Generate and load ACL (firewall) configuration on network devices.
New in version 2017.7.0.
codeauthor: | Mircea Ulinic <mircea@cloudflare.com> |
---|---|
maturity: | new |
depends: | capirca, napalm |
platform: | unix |
The firewall configuration is generated by Capirca.
To install Capirca, execute: pip install capirca
.
To be able to load configuration on network devices,
it requires NAPALM library to be installed: pip install napalm
.
Please check Installation for complete details.
salt.modules.napalm_acl.
get_filter_pillar
(filter_name, pillar_key='acl', pillarenv=None, saltenv=None)¶Helper that can be used inside a state SLS, in order to get the filter configuration given its name.
pillarenv_from_saltenv
, and is otherwise ignored.salt.modules.napalm_acl.
get_term_pillar
(filter_name, term_name, pillar_key='acl', pillarenv=None, saltenv=None)¶Helper that can be used inside a state SLS, in order to get the term configuration given its name, under a certain filter uniquely identified by its name.
acl
acl
.pillarenv_from_saltenv
, and is otherwise ignored.salt.modules.napalm_acl.
load_filter_config
(*args, **kwargs)¶Generate and load the configuration of a policy filter.
Note
The order of the terms is very important. The configuration loaded
on the device respects the order defined in the terms
and/or
inside the pillar.
When merging the terms
with the pillar data, consider the
prepend
argument to make sure the order is correct!
merge_pillar
is set as False
.True
merge_pillar
is set as True
, the final list of terms generated by merging
the terms from terms
with those defined in the pillar (if any): new terms are prepended
at the beginning, while existing ones will preserve the position. To add the new terms
at the end of the list, set this argument to False
.acl
acl
.pillarenv_from_saltenv
, and is otherwise ignored.True
Merge the CLI variables with the pillar. Default: True
.
The merge logic depends on the prepend
argument and
the CLI has higher priority than the pillar.
False
False
.
This option requires merge_pillar
, otherwise it is ignored.True
True
.%Y/%m/%d
%Y/%m/%d
(<year>/<month>/<day>).False
True
, will apply the config, discard and return the changes.
Default: False
and will commit the changes on the device.True
True
.False
loaded_config
containing the raw configuration loaded on the device.The output is a dictionary having the same form as net.load_config
.
CLI Example:
salt 'edge01.bjm01' netacl.load_filter_config my-filter pillar_key=netacl debug=True
Output Example:
edge01.bjm01:
----------
already_configured:
False
comment:
diff:
[edit firewall]
+ family inet {
+ /*
+ ** $Date: 2017/03/22 $
+ **
+ */
+ filter my-filter {
+ interface-specific;
+ term my-term {
+ from {
+ source-port [ 1234 1235 ];
+ }
+ then {
+ reject;
+ }
+ }
+ term my-other-term {
+ from {
+ protocol tcp;
+ source-port 5678-5680;
+ }
+ then accept;
+ }
+ }
+ }
loaded_config:
firewall {
family inet {
replace:
/*
** $Date: 2017/03/22 $
**
*/
filter my-filter {
interface-specific;
term my-term {
from {
source-port [ 1234 1235 ];
}
then {
reject;
}
}
term my-other-term {
from {
protocol tcp;
source-port 5678-5680;
}
then accept;
}
}
}
}
result:
True
The filter configuration has been loaded from the pillar, having the following structure:
netacl:
- my-filter:
terms:
- my-term:
source_port:
- 1234
- 1235
action: reject
- my-other-term:
source_port:
- - 5678
- 5680
protocol: tcp
action: accept
salt.modules.napalm_acl.
load_policy_config
(*args, **kwargs)¶Generate and load the configuration of the whole policy.
Note
The order of the filters and their terms is very important.
The configuration loaded on the device respects the order
defined in the filters
and/or inside the pillar.
When merging the filters
with the pillar data, consider the
prepend
argument to make sure the order is correct!
merge_pillar
is set as False
.True
merge_pillar
is set as True
, the final list of filters generated by merging
the filters from filters
with those defined in the pillar (if any): new filters are prepended
at the beginning, while existing ones will preserve the position. To add the new filters
at the end of the list, set this argument to False
.acl
acl
.pillarenv_from_saltenv
, and is otherwise ignored.True
Merge the CLI variables with the pillar. Default: True
.
The merge logic depends on the prepend
argument and
the CLI has higher priority than the pillar.
False
False
.
This option requires merge_pillar
, otherwise it is ignored.True
True
.%Y/%m/%d
%Y/%m/%d
(<year>/<month>/<day>).False
True
, will apply the config, discard and return the changes.
Default: False
and will commit the changes on the device.True
True
.False
loaded_config
containing the raw configuration loaded on the device.The output is a dictionary having the same form as net.load_config
.
CLI Example:
salt 'edge01.flw01' netacl.load_policy_config debug=True
Output Example:
edge01.flw01:
----------
already_configured:
False
comment:
diff:
---
+++
@@ -1228,9 +1228,24 @@
!
+ipv4 access-list my-filter
+ 10 remark my-term
+ 20 deny tcp host 1.2.3.4 eq 1234 any
+ 30 deny udp host 1.2.3.4 eq 1234 any
+ 40 deny tcp host 1.2.3.4 eq 1235 any
+ 50 deny udp host 1.2.3.4 eq 1235 any
+ 60 remark my-other-term
+ 70 permit tcp any range 5678 5680 any
+!
+!
+ipv4 access-list block-icmp
+ 10 remark first-term
+ 20 deny icmp any any
!
loaded_config:
! $Date: 2017/03/22 $
no ipv4 access-list my-filter
ipv4 access-list my-filter
remark my-term
deny tcp host 1.2.3.4 eq 1234 any
deny udp host 1.2.3.4 eq 1234 any
deny tcp host 1.2.3.4 eq 1235 any
deny udp host 1.2.3.4 eq 1235 any
remark my-other-term
permit tcp any range 5678 5680 any
exit
no ipv4 access-list block-icmp
ipv4 access-list block-icmp
remark first-term
deny icmp any any
exit
result:
True
The policy configuration has been loaded from the pillar, having the following structure:
acl:
- my-filter:
terms:
- my-term:
source_port:
- 1234
- 1235
protocol:
- tcp
- udp
source_address: 1.2.3.4
action: reject
- my-other-term:
source_port:
- [5678, 5680]
protocol: tcp
action: accept
- block-icmp:
terms:
- first-term:
protocol:
- icmp
action: reject
salt.modules.napalm_acl.
load_term_config
(*args, **kwargs)¶Generate and load the configuration of a policy term.
acl
The key in the pillar containing the default attributes values. Default: acl
.
If the pillar contains the following structure:
firewall:
- my-filter:
terms:
- my-term:
source_port: 1234
source_address:
- 1.2.3.4/32
- 5.6.7.8/32
The pillar_key
field would be specified as firewall
.
pillarenv_from_saltenv
, and is otherwise ignored.True
Merge the CLI variables with the pillar. Default: True
.
The properties specified through the CLI have higher priority than the pillar.
True
True
.%Y/%m/%d
%Y/%m/%d
(<year>/<month>/<day>).False
True
, will apply the config, discard and return the changes.
Default: False
and will commit the changes on the device.True
True
.False
loaded_config
containing the raw configuration loaded on the device.A special service to choose from. This is a helper so the user is able to select a source just using the name, instead of specifying a source_port and protocol.
As this module is available on Unix platforms only, it reads the IANA port assignment from /etc/services.
If the user requires additional shortcuts to be referenced, they can add entries under /etc/services,
which can be managed using the file state
.
source_service
.Note
The following fields are accepted (some being platform-specific):
Note
The following fields can be also a single value and a list of values:
Example: destination_address
can be either defined as:
destination_address: 172.17.17.1/24
or as a list of destination IP addresses:
destination_address:
- 172.17.17.1/24
- 172.17.19.1/24
or a list of services to be matched:
source_service:
- ntp
- snmp
- ldap
- bgpd
Note
The port fields source_port
and destination_port
can be used as above to select either
a single value, either a list of values, but also they can select port ranges. Example:
source_port:
- - 1000
- 2000
- - 3000
- 4000
With the configuration above, the user is able to select the 1000-2000 and 3000-4000 source port ranges.
The output is a dictionary having the same form as net.load_config
.
CLI Example:
salt 'edge01.bjm01' netacl.load_term_config filter-name term-name source_address=1.2.3.4 destination_address=5.6.7.8 action=accept test=True debug=True
Output Example:
edge01.bjm01:
----------
already_configured:
False
comment:
Configuration discarded.
diff:
[edit firewall]
+ family inet {
+ /*
+ ** $Date: 2017/03/22 $
+ **
+ */
+ filter filter-name {
+ interface-specific;
+ term term-name {
+ from {
+ source-address {
+ 1.2.3.4/32;
+ }
+ destination-address {
+ 5.6.7.8/32;
+ }
+ }
+ then accept;
+ }
+ }
+ }
loaded_config:
firewall {
family inet {
replace:
/*
** $Date: 2017/03/22 $
**
*/
filter filter-name {
interface-specific;
term term-name {
from {
source-address {
1.2.3.4/32;
}
destination-address {
5.6.7.8/32;
}
}
then accept;
}
}
}
}
result:
True