unnumbered – techbloc.net

--- loopback: 10.255.0.3/32 bgp_fabric: asn: 65001 router_id: 10.255.0.3 neighbor: - swp51 - swp52 networks: - 10.0.4.0/24 - 10.255.0.3/32 - 10.255.100.1/32 - 10.0.255.0/28 evpn: true advertise_vni: true peerlink: bond_slaves: swp53 swp54 mtu: 9216 vlan: 4094 address: 169.254.1.1/30 clagd_peer_ip: 169.254.1.2 clagd_backup_ip: 192.168.100.4 clagd_sys_mac: 44:38:39:FF:40:94 clagd_priority: 4096 bridge: ports: peerlink vxlan10201 vids: 901 201 vlans: 901: alias: edge-transit-901 vipv4: 10.0.255.14/28 vmac: 00:00:5e:00:09:01 pipv4: 10.0.255.12/28 201: alias: prod-server-10201 vipv4: 10.0.4.254/24 vmac: 00:00:00:00:02:01 pipv4: 10.0.4.252/24 vlan_id: 201 vlan_raw_device: bridge vxlans: 10201: alias: prod-server-10201 vxlan_local_tunnelip: 10.255.0.3 bridge_access: 201 bridge_learning: 'off' bridge_arp_nd_suppress: 'on'

{% if loopback is defined %} auto lo iface lo inet loopback address {{ loopback }} {% if clagd_vxlan_anycast_ip is defined %} clagd-vxlan-anycast-ip {{ clagd_vxlan_anycast_ip }} {% endif %} {% endif %} ... {% if bridge is defined %} {% for vxlan_id, value in vxlans.items() %} auto vxlan{{ vxlan_id }} iface vxlan{{ vxlan_id }} alias {{ value.alias }} vxlan-id {{ vxlan_id }} vxlan-local-tunnelip {{ value.vxlan_local_tunnelip }} bridge-access {{ value.bridge_access }} bridge-learning {{ value.bridge_learning }} bridge-arp-nd-suppress {{ value.bridge_arp_nd_suppress }} mstpctl-bpduguard yes mstpctl-portbpdufilter yes {% endfor %} {% endif %}

... {% if bgp_fabric.evpn is defined %} address-family ipv6 unicast neighbor fabric activate exit-address-family ! address-family l2vpn evpn neighbor fabric activate {% if bgp_fabric.advertise_vni is defined %} advertise-all-vni {% endif %} exit-address-family {% endif %} {% endif %} ...

This is my Ansible Playbook for a Cumulus Linux BGP IP-Fabric using BGP unnumbered and Cumulus NetQ to validate the configuration in a CICD pipeline. I use the same CICD pipeline from my previous post about Continuous Integration and Delivery for Networking with Cumulus Linux but added the Cumulus NetQ validation in the production stage to check BGP and CLAG configuration.

Network overview:

Here’s my Github repository where you find the complete Ansible Playbook: https://github.com/berndonline/cumulus-lab-provision

The variables are split between group_vars and host_vars. Still need to see if I can find a better way for the variables because interface settings for spine and edge switches are in group_vars, and for leaf switches the interface configuration is per host in host_vars. Not ideal at the moment, it should be the same for all devices.

Roles:

Hostname: This task changes the hostname
Interfaces: This creates the interfaces and bridge (only leafs and edges) configuration. The task uses templates interfaces.j2 and interfaces_config.j2 to create the configuration files under /etc/network/…
Routing: The template frr.j2 creates the FRR (Free Range Routing) configuration file. FRR replaces Quagga since Cumulus Linux version 3.4.x
PTM: Uses as well an template topology.j2 to generate the topology file for the Prescriptive Topology Manager (PTM)
NTP: Ntp and timezone settings

In most of the cases I use Jinja2 templates to generate configuration files. The site.yml is otherwise very simple. It executes the different roles, and triggers the handlers if a change is made by a role.

---

- hosts: network
  strategy: free

  user: cumulus
  become: 'True'
  gather_facts: 'False'

  handlers:
    - name: reload networking
      command: "{{item}}"
      with_items:
        - ifreload -a
        - sleep 10

    - name: reload frr
      service: name=frr state=reloaded

    - name: apply hostname
      command: hostname -F /etc/hostname

    - name: restart netq agent
      command: netq config agent restart

    - name: reload ptmd
      service: name=ptmd state=reloaded

    - name: apply timezone
      command: /usr/sbin/dpkg-reconfigure --frontend noninteractive tzdata

    - name: restart ntp
      service: name=ntp state=restarted

  roles:
    - hostname
    - interfaces
    - routing
    - ptm
    - ntp

Like mentioned in previous posts, I use Gitlab-CI for my Continuous Integration / Continuous Delivery (CICD) pipeline to simulate changes against a virtual Cumulus Linux network using Vagrant. You can find more information about the pipeline configuration in the .gitlab-ci.yml.

Changes in the staging branch will spin-up the Vagrant environment but only executes the the Ansible Playbook:

Cumulus NetQ configuration validation in production:

The production stage in the pipeline spins-up the Vagrant environment and executes the Ansible Playbook, then continues executing the two NetQ checks netq_check_bgp.yml and netq_check_clag.yml to validate the BGP and CLAG configuration: