Skip to content

The dellos-aaa role facilitates the configuration of Authentication Authorization Acccounting (AAA) attributes along with TACACS and RADIUS in devices running Dell EMC Networking Operating Systems.

License

Notifications You must be signed in to change notification settings

Dell-Networking/ansible-role-dellos-aaa

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

14 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

AAA role

This role facilitates the configuration of authentication authorization acccounting (AAA). It supports the configuration of TACACS for dellos9 and the configuration of RADIUS server and AAA for dellos10 and dellos6. The AAA role requires an SSH connection for connectivity to a Dell EMC Networking device. You can use any of the built-in OS connection variables .

Installation

ansible-galaxy install Dell-Networking.dellos-aaa

Role variables

  • Role is abstracted using the ansible_network_os variable that can take dellos6, dellos9 and dellos10 values
  • If dellos_cfg_generate is set to true, the variable generates the role configuration commands in a file
  • Any role variable with a corresponding state variable set to absent negates the configuration of that variable
  • Setting an empty value for any variable negates the corresponding configuration
  • Variables and values are case-sensitive

dellos_aaa keys

Key Type Description Support
radius_server dictionary Configures the radius server (see radius_server.*) dellos6, dellos9, dellos10
radius_server.key string (required): 0,7,LINE Configures the authentication key for the radius server dellos6, dellos9
radius_server.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0 dellos6, dellos9
radius_server.retransmit integer Configures the number of retransmissions dellos6, dellos9, dellos10
radius_server.timeout integer Configures the timeout for retransmissions dellos6, dellos9, dellos10
radius_server.deadtime integer Configures the server dead time dellos9
radius_server.group dictionary Configures the radius servers group (see group.*) dellos9
group.name string (required) Configures the group name of the radius servers dellos9
group.host dictionary Configures the radius server host in the group (see host.*) dellos9
host.ip string Configures the radius server host address in the group dellos9
host.key string (required): 0,7,LINE Configures the authentication key dellos9
host.key_string string: 7,0 Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 dellos9
host.retransmit integer Configures the number of retransmissions dellos9
host.auth_port integer Configures the authentication port (0 to 65535) dellos9
host.timeout integer Configures the timeout for retransmissions dellos9
host.state string: present,absent Removes the host from group of radius server if set to absent dellos9
group.vrf dictionary Configures the VRF for radius servers in the group (see vrf.*) dellos9
vrf.vrf_name string (required) Configures the name of VRF for the radius server group dellos9
vrf.source_intf integer Configures the source interface for outgoing packets from servers in the group dellos9
vrf.state string: present,absent Removes the VRF from group of radius servers if set to absent dellos9
group.state string: present,absent Removes the radius server group if set to absent dellos9
radius_server.host dictionary Configures the radius server host (see host.*) dellos6,dellos9, dellos10
host.ip string Configures the radius server host address dellos6, dellos9, dellos10
host.key string (required); 0,7,LINE Configures the authentication key dellos6, dellos9, dellos10
host.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 dellos6, dellos9
host.retransmit integer Configures the number of retransmissions dellos6, dellos9
host.auth_port integer Configures the authentication port (0 to 65535) dellos6, dellos9, dellos10
host.timeout integer Configures timeout for retransmissions dellos6, dellos9
host.state string: present,absent Removes the radius server host if set to absent dellos6, dellos9, dellos10
radius_server.acct dictionary Configures the radius server acct (see host.*) dellos6
acct.ip string Configures the radius server acct address dellos6
acct.key string (required); 0,7,LINE Configures the authentication key dellos6
acct.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 dellos6
acct.auth_port integer Configures the authentication port (0 to 65535) dellos6
acct.state string: present,absent Removes the radius server acct if set to absent dellos6
radius_server.auth dictionary Configures the radius server auth (see auth.*) dellos6
auth.ip string Configures the radius server host address dellos6
auth.key string (required); 0,7,LINE Configures the authentication key dellos6, dellos9, dellos10
auth.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 dellos6
auth.name string (required) Configures the auth name of the radius servers dellos6
auth.usage string (required) Configures the usage type of the radius servers dellos6
auth.priority integer Configures the number of priority dellos6
auth.retransmit integer Configures the number of retransmissions dellos6
auth.auth_port integer Configures the authentication port (0 to 65535) dellos6
auth.timeout integer Configures timeout for retransmissions dellos6
auth.deadtime integer Configures the number of deadtime dellos6
auth.attribute dictionary Configures the radius server auth (see attribute.*) dellos6
attribute.id integer Configures the radius server attribute id dellos6
auth (see attribute.*) dellos6
attribute.type integer Configures the radius server attribute type based on id dellos6
attribute.state string: present,absent Removes the radius server attribute if set to absent dellos6
auth.state string: present,absent Removes the radius server auth if set to absent dellos6
radius_server.attribute dictionary Configures the radius server auth (see attribute.*) dellos6
attribute.id integer Configures the radius server attribute id dellos6
auth (see attribute.*) dellos6
attribute.type integer Configures the radius server attribute type based on id dellos6
attribute.state string: present,absent Removes the radius server attribute if set to absent dellos6
tacacs_server dictionary Configures the tacacs server (see tacacs_server.*) dellos6, dellos9
tacacs_server.key string (required): 0,7,LINE Configures the authentication key for tacacs server dellos6, dellos9
tacacs_server.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if tacacs_server.key is 7 or 0 dellos6, dellos9
tacacs_server.group dictionary Configures the group of tacacs servers (see group.*) dellos9
group.name string (required) Configures the group name of the tacacs servers dellos9
group.host dictionary Configures the tacacs server host in the group (see host.*) dellos9
host.ip string Configures the tacacs server host address in the group dellos9
host.key string (required): 0,7,LINE Configures the authentication key of the tacacs server host dellos9
host.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only host.key is 7 or 0 dellos9
host.retransmit integer Configures the number of retransmissions dellos9
host.auth_port integer Configures the authentication port (0 to 65535) dellos9
host.timeout integer Configures timeout for retransmissions dellos9
host.state string: present,absent Removes the host from group of tacacs server if set to absent dellos9
group.vrf dictionary Configures VRF for tacacs servers in the group (see vrf.*) dellos9
vrf.vrf_name string (required) Configures the name of VRF for tacacs server group dellos9
vrf.source_intf integer Configures source interface for outgoing packets from servers in the group dellos9
vrf.state string: present,absent Removes the VRF from group of tacacs server if set to absent dellos9
group.state string: present,absent Removes the tacacs server group if set to absent dellos9
tacacs_server.host dictionary Configures the tacacs server host (see host.*) dellos6, dellos9
host.ip string Configures the tacacs sever host address dellos6, dellos9
host.key string (required): 0,7,LINE Configures the authentication key dellos6, dellos9
host.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 dellos6, dellos9
host.retransmit integer Configures the number of retransmissions dellos9
host.auth_port integer Configures the authentication port (0 to 65535) dellos6, dellos9
host.timeout integer Configures the timeout for retransmissions dellos6, dellos9
host.state string: present,absent Removes the tacacs server host if set to absent dellos6, dellos9
aaa_accounting dictionary Configures accounting parameters (see aaa_accounting.*) dellos6, dellos9
aaa_accounting.commands list Configures accounting for exec (shell) and config commands (see commands.*) dellos9
commands.enable_level integer Configures enable level for accounting of commands dellos9
commands.role_name string Configures user role for accounting of commands; variable is mutually exclusive with enable_level dellos9
commands.accounting_list_name integer Configures named accounting list for commands dellos9
commands.no_accounting boolean Configures no accounting of commands dellos9
commands.record_option string: start-stop,stop-only,wait-start Configures options to record data dellos9
commands.state string: present,absent Removes the named accounting list for the commands if set to absent dellos9
aaa_accounting.exec list Configures accounting for EXEC (shell) commands (see exec.*) dellos9
exec.accounting_list_name string Configures named accounting list for exec commands dellos9
exec.no_accounting boolean Configures no accounting of EXEC commands dellos9
exec.record_option string: start-stop,stop-only,wait-start Configures options to record data dellos9
exec.state string: present,absent Removes the named accounting list for the exec commands if set to absent dellos9
aaa_accounting.suppress boolean Suppresses accounting for users with NULL username dellos9
aaa_accounting.dot1x string: none,start-stop,stop-only,wait-start Configures accounting for dot1x events dellos6, dellos9
aaa_accounting.rest string:none,start-stop,stop-only,wait-start Configures accounting for rest interface events dellos9
aaa_authorization dictionary Configures authorization parameters (see aaa_authorization.*) dellos6, dellos9
aaa_authorization.commands list Configures authorization for EXEC (shell) and config commands (see commands.*) dellos9
commands.enable_level integer Configures enable level for authorization of commands dellos9
commands.role_name string Configures user role for authorization of commands; mutually exclusive with enable_level dellos9
commands.authorization_list_name string Configures named authorization list for commands dellos9
commands.authorization_method string: none Configures no authorization of commands dellos9
commands.use_data string: local,tacacs+ Configures data used for authorization dellos9
commands.state string: present,absent Removes the named authorization list for the commands if set to absent dellos9
aaa_authorization.config_commands boolean Configures authorization for configuration mode commands dellos9
aaa_authorization.role_only boolean Configures validation of authentication mode for user role dellos9
aaa_authorization.exec list Configures authorization for EXEC (shell) commands (see exec.*) dellos6, dellos9
exec.authorization_list_name string Configures named authorization list for EXEC commands dellos6, dellos9
exec.authorization_method string: none Configures no authorization of EXEC commands dellos6, dellos9
exec.use_data string: local,tacacs+ Configures data used for authorization dellos6, dellos9
exec.state string: present,absent Removes the named authorization list for the EXEC commands if set to absent dellos6, dellos9
aaa_authorization.network string: none,radius,ias Configures authorization for network events dellos6, dellos9
aaa_authentication dictionary Configures authentication parameters (see aaa_authentication.*) dellos9, dellos10
aaa_authentication.local_auth dictionary Configures local authentication parameters (see aