Skip to content

Commit baa360b

Browse files
ppiwowa-cscoppiwowa-csco
committed
Example scenarions
1 parent 0167f52 commit baa360b

File tree

10 files changed

+463
-6
lines changed

10 files changed

+463
-6
lines changed

‎plugins/modules/policy.py

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -210,12 +210,14 @@ def run_module():
210210
object_endpoint = module.session.api.policy.security
211211
policy_definition = module.params.get("security")
212212

213-
all_policies: DataSequence[CentralizedPolicyInfo | LocalizedPolicyInfo | AnySecurityPolicyInfo] = module.get_response_safely(object_endpoint.get)
213+
all_policies: DataSequence[CentralizedPolicyInfo | LocalizedPolicyInfo | AnySecurityPolicyInfo] = (
214+
module.get_response_safely(object_endpoint.get)
215+
)
214216
if module.params.get("security"):
215217
all_policies = all_policies.security
216-
filtered_definitions: Optional[DataSequence[CentralizedPolicyInfo | LocalizedPolicyInfo | AnySecurityPolicyInfo]] = all_policies.filter(
217-
policy_name=object_name
218-
)
218+
filtered_definitions: Optional[
219+
DataSequence[CentralizedPolicyInfo | LocalizedPolicyInfo | AnySecurityPolicyInfo]
220+
] = all_policies.filter(policy_name=object_name)
219221
if filtered_definitions:
220222
existing_object: DataSequence[CentralizedPolicy | LocalizedPolicy | SecurityPolicy] = [
221223
module.get_response_safely(object_endpoint.get, id=filtered_definitions[0].policy_id)
@@ -309,7 +311,7 @@ def run_module():
309311
device_action.wait_for_completed()
310312
object_endpoint.edit(policy=object_to_create)
311313
elif module.params.get("localized") or module.params.get("security"):
312-
object_endpoint.edit(policy=object_to_create)
314+
object_endpoint.edit(id=existing_object_id, policy=object_to_create)
313315
elif module.params.get("definition"):
314316
object_endpoint.edit(
315317
id=existing_object_id,

‎roles/policies/defaults/main.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
2+
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
4+
---
5+
6+
policies: {}
7+
default_policy:
8+
name: "Ansible Managed centralized policy"
9+
hub_and_spoke: []
10+
mesh: []
11+
acl_policy: []
12+
app_route: []
13+
geolocation_block: []
14+
15+
combined_policies: "{{ default_policy | combine(policies, recursive=True) }}"
16+
17+
created_centralized_policies: []
18+
created_localized_policies: []
19+
created_security_policies: []

‎roles/policies/meta/main.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
3+
galaxy_info:
4+
author: Piotr Piwowarski <[email protected]>
5+
description: Allow user to configure pre defined policies in Cisco SD-WAN
6+
license: GPL-3.0-or-later
7+
min_ansible_version: "2.16.6"
8+
9+
galaxy_tags:
10+
- cisco
11+
- sdwan
12+
- catalystwan
13+
- networking
14+
15+
dependencies: []

‎roles/policies/tasks/acl_policy.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
2+
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
4+
---
5+
- name: "Create acl policy {{ policy_item['name'] }}"
6+
cisco.catalystwan.policy:
7+
name: "{{ policy_item['name'] }}"
8+
definition:
9+
type: "access_control_list"
10+
sequences: "{{ _sequences | from_yaml }}"
11+
manager_credentials:
12+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
13+
username: "{{ (vmanage_instances | first).admin_username }}"
14+
password: "{{ (vmanage_instances | first).admin_password }}"
15+
register: result_policy
16+
vars:
17+
_sequences: |
18+
- sequenceId: 1
19+
{% if "next_hop" in policy_item['action'] %}
20+
actions:
21+
- type: set
22+
parameter:
23+
- field: nextHop
24+
value: "{{ policy_item['action']['next_hop'] }}"
25+
{% endif %}
26+
match:
27+
entries:
28+
{% if "source_port" in policy_item['match'] %}
29+
- field: sourcePort
30+
value: "{{ policy_item['match']['source_port'] }}"
31+
{% endif %}
32+
{% if "destination_port" in policy_item['match'] %}
33+
- field: destinationPort
34+
value: "{{ policy_item['match']['destination_port'] }}"
35+
{% endif %}
36+
{% if "source_ip" in policy_item['match'] %}
37+
- field: sourceIp
38+
value: "{{ policy_item['match']['source_ip'] }}"
39+
{% endif %}
40+
{% if "destination_ip" in policy_item['match'] %}
41+
- field: destinationIp
42+
value: "{{ policy_item['match']['destination_ip'] }}"
43+
{% endif %}
44+
45+
- name: Save policy id
46+
ansible.builtin.set_fact:
47+
created_localized_policies: "{{ created_localized_policies + [_created_policy] }}"
48+
vars:
49+
_created_policy:
50+
type: acl
51+
definitionId: "{{ result_policy['id'] }}"

