Skip to content

Commit 19adfcb

Browse files
Vibhu-gslabpre-commit-ci[bot]laxmikantchintakindigmuloccarl-baillargeon
authored
Refactor(eos_cli_config_gen): Add the entries key under ipv6_access_lists (#6564)
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: laxmikantchintakindi <[email protected]> Co-authored-by: Guillaume Mulocher <[email protected]> Co-authored-by: Carl Baillargeon <[email protected]>
1 parent e403e48 commit 19adfcb

17 files changed

Lines changed: 1146 additions & 303 deletions

File tree

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/documentation/devices/host1.md‎

Lines changed: 26 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -12164,45 +12164,42 @@ ipv6 access-list standard ipv6_test1
1216412164

1216512165
#### IPv6 Extended Access-lists Summary
1216612166

12167-
##### acl_qos_tc0_v6
12167+
##### ACL_SEQUENCE_AND_COUNTERS
1216812168

12169-
| Sequence | Action |
12170-
| -------- | ------ |
12171-
| 10 | permit ipv6 any any dscp cs1 |
12172-
12173-
##### acl_qos_tc5_v6
12174-
12175-
| Sequence | Action |
12176-
| -------- | ------ |
12177-
| 10 | permit ipv6 any 2001:db8::/48 |
12178-
12179-
##### TEST1
12180-
12181-
| Sequence | Action |
12182-
| -------- | ------ |
12183-
| 5 | deny ipv6 fe80::/64 any |
12184-
| 10 | permit ipv6 fe90::/64 any |
12169+
ACL has counting mode `counters per-entry` enabled!
1218512170

1218612171
##### TEST2
1218712172

1218812173
ACL has counting mode `counters per-entry` enabled!
1218912174

12190-
| Sequence | Action |
12191-
| -------- | ------ |
12192-
| 5 | permit ipv6 2001:db8::/64 any |
12193-
| 10 | deny ipv6 2001:db8::/32 any |
12194-
12195-
##### TEST3
12196-
12197-
| Sequence | Action |
12198-
| -------- | ------ |
12199-
| 5 | deny ipv6 2001:db8:1000::/64 any |
12200-
| 10 | permit ipv6 2001:db8::/32 any |
12201-
1220212175
#### IPv6 Extended Access-lists Device Configuration
1220312176

1220412177
```eos
1220512178
!
12179+
ipv6 access-list ACL_NO_SEQUENCE
12180+
remark test acl without sequence numbers
12181+
deny udp any any log
12182+
permit icmpv6 any any 3 4
12183+
permit icmpv6 any any unreachable
12184+
permit ipv6 any any dscp 46 3
12185+
permit ipv6 any any tracked hop-limit gt 3 dscp ef
12186+
permit ipv6 any any nexthop-group NH_TEST hop-limit eq 254
12187+
permit vlan 235 0x1FF inner 124 0x001 ipv6 any any
12188+
permit vlan inner 123 0x000 ipv6 any any
12189+
permit vlan 234 0xFFF ipv6 any any
12190+
permit icmpv6 any any
12191+
!
12192+
ipv6 access-list ACL_SEQUENCE_AND_COUNTERS
12193+
counters per-entry
12194+
10 remark test acl with sequence numbers
12195+
20 permit ipv6 host fe81::1 any
12196+
30 permit tcp fe82::/64 any established
12197+
40 permit tcp any gt 1023 host fe83::1 eq 22
12198+
50 permit tcp any range 1000 1100 any range 10 20
12199+
4294967295 deny ipv6 any any
12200+
!
12201+
ipv6 access-list ACL_WITHOUT_ENTRIES
12202+
!
1220612203
ipv6 access-list TEST1
1220712204
5 deny ipv6 fe80::/64 any
1220812205
10 permit ipv6 fe90::/64 any

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/intended/configs/host1.cfg‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4988,6 +4988,30 @@ ip address virtual source-nat vrf TEST_04 address 1.1.1.3
49884988
ipv6 address virtual source-nat vrf TEST_03 address 2001:db8:85a3::8a2e:370:7334
49894989
ipv6 address virtual source-nat vrf TEST_04 address 2001:db8:85a3::8a2e:370:7335
49904990
!
4991+
ipv6 access-list ACL_NO_SEQUENCE
4992+
remark test acl without sequence numbers
4993+
deny udp any any log
4994+
permit icmpv6 any any 3 4
4995+
permit icmpv6 any any unreachable
4996+
permit ipv6 any any dscp 46 3
4997+
permit ipv6 any any tracked hop-limit gt 3 dscp ef
4998+
permit ipv6 any any nexthop-group NH_TEST hop-limit eq 254
4999+
permit vlan 235 0x1FF inner 124 0x001 ipv6 any any
5000+
permit vlan inner 123 0x000 ipv6 any any
5001+
permit vlan 234 0xFFF ipv6 any any
5002+
permit icmpv6 any any
5003+
!
5004+
ipv6 access-list ACL_SEQUENCE_AND_COUNTERS
5005+
counters per-entry
5006+
10 remark test acl with sequence numbers
5007+
20 permit ipv6 host fe81::1 any
5008+
30 permit tcp fe82::/64 any established
5009+
40 permit tcp any gt 1023 host fe83::1 eq 22
5010+
50 permit tcp any range 1000 1100 any range 10 20
5011+
4294967295 deny ipv6 any any
5012+
!
5013+
ipv6 access-list ACL_WITHOUT_ENTRIES
5014+
!
49915015
ipv6 access-list TEST1
49925016
5 deny ipv6 fe80::/64 any
49935017
10 permit ipv6 fe90::/64 any

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/inventory/host_vars/host1/ipv6-access-lists.yml‎

Lines changed: 149 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,165 @@
11
---
2-
### IPv6 ACLs ###
2+
# eos - extended access-lists - improved data model, ipv6-access-lists.j2
33
ipv6_access_lists:
44
- name: acl_qos_tc0_v6
5-
sequence_numbers:
5+
entries:
66
- sequence: 10
7-
action: "permit ipv6 any any dscp cs1"
7+
action: permit
8+
protocol: ipv6
9+
source: any
10+
destination: any
11+
dscp: cs1
812
- name: acl_qos_tc5_v6
9-
sequence_numbers:
13+
entries:
1014
- sequence: 10
11-
action: "permit ipv6 any 2001:db8::/48"
15+
action: permit
16+
protocol: ipv6
17+
source: any
18+
destination: 2001:db8::/48
1219
- name: TEST1
13-
sequence_numbers:
14-
- sequence: 10
15-
action: "permit ipv6 fe90::/64 any"
20+
entries:
1621
- sequence: 5
17-
action: "deny ipv6 fe80::/64 any"
22+
action: deny
23+
protocol: ipv6
24+
source: fe80::/64
25+
destination: any
26+
- sequence: 10
27+
action: permit
28+
protocol: ipv6
29+
source: fe90::/64
30+
destination: any
1831
- name: TEST2
1932
counters_per_entry: true
20-
sequence_numbers:
33+
entries:
2134
- sequence: 5
22-
action: "permit ipv6 2001:db8::/64 any"
35+
action: permit
36+
protocol: ipv6
37+
source: 2001:db8::/64
38+
destination: any
2339
- sequence: 10
24-
action: "deny ipv6 2001:db8::/32 any"
40+
action: deny
41+
protocol: ipv6
42+
source: 2001:db8::/32
43+
destination: any
2544
- name: TEST3
2645
counters_per_entry: false
27-
sequence_numbers:
46+
entries:
2847
- sequence: 5
29-
action: "deny ipv6 2001:db8:1000::/64 any"
48+
action: deny
49+
protocol: ipv6
50+
source: 2001:db8:1000::/64
51+
destination: any
3052
- sequence: 10
31-
action: "permit ipv6 2001:db8::/32 any"
53+
action: permit
54+
protocol: ipv6
55+
source: 2001:db8::/32
56+
destination: any
57+
- name: ACL_SEQUENCE_AND_COUNTERS
58+
counters_per_entry: true
59+
entries:
60+
- sequence: 10
61+
remark: test acl with sequence numbers
62+
- sequence: 20
63+
action: permit
64+
protocol: ipv6
65+
source: fe81::1
66+
destination: any
67+
- sequence: 30
68+
action: permit
69+
protocol: tcp
70+
source: fe82::/64
71+
destination: any
72+
tcp_flags: ["established"]
73+
- sequence: 40
74+
action: permit
75+
protocol: tcp
76+
source: any
77+
source_ports_match: gt
78+
source_ports: [1023]
79+
destination: fe83::1
80+
destination_ports: [22]
81+
# test port range
82+
- sequence: 50
83+
action: permit
84+
protocol: tcp
85+
source: any
86+
source_ports_match: range
87+
source_ports: [1000, 1100]
88+
destination: any
89+
destination_ports_match: range
90+
destination_ports: [10, 20]
91+
# verify issue 4423 where a protocol was missing
92+
# and an entry with only the sequence number was rendered.
93+
- sequence: 60
94+
source: any
95+
destination: any
96+
- sequence: 4294967295
97+
action: deny
98+
protocol: ipv6
99+
source: any
100+
destination: any
101+
- name: ACL_NO_SEQUENCE
102+
entries:
103+
- remark: test acl without sequence numbers
104+
- action: deny
105+
protocol: udp
106+
source: any
107+
destination: any
108+
log: true
109+
- action: permit
110+
protocol: icmpv6
111+
source: any
112+
destination: any
113+
icmp_type: 3
114+
icmp_code: 4
115+
- action: permit
116+
protocol: icmpv6
117+
source: any
118+
destination: any
119+
icmp_type: unreachable
120+
- action: permit
121+
protocol: ipv6
122+
source: any
123+
destination: any
124+
dscp: 46
125+
dscp_mask: 3
126+
- action: permit
127+
protocol: ipv6
128+
source: any
129+
destination: any
130+
tracked: true
131+
dscp: ef
132+
hop_limit: 3
133+
hop_limit_match: gt
134+
- action: permit
135+
protocol: ipv6
136+
source: any
137+
destination: any
138+
nexthop_group: NH_TEST
139+
hop_limit: 254
140+
- action: permit
141+
inner_vlan_number: 124
142+
inner_vlan_mask: "0x001"
143+
vlan_number: 235
144+
vlan_mask: "0x1FF"
145+
protocol: ipv6
146+
source: any
147+
destination: any
148+
- action: permit
149+
inner_vlan_number: 123
150+
inner_vlan_mask: "0x000"
151+
protocol: ipv6
152+
source: any
153+
destination: any
154+
- action: permit
155+
vlan_number: 234
156+
vlan_mask: "0xFFF"
157+
protocol: ipv6
158+
source: any
159+
destination: any
160+
- action: permit
161+
protocol: icmpv6
162+
source: any
163+
destination: any
164+
- name: ACL_WITHOUT_ENTRIES
165+
counters_per_entry: false

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen_deprecated_vars/documentation/devices/host1.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
- [ACL](#acl)
1818
- [Standard Access-lists](#standard-access-lists)
1919
- [Extended Access-lists](#extended-access-lists)
20+
- [IPv6 Extended Access-lists](#ipv6-extended-access-lists)
2021

2122
## Management
2223

@@ -400,3 +401,66 @@ ip access-list acl_qos_tc0_v4
400401
ip access-list acl_qos_tc5_v4
401402
10 permit ip any any dscp ef
402403
```
404+
405+
### IPv6 Extended Access-lists
406+
407+
#### IPv6 Extended Access-lists Summary
408+
409+
##### acl_qos_tc0_v6
410+
411+
| Sequence | Action |
412+
| -------- | ------ |
413+
| 10 | permit ipv6 any any dscp cs1 |
414+
415+
##### acl_qos_tc5_v6
416+
417+
| Sequence | Action |
418+
| -------- | ------ |
419+
| 10 | permit ipv6 any 2001:db8::/48 |
420+
421+
##### TEST1
422+
423+
| Sequence | Action |
424+
| -------- | ------ |
425+
| 5 | deny ipv6 fe80::/64 any |
426+
| 10 | permit ipv6 fe90::/64 any |
427+
428+
##### TEST2
429+
430+
ACL has counting mode `counters per-entry` enabled!
431+
432+
| Sequence | Action |
433+
| -------- | ------ |
434+
| 5 | permit ipv6 2001:db8::/64 any |
435+
| 10 | deny ipv6 2001:db8::/32 any |
436+
437+
##### TEST3
438+
439+
| Sequence | Action |
440+
| -------- | ------ |
441+
| 5 | deny ipv6 2001:db8:1000::/64 any |
442+
| 10 | permit ipv6 2001:db8::/32 any |
443+
444+
#### IPv6 Extended Access-lists Device Configuration
445+
446+
```eos
447+
!
448+
ipv6 access-list TEST1
449+
5 deny ipv6 fe80::/64 any
450+
10 permit ipv6 fe90::/64 any
451+
!
452+
ipv6 access-list TEST2
453+
counters per-entry
454+
5 permit ipv6 2001:db8::/64 any
455+
10 deny ipv6 2001:db8::/32 any
456+
!
457+
ipv6 access-list TEST3
458+
5 deny ipv6 2001:db8:1000::/64 any
459+
10 permit ipv6 2001:db8::/32 any
460+
!
461+
ipv6 access-list acl_qos_tc0_v6
462+
10 permit ipv6 any any dscp cs1
463+
!
464+
ipv6 access-list acl_qos_tc5_v6
465+
10 permit ipv6 any 2001:db8::/48
466+
```

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen_deprecated_vars/intended/configs/host1.cfg‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,25 @@ interface VLAN20
4343
ipv6 nd other-config-flag
4444
ipv6 nd prefix 2001:db8:20::/64 infinite infinite no-autoconfig
4545
!
46+
ipv6 access-list TEST1
47+
5 deny ipv6 fe80::/64 any
48+
10 permit ipv6 fe90::/64 any
49+
!
50+
ipv6 access-list TEST2
51+
counters per-entry
52+
5 permit ipv6 2001:db8::/64 any
53+
10 deny ipv6 2001:db8::/32 any
54+
!
55+
ipv6 access-list TEST3
56+
5 deny ipv6 2001:db8:1000::/64 any
57+
10 permit ipv6 2001:db8::/32 any
58+
!
59+
ipv6 access-list acl_qos_tc0_v6
60+
10 permit ipv6 any any dscp cs1
61+
!
62+
ipv6 access-list acl_qos_tc5_v6
63+
10 permit ipv6 any 2001:db8::/48
64+
!
4665
ip access-list 4
4766
10 remark ACL to restrict access RFC1918 addresses
4867
20 deny ip 10.0.0.0/8 any

0 commit comments

Comments
 (0)