AAA role

This role facilitates the configuration of authentication authorization acccounting (AAA). It supports the configuration of TACACS for dellos9 and the configuration of RADIUS server and AAA for dellos10 and dellos6. The AAA role requires an SSH connection for connectivity to a Dell EMC Networking device. You can use any of the built-in OS connection variables .

Installation

ansible-galaxy install Dell-Networking.dellos-aaa

Role variables

Role is abstracted using the ansible_network_os variable that can take dellos6, dellos9 and dellos10 values
If dellos_cfg_generate is set to true, the variable generates the role configuration commands in a file
Any role variable with a corresponding state variable set to absent negates the configuration of that variable
Setting an empty value for any variable negates the corresponding configuration
Variables and values are case-sensitive

dellos_aaa keys

Key	Type	Description	Support
`radius_server`	dictionary	Configures the radius server (see `radius_server.*`)	dellos6, dellos9, dellos10
`radius_server.key`	string (required): 0,7,LINE	Configures the authentication key for the radius server	dellos6, dellos9
`radius_server.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0	dellos6, dellos9
`radius_server.retransmit`	integer	Configures the number of retransmissions	dellos6, dellos9, dellos10
`radius_server.timeout`	integer	Configures the timeout for retransmissions	dellos6, dellos9, dellos10
`radius_server.deadtime`	integer	Configures the server dead time	dellos9
`radius_server.group`	dictionary	Configures the radius servers group (see `group.*`)	dellos9
`group.name`	string (required)	Configures the group name of the radius servers	dellos9
`group.host`	dictionary	Configures the radius server host in the group (see `host.*`)	dellos9
`host.ip`	string	Configures the radius server host address in the group	dellos9
`host.key`	string (required): 0,7,LINE	Configures the authentication key	dellos9
`host.key_string`	string: 7,0	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0	dellos9
`host.retransmit`	integer	Configures the number of retransmissions	dellos9
`host.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos9
`host.timeout`	integer	Configures the timeout for retransmissions	dellos9
`host.state`	string: present,absent	Removes the host from group of radius server if set to absent	dellos9
`group.vrf`	dictionary	Configures the VRF for radius servers in the group (see `vrf.*`)	dellos9
`vrf.vrf_name`	string (required)	Configures the name of VRF for the radius server group	dellos9
`vrf.source_intf`	integer	Configures the source interface for outgoing packets from servers in the group	dellos9
`vrf.state`	string: present,absent	Removes the VRF from group of radius servers if set to absent	dellos9
`group.state`	string: present,absent	Removes the radius server group if set to absent	dellos9
`radius_server.host`	dictionary	Configures the radius server host (see `host.*`)	dellos6,dellos9, dellos10
`host.ip`	string	Configures the radius server host address	dellos6, dellos9, dellos10
`host.key`	string (required); 0,7,LINE	Configures the authentication key	dellos6, dellos9, dellos10
`host.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0	dellos6, dellos9
`host.retransmit`	integer	Configures the number of retransmissions	dellos6, dellos9
`host.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos6, dellos9, dellos10
`host.timeout`	integer	Configures timeout for retransmissions	dellos6, dellos9
`host.state`	string: present,absent	Removes the radius server host if set to absent	dellos6, dellos9, dellos10
`radius_server.acct`	dictionary	Configures the radius server acct (see `host.*`)	dellos6
`acct.ip`	string	Configures the radius server acct address	dellos6
`acct.key`	string (required); 0,7,LINE	Configures the authentication key	dellos6
`acct.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0	dellos6
`acct.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos6
`acct.state`	string: present,absent	Removes the radius server acct if set to absent	dellos6
`radius_server.auth`	dictionary	Configures the radius server auth (see `auth.*`)	dellos6
`auth.ip`	string	Configures the radius server host address	dellos6
`auth.key`	string (required); 0,7,LINE	Configures the authentication key	dellos6, dellos9, dellos10
`auth.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0	dellos6
`auth.name`	string (required)	Configures the auth name of the radius servers	dellos6
`auth.usage`	string (required)	Configures the usage type of the radius servers	dellos6
`auth.priority`	integer	Configures the number of priority	dellos6
`auth.retransmit`	integer	Configures the number of retransmissions	dellos6
`auth.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos6
`auth.timeout`	integer	Configures timeout for retransmissions	dellos6
`auth.deadtime`	integer	Configures the number of deadtime	dellos6
`auth.attribute`	dictionary	Configures the radius server auth (see `attribute.*`)	dellos6
`attribute.id`	integer	Configures the radius server attribute id	dellos6
auth (see `attribute.*`)	dellos6
`attribute.type`	integer	Configures the radius server attribute type based on id	dellos6
`attribute.state`	string: present,absent	Removes the radius server attribute if set to absent	dellos6
`auth.state`	string: present,absent	Removes the radius server auth if set to absent	dellos6
`radius_server.attribute`	dictionary	Configures the radius server auth (see `attribute.*`)	dellos6
`attribute.id`	integer	Configures the radius server attribute id	dellos6
auth (see `attribute.*`)	dellos6
`attribute.type`	integer	Configures the radius server attribute type based on id	dellos6
`attribute.state`	string: present,absent	Removes the radius server attribute if set to absent	dellos6
`tacacs_server`	dictionary	Configures the tacacs server (see `tacacs_server.*`)	dellos6, dellos9
`tacacs_server.key`	string (required): 0,7,LINE	Configures the authentication key for tacacs server	dellos6, dellos9
`tacacs_server.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if tacacs_server.key is 7 or 0	dellos6, dellos9
`tacacs_server.group`	dictionary	Configures the group of tacacs servers (see `group.*`)	dellos9
`group.name`	string (required)	Configures the group name of the tacacs servers	dellos9
`group.host`	dictionary	Configures the tacacs server host in the group (see `host.*`)	dellos9
`host.ip`	string	Configures the tacacs server host address in the group	dellos9
`host.key`	string (required): 0,7,LINE	Configures the authentication key of the tacacs server host	dellos9
`host.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only host.key is 7 or 0	dellos9
`host.retransmit`	integer	Configures the number of retransmissions	dellos9
`host.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos9
`host.timeout`	integer	Configures timeout for retransmissions	dellos9
`host.state`	string: present,absent	Removes the host from group of tacacs server if set to absent	dellos9
`group.vrf`	dictionary	Configures VRF for tacacs servers in the group (see `vrf.*`)	dellos9
`vrf.vrf_name`	string (required)	Configures the name of VRF for tacacs server group	dellos9
`vrf.source_intf`	integer	Configures source interface for outgoing packets from servers in the group	dellos9
`vrf.state`	string: present,absent	Removes the VRF from group of tacacs server if set to absent	dellos9
`group.state`	string: present,absent	Removes the tacacs server group if set to absent	dellos9
`tacacs_server.host`	dictionary	Configures the tacacs server host (see `host.*`)	dellos6, dellos9
`host.ip`	string	Configures the tacacs sever host address	dellos6, dellos9
`host.key`	string (required): 0,7,LINE	Configures the authentication key	dellos6, dellos9
`host.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0	dellos6, dellos9
`host.retransmit`	integer	Configures the number of retransmissions	dellos9
`host.auth_port`	integer	Configures the authentication port (0 to 65535)	dellos6, dellos9
`host.timeout`	integer	Configures the timeout for retransmissions	dellos6, dellos9
`host.state`	string: present,absent	Removes the tacacs server host if set to absent	dellos6, dellos9
`aaa_accounting`	dictionary	Configures accounting parameters (see `aaa_accounting.*`)	dellos6, dellos9
`aaa_accounting.commands`	list	Configures accounting for exec (shell) and config commands (see `commands.*`)	dellos9
`commands.enable_level`	integer	Configures enable level for accounting of commands	dellos9
`commands.role_name`	string	Configures user role for accounting of commands; variable is mutually exclusive with `enable_level`	dellos9
`commands.accounting_list_name`	integer	Configures named accounting list for commands	dellos9
`commands.no_accounting`	boolean	Configures no accounting of commands	dellos9
`commands.record_option`	string: start-stop,stop-only,wait-start	Configures options to record data	dellos9
`commands.state`	string: present,absent	Removes the named accounting list for the commands if set to absent	dellos9
`aaa_accounting.exec`	list	Configures accounting for EXEC (shell) commands (see `exec.*`)	dellos9
`exec.accounting_list_name`	string	Configures named accounting list for exec commands	dellos9
`exec.no_accounting`	boolean	Configures no accounting of EXEC commands	dellos9
`exec.record_option`	string: start-stop,stop-only,wait-start	Configures options to record data	dellos9
`exec.state`	string: present,absent	Removes the named accounting list for the exec commands if set to absent	dellos9
`aaa_accounting.suppress`	boolean	Suppresses accounting for users with NULL username	dellos9
`aaa_accounting.dot1x`	string: none,start-stop,stop-only,wait-start	Configures accounting for dot1x events	dellos6, dellos9
`aaa_accounting.rest`	string:none,start-stop,stop-only,wait-start	Configures accounting for rest interface events	dellos9
`aaa_authorization`	dictionary	Configures authorization parameters (see `aaa_authorization.*`)	dellos6, dellos9
`aaa_authorization.commands`	list	Configures authorization for EXEC (shell) and config commands (see `commands.*`)	dellos9
`commands.enable_level`	integer	Configures enable level for authorization of commands	dellos9
`commands.role_name`	string	Configures user role for authorization of commands; mutually exclusive with `enable_level`	dellos9
`commands.authorization_list_name`	string	Configures named authorization list for commands	dellos9
`commands.authorization_method`	string: none	Configures no authorization of commands	dellos9
`commands.use_data`	string: local,tacacs+	Configures data used for authorization	dellos9
`commands.state`	string: present,absent	Removes the named authorization list for the commands if set to absent	dellos9
`aaa_authorization.config_commands`	boolean	Configures authorization for configuration mode commands	dellos9
`aaa_authorization.role_only`	boolean	Configures validation of authentication mode for user role	dellos9
`aaa_authorization.exec`	list	Configures authorization for EXEC (shell) commands (see `exec.*`)	dellos6, dellos9
`exec.authorization_list_name`	string	Configures named authorization list for EXEC commands	dellos6, dellos9
`exec.authorization_method`	string: none	Configures no authorization of EXEC commands	dellos6, dellos9
`exec.use_data`	string: local,tacacs+	Configures data used for authorization	dellos6, dellos9
`exec.state`	string: present,absent	Removes the named authorization list for the EXEC commands if set to absent	dellos6, dellos9
`aaa_authorization.network`	string: none,radius,ias	Configures authorization for network events	dellos6, dellos9
`aaa_authentication`	dictionary	Configures authentication parameters (see `aaa_authentication.*`)	dellos9, dellos10
`aaa_authentication.local_auth`	dictionary	Configures local authentication parameters (see `aaa_authentication.local_auth.*`)	dellos10
`aaa_authetication.local_auth.radius`	boolean	Configures authentication method as local along with radius if set to true	dellos10
`aaa_authentication.radius_auth`	dictionary	Configures radius authentication parameters (see `aaa_authentication.radius_auth.*`)	dellos10
`aaa_authetication.radius_auth.local`	boolean	Configures authentication method as radius along with local if set to true	dellos10
`aaa_authentication.re_authenticate`	boolean	Configures re-authenticate by enable if set to true on dellos10 devices	dellos10
`aaa_radius`	dictionary	Configures AAA for radius group of servers (see `aaa_radius.*`)	dellos9
`aaa_radius.group`	string	Configures name of the radius group of servers for AAA	dellos9
`aaa_radius.auth_method`	string: pap,mschapv2	Configures authentication method of radius group of servers for AAA	dellos9
`aaa_tacacs`	dictionary	Configures AAA for tacacs group of servers (see `aaa_tacacs.*`)	dellos9
`aaa_tacacs.group`	string	Configures name of the tacacs group of servers for AAA	dellos9
`aaa_authentication.auth_list`	list	Configures named authentication list for hosts (see `host.*`)	dellos6, dellos9
`auth_list.name`	string	Configures named authentication list	dellos6, dellos9
`auth_list.login_or_enable`	string: enable,login	Configures authentication list for login or enable	dellos6, dellos9
`auth_list.server`	string: radius,tacacs+	Configures AAA to use this list of all server hosts	dellos6, dellos9
`auth_list.use_password`	string: line,local,enable,none	Configures password to use for authentication	dellos6, dellos9
`auth_list.state`	string: present,absent	Removes the named authentication list if set to absent	dellos6, dellos9
`aaa_authentication.dot1x`	string: none,radius,ias	Configures authentication for dot1x events	dellos6, dellos9
`line_terminal`	dictionary	Configures the terminal line (see `line_terminal.*`)	dellos9
`line_terminal.<terminal>`	dictionary	Configures the primary or virtual terminal line (see `<terminal>.*`); value can be console <line_number>, vty <line_number>	dellos9
`<terminal>.authorization`	dictionary	Configures authorization parameters of line terminal (see `authorization.*`)	dellos9
`authorization.commands`	list	Configures authorization for EXEC (shell) and config commands (see `commands.*`)	dellos9
`commands.enable_level`	integer	Configures enable level for authorization of commands at line terminal	dellos9
`commands.role_name`	string	Configures user role for authorization of commands at line terminal; mutually exclusive with `enable_level`	dellos9
`commands.authorization_list_name`	string	Configures named authorization list for commands	dellos9
`commands.state`	string: present,absent	Removes the authorization of commands from line terminal if set to absent	dellos9
`authorization.exec`	list	Configures authorization for EXEC (shell) commands at line terminal (see `exec.*`)	dellos9
`exec.authorization_list_name`	string	Configures named authorization list for EXEC commands	dellos9
`exec.state`	string: present,absent	Removes the authorization of EXEC (shell) from line terminal if set to absent	dellos9
`<terminal>.accounting`	dictionary	Configures accounting parameters of line terminal (see `accounting.*`)	dellos9
`accounting.commands`	list	Configures accounting for EXEC (shell) and config commands (see `commands.*`)	dellos9
`commands.enable_level`	integer	Configures enable level for accounting of commands at line terminal	dellos9
`commands.role_name`	string	Configures user role for accounting of commands at line terminal; mutually exclusive with `enable_level`	dellos9
`commands.accounting_list_name`	string	Configures named accounting list for commands	dellos9
`commands.state`	string: present,absent	Removes the accounting of commands from line terminal if set to absent	dellos9
`accounting.exec`	list	Configures accounting for EXEC (shell) commands at line terminal (see `exec.*`)	dellos9
`exec.accounting_list_name`	string	Configures named accounting list for EXEC commands	dellos9
`exec.state`	string: present,absent	Removes the accounting of EXEC (shell) from line terminal if set to absent	dellos9
`<terminal>.authentication`	dictionary	Configures authentication parameters of line terminal (see `authentication.*`)	dellos9
`authentication.enable`	string	Configures the authentication list for privilege-level password authentication	dellos9
`authentication.login`	string	Configures the authentication list for password checking	dellos9
`aaa_server`	dictionary	Configures the aaa server (see `aaa_server.*`)	dellos6
`radius`	dictionary	Configures the radius server (see `radius.*`)	dellos6
`dynamic_author`	dictionary	Configures the radius server (see `dynamic_author.*`)	dellos6
`dynamic_author.auth_type`	string	Configures the authentication type for the radius server	dellos6
`dynamic_author.client`	list	Configures the client for the radius server	dellos6
`client.ip`	string	Configures the client ip for the radius server	dellos69
`client.key`	string (required): 0,7,LINE	Configures the authentication key for the radius server	dellos69
`client.key_string`	string	Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0	dellos6
`client.state`	string: present,absent	Removes the accounting of client if set to absent	dellos6
`dynamic_author.state`	string: present,absent	Removes the accounting of client if set to absent	dellos6

NOTE: Asterisk (*) denotes the default value if none is specified.

Connection variables

Ansible Dell EMC Networking roles require connection information to establish communication with the nodes in your inventory. This information can exist in the Ansible group_vars or host_vars directories or inventory, or in the playbook itself.

Key	Required	Choices	Description
`ansible_host`	yes		Specifies the hostname or address for connecting to the remote device over the specified transport
`ansible_port`	no		Specifies the port used to build the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_PORT option is used; it defaults to 22
`ansible_ssh_user`	no		Specifies the username that authenticates the CLI login for the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_USER environment variable value is used
`ansible_ssh_pass`	no		Specifies the password that authenticates the connection to the remote device.
`ansible_become`	no	yes, no*	Instructs the module to enter privileged mode on the remote device before sending any commands; if value is unspecified, the ANSIBLE_BECOME environment variable value is used, and the device attempts to execute all commands in non-privileged mode
`ansible_become_method`	no	enable, sudo*	Instructs the module to allow the become method to be specified for handling privilege escalation; if value is unspecified, the ANSIBLE_BECOME_METHOD environment variable value is used.
`ansible_become_pass`	no		Specifies the password to use if required to enter privileged mode on the remote device; if `ansible_become` is set to no this key is not applicable.
`ansible_network_os`	yes	dellos6/dellos9/dellos10, null*	This value is used to load the correct terminal and cliconf plugins to communicate with the remote device.

