Feat(eos_cli_config_gen): Add support for connection tx-interface match source-ip for ip security
#4844
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Review docs on Read the Docs To test this pull request: # Create virtual environment for this testing below the current directory
python -m venv test-avd-pr-4844
# Activate the virtual environment
source test-avd-pr-4844/bin/activate
# Install all requirements including PyAVD
pip install "pyavd[ansible] @ git+https://github.com/laxmikantchintakindi/avd.git@feat/eos_cli/ip_security#subdirectory=python-avd" --force
# Point Ansible collections path to the Python virtual environment
export ANSIBLE_COLLECTIONS_PATH=$VIRTUAL_ENV/ansible_collections
# Install Ansible collection
ansible-galaxy collection install git+https://github.com/laxmikantchintakindi/avd.git#/ansible_collections/arista/avd/,feat/eos_cli/ip_security --force
# Optional: Install AVD examples
cd test-avd-pr-4844
ansible-playbook arista.avd.install_examples |
github-actions
bot
added
role: eos_cli_config_gen
MaheshGSLAB
reviewed
Dec 31, 2024
python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/ip_security.schema.yml
Outdated
Show resolved
Hide resolved
python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/ip_security.schema.yml
Outdated
Show resolved
Hide resolved
laxmikantchintakindi
force-pushed
the
feat/eos_cli/ip_security
branch
from
0e61eb5 to
0c41c1f
Compare
MaheshGSLAB
reviewed
Jan 3, 2025
python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/ip-security.j2
Outdated
Show resolved
Hide resolved
python-avd/pyavd/_eos_cli_config_gen/j2templates/documentation/ip-security.j2
Outdated
Show resolved
Hide resolved
Vibhu-gslab
reviewed
Jan 3, 2025
| @@ -80,3 +80,4 @@ ip_security: | |||
| key_controller: | |||
| profile: Profile-1 | |||
| hardware_encryption_disabled: true | |||
| connection_tx_interface_match_source_ip: true | |||
There was a problem hiding this comment.
We don't see cli config of the input
There was a problem hiding this comment.
Fixed in latest commit.
MaheshGSLAB
approved these changes
Jan 6, 2025
| @@ -89,4 +89,7 @@ ip security | |||
| {% if ip_security.hardware_encryption_disabled is arista.avd.defined(true) %} | |||
| hardware encryption disabled | |||
| {% endif %} | |||
| {% if ip_security.connection_tx_interface_match_source_ip is arista.avd.defined(true) %} | |||
There was a problem hiding this comment.
are you sure about the ordering here?
There was a problem hiding this comment.
ip security
profile Profile-4
connection add
no shared-key
no pki-profile
no dpd
no flow parallelization encapsulation
mode tunnel
!
flow entropy udp
!
key controller
profile Profile-1
dh-group 14
lifetime 8 hours
connection tx-interface match source-ip
no fips restrictions
I am seeing this in output. hardware encryption disabled is not reflecting in show run and show run all.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Summary
Add support for
connection tx-interface match source-ipforip securityRelated Issue(s)
Fixes #4841
Component(s) name
arista.avd.eos_cli_config_genProposed changes
In CV Pathfinder solution, if there is ECMP route pointing via more than one nexthop-interface to reach the destination endpoint, it was not selecting the proper source-interface to send out the packets. This was fixed in the recent version.
This configuration is required in the latest versions for the Fix to work.
We need to check the possible method to integrate this command in the CV Pathfinder AVD configs.
How to test
Checklist
User Checklist
Repository Checklist