Fix(eos_cli_config_gen): Sort IPsec SA, IKE policies and profiles (#4227

) Co-authored-by: Claus Holbech <[email protected]>
aristanetworks · Aug 21, 2024 · 3cc0195 · 3cc0195
1 parent 55d7297
commit 3cc0195
Show file tree

Hide file tree

Showing 18 changed files with 151 additions and 136 deletions.
diff --git a/...ons/arista/avd/molecule/eos_cli_config_gen/documentation/devices/ip-security.md b/...ons/arista/avd/molecule/eos_cli_config_gen/documentation/devices/ip-security.md
@@ -62,6 +62,7 @@ interface Management1
 | SA-4 | md5 | 3des | - | - |
 | SA-5 | sha512 | - | - | - |
 | SA-6 | sha384 | - | - | - |
+| SA-7 | - | - | - | - |
 
 ### IPSec profiles
 
@@ -70,6 +71,7 @@ interface Management1
 | Profile-1 | IKE-1 | SA-1 | start | - | - | - | transport | - |
 | Profile-2 | - | SA-2 | start | - | - | - | tunnel | False |
 | Profile-3 | - | SA-3 | start | - | - | - | tunnel | True |
+| Profile-4 | - | - | - | - | - | - | - | - |
 
 ### Key controller
 
@@ -122,6 +124,8 @@ ip security
    sa policy SA-6
       esp integrity sha384
    !
+   sa policy SA-7
+   !
    profile Profile-1
       ike-policy IKE-1
       sa-policy SA-1
@@ -143,6 +147,8 @@ ip security
       flow parallelization encapsulation udp
       mode tunnel
    !
+   profile Profile-4
+   !
    key controller
       profile Profile-1
    hardware encryption disabled

diff --git a/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ip-security.cfg b/ansible_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ip-security.cfg
@@ -40,6 +40,8 @@ ip security
    sa policy SA-6
       esp integrity sha384
    !
+   sa policy SA-7
+   !
    profile Profile-1
       ike-policy IKE-1
       sa-policy SA-1
@@ -61,6 +63,8 @@ ip security
       flow parallelization encapsulation udp
       mode tunnel
    !
+   profile Profile-4
+   !
    key controller
       profile Profile-1
    hardware encryption disabled

diff --git a/...le_collections/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ip-security.yml b/...le_collections/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ip-security.yml
@@ -1,19 +1,22 @@
 ### IP Security ###
 ip_security:
   ike_policies:
+    # Testing sorting
+    - name: IKE-2
     - name: IKE-1
       local_id: 192.168.100.1
       ike_lifetime: 24
       encryption: aes256
       dh_group: 20
-    - name: IKE-2
     - name: IKE-FQDN
       local_id_fqdn: fqdn.local
     - name: IKE-UFQDN
       local_id_fqdn: [email protected]
       # local_id won't be rendered as local_id_fqdn takes precedence
       local_id: 192.168.42.42
   sa_policies:
+    # Testing sorting
+    - name: SA-7
     - name: SA-1
       esp:
         encryption: aes128
@@ -44,6 +47,8 @@ ip_security:
       esp:
         integrity: sha384
   profiles:
+    # testing sorting
+    - name: Profile-4
     - name: Profile-1
       ike_policy: IKE-1
       sa_policy: SA-1

diff --git a/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-1.cfg b/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-1.cfg
@@ -108,21 +108,14 @@ ip security
    ike policy CP-IKE-POLICY
       local-id 192.168.142.1
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -131,6 +124,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    key controller
       profile DP-PROFILE
 !

diff --git a/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-2.cfg b/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-2.cfg
@@ -108,21 +108,14 @@ ip security
    ike policy CP-IKE-POLICY
       local-id 192.168.142.2
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -131,6 +124,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    key controller
       profile DP-PROFILE
 !

diff --git a/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-3.cfg b/..._designs_unit_tests/intended/configs/cv-pathfinder-custom-control-plane-policy-edge-3.cfg
@@ -108,21 +108,14 @@ ip security
    ike policy CP-IKE-POLICY
       local-id 192.168.142.3
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -131,6 +124,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    key controller
       profile DP-PROFILE
 !

diff --git a/...cule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge-custom-default-policy.cfg b/...cule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge-custom-default-policy.cfg
@@ -120,21 +120,14 @@ ip security
    ike policy CP-IKE-POLICY
       local-id 192.168.255.1
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -143,6 +136,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    key controller
       profile DP-PROFILE
 !

diff --git a/...molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge-no-default-policy.cfg b/...molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge-no-default-policy.cfg
@@ -114,21 +114,14 @@ ip security
    ike policy CP-IKE-POLICY
       local-id 192.168.255.1
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -137,6 +130,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    key controller
       profile DP-PROFILE
 !

diff --git a/...ctions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge.cfg b/...ctions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge.cfg
@@ -254,11 +254,11 @@ ip security
       encryption aes256
       dh-group 24
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
@@ -268,13 +268,6 @@ ip security
       sa lifetime 8 hours
       pfs dh-group 24
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -283,6 +276,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    profile IE-ZSCALER-EXIT-POLICY-1-PROFILE
       ike-policy IE-ZSCALER-EXIT-POLICY-1-IKE-POLICY
       sa-policy IE-ZSCALER-EXIT-POLICY-1-SA-POLICY

diff --git a/...tions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge1.cfg b/...tions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/cv-pathfinder-edge1.cfg
@@ -259,11 +259,11 @@ ip security
       encryption aes256
       dh-group 24
    !
-   sa policy DP-SA-POLICY
+   sa policy CP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
-   sa policy CP-SA-POLICY
+   sa policy DP-SA-POLICY
       esp encryption aes256gcm128
       pfs dh-group 14
    !
@@ -279,13 +279,6 @@ ip security
       sa lifetime 8 hours
       pfs dh-group 24
    !
-   profile DP-PROFILE
-      sa-policy DP-SA-POLICY
-      connection start
-      shared-key 7 ABCDEF1234567890666
-      dpd 10 50 clear
-      mode transport
-   !
    profile CP-PROFILE
       ike-policy CP-IKE-POLICY
       sa-policy CP-SA-POLICY
@@ -294,6 +287,13 @@ ip security
       dpd 10 50 clear
       mode transport
    !
+   profile DP-PROFILE
+      sa-policy DP-SA-POLICY
+      connection start
+      shared-key 7 ABCDEF1234567890666
+      dpd 10 50 clear
+      mode transport
+   !
    profile IE-ZSCALER-EXIT-POLICY-1-PROFILE
       ike-policy IE-ZSCALER-EXIT-POLICY-1-IKE-POLICY
       sa-policy IE-ZSCALER-EXIT-POLICY-1-SA-POLICY