Add tech_docs/networking/iac_github_project.md
This commit is contained in:
319
tech_docs/networking/iac_github_project.md
Normal file
319
tech_docs/networking/iac_github_project.md
Normal file
@@ -0,0 +1,319 @@
|
|||||||
|
Below is the **sanitized, pseudocode-style** view of every functional knob an ASR-1002 DMVPN head-end needs—**no literals, no opinionated values**.
|
||||||
|
Each bullet is a **config option** you can turn on/off or fill-in later.
|
||||||
|
Think of it as a checklist you hand to an engineer who will decide the actual values.
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
GLOBAL / SYSTEM
|
||||||
|
--------------------------------------------------------
|
||||||
|
- set hostname → string
|
||||||
|
- set boot system flash image → filename
|
||||||
|
- set config-register → hex
|
||||||
|
- set enable secret hash → encrypted-secret
|
||||||
|
- set clock timezone / summer-time → zone offset [summer-rules]
|
||||||
|
- set ip domain-name → fqdn
|
||||||
|
- set ip name-servers → list<ip>
|
||||||
|
- set logging buffered size → bytes
|
||||||
|
- set logging console | monitor → level
|
||||||
|
- set logging hosts → list<ip> [transport udp/tcp port]
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
AAA
|
||||||
|
--------------------------------------------------------
|
||||||
|
- aaa new-model
|
||||||
|
- aaa group server tacacs+
|
||||||
|
- server-private ip key
|
||||||
|
- aaa authentication login default → [local | group tacacs | line]
|
||||||
|
- aaa authorization commands 15 → [local | group tacacs]
|
||||||
|
- aaa accounting commands 15 → [start-stop | none] group tacacs
|
||||||
|
- local username / privilege / secret
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
VRFs
|
||||||
|
--------------------------------------------------------
|
||||||
|
- vrf definition <name>
|
||||||
|
- rd <rd>
|
||||||
|
- address-family [ipv4 | ipv6]
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
CRYPTO
|
||||||
|
--------------------------------------------------------
|
||||||
|
- crypto keyring <name> vrf <vrf>
|
||||||
|
- pre-shared-key address ip key
|
||||||
|
- crypto isakmp policy <id>
|
||||||
|
- encr [3des | aes]
|
||||||
|
- auth [pre-share | rsa-sig]
|
||||||
|
- group [2 | 5 | 14]
|
||||||
|
- crypto ipsec transform-set <name>
|
||||||
|
- [esp-3des | esp-aes] [esp-md5 | esp-sha-hmac]
|
||||||
|
- mode [tunnel | transport]
|
||||||
|
- crypto ipsec profile <name>
|
||||||
|
- set transform-set <name>
|
||||||
|
- set pfs | idle-time | lifetime
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
TUNNEL / DMVPN
|
||||||
|
--------------------------------------------------------
|
||||||
|
- interface Tunnel<id>
|
||||||
|
- ip address / mask
|
||||||
|
- tunnel source [interface | ip]
|
||||||
|
- tunnel mode gre multipoint
|
||||||
|
- tunnel key <int>
|
||||||
|
- tunnel vrf <vrf>
|
||||||
|
- tunnel protection ipsec profile <name>
|
||||||
|
- ip nhrp network-id <int>
|
||||||
|
- ip nhrp authentication <string>
|
||||||
|
- ip nhrp map multicast dynamic
|
||||||
|
- ip nhrp server-only | nhs | redirect | shortcut
|
||||||
|
- ip tcp adjust-mss <int>
|
||||||
|
- qos pre-classify
|
||||||
|
- service-policy output <policy>
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
ROUTING – OSPF
|
||||||
|
--------------------------------------------------------
|
||||||
|
- router ospf <pid> [vrf <vrf>]
|
||||||
|
- router-id <ip>
|
||||||
|
- auto-cost reference-bandwidth <mbps>
|
||||||
|
- passive-interface default
|
||||||
|
- network <prefix> <wildcard> area <area>
|
||||||
|
- area <area> authentication message-digest
|
||||||
|
- interface ip ospf message-digest-key <key-id> md5 <key>
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
ROUTING – BGP
|
||||||
|
--------------------------------------------------------
|
||||||
|
- router bgp <asn>
|
||||||
|
- bgp router-id <ip>
|
||||||
|
- bgp log-neighbor-changes
|
||||||
|
- neighbor <ip | peer-group> remote-as <asn>
|
||||||
|
- neighbor <ip> description <text>
|
||||||
|
- neighbor <ip> ebgp-multihop <ttl>
|
||||||
|
- neighbor <ip> update-source <interface>
|
||||||
|
- neighbor <ip> password <string>
|
||||||
|
- bgp listen range <prefix> peer-group <pg>
|
||||||
|
- address-family ipv4
|
||||||
|
- neighbor <ip> activate
|
||||||
|
- neighbor <ip> route-reflector-client
|
||||||
|
- neighbor <ip> next-hop-self [all]
