diff --git a/.github/workflows/clab-validate.yml b/.github/workflows/clab-validate.yml index 04dd9c6..fb9029f 100644 --- a/.github/workflows/clab-validate.yml +++ b/.github/workflows/clab-validate.yml @@ -4,6 +4,9 @@ on: branches: - master pull_request: + paths: + - 'Containerlab/**' + - 'Containerlab-SRL/**' permissions: contents: read diff --git a/.github/workflows/go-lint.yml b/.github/workflows/go-lint.yml index ef446a8..112ea99 100644 --- a/.github/workflows/go-lint.yml +++ b/.github/workflows/go-lint.yml @@ -5,6 +5,8 @@ on: branches: - main pull_request: + paths: + - 'Probe/**' permissions: contents: read diff --git a/.gitignore b/.gitignore index 11c4362..254115a 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,10 @@ Diagrams/*.bkp +# Ansible related +ansible/venv/ +ansible/.venv/ + # Containerlab related Containerlab/clab-aquila/.tls/ Containerlab/clab-aquila/*leaf*/ diff --git a/Containerlab/aquila.clab.yml b/Containerlab/aquila.clab.yml index c254d75..c37eddd 100644 --- a/Containerlab/aquila.clab.yml +++ b/Containerlab/aquila.clab.yml @@ -6,28 +6,33 @@ mgmt: topology: kinds: - juniper_vjunosrouter: - image: vrnetlab/juniper_vjunos-router:25.4R1.12 + nokia_srlinux: + image: ghcr.io/nokia/srlinux + type: ixr-d3 linux: image: rubydelusion/aquila:probe-latest nodes: # Leaves leaf1: - kind: juniper_vjunosrouter + kind: nokia_srlinux mgmt-ipv4: 192.168.10.254 + startup-config: ./configs/leaf1.cfg group: site1 leaf2: - kind: juniper_vjunosrouter + kind: nokia_srlinux mgmt-ipv4: 192.168.10.253 + startup-config: ./configs/leaf2.cfg group: site2 leaf3: - kind: juniper_vjunosrouter + kind: nokia_srlinux mgmt-ipv4: 192.168.10.252 + startup-config: ./configs/leaf3.cfg group: site3 leaf4: - kind: juniper_vjunosrouter + kind: nokia_srlinux mgmt-ipv4: 192.168.10.251 + startup-config: ./configs/leaf3.cfg group: site4 # Probes @@ -56,23 +61,23 @@ topology: links: # Inter-Leaf links - - endpoints: [ "leaf1:eth9", "leaf2:eth9" ] - - endpoints: [ "leaf1:eth10", "leaf2:eth10" ] - - endpoints: [ "leaf1:eth11", "leaf3:eth11" ] - - endpoints: [ "leaf1:eth12", "leaf3:eth12" ] - - endpoints: [ "leaf2:eth11", "leaf4:eth11" ] - - endpoints: [ "leaf2:eth12", "leaf4:eth12" ] - - endpoints: [ "leaf3:eth9", "leaf4:eth9" ] - - endpoints: [ "leaf3:eth10", "leaf4:eth10" ] + - endpoints: [ "leaf1:ethernet-1/9", "leaf2:ethernet-1/9" ] + - endpoints: [ "leaf1:ethernet-1/10", "leaf2:ethernet-1/10" ] + - endpoints: [ "leaf1:ethernet-1/11", "leaf3:ethernet-1/11" ] + - endpoints: [ "leaf1:ethernet-1/12", "leaf3:ethernet-1/12" ] + - endpoints: [ "leaf2:ethernet-1/11", "leaf4:ethernet-1/11" ] + - endpoints: [ "leaf2:ethernet-1/12", "leaf4:ethernet-1/12" ] + - endpoints: [ "leaf3:ethernet-1/9", "leaf4:ethernet-1/9" ] + - endpoints: [ "leaf3:ethernet-1/10", "leaf4:ethernet-1/10" ] # Leaf-Probe links - - endpoints: [ "probe-leaf1:eth2", "leaf1:eth1" ] - - endpoints: [ "probe-leaf2:eth2", "leaf2:eth1" ] - - endpoints: [ "probe-leaf3:eth2", "leaf3:eth1" ] - - endpoints: [ "probe-leaf4:eth2", "leaf4:eth1" ] + - endpoints: [ "probe-leaf1:eth1", "leaf1:ethernet-1/1" ] + - endpoints: [ "probe-leaf2:eth1", "leaf2:ethernet-1/1" ] + - endpoints: [ "probe-leaf3:eth1", "leaf3:ethernet-1/1" ] + - endpoints: [ "probe-leaf4:eth1", "leaf4:ethernet-1/1" ] # Orchestrator-Probe links - - endpoints: [ "orchestrator:eth1", "probe-leaf1:eth1" ] - - endpoints: [ "orchestrator:eth2", "probe-leaf2:eth1" ] - - endpoints: [ "orchestrator:eth3", "probe-leaf3:eth1" ] - - endpoints: [ "orchestrator:eth4", "probe-leaf4:eth1" ] + - endpoints: [ "orchestrator:eth1", "probe-leaf1:eth2" ] + - endpoints: [ "orchestrator:eth2", "probe-leaf2:eth2" ] + - endpoints: [ "orchestrator:eth3", "probe-leaf3:eth2" ] + - endpoints: [ "orchestrator:eth4", "probe-leaf4:eth2" ] diff --git a/Containerlab/clab-aquila/ansible-inventory.yml b/Containerlab/clab-aquila/ansible-inventory.yml new file mode 100644 index 0000000..f10e0f0 --- /dev/null +++ b/Containerlab/clab-aquila/ansible-inventory.yml @@ -0,0 +1,36 @@ +all: + vars: + # The generated inventory is assumed to be used from the clab host. + # Hence no http proxy should be used. Therefore we make sure the http + # module does not attempt using any global http proxy. + ansible_httpapi_use_proxy: false + children: + linux: + hosts: + clab-aquila-orchestrator: + ansible_host: 192.168.10.4 + clab-aquila-probe-leaf1: + ansible_host: 192.168.10.5 + clab-aquila-probe-leaf2: + ansible_host: 192.168.10.6 + clab-aquila-probe-leaf3: + ansible_host: 192.168.10.7 + clab-aquila-probe-leaf4: + ansible_host: 192.168.10.8 + nokia_srlinux: + vars: + ansible_network_os: nokia.srlinux.srlinux + # default connection type for nodes of this kind + # feel free to override this in your inventory + ansible_connection: ansible.netcommon.httpapi + ansible_user: admin + ansible_password: NokiaSrl1! + hosts: + clab-aquila-leaf1: + ansible_host: 192.168.10.254 + clab-aquila-leaf2: + ansible_host: 192.168.10.253 + clab-aquila-leaf3: + ansible_host: 192.168.10.252 + clab-aquila-leaf4: + ansible_host: 192.168.10.251 \ No newline at end of file diff --git a/Containerlab/clab-aquila/nornir-simple-inventory.yml b/Containerlab/clab-aquila/nornir-simple-inventory.yml new file mode 100644 index 0000000..79df59c --- /dev/null +++ b/Containerlab/clab-aquila/nornir-simple-inventory.yml @@ -0,0 +1,46 @@ +--- +orchestrator: + username: + password: + platform: linux + hostname: 192.168.10.4 +probe-leaf1: + username: + password: + platform: linux + hostname: 192.168.10.5 +probe-leaf2: + username: + password: + platform: linux + hostname: 192.168.10.6 +probe-leaf3: + username: + password: + platform: linux + hostname: 192.168.10.7 +probe-leaf4: + username: + password: + platform: linux + hostname: 192.168.10.8 +leaf1: + username: admin + password: NokiaSrl1! + platform: nokia_srlinux + hostname: 192.168.10.254 +leaf2: + username: admin + password: NokiaSrl1! + platform: nokia_srlinux + hostname: 192.168.10.253 +leaf3: + username: admin + password: NokiaSrl1! + platform: nokia_srlinux + hostname: 192.168.10.252 +leaf4: + username: admin + password: NokiaSrl1! + platform: nokia_srlinux + hostname: 192.168.10.251 \ No newline at end of file diff --git a/Containerlab/configs/leaf1.cfg b/Containerlab/configs/leaf1.cfg new file mode 100644 index 0000000..c0ea118 --- /dev/null +++ b/Containerlab/configs/leaf1.cfg @@ -0,0 +1,56 @@ +set / interface lag102 admin-state enable +set / interface lag102 lag lag-type lacp +set / interface lag102 lag min-links 1 +set / interface lag102 lag lacp interval FAST +set / interface lag102 lag lacp lacp-mode ACTIVE + +set / interface lag103 admin-state enable +set / interface lag103 lag lag-type lacp +set / interface lag103 lag min-links 1 +set / interface lag103 lag lacp interval FAST +set / interface lag103 lag lacp lacp-mode ACTIVE + +set / interface lo0 admin-state enable +set / interface lo0 subinterface 1 admin-state enable +set / interface lo0 subinterface 1 ipv4 admin-state enable +set / interface lo0 subinterface 1 ipv4 address 10.0.0.1/32 +set / network-instance default interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 passive true + +set / interface ethernet-1/9 admin-state enable +set / interface ethernet-1/9 ethernet aggregate-id lag102 +set / interface ethernet-1/9 ethernet port-speed 25G +set / interface ethernet-1/9 description ISL-leaf2-eth-1/9 +set / interface ethernet-1/10 admin-state enable +set / interface ethernet-1/10 ethernet aggregate-id lag102 +set / interface ethernet-1/10 ethernet port-speed 25G +set / interface ethernet-1/10 description ISL-leaf2-eth-1/10 + +set / interface ethernet-1/11 admin-state enable +set / interface ethernet-1/11 ethernet aggregate-id lag103 +set / interface ethernet-1/11 ethernet port-speed 25G +set / interface ethernet-1/11 description ISL-leaf3-eth-1/11 +set / interface ethernet-1/12 admin-state enable +set / interface ethernet-1/12 ethernet aggregate-id lag103 +set / interface ethernet-1/12 ethernet port-speed 25G +set / interface ethernet-1/12 description ISL-leaf3-eth-1/12 + +set / interface lag102 subinterface 1 admin-state enable +set / interface lag102 subinterface 1 ipv4 admin-state enable +set / interface lag102 subinterface 1 ipv4 address 172.16.10.0/31 + +set / interface lag103 subinterface 1 admin-state enable +set / interface lag103 subinterface 1 ipv4 admin-state enable +set / interface lag103 subinterface 1 ipv4 address 172.16.10.2/31 + +set / network-instance default interface lag102.1 +set / network-instance default interface lag103.1 + +set / network-instance default protocols ospf instance aquila admin-state enable +set / network-instance default protocols ospf instance aquila version ospf-v2 +set / network-instance default protocols ospf instance aquila router-id 0.0.0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 + +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lag102.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lag103.1 \ No newline at end of file diff --git a/Containerlab/configs/leaf2.cfg b/Containerlab/configs/leaf2.cfg new file mode 100644 index 0000000..7e68f3e --- /dev/null +++ b/Containerlab/configs/leaf2.cfg @@ -0,0 +1,35 @@ +set / interface lag102 admin-state enable +set / interface lag102 lag lag-type lacp +set / interface lag102 lag min-links 1 +set / interface lag102 lag lacp interval FAST +set / interface lag102 lag lacp lacp-mode ACTIVE + +set / interface lo0 admin-state enable +set / interface lo0 subinterface 1 admin-state enable +set / interface lo0 subinterface 1 ipv4 admin-state enable +set / interface lo0 subinterface 1 ipv4 address 10.0.0.2/32 +set / network-instance default interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 passive true + +set / interface ethernet-1/9 admin-state enable +set / interface ethernet-1/9 ethernet aggregate-id lag102 +set / interface ethernet-1/9 ethernet port-speed 25G +set / interface ethernet-1/9 description ISL-leaf1-eth-1/9 +set / interface ethernet-1/10 admin-state enable +set / interface ethernet-1/10 ethernet aggregate-id lag102 +set / interface ethernet-1/10 ethernet port-speed 25G +set / interface ethernet-1/10 description ISL-leaf1-eth-1/10 + +set / interface lag102 subinterface 1 admin-state enable +set / interface lag102 subinterface 1 ipv4 admin-state enable +set / interface lag102 subinterface 1 ipv4 address 172.16.10.1/31 + +set / network-instance default interface lag102.1 + +set / network-instance default protocols ospf instance aquila admin-state enable +set / network-instance default protocols ospf instance aquila version ospf-v2 +set / network-instance default protocols ospf instance aquila router-id 0.0.0.2 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 + +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lag102.1 \ No newline at end of file diff --git a/Containerlab/configs/leaf3.cfg b/Containerlab/configs/leaf3.cfg new file mode 100644 index 0000000..71d7e9d --- /dev/null +++ b/Containerlab/configs/leaf3.cfg @@ -0,0 +1,35 @@ +set / interface lag103 admin-state enable +set / interface lag103 lag lag-type lacp +set / interface lag103 lag min-links 1 +set / interface lag103 lag lacp interval FAST +set / interface lag103 lag lacp lacp-mode ACTIVE + +set / interface lo0 admin-state enable +set / interface lo0 subinterface 1 admin-state enable +set / interface lo0 subinterface 1 ipv4 admin-state enable +set / interface lo0 subinterface 1 ipv4 address 10.0.0.3/32 +set / network-instance default interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lo0.1 passive true + +set / interface ethernet-1/11 admin-state enable +set / interface ethernet-1/11 ethernet aggregate-id lag103 +set / interface ethernet-1/11 ethernet port-speed 25G +set / interface ethernet-1/11 description ISL-leaf1-eth-1/11 +set / interface ethernet-1/12 admin-state enable +set / interface ethernet-1/12 ethernet aggregate-id lag103 +set / interface ethernet-1/12 ethernet port-speed 25G +set / interface ethernet-1/12 description ISL-leaf1-eth-1/12 + +set / interface lag103 subinterface 1 admin-state enable +set / interface lag103 subinterface 1 ipv4 admin-state enable +set / interface lag103 subinterface 1 ipv4 address 172.16.10.3/31 + +set / network-instance default interface lag103.1 + +set / network-instance default protocols ospf instance aquila admin-state enable +set / network-instance default protocols ospf instance aquila version ospf-v2 +set / network-instance default protocols ospf instance aquila router-id 0.0.0.3 +set / network-instance default protocols ospf instance aquila area 0.0.0.0 + +set / network-instance default protocols ospf instance aquila area 0.0.0.0 interface lag103.1 \ No newline at end of file diff --git a/Containerlab/junos-base.txt b/Containerlab/junos-base.txt deleted file mode 100644 index 68306d4..0000000 --- a/Containerlab/junos-base.txt +++ /dev/null @@ -1,13 +0,0 @@ -configure -system { - login { - user alex { - uid 2001; - class super-user; - authentication { - ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBe2NbH9tX4MVZcfKTggOt60YgtHCbn2iE4S/WjZiKJz alex@Mac.localdomain"; ## SECRET-DATA - } - } - } -} -commit \ No newline at end of file diff --git a/Diagrams/hld.drawio b/Diagrams/hld.drawio index 99d80e7..e4fc416 100644 --- a/Diagrams/hld.drawio +++ b/Diagrams/hld.drawio @@ -1,254 +1,275 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Diagrams/hld.drawio.png b/Diagrams/hld.drawio.png index eff7aaf..3508108 100644 Binary files a/Diagrams/hld.drawio.png and b/Diagrams/hld.drawio.png differ diff --git a/Probe/Dockerfile b/Probe/Dockerfile index 0590618..e7ac29d 100644 --- a/Probe/Dockerfile +++ b/Probe/Dockerfile @@ -2,7 +2,7 @@ FROM ubuntu:24.04 as base LABEL authors="alex" RUN apt-get update && \ - apt-get install -y openssh-server sudo && \ + apt-get install -y openssh-server iputils-ping net-tools iproute2 netplan.io sudo && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* diff --git a/README.md b/README.md index 00266ef..d03a702 100644 --- a/README.md +++ b/README.md @@ -4,24 +4,69 @@ A (hopefully scalable) network monitoring tool used to determine packet loss and * Symfony on the webapp * Junos on the routers (for now) -### High-level diagram: +## High-level diagram: ![Clab-PoC-Diagram](Diagrams/hld.drawio.png) + To test basic functionality we'll use this in the meantime before scaling out to bigger and better things. -Rules: +## IP Addressing +| Host / Interface | IPv4 | Host / Interface | IPv4 | +|------------------|----------------|-------------------------|-------------| +| leaf1 (mgmt) | 192.168.10.254 | probe-leaf (eth1) | 10.0.0.1/32 | +| leaf2 (mgmt) | 192.168.10.253 | probe-leaf (eth1) | 10.0.0.2/32 | +| leaf3 (mgmt) | 192.168.10.253 | probe-leaf (eth1) | 10.0.0.3/32 | +| leaf4 (mgmt) | 192.168.10.252 | probe-leaf (eth1) | 10.0.0.4/32 | +| leaf1 (lo0) | 10.0.0.1/32 | probe-leaf (eth2 / LAN) | | +| leaf2 (lo0) | 10.0.0.2/32 | probe-leaf (eth2 / LAN) | | +| leaf3 (lo0) | 10.0.0.3/32 | probe-leaf (eth2 / LAN) | | +| leaf4 (lo0) | 10.0.0.4/32 | probe-leaf (eth2 / LAN) | | + +### ISLs +| ISL Name | A End | A End IP | B End | B End IP | +|-------------|---------------------------------------|----------------|---------------------------------------|----------------| +| ae102 | leaf1 ethernet-1/9 leaf1 ethernet-1/10 | 172.16.10.0/31 | leaf1 ethernet-1/9 leaf1 ethernet-1/10 | 172.16.10.1/31 | +| ae103 | leaf1 ethernet-1/11 leaf1 ethernet-1/12 | 172.16.10.2/31 | leaf3 ethernet-1/11 leaf3 ethernet-1/12 | 172.16.10.3/31 | +| ae204 | leaf2 ethernet-1/11 leaf2 ethernet-1/12 | 172.16.10.4/31 | leaf4 ethernet-1/11 leaf4 ethernet-1/12 | 172.16.10.5/31 | +| ae304 | leaf3 ethernet-1/9 leaf3 ethernet-1/10 | 172.16.10.6/31 | leaf4 ethernet-1/9 leaf4 ethernet-1/10 | 172.16.10.6/31 | + +## Development +Since we're using srlinux on containerlab, we can run topologies via whatever linux vm. After provisioning the linux VM you can copy-paste the contents of the `provision-vm.sh`script that'll download the stuff you need bar configuring git credentials which need to be done manually - merry christmas. + +## Rules: * Dan's not allowed to write any php -Tasks: -* Design containerlab testing topology - **Alex** -* Build containerlab topology - **Bas** - * Plan an IP addressing scheme - * Build containerlab topology as per network diagram -* Configure containerlab (network) - **Vio** +## Tasks: + +**Alex** +* Build out network + * Configure lacp + ospf ring + * Document ip addresing schema for isls +* Provision probe interfaces + draft netplan + ufw roles +* Build / Provision containers for orcestrator / visualisation server + +**Bas** +* Write / scaffold Go module +* Write PoC scripts to make the probes ping eachother on their LAN interfaces +* Draft go unit tests + actions +* Test clab network + +**Vio** +* Configure containerlab (network) * Write config templates / config files as network as per diagram * Write a provisioning script to apply the configs to the switches -* Configure containerlab (systems) - **Dan** + * Configure leaf4 + * ISL interface config + * OSPF config + * Loopback interface + * Auto-provision based on containerlab topology + +**Dan** +* Configure containerlab (systems) Using ansible: - * Deploy ssh keys for all users + do correct permissions - * Work with containerlab kind default ubuntu user + * Deploy ssh keys for all users + do correct user permissions * Provision aquila-user with correct permissions - * Place demo file in aquila-user dir with correct permissions \ No newline at end of file + * Place demo file in aquila-user dir with correct permissions + * Configure probe-leaf4 + * Netplan vars based on ip schema + * UFW allow config / hardening + * Auto-provision based on containerlab topology \ No newline at end of file diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg new file mode 100644 index 0000000..6fbc0a6 --- /dev/null +++ b/ansible/ansible.cfg @@ -0,0 +1,2 @@ +[defaults] +inventory = cat ./../Containerlab/clab-aquila/ansible-inventory.yml \ No newline at end of file diff --git a/ansible/ansible.md b/ansible/ansible.md new file mode 100644 index 0000000..83171b8 --- /dev/null +++ b/ansible/ansible.md @@ -0,0 +1,3 @@ +Keep systems / testing playbooks in this dir, the `ansible.cfg` file points towards the containerlab-generated hosts file in `Containerlab/clab-aquila/ansible-inventory.yml` + +Try to avoid adhoc commands as you'll need to point towards the hosts file. \ No newline at end of file diff --git a/ansible/requirements.txt b/ansible/requirements.txt new file mode 100644 index 0000000..33cb068 --- /dev/null +++ b/ansible/requirements.txt @@ -0,0 +1 @@ +ansible-core \ No newline at end of file diff --git a/provision-vm.sh b/provision-vm.sh new file mode 100644 index 0000000..fc56de0 --- /dev/null +++ b/provision-vm.sh @@ -0,0 +1,12 @@ +#!/bin/bash +sudo apt-get update +sudo apt-get install -y git ansible ca-certificates curl +git clone https://github.com/ErcModel3/Aquila.git +git clone https://github.com/srl-labs/vrnetlab.git +sudo install -m 0755 -d /etc/apt/keyrings +sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc +sudo chmod a+r /etc/apt/keyrings/docker.asc +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null +sudo apt-get update +sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin +bash -c "$(curl -sL https://get.containerlab.dev)" \ No newline at end of file