Skip to content

Commit b05c835

Browse files
MaheshGSLABVibhu-gslab
MaheshGSLAB
and
Vibhu-gslab
authored
Feat(eos_cli_config_gen): Added the support of TLS for AAA server group RADIUS (#6827)
Co-authored-by: Vibhu-gslab <109593615+Vibhu-gslab@users.noreply.github.com>
1 parent 86995a3 commit b05c835

9 files changed

Lines changed: 137 additions & 23 deletions

File tree

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/documentation/devices/host1.md‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1667,23 +1667,25 @@ ip radius vrf abc source-interface Loopback10
16671667

16681668
#### AAA Server Groups Summary
16691669

1670-
| Server Group Name | Type | VRF | IP address |
1671-
| ----------------- | ---- | --- | ---------- |
1672-
| TACACS | tacacs+ | mgt | 10.10.11.157 |
1673-
| TACACS | tacacs+ | default | 10.10.11.249 |
1674-
| TACACS1 | tacacs+ | mgt | 10.10.10.157 |
1675-
| TACACS1 | tacacs+ | default | 10.10.10.249 |
1676-
| TACACS2 | tacacs+ | mgt | 192.168.10.157 |
1677-
| TACACS2 | tacacs+ | default | 10.10.10.248 |
1678-
| LDAP1 | ldap | mgt | 192.168.10.157 |
1679-
| LDAP1 | ldap | default | 10.10.10.248 |
1680-
| LADP2 | ldap | mgt | 10.10.10.157 |
1681-
| LADP2 | ldap | default | 10.10.10.249 |
1682-
| RADIUS1 | radius | mgt | 192.168.10.157 |
1683-
| RADIUS1 | radius | default | 10.10.10.248 |
1684-
| RADIUS2 | radius | mgt | 10.10.10.157 |
1685-
| RADIUS2 | radius | default | 10.10.10.249 |
1686-
| RADIUS3 | radius | - | - |
1670+
| Server Group Name | Type | VRF | IP address | TLS Enabled | TLS Port |
1671+
| ----------------- | ---- | --- | ---------- | ----------- | -------- |
1672+
| TACACS | tacacs+ | mgt | 10.10.11.157 | - | - |
1673+
| TACACS | tacacs+ | default | 10.10.11.249 | - | - |
1674+
| TACACS1 | tacacs+ | mgt | 10.10.10.157 | - | - |
1675+
| TACACS1 | tacacs+ | default | 10.10.10.249 | - | - |
1676+
| TACACS2 | tacacs+ | mgt | 192.168.10.157 | - | - |
1677+
| TACACS2 | tacacs+ | default | 10.10.10.248 | - | - |
1678+
| LDAP1 | ldap | mgt | 192.168.10.157 | - | - |
1679+
| LDAP1 | ldap | default | 10.10.10.248 | - | - |
1680+
| LADP2 | ldap | mgt | 10.10.10.157 | - | - |
1681+
| LADP2 | ldap | default | 10.10.10.249 | - | - |
1682+
| RADIUS1 | radius | mgt | 192.168.10.157 | - | - |
1683+
| RADIUS1 | radius | default | 10.10.10.248 | - | - |
1684+
| RADIUS1 | radius | mgt | 11.11.11.123 | True | 2086 |
1685+
| RADIUS2 | radius | mgt | 10.10.10.157 | - | - |
1686+
| RADIUS2 | radius | default | 10.10.10.249 | - | - |
1687+
| RADIUS2 | radius | default | 12.12.12.145 | True | - |
1688+
| RADIUS3 | radius | - | - | - | - |
16871689

16881690
#### AAA Server Groups Device Configuration
16891691

@@ -1700,10 +1702,12 @@ aaa group server ldap LDAP1
17001702
aaa group server radius RADIUS1
17011703
server 192.168.10.157 vrf mgt
17021704
server 10.10.10.248
1705+
server 11.11.11.123 vrf mgt tls port 2086
17031706
!
17041707
aaa group server radius RADIUS2
17051708
server 10.10.10.157 vrf mgt
17061709
server 10.10.10.249
1710+
server 12.12.12.145 tls
17071711
!
17081712
aaa group server radius RADIUS3
17091713
!

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/intended/configs/host1.cfg‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1894,10 +1894,12 @@ radius-server host 10.10.11.158 vrf mgt tls ssl-profile SSL_PROFILE
18941894
aaa group server radius RADIUS1
18951895
server 192.168.10.157 vrf mgt
18961896
server 10.10.10.248
1897+
server 11.11.11.123 vrf mgt tls port 2086
18971898
!
18981899
aaa group server radius RADIUS2
18991900
server 10.10.10.157 vrf mgt
19001901
server 10.10.10.249
1902+
server 12.12.12.145 tls
19011903
!
19021904
aaa group server radius RADIUS3
19031905
!

‎ansible_collections/arista/avd/extensions/molecule/eos_cli_config_gen/inventory/host_vars/host1/aaa-server-groups.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,19 @@ aaa_server_groups:
3737
- server: 192.168.10.157
3838
vrf: mgt
3939
- server: 10.10.10.248
40+
- server: 11.11.11.123
41+
vrf: mgt
42+
tls:
43+
enabled: true
44+
port: 2086
4045
- name: RADIUS2
4146
type: radius
4247
servers:
4348
- server: 10.10.10.157
4449
vrf: mgt
4550
- server: 10.10.10.249
51+
- server: 12.12.12.145
52+
tls:
53+
enabled: true
4654
- name: RADIUS3
4755
type: radius

‎ansible_collections/arista/avd/roles/eos_cli_config_gen/docs/tables/aaa-server-groups.md‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎python-avd/pyavd/_eos_cli_config_gen/j2templates/documentation/aaa-server-groups.j2‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,23 @@
1010

1111
#### AAA Server Groups Summary
1212

13-
| Server Group Name | Type | VRF | IP address |
14-
| ----------------- | ---- | --- | ---------- |
13+
| Server Group Name | Type | VRF | IP address | TLS Enabled | TLS Port |
14+
| ----------------- | ---- | --- | ---------- | ----------- | -------- |
1515
{% for aaa_server_group in aaa_server_groups %}
1616
{% if aaa_server_group.type is arista.avd.defined %}
1717
{% if aaa_server_group.servers is arista.avd.defined %}
1818
{% for server in aaa_server_group.servers %}
1919
{% set vrf = server.vrf | arista.avd.default('default') %}
20-
| {{ aaa_server_group.name }} | {{ aaa_server_group.type }} | {{ vrf }} | {{ server.server }} |
20+
{% set tls = "-" %}
21+
{% set tls_port = "-" %}
22+
{% if aaa_server_group.type is arista.avd.defined("radius") and server.tls is arista.avd.defined %}
23+
{% set tls = server.tls.enabled %}
24+
{% set tls_port = server.tls.port | arista.avd.default("-") %}
25+
{% endif %}
26+
| {{ aaa_server_group.name }} | {{ aaa_server_group.type }} | {{ vrf }} | {{ server.server }} | {{ tls }} | {{ tls_port }} |
2127
{% endfor %}
2228
{% else %}
23-
| {{ aaa_server_group.name }} | {{ aaa_server_group.type }} | - | - |
29+
| {{ aaa_server_group.name }} | {{ aaa_server_group.type }} | - | - | - | - |
2430
{% endif %}
2531
{% endif %}
2632
{% endfor %}

‎python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/aaa-server-groups-radius.j2‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ aaa group server radius {{ aaa_server_group.name }}
1212
{% set server_cli = "server " ~ server.server %}
1313
{% if server.vrf is arista.avd.defined %}
1414
{% set server_cli = server_cli ~ " vrf " ~ server.vrf %}
15+
{% endif %}
16+
{% if server.tls.enabled is arista.avd.defined(true) %}
17+
{% set server_cli = server_cli ~ " tls" %}
18+
{% if server.tls.port is arista.avd.defined %}
19+
{% set server_cli = server_cli ~ " port " ~ server.tls.port %}
20+
{% endif %}
1521
{% endif %}
1622
{{ server_cli }}
1723
{% endfor %}

‎python-avd/pyavd/_eos_cli_config_gen/schema/__init__.py‎

Lines changed: 45 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎python-avd/pyavd/_eos_cli_config_gen/schema/eos_cli_config_gen.schema.yml‎

Lines changed: 18 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/aaa_server_groups.schema.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,18 @@ keys:
3333
description: VRF name.
3434
convert_types:
3535
- int
36+
tls:
37+
type: dict
38+
description: TLS settings for the RADIUS group server. Only applicable when the parent server group type is 'radius'.
39+
keys:
40+
enabled:
41+
type: bool
42+
description: Enable TLS to secure communication with the RADIUS group server.
43+
required: true
44+
port:
45+
type: int
46+
min: 1
47+
max: 65535
48+
convert_types:
49+
- str
50+
description: TCP port used for TLS-secured RADIUS communication. Overrides the default RadSec port (EOS default is 2083).

0 commit comments

Comments
 (0)