|
||||||
|
- neighbor <ip> default-originate
|
||||||
|
- neighbor <ip> soft-reconfiguration inbound
|
||||||
|
- neighbor <ip> route-map <in|out> <name>
|
||||||
|
- network <prefix> mask <mask>
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
QOS
|
||||||
|
--------------------------------------------------------
|
||||||
|
- class-map <match-any | match-all> <name>
|
||||||
|
- match [access-group | dscp | protocol | …]
|
||||||
|
- policy-map <name>
|
||||||
|
- class <name>
|
||||||
|
- priority percent <int>
|
||||||
|
- bandwidth remaining percent <int>
|
||||||
|
- shape average <bps>
|
||||||
|
- queue-limit <packets>
|
||||||
|
- random-detect dscp-based
|
||||||
|
- service-policy [input | output] <policy>
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
ACL / PREFIX / COMMUNITY LISTS
|
||||||
|
--------------------------------------------------------
|
||||||
|
- access-list <num|name> [standard | extended] [permit | deny] <rule>
|
||||||
|
- ip prefix-list <name> seq <num> permit/deny <prefix> [ge | le]
|
||||||
|
- ip community-list [standard | expanded] <name> [permit | deny] <regex>
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
SNMP
|
||||||
|
--------------------------------------------------------
|
||||||
|
- snmp-server community <name> [ro | rw] [acl]
|
||||||
|
- snmp-server group <name> v3 [auth | priv] [read | write] <view>
|
||||||
|
- snmp-server user <user> <group> v3 auth sha <key> priv aes 128 <key>
|
||||||
|
- snmp-server host <ip> traps version 3 …
|
||||||
|
- snmp-server location <text>
|
||||||
|
- snmp-server contact <text>
|
||||||
|
- snmp-server enable traps … (list of trap types)
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
INTERFACES (GENERIC)
|
||||||
|
--------------------------------------------------------
|
||||||
|
- interface <type num>
|
||||||
|
- description <text>
|
||||||
|
- ip address <ip> <mask> [secondary]
|
||||||
|
- vrf forwarding <vrf>
|
||||||
|
- mtu <bytes>
|
||||||
|
- ip flow [ingress | egress]
|
||||||
|
- service-policy [input | output] <policy>
|
||||||
|
- ip ospf cost | hello-interval | dead-interval
|
||||||
|
- channel-group <num> mode [active | passive | on]
|
||||||
|
- speed / duplex / negotiation
|
||||||
|
- shutdown | no shutdown
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
MISCELLANEOUS
|
||||||
|
--------------------------------------------------------
|
||||||
|
- ip route [vrf <vrf>] <dest> <mask> <next-hop>
|
||||||
|
- ip sla <num> [icmp-echo | tcp-connect | udp-jitter] …
|
||||||
|
- ip sla schedule <num> life forever start-time now
|
||||||
|
- control-plane service-policy input <policy>
|
||||||
|
- line con 0 / line vty 0 15
|
||||||
|
- password <string>
|
||||||
|
- exec-timeout <min> <sec>
|
||||||
|
- transport input [ssh | telnet | none]
|
||||||
|
|
||||||
|
Keep this checklist handy—fill in the blanks with real values only when you build the YAML for a specific box.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Below is a **minimal, reusable skeleton** that drops straight into
|
||||||
|
`config_components/` and cleanly separates **policy** from **data**,
|
||||||
|
while leaving every literal as a variable.
|
||||||
|
|
||||||
|
You can copy-paste these empty “placeholders” into the filenames shown;
|
||||||
|
they already contain **only the functional knobs** (pseudocode).
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
core_settings/00_licensing.j2
|
||||||
|
```
|
||||||
|
{# License boot level or Smart-Call-Home declarations #}
|
||||||
|
license boot level {{ license_level | default('network-advantage') }}
|
||||||
|
```
|
||||||
|
|
||||||
|
core_settings/10_system_settings.j2
|
||||||
|
```
|
||||||
|
hostname {{ hostname }}
|
||||||
|
service password-encryption
|
||||||
|
service timestamps debug datetime msec
|
||||||
|
service timestamps log datetime msec
|
||||||
|
ip domain-name {{ domain_name }}
|
||||||
|
{% for ns in name_servers %}
|
||||||
|
ip name-server {{ ns }}
|
||||||
|
{% endfor %}
|
||||||
|
clock timezone {{ tz_name }} {{ tz_offset }}
|
||||||
|
```
|
||||||
|
|
||||||
|
core_settings/20_aaa.j2
|
||||||
|
```
|
||||||
|
aaa new-model
|
||||||
|
!
|
||||||
|
aaa group server tacacs+ {{ tacacs_group }}
|
||||||
|
{% for srv in tacacs_servers %}
|
||||||
|
server-private {{ srv.host }} key {{ srv.key }}
|
||||||
|
{% endfor %}
|
||||||
|
!