‎roles/policies/tasks/app_route.yml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
2+
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
4+
---
5+
- name: "Create SLA class list for application route policy {{ policy_item['name'] }}"
6+
cisco.catalystwan.policy:
7+
name: "{{ policy_item['name'] }}_sla"
8+
list:
9+
type: "sla"
10+
entries:
11+
- loss: "{{ policy_item['action']['sla_class']['loss'] }}"
12+
latency: "{{ policy_item['action']['sla_class']['latency'] }}"
13+
jitter: "{{ policy_item['action']['sla_class']['jitter'] }}"
14+
manager_credentials:
15+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
16+
username: "{{ (vmanage_instances | first).admin_username }}"
17+
password: "{{ (vmanage_instances | first).admin_password }}"
18+
when: "'sla_class' in policy_item['action']"
19+
register: result_sla_class
20+
21+
- name: "Create application route policy {{ policy_item['name'] }}"
22+
cisco.catalystwan.policy:
23+
name: "{{ policy_item['name'] }}"
24+
definition:
25+
type: "app_route"
26+
sequences: "{{ _sequences | from_yaml }}"
27+
manager_credentials:
28+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
29+
username: "{{ (vmanage_instances | first).admin_username }}"
30+
password: "{{ (vmanage_instances | first).admin_password }}"
31+
register: result_policy
32+
vars:
33+
_sequences: |
34+
- sequenceId: 1
35+
actions:
36+
{% if "counter" in policy_item['action'] %}
37+
- type: count
38+
parameter: "{{ policy_item['action']['counter'] }}"
39+
{% endif %}
40+
{% if "log" in policy_item['action'] %}
41+
- type: log
42+
parameter: "{{ policy_item['action']['log'] }}"
43+
{% endif %}
44+
{% if "log" in policy_item['action'] %}
45+
- type: slaClass
46+
parameter: "{{ policy_item['action']['sla_class'] }}"
47+
{% endif %}
48+
match:
49+
entries:
50+
{% if "source_port" in policy_item['match'] %}
51+
- field: sourcePort
52+
value: "{{ policy_item['match']['source_port'] }}"
53+
{% endif %}
54+
{% if "destination_port" in policy_item['match'] %}
55+
- field: destinationPort
56+
value: "{{ policy_item['match']['destination_port'] }}"
57+
{% endif %}
58+
{% if "source_ip" in policy_item['match'] %}
59+
- field: sourceIp
60+
value: "{{ policy_item['match']['source_ip'] }}"
61+
{% endif %}
62+
{% if "destination_ip" in policy_item['match'] %}
63+
- field: destinationIp
64+
value: "{{ policy_item['match']['destination_ip'] }}"
65+
{% endif %}
66+
67+
- name: Save policy id
68+
ansible.builtin.set_fact:
69+
created_centralized_policies: "{{ created_centralized_policies + [_created_policy] }}"
70+
vars:
71+
_created_policy:
72+
type: appRoute
73+
definitionId: "{{ result_policy['id'] }}"

‎roles/policies/tasks/example-forwarding-qos.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
# Copyright 2024 Cisco Systems, Inc. and its affiliates
2+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
33
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
44

55
# https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/qos/vEdge-20-x/qos-book/forwarding-qos.html#Cisco_Concept.dita_aa3e0d07-462e-463f-8f45-681f38f61ab0

‎roles/policies/tasks/geolocation_block.yml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
2+
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
4+
---
5+
- name: "Create source zone for geolocation block policy {{ policy_item['name'] }}"
6+
cisco.catalystwan.policy:
7+
name: "{{ policy_item['name'] }}_src"
8+
list:
9+
type: "zone"
10+
entries:
11+
- vpn: "{{ policy_item['source_vpn'] }}"
12+
manager_credentials:
13+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
14+
username: "{{ (vmanage_instances | first).admin_username }}"
15+
password: "{{ (vmanage_instances | first).admin_password }}"
16+
register: result_source_zone
17+
18+
- name: "Create destination zone for geolocation block policy {{ policy_item['name'] }}"
19+
cisco.catalystwan.policy:
20+
name: "{{ policy_item['name'] }}_dst"
21+
list:
22+
type: "zone"
23+
entries:
24+
- vpn: "{{ policy_item['destination_vpn'] }}"
25+
manager_credentials:
26+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
27+
username: "{{ (vmanage_instances | first).admin_username }}"
28+
password: "{{ (vmanage_instances | first).admin_password }}"
29+
register: result_destination_zone
30+
31+
32+
- name: "Create security policy {{ policy_item['name'] }}"
33+
cisco.catalystwan.policy:
34+
name: "{{ policy_item['name'] }}"
35+
definition:
36+
type: "zone_based_firewall"
37+
definition:
38+
entries:
39+
- sourceZone: "{{ result_source_zone['id'] }}"
40+
destinationZone: "{{ result_destination_zone['id'] }}"
41+
sequences: "{{ _sequences | from_yaml }}"
42+
manager_credentials:
43+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
44+
username: "{{ (vmanage_instances | first).admin_username }}"
45+
password: "{{ (vmanage_instances | first).admin_password }}"
46+
register: result_policy
47+
vars:
48+
_sequences: |
49+
- sequenceId: 1
50+
sequenceName: sequence 1
51+
match:
52+
entries:
53+
{% for geolocation in policy_item['geolocations'] %}
54+
- field: sourceGeoLocation
55+
value: "{{ geolocation }}"
56+
{% endfor %}
57+
- sequenceId: 2
58+
sequenceName: sequence 2
59+
match:
60+
entries:
61+
{% for geolocation in policy_item['geolocations'] %}
62+
- field: destinationGeoLocation
63+
value: "{{ geolocation }}"
64+
{% endfor %}
65+
66+
- name: Save policy id
67+
ansible.builtin.set_fact:
68+
created_security_policies: "{{ created_security_policies + [_created_policy] }}"
69+
vars:
70+
_created_policy:
71+
type: zoneBasedFW
72+
definitionId: "{{ result_policy['id'] }}"

‎roles/policies/tasks/hub_and_spoke.yml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Copyright 2025 Cisco Systems, Inc. and its affiliates
2+
# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
4+
---
5+
- name: "Create vpn list for hub and spoke policy {{ policy_item['name'] }}"
6+
cisco.catalystwan.policy:
7+
name: "{{ policy_item['name'] }}_vpn"
8+
list:
9+
type: "vpn"
10+
entries: "{{ _entries | from_yaml }}"
11+
manager_credentials:
12+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
13+
username: "{{ (vmanage_instances | first).admin_username }}"
14+
password: "{{ (vmanage_instances | first).admin_password }}"
15+
register: result_vpn_list
16+
vars:
17+
_entries: |
18+
{% for id in policy_item['vpns'] %}
19+
- vpn: {{ id }}
20+
{% endfor %}
21+
22+
- name: "Create hub list for hub and spoke policy {{ policy_item['name'] }}"
23+
cisco.catalystwan.policy:
24+
name: "{{ policy_item['name'] }}_hub"
25+
list:
26+
type: "site"
27+
entries: "{{ _entries | from_yaml }}"
28+
manager_credentials:
29+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
30+
username: "{{ (vmanage_instances | first).admin_username }}"
31+
password: "{{ (vmanage_instances | first).admin_password }}"
32+
register: result_hub_list
33+
vars:
34+
_entries: |
35+
{% for id in policy_item['hubs'] %}
36+
- site_id: "{{ id }}"
37+
{% endfor %}
38+
39+
- name: "Create spoke list for hub and spoke policy {{ policy_item['name'] }}"
40+
cisco.catalystwan.policy:
41+
name: "{{ policy_item['name'] }}_spoke"
42+
list:
43+
type: "site"
44+
entries: "{{ _entries | from_yaml }}"
45+
manager_credentials:
46+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
47+
username: "{{ (vmanage_instances | first).admin_username }}"
48+
password: "{{ (vmanage_instances | first).admin_password }}"
49+
register: result_spoke_list
50+
vars:
51+
_entries: |
52+
{% for id in policy_item['spokes'] %}
53+
- site_id: "{{ id }}"
54+
{% endfor %}
55+
56+
- name: "Create hub and spoke policy {{ policy_item['name'] }}"
57+
cisco.catalystwan.policy:
58+
name: "{{ policy_item['name'] }}"
59+
definition:
60+
type: "hub_and_spoke"
61+
definition:
62+
vpnList: "{{ result_vpn_list['id'] }}"
63+
subDefinitions:
64+
- spokes:
65+
- siteList: "{{ result_spoke_list['id'] }}"
66+
hubs:
67+
- siteList: "{{ result_spoke_list['id'] }}"
68+
manager_credentials:
69+
url: "{{ (vmanage_instances | first).mgmt_public_ip }}"
70+
username: "{{ (vmanage_instances | first).admin_username }}"
71+
password: "{{ (vmanage_instances | first).admin_password }}"
72+
register: result_policy
73+
74+
- name: Save policy id
75+
ansible.builtin.set_fact:
76+
created_centralized_policies: "{{ created_centralized_policies + [_created_policy] }}"
77+
vars:
78+
_created_policy:
79+
type: hubAndSpoke
80+
definitionId: "{{ result_policy['id'] }}"

0 commit comments

Comments
 (0)