||
| public_ip: 192.168.55.55 | ||
|
|
||
| wan_ipsec_profiles: | ||
| control_plane: | ||
| shared_key: ABCDEF1234567890 | ||
| data_plane: | ||
| shared_key: ABCDEF1234567890666 | ||
|
|
||
| wan_router: | ||
| defaults: | ||
| loopback_ipv4_pool: 192.168.42.0/24 | ||
| vtep_loopback_ipv4_pool: 192.168.255.0/24 | ||
| filter: | ||
| always_include_vrfs_in_tenants: [TenantA] | ||
| nodes: | ||
| - name: duplicate-tunnel-interface-internet-exit | ||
| cv_pathfinder_region: AVD_Land_West | ||
| cv_pathfinder_site: Site422 | ||
| id: 1 | ||
| l3_interfaces: | ||
| - name: Ethernet1 | ||
| wan_carrier: ATT | ||
| wan_circuit_id: 666 | ||
| dhcp_accept_default_route: true | ||
| ip_address: dhcp | ||
| cv_pathfinder_internet_exit: | ||
| policies: | ||
| - name: ZSCALER-EXIT-POLICY-1 | ||
| tunnel_interface_numbers: 100-102 | ||
| - name: Ethernet2 | ||
| wan_carrier: ATT | ||
| wan_circuit_id: 777 | ||
| dhcp_accept_default_route: true | ||
| ip_address: dhcp | ||
| cv_pathfinder_internet_exit: | ||
| policies: | ||
| - name: ZSCALER-EXIT-POLICY-2 | ||
| # Clashing IDs with Ethernet1 | ||
| tunnel_interface_numbers: 100-102 | ||
|
|
||
| wan_path_groups: | ||
| - name: INET | ||
| id: 101 | ||
|
|
||
| wan_carriers: | ||
| - name: ATT | ||
| path_group: INET | ||
| trusted: true | ||
|
|
||
| tenants: | ||
| - name: TenantA | ||
| vrfs: | ||
| - name: default | ||
| vrf_id: 1 | ||
| - name: PROD | ||
| vrf_id: 42 | ||
|
|
||
| wan_virtual_topologies: | ||
| vrfs: | ||
| - name: PROD | ||
| wan_vni: 42 | ||
| policies: | ||
| - name: DEFAULT-POLICY | ||
| default_virtual_topology: | ||
| drop_unmatched: true | ||
| application_virtual_topologies: | ||
| - application_profile: TEST | ||
| path_groups: | ||
| - names: [ INET ] | ||
| internet_exit: | ||
| policy: ZSCALER-EXIT-POLICY-1 | ||
| id: 42 | ||
| - application_profile: TEST2 | ||
| path_groups: | ||
| - names: [ INET ] | ||
| internet_exit: | ||
| policy: ZSCALER-EXIT-POLICY-2 | ||
| id: 43 | ||
|
|
||
| application_classification: | ||
| application_profiles: | ||
| - name: TEST | ||
| - name: TEST2 | ||
|
|
||
| cv_pathfinder_internet_exit_policies: | ||
| - name: ZSCALER-EXIT-POLICY-1 | ||
| type: zscaler | ||
| zscaler: | ||
| cloud_name: zscalerbeta | ||
| domain_name: test.local | ||
| ipsec_key_salt: THIS_SHOULD_BE_VAULTED | ||
| - name: ZSCALER-EXIT-POLICY-2 | ||
| fallback_to_system_default: False | ||
| type: zscaler | ||
| zscaler: | ||
| cloud_name: zscalerbeta | ||
| domain_name: test.local | ||
| ipsec_key_salt: THIS_SHOULD_BE_VAULTED | ||
|
|
||
| zscaler_endpoints: | ||
| primary: | ||
| city: Fremont, CA | ||
| datacenter: FMT1 | ||
| country: United States | ||
| latitude: 37 | ||
| longitude: -121 | ||
| ip_address: 10.37.121.1 # Not the correct address | ||
|
|
||
| expected_error_message: >- | ||
| Found duplicate objects with conflicting data while generating configuration for Tunnel interface for Internet Exit policy. | ||
| {'name': 'Tunnel100', 'description': 'Internet Exit ZSCALER-EXIT-POLICY-2 PRI', 'ip_address': 'unnumbered Ethernet2', 'source_interface': 'Ethernet2'} | ||
| conflicts with | ||
| {'name': 'Tunnel100', 'description': 'Internet Exit ZSCALER-EXIT-POLICY-1 PRI', 'ip_address': 'unnumbered Ethernet1', 'source_interface': 'Ethernet1'}. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.