Add sha, shared-secret options for authentication.

aristanetworks · Jun 18, 2024 · 782bf18 · 782bf18
1 parent d51750e
commit 782bf18
Show file tree

Hide file tree

Showing 22 changed files with 2,336 additions and 48 deletions.
diff --git a/...ta/avd/molecule/eos_cli_config_gen/documentation/devices/ethernet-interfaces.md b/...ta/avd/molecule/eos_cli_config_gen/documentation/devices/ethernet-interfaces.md
@@ -312,7 +312,7 @@ sFlow is disabled.
 
 | Interface | Channel Group | ISIS Instance | ISIS BFD | ISIS Metric | Mode | ISIS Circuit Type | Hello Padding | Authentication Mode |
 | --------- | ------------- | ------------- | -------- | ----------- | ---- | ----------------- | ------------- | ------------------- |
-| Ethernet5 | - | ISIS_TEST | True | 99 | point-to-point | level-2 | False | md5 |
+| Ethernet5 | - | ISIS_TEST | True | 99 | point-to-point | level-2 | False | shared-secret |
 
 ##### EVPN Multihoming
 
@@ -475,8 +475,8 @@ interface Ethernet5
    isis metric 99
    no isis hello padding
    isis network point-to-point
-   isis authentication mode md5
    isis authentication key 7 <removed>
+   isis authentication mode shared-secret profile profile1 algorithm sha-1
    spanning-tree guard loop
 !
 interface Ethernet6

diff --git a/...llections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ethernet-interfaces.cfg b/...llections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ethernet-interfaces.cfg
@@ -128,8 +128,8 @@ interface Ethernet5
    isis metric 99
    no isis hello padding
    isis network point-to-point
-   isis authentication mode md5
    isis authentication key 7 asfddja23452
+   isis authentication mode shared-secret profile profile1 algorithm sha-1
    spanning-tree guard loop
 !
 interface Ethernet6

diff --git a/...ctions/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ethernet-interfaces.yml b/...ctions/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ethernet-interfaces.yml
@@ -209,8 +209,13 @@ ethernet_interfaces:
     isis_network_point_to_point: true
     isis_circuit_type: level-2
     isis_hello_padding: false
-    isis_authentication_mode: md5
+    isis_authentication_mode: shared-secret
     isis_authentication_key: "asfddja23452"
+    isis_authentication_parameters:
+      both:
+        shared_secret:
+          profile: "profile1"
+          algorithm: "sha-1"
     spanning_tree_guard: loop
 
   - name: Ethernet6

diff --git a/...ctions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/core-1-isis-sr-ldp.cfg b/...ctions/arista/avd/molecule/eos_designs_unit_tests/intended/configs/core-1-isis-sr-ldp.cfg
@@ -36,21 +36,19 @@ interface Port-Channel12
 interface Ethernet1
    description P2P_LINK_TO_core-2-ospf-ldp_Ethernet1
    no shutdown
-   mtu 1500
-   speed forced 1000full
+   mtu 1600
    no switchport
    ip address unnumbered loopback0
-   ipv6 enable
    mpls ldp igp sync
    mpls ldp interface
    mpls ip
    isis enable CORE
    isis circuit-type level-2
-   isis metric 60
-   no isis hello padding
+   isis metric 50
+   isis hello padding
    isis network point-to-point
    isis authentication mode md5
-   isis authentication key 7 $1c$sTNAlR6rKSw=
+   isis authentication key 7 $1c$mNvaIXPetcSA2UnFwIaxwA==
 !
 interface Ethernet2
    description P2P_LINK_TO_core-2-ospf-ldp_Ethernet2

diff --git a/...llections/arista/avd/molecule/eos_designs_unit_tests/intended/configs/core-2-ospf-ldp.cfg b/...llections/arista/avd/molecule/eos_designs_unit_tests/intended/configs/core-2-ospf-ldp.cfg
@@ -31,11 +31,9 @@ interface Port-Channel12
 interface Ethernet1
    description P2P_LINK_TO_core-1-isis-sr-ldp_Ethernet1
    no shutdown
-   mtu 1500
-   speed forced 1000full
+   mtu 1600
    no switchport
    ip address unnumbered loopback0
-   ipv6 enable
    mpls ldp igp sync
    mpls ldp interface
    mpls ip

diff --git a/...ta/avd/molecule/eos_designs_unit_tests/intended/structured_configs/core-1-isis-sr-ldp.yml b/...ta/avd/molecule/eos_designs_unit_tests/intended/structured_configs/core-1-isis-sr-ldp.yml
@@ -76,22 +76,20 @@ ethernet_interfaces:
   description: P2P_LINK_TO_core-2-ospf-ldp_Ethernet1
   type: routed
   shutdown: false
-  mtu: 1500
+  mtu: 1600
   ip_address: unnumbered loopback0
-  ipv6_enable: true
   isis_enable: CORE
-  isis_metric: 60
+  isis_metric: 50
   isis_network_point_to_point: true
-  isis_hello_padding: false
+  isis_hello_padding: true
   isis_circuit_type: level-2
   isis_authentication_mode: md5
-  isis_authentication_key: $1c$sTNAlR6rKSw=
+  isis_authentication_key: $1c$mNvaIXPetcSA2UnFwIaxwA==
   mpls:
     ip: true
     ldp:
       interface: true
       igp_sync: true
-  speed: forced 1000full
 - name: Ethernet2
   peer: core-2-ospf-ldp
   peer_interface: Ethernet2

diff --git a/...rista/avd/molecule/eos_designs_unit_tests/intended/structured_configs/core-2-ospf-ldp.yml b/...rista/avd/molecule/eos_designs_unit_tests/intended/structured_configs/core-2-ospf-ldp.yml
@@ -62,17 +62,15 @@ ethernet_interfaces:
   description: P2P_LINK_TO_core-1-isis-sr-ldp_Ethernet1
   type: routed
   shutdown: false
-  mtu: 1500
+  mtu: 1600
   ip_address: unnumbered loopback0
-  ipv6_enable: true
   ospf_network_point_to_point: true
   ospf_area: 0.0.0.0
   mpls:
     ip: true
     ldp:
       interface: true
       igp_sync: true
-  speed: forced 1000full
 - name: Ethernet2
   peer: core-1-isis-sr-ldp
   peer_interface: Ethernet2

diff --git a/...tions/arista/avd/molecule/eos_designs_unit_tests/inventory/group_vars/CORE_UNIT_TESTS.yml b/...tions/arista/avd/molecule/eos_designs_unit_tests/inventory/group_vars/CORE_UNIT_TESTS.yml
@@ -67,7 +67,6 @@ core_interfaces:
       ipv6_enable: true
       isis_authentication_mode: md5
       isis_authentication_key: $1c$sTNAlR6rKSw=
-
     - name: ospf_bb_profile
       speed: "forced 1000full"
       mtu: 1500
@@ -79,7 +78,7 @@ core_interfaces:
     - nodes: [ core-1-isis-sr-ldp, core-2-ospf-ldp ]
       id: 1
       interfaces: [ Ethernet1, Ethernet1 ]
-      profile: isis_bb_profile
+      # profile: isis_bb_profile
       ip: ["unnumbered loopback0", "unnumbered loopback0"]
 
     # Link w/o bb profile

diff --git a/...lections/arista/avd/roles/eos_cli_config_gen/docs/tables/ethernet-interfaces.md b/...lections/arista/avd/roles/eos_cli_config_gen/docs/tables/ethernet-interfaces.md
@@ -190,8 +190,30 @@
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_network_point_to_point</samp>](## "ethernet_interfaces.[].isis_network_point_to_point") | Boolean |  |  |  |  |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_circuit_type</samp>](## "ethernet_interfaces.[].isis_circuit_type") | String |  |  | Valid Values:<br>- <code>level-1-2</code><br>- <code>level-1</code><br>- <code>level-2</code> |  |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_hello_padding</samp>](## "ethernet_interfaces.[].isis_hello_padding") | Boolean |  |  |  |  |
-    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_authentication_mode</samp>](## "ethernet_interfaces.[].isis_authentication_mode") | String |  |  | Valid Values:<br>- <code>text</code><br>- <code>md5</code> |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_authentication_mode</samp>](## "ethernet_interfaces.[].isis_authentication_mode") | String |  |  | Valid Values:<br>- <code>text</code><br>- <code>md5</code><br>- <code>shared-secret</code><br>- <code>sha</code> |  |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_authentication_key</samp>](## "ethernet_interfaces.[].isis_authentication_key") | String |  |  |  | Type-7 encrypted password. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;isis_authentication_parameters</samp>](## "ethernet_interfaces.[].isis_authentication_parameters") | Dictionary |  |  |  | Required when `isis_authentication mode` is `shared-secret` or `sha`. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;both</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both") | Dictionary |  |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sha</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.sha") | Dictionary |  |  |  | Required settings for authentication mode 'sha'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key_id</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.sha.key_id") | Integer | Required |  | Min: 1<br>Max: 65535 |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shared_secret</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.shared_secret") | Dictionary |  |  |  | Required settings for authentication mode 'shared_secret'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;profile</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.shared_secret.profile") | String | Required |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;algorithm</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.shared_secret.algorithm") | String | Required |  | Valid Values:<br>- <code>md5</code><br>- <code>sha-1</code><br>- <code>sha-224</code><br>- <code>sha-256</code><br>- <code>sha-384</code><br>- <code>sha-512</code> |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rx_disable</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.both.rx_disable") | Boolean |  |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;level_1</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1") | Dictionary |  |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sha</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.sha") | Dictionary |  |  |  | Required settings for authentication mode 'sha'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key_id</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.sha.key_id") | Integer | Required |  | Min: 1<br>Max: 65535 |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shared_secret</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.shared_secret") | Dictionary |  |  |  | Required settings for authentication mode 'shared_secret'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;profile</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.shared_secret.profile") | String | Required |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;algorithm</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.shared_secret.algorithm") | String | Required |  | Valid Values:<br>- <code>md5</code><br>- <code>sha-1</code><br>- <code>sha-224</code><br>- <code>sha-256</code><br>- <code>sha-384</code><br>- <code>sha-512</code> |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rx_disable</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_1.rx_disable") | Boolean |  |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;level_2</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2") | Dictionary |  |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sha</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.sha") | Dictionary |  |  |  | Required settings for authentication mode 'sha'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key_id</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.sha.key_id") | Integer | Required |  | Min: 1<br>Max: 65535 |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shared_secret</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.shared_secret") | Dictionary |  |  |  | Required settings for authentication mode 'shared_secret'. |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;profile</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.shared_secret.profile") | String | Required |  |  |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;algorithm</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.shared_secret.algorithm") | String | Required |  | Valid Values:<br>- <code>md5</code><br>- <code>sha-1</code><br>- <code>sha-224</code><br>- <code>sha-256</code><br>- <code>sha-384</code><br>- <code>sha-512</code> |  |
+    | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rx_disable</samp>](## "ethernet_interfaces.[].isis_authentication_parameters.level_2.rx_disable") | Boolean |  |  |  |  |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;poe</samp>](## "ethernet_interfaces.[].poe") | Dictionary |  |  |  |  |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;disabled</samp>](## "ethernet_interfaces.[].poe.disabled") | Boolean |  | `False` |  | Disable PoE on a POE capable port. PoE is enabled on all ports that support it by default in EOS. |
     | [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;priority</samp>](## "ethernet_interfaces.[].poe.priority") | String |  |  | Valid Values:<br>- <code>critical</code><br>- <code>high</code><br>- <code>medium</code><br>- <code>low</code> | Prioritize a port's power in the event that one of the switch's power supplies loses power. |
@@ -750,10 +772,46 @@
         isis_network_point_to_point: <bool>
         isis_circuit_type: <str; "level-1-2" | "level-1" | "level-2">
         isis_hello_padding: <bool>
-        isis_authentication_mode: <str; "text" | "md5">
+        isis_authentication_mode: <str; "text" | "md5" | "shared-secret" | "sha">
 
         # Type-7 encrypted password.
         isis_authentication_key: <str>
+
+        # Required when `isis_authentication mode` is `shared-secret` or `sha`.
+        isis_authentication_parameters:
+          both:
+
+            # Required settings for authentication mode 'sha'.
+            sha:
+              key_id: <int; 1-65535; required>
+
+            # Required settings for authentication mode 'shared_secret'.
+            shared_secret:
+              profile: <str; required>
+              algorithm: <str; "md5" | "sha-1" | "sha-224" | "sha-256" | "sha-384" | "sha-512"; required>
+            rx_disable: <bool>
+          level_1:
+
+            # Required settings for authentication mode 'sha'.
+            sha:
+              key_id: <int; 1-65535; required>
+
+            # Required settings for authentication mode 'shared_secret'.
+            shared_secret:
+              profile: <str; required>
+              algorithm: <str; "md5" | "sha-1" | "sha-224" | "sha-256" | "sha-384" | "sha-512"; required>
+            rx_disable: <bool>
+          level_2:
+
+            # Required settings for authentication mode 'sha'.
+            sha:
+              key_id: <int; 1-65535; required>
+
+            # Required settings for authentication mode 'shared_secret'.
+            shared_secret:
+              profile: <str; required>
+              algorithm: <str; "md5" | "sha-1" | "sha-224" | "sha-256" | "sha-384" | "sha-512"; required>
+            rx_disable: <bool>
         poe:
 
           # Disable PoE on a POE capable port. PoE is enabled on all ports that support it by default in EOS.