Red Hat Ansible for Network Automation

Add group variables that support template-driven configuration to support a management access ACL.

1. Create a group_vars/all/ directory if it does not already exist.

   [student@workstation proj]$ mkdir -p group_vars/all

2. Add variables workstation_ipv4 and tower_ipv4 to the group_vars/all/vars.yml file. Create this file if it does not already exist. Edit it to make sure it contains the following contents:

   workstation_ipv4: 172.25.250.254/24
   tower_ipv4: 172.25.250.9/24

Update NOS-specific device configuration templates to provide parameterized configuration statements that define a management access ACL.

1. Add lines to the device configuration Jinja2 template for IOS device configuration. Under IOS, SNMP requires a standard access list, so that is used here. Modify j2/ios-config.j2 to include the following content:

   hostname {{ inventory_hostname }}
   ip domain-name {{ domain_name }}
   {% for nameserver in nameservers %}
   ip name-server {{ nameserver }}
   {% endfor %}
   service timestamps log datetime
   service timestamps debug datetime
   logging {{ syslog_ipv4 }}
   logging trap {{ ios_loglevel }}
   access-list 1 permit {{ workstation_ipv4 | ipaddr('address') }} log
   access-list 1 permit {{ tower_ipv4 | ipaddr('address') }} log

Perform a play that configures network devices from the updated Jinja2 templates.

1. Perform the play found in the j2cfg.yml file. Limit it to cs01. You already created playbook j2cfg.yml, which sources configuration statements from the VyOS- and IOS- Jinja2 templates.

   [student@workstation proj]$ ansible-playbook -l cs01 j2cfg.yml

2. Execute an ad hoc command that verifies that the ACL has been created.

   [student@workstation proj]$ ansible -m ios_command \
   > -a "commands='sh access-list 1'" cs01
   cs01 | SUCCESS => {
       "changed": false,
       "stdout": [
           "Standard IP access list 1\n    20 permit 172.25.250.9 log\n
            10 permit 172.25.250.254 log"
       ],
       "stdout_lines": [
           [
               "Standard IP access list 1",
               "    20 permit 172.25.250.9 log",
               "    10 permit 172.25.250.254 log"
           ]
       ]
   }