|
||||||
|
aaa authentication login default group {{ tacacs_group }} local
|
||||||
|
aaa authorization exec default group {{ tacacs_group }} local
|
||||||
|
aaa accounting commands 15 default start-stop group {{ tacacs_group }}
|
||||||
|
```
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
network_services/30_vlans.j2
|
||||||
|
```
|
||||||
|
{% for vlan in vlans %}
|
||||||
|
vlan {{ vlan.id }}
|
||||||
|
name {{ vlan.name }}
|
||||||
|
{% endfor %}
|
||||||
|
```
|
||||||
|
|
||||||
|
network_services/40_routing.j2
|
||||||
|
```
|
||||||
|
{% for instance in routing.ospf %}
|
||||||
|
router ospf {{ instance.pid }}{% if instance.vrf %} vrf {{ instance.vrf }}{% endif %}
|
||||||
|
router-id {{ instance.rid }}
|
||||||
|
{% for net in instance.networks %}
|
||||||
|
network {{ net.prefix }} {{ net.wc }} area {{ net.area }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{% if routing.bgp %}
|
||||||
|
router bgp {{ routing.bgp.as }}
|
||||||
|
bgp router-id {{ routing.bgp.rid }}
|
||||||
|
{% for neigh in routing.bgp.neighbors %}
|
||||||
|
neighbor {{ neigh.ip }} remote-as {{ neigh.as }}
|
||||||
|
neighbor {{ neigh.ip }} description {{ neigh.desc }}
|
||||||
|
{% endfor %}
|
||||||
|
address-family ipv4
|
||||||
|
{% for net in routing.bgp.networks %}
|
||||||
|
network {{ net.prefix }} mask {{ net.mask }}
|
||||||
|
{% endfor %}
|
||||||
|
{% for neigh in routing.bgp.neighbors %}
|
||||||
|
neighbor {{ neigh.ip }} activate
|
||||||
|
{% endfor %}
|
||||||
|
exit-address-family
|
||||||
|
{% endif %}
|
||||||
|
```
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
interfaces/50_port_profiles/access_port.j2
|
||||||
|
```
|
||||||
|
interface {{ port.name }}
|
||||||
|
description {{ port.desc | default('Access port') }}
|
||||||
|
switchport mode access
|
||||||
|
switchport access vlan {{ port.access_vlan }}
|
||||||
|
switchport nonegotiate
|
||||||
|
spanning-tree portfast
|
||||||
|
{% if port.shutdown is defined and port.shutdown %}shutdown{% else %}no shutdown{% endif %}
|
||||||
|
```
|
||||||
|
|
||||||
|
interfaces/50_port_profiles/trunk_port.j2
|
||||||
|
```
|
||||||
|
interface {{ port.name }}
|
||||||
|
description {{ port.desc | default('Trunk port') }}
|
||||||
|
switchport mode trunk
|
||||||
|
switchport trunk native vlan {{ port.native_vlan }}
|
||||||
|
switchport trunk allowed vlan {{ port.allowed_vlans | join(',') }}
|
||||||
|
switchport nonegotiate
|
||||||
|
{% if port.shutdown is defined and port.shutdown %}shutdown{% else %}no shutdown{% endif %}
|
||||||
|
```
|
||||||
|
|
||||||
|
interfaces/60_interface_assignments.j2
|
||||||
|
```
|
||||||
|
{% for port in interfaces %}
|
||||||
|
{% set template = port.profile ~ '.j2' %}
|
||||||
|
{% include 'interfaces/50_port_profiles/' + template %}
|
||||||
|
{% endfor %}
|
||||||
|
```
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
policies/70_qos.j2
|
||||||
|
```
|
||||||
|
{% for cmap in qos.class_maps %}
|
||||||
|
class-map {{ cmap.match_type }} {{ cmap.name }}
|
||||||
|
{% for rule in cmap.rules %}
|
||||||
|
match {{ rule.type }} {{ rule.value }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
!
|
||||||
|
{% for pmap in qos.policy_maps %}
|
||||||
|
policy-map {{ pmap.name }}
|
||||||
|
{% for cls in pmap.classes %}
|
||||||
|
class {{ cls.name }}
|
||||||
|
{% for action in cls.actions %}
|
||||||
|
{{ action.cmd }} {{ action.value | default('') }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
```
|
||||||
|
|
||||||
|
policies/80_access_lists.j2
|
||||||
|
```
|
||||||
|
{% for acl in acls %}
|
||||||
|
{% if acl.type == 'extended' %}
|
||||||
|
ip access-list extended {{ acl.name }}
|
||||||
|
{% else %}
|
||||||
|
ip access-list standard {{ acl.name }}
|
||||||
|
{% endif %}
|
||||||
|
{% for rule in acl.rules %}
|
||||||
|
{{ rule.action }} {{ rule.text }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
```
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
USAGE (single command)
|
||||||
|
--------------------------------------------------------
|
||||||
|
```
|
||||||
|
find config_components -name "*.j2" | sort | xargs cat \
|
||||||
|
| jinja2 -d site.yaml > final.cfg
|
||||||
|
```
|
||||||
|
|
||||||
|
- Each `.j2` file contains **only pseudocode variables**—no literals.
|
||||||
|
- Drop **real values** into `site.yaml` (or per-device YAML) and render.
|
||||||
Reference in New Issue
Block a user