NOTE: Asterisk (*) denotes the default value if none is specified.

Dependencies

The dellos-aaa role is built on modules included in the core Ansible code. These modules were added in Ansible version 2.2.0.

Example playbook

This example uses the dellos-aaa role to configure AAA for radius and TACACS servers. It creates a hosts file with the switch details and corresponding variables. The hosts file should define the ansible_network_os variable with the corresponding Dell EMC Networking OS name.

When dellos_cfg_generate is set to true, the variable generates the configuration commands as a .part file in the build_dir path. By default, it is set to false and it writes a simple playbook that only references the dellos-aaa role.

Sample hosts file

leaf1 ansible_host= <ip_address>

Sample host_vars/leaf1

hostname: leaf1
ansible_become: yes
ansible_become_method: xxxxx
ansible_become_pass: xxxxx
ansible_ssh_user: xxxxx
ansible_ssh_pass: xxxxx
ansible_network_os: dellos9
build_dir: ../temp/dellos9

dellos_aaa:
  radius_server:
      key: radius
      retransmit: 5
      timeout: 40
      deadtime: 2300
      group:
        - name: RADIUS
          host:
            - ip: 2001:4898:f0:f09b::1002
              key: 0
              key_string: aaaa
              retransmit: 5
              auth_port: 3
              timeout: 2
              state: present
          vrf:
            vrf_name: test
            source_intf: fortyGigE 1/2
            state: absent
          state: present
      host:
        - ip: 2001:4898:f0:f09b::1002
          key: xxx
          retransmit: 5
          auth_port: 3
          timeout: 2
          state: present
  tacacs_server:
      key: 7
      key_string: 9ea8ec421c2e2e5bec757f44205015f6d81e83a4f0aa52fa
      group:
        - name: TACACS
          host:
            - ip: 2001:4898:f0:f09b::1000
              key: 0
              key_string: aaa
              retransmit: 6
              auth_port: 3
              timeout: 2
              state: present
          vrf:
            vrf_name: tes
            source_intf: fortyGigE 1/3
            state: present
          state: present
      host:
        - ip: 2001:4898:f0:f09b::1000
          key: 0
          key_string: aa
          retransmit: 5
          auth_port: 3
          timeout: 2
          state: present
  aaa_accounting:
      commands:
          - enable_level: 2
            accounting_list_name: aa
            record_option: start-stop
            state: present
          - role_name: netadmin
            accounting_list_name: aa
            no_accounting: none
      suppress: True
      exec:
          - accounting_list_name: aaa
            no_accounting: true
            state: present
      dot1x: none
      rest: none
  aaa_authorization:
      commands:
          - enable_level: 2
            authorization_list_name: aa
            use_data: local
            state: present
          - role_name: netadmin
            authorization_list_name: aa
            authorization_method: none
            use_data: local
      config_commands: True
      role_only:
      exec:
          - authorization_list_name: aaa
            authorization_method: if-authenticated
            use_data: local
            state: present
  aaa_authentication:
      auth_list:
        - name: default
          login_or_enable: login
          server: radius
          use_password: local
          state: present
        - name: console
          server: tacacs+
          login_or_enable: login
          use_password: local
  aaa_radius:
      group: RADIUS
      auth_method: pap
  aaa_tacacs:
      group: TACACS
  line_terminal:
    vty 0:
      authorization:
        commands:
           - enable_level: 2
             authorization_list_name: aa
             state: present
           - role_name: netadmin
             authorization_list_name: aa
             state: present
        exec:
           - authorization_list_name: aa
             state: present
      accounting:
        commands:
           - enable_level: 2
             accounting_list_name: aa
             state: present
           - role_name: netadmin
             accounting_list_name: aa
             state: absent
        exec:
           accounting_list_name: aa
           state: present
      authentication:
        enable:
        login: console

Simple playbook to setup system - leaf.yaml

- hosts: leaf1
  roles:
     - Dell-Networking.dellos-aaa

Run

ansible-playbook -i hosts leaf.yaml

dell-networking / ansible-role-dellos-aaa Goto Github PK

ansible-role-dellos-aaa's Introduction

AAA role

Installation

Role variables

Connection variables

Dependencies

Example playbook

ansible-role-dellos-aaa's People

Contributors

Watchers

Forkers

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent