Feat(eos_cli_config_gen): Add support for ipv4/ipv6 access group ingr…

…ess default in system.control_plane
aristanetworks · Nov 12, 2024 · 0a36b5a · 0a36b5a
1 parent adc3dd2
commit 0a36b5a
Show file tree

Hide file tree

Showing 11 changed files with 118 additions and 116 deletions.
diff --git a/...llections/arista/avd/molecule/eos_cli_config_gen/documentation/devices/host1.md b/...llections/arista/avd/molecule/eos_cli_config_gen/documentation/devices/host1.md
@@ -8,6 +8,7 @@
   - [IP Domain-list](#ip-domain-list)
   - [Clock Settings](#clock-settings)
   - [NTP](#ntp)
+  - [System Control-Plane](#system-control-plane)
   - [Management SSH](#management-ssh)
   - [Management Tech-Support](#management-tech-support)
 - [CVX](#cvx)
@@ -150,6 +151,9 @@
 - [VRF Instances](#vrf-instances)
   - [VRF Instances Summary](#vrf-instances-summary)
   - [VRF Instances Device Configuration](#vrf-instances-device-configuration)
+- [System L1](#system-l1)
+  - [Unsupported Interface Configurations](#unsupported-interface-configurations)
+  - [System L1 Device Configuration](#system-l1-device-configuration)
 - [Application Traffic Recognition](#application-traffic-recognition)
   - [Applications](#applications)
   - [Application Profiles](#application-profiles)
@@ -328,6 +332,48 @@ ntp server 20.20.20.1 key <removed>
 ntp server ie.pool.ntp.org iburst key <removed>
 ```
 
+### System Control-Plane
+
+#### TCP MSS Ceiling
+
+| Protocol | Segment Size |
+| -------- | -------------|
+| IPv4 | 1344 |
+| IPv6 | 1366 |
+
+#### Control-Plane Access-Groups
+
+| Protocol | VRF | Access-list |
+| -------- | --- | ------------|
+| IPv4 Ingress default | All | ingress_ipv4_acl |
+| IPv6 Ingress default | All | ingress_ipv6_acl |
+| IPv4 | default | acl4_1 |
+| IPv4 | red | acl4_2 |
+| IPv4 | red_1 | acl4_2 |
+| IPv4 | default | acl4_3 |
+| IPv6 | default | acl6_1 |
+| IPv6 | blue | acl6_2 |
+| IPv6 | blue_1 | acl6_2 |
+| IPv6 | default | acl6_3 |
+
+#### System Control-Plane Device Configuration
+
+```eos
+!
+system control-plane
+   tcp mss ceiling ipv4 1344 ipv6 1366
+   ip access-group ingress default ingress_ipv4_acl
+   ip access-group acl4_1 in
+   ip access-group acl4_3 vrf default in
+   ip access-group acl4_2 vrf red in
+   ip access-group acl4_2 vrf red_1 in
+   ipv6 access-group ingress default ingress_ipv6_acl
+   ipv6 access-group acl6_1 in
+   ipv6 access-group acl6_3 vrf default in
+   ipv6 access-group acl6_2 vrf blue in
+   ipv6 access-group acl6_2 vrf blue_1 in
+```
+
 ### Management SSH
 
 #### Authentication Settings
@@ -6098,6 +6144,24 @@ vrf instance TENANT_A_PROJECT01
 vrf instance TENANT_A_PROJECT02
 ```
 
+## System L1
+
+### Unsupported Interface Configurations
+
+| Unsupported Configuration | action |
+| ---------------- | -------|
+| Speed | warn |
+| Error correction | error |
+
+### System L1 Device Configuration
+
+```eos
+!
+system l1
+   unsupported speed action warn
+   unsupported error-correction action error
+```
+
 ## Application Traffic Recognition
 
 ### Applications

diff --git a/...lections/arista/avd/molecule/eos_cli_config_gen/documentation/devices/system.md b/...lections/arista/avd/molecule/eos_cli_config_gen/documentation/devices/system.md
diff --git a/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/host1.cfg b/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/host1.cfg
@@ -500,6 +500,10 @@ no sflow hardware acceleration module Linecard3
 !
 service unsupported-transceiver test dsafDSFfvadskjh3424
 !
+system l1
+   unsupported speed action warn
+   unsupported error-correction action error
+!
 tap aggregation
    mode exclusive profile tap-aggregation-extended
    encapsulation dot1br strip
@@ -3065,6 +3069,19 @@ mac access-list TEST4
    permit any 02:00:00:12:34:56 00:00:00:00:00:00
    deny any 02:00:00:ab:cd:ef 00:00:00:00:00:00
 !
+system control-plane
+   tcp mss ceiling ipv4 1344 ipv6 1366
+   ip access-group ingress default ingress_ipv4_acl
+   ip access-group acl4_1 in
+   ip access-group acl4_3 vrf default in
+   ip access-group acl4_2 vrf red in
+   ip access-group acl4_2 vrf red_1 in
+   ipv6 access-group ingress default ingress_ipv6_acl
+   ipv6 access-group acl6_1 in
+   ipv6 access-group acl6_3 vrf default in
+   ipv6 access-group acl6_2 vrf blue in
+   ipv6 access-group acl6_2 vrf blue_1 in
+!
 mac address-table notification host-flap logging
 mac address-table notification host-flap detection window 10
 mac address-table notification host-flap detection moves 2

diff --git a/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/system.cfg b/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/system.cfg
diff --git a/...config_gen/inventory/host_vars/system.yml → ..._gen/inventory/host_vars/host1/system.yml b/...config_gen/inventory/host_vars/system.yml → ..._gen/inventory/host_vars/host1/system.yml
@@ -3,6 +3,7 @@ system:
     tcp_mss:
       ipv4: 1344
       ipv6: 1366
+    ipv4_access_group_ingress_default: ingress_ipv4_acl
     ipv4_access_groups:
       - acl_name: "acl4_1"
       - acl_name: "acl4_2"
@@ -11,6 +12,7 @@ system:
         vrf: red_1
       - acl_name: "acl4_3"
         vrf: default
+    ipv6_access_group_ingress_default: ingress_ipv6_acl
     ipv6_access_groups:
       - acl_name: "acl6_1"
       - acl_name: "acl6_2"

diff --git a/ansible_collections/arista/avd/molecule/eos_cli_config_gen/inventory/hosts.yml b/ansible_collections/arista/avd/molecule/eos_cli_config_gen/inventory/hosts.yml
@@ -85,7 +85,6 @@ test_hosts:
     spanning-tree-rapid-pvst:
     sync-e:
     tcam-profile:
-    system:
     terminattr-cloud:
     terminattr-extra-flags:
     terminattr-multi-cluster-certs:

diff --git a/ansible_collections/arista/avd/roles/eos_cli_config_gen/docs/tables/system.md b/ansible_collections/arista/avd/roles/eos_cli_config_gen/docs/tables/system.md
diff --git a/python-avd/pyavd/_eos_cli_config_gen/j2templates/documentation/system.j2 b/python-avd/pyavd/_eos_cli_config_gen/j2templates/documentation/system.j2
@@ -20,12 +20,20 @@
 | IPv6 | {{ system.control_plane.tcp_mss.ipv6 }} |
 {%         endif %}
 {%     endif %}
-{%     if system.control_plane.ipv4_access_groups is arista.avd.defined or system.control_plane.ipv6_access_groups is arista.avd.defined %}
+{%     if system.control_plane.ipv4_access_groups is arista.avd.defined or system.control_plane.ipv6_access_groups is arista.avd.defined or system.control_plane.ipv4_access_group_ingress_default is arista.avd.defined or system.control_plane.ipv6_access_group_ingress_default is arista.avd.defined %}
 
 #### Control-Plane Access-Groups
 
 | Protocol | VRF | Access-list |
 | -------- | --- | ------------|
+{#         IPv4 Access-groups Ingress Default #}
+{%         if system.control_plane.ipv4_access_group_ingress_default is arista.avd.defined %}
+| IPv4 Ingress default | All | {{ system.control_plane.ipv4_access_group_ingress_default }} |
+{%         endif %}
+{#         IPv6 Access-groups Ingress Default #}
+{%         if system.control_plane.ipv6_access_group_ingress_default is arista.avd.defined %}
+| IPv6 Ingress default | All | {{ system.control_plane.ipv6_access_group_ingress_default }} |
+{%         endif %}
 {#         IPv4 Access-groups #}
 {%         for acl_set in system.control_plane.ipv4_access_groups | arista.avd.natural_sort %}
 | IPv4 | {{ acl_set.vrf | arista.avd.default('default') }} | {{ acl_set.acl_name }} |

diff --git a/python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/system.j2 b/python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/system.j2
@@ -19,6 +19,9 @@ system control-plane
    {{ cp_mss_cli }}
 {%     endif %}
 {#     control_plane access_groups ipv4 #}
+{%     if system.control_plane.ipv4_access_group_ingress_default is arista.avd.defined %}
+   ip access-group ingress default {{ system.control_plane.ipv4_access_group_ingress_default }}
+{%     endif %}
 {%     if system.control_plane.ipv4_access_groups is arista.avd.defined %}
 {%         set with_vrf_non_default = system.control_plane.ipv4_access_groups | selectattr('vrf', 'arista.avd.defined') | rejectattr('vrf', 'equalto', 'default') | arista.avd.natural_sort | arista.avd.natural_sort('vrf') %}
 {%         set without_vrf = system.control_plane.ipv4_access_groups | rejectattr('vrf', 'arista.avd.defined') | arista.avd.natural_sort %}
@@ -34,6 +37,9 @@ system control-plane
    {{ cp_ipv4_access_grp }}
 {%     endfor %}
 {#     control_plane access_groups ipv6 #}
+{%     if system.control_plane.ipv6_access_group_ingress_default is arista.avd.defined %}
+   ipv6 access-group ingress default {{ system.control_plane.ipv6_access_group_ingress_default }}
+{%     endif %}
 {%     if system.control_plane.ipv6_access_groups is arista.avd.defined %}
 {%         set with_vrf_non_default = system.control_plane.ipv6_access_groups | selectattr('vrf', 'arista.avd.defined') | rejectattr('vrf', 'equalto', 'default') | arista.avd.natural_sort | arista.avd.natural_sort('vrf') %}
 {%         set without_vrf = system.control_plane.ipv6_access_groups | rejectattr('vrf', 'arista.avd.defined') | arista.avd.natural_sort %}

diff --git a/python-avd/pyavd/_eos_cli_config_gen/schema/eos_cli_config_gen.schema.yml b/python-avd/pyavd/_eos_cli_config_gen/schema/eos_cli_config_gen.schema.yml
diff --git a/python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/system.schema.yml b/python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/system.schema.yml
@@ -22,6 +22,9 @@ keys:
               ipv6:
                 type: int
                 description: Segment size.
+          ipv4_access_group_ingress_default:
+            type: str
+            description: ACL name to be used as the default CP ACL for all VRFs.
           ipv4_access_groups:
             type: list
             unique_keys:
@@ -36,6 +39,9 @@ keys:
                   type: str
                   convert_types:
                     - int
+          ipv6_access_group_ingress_default:
+            type: str
+            description: ACL name to be used as the default CP ACL for all VRFs.
           ipv6_access_groups:
             type: list
             unique_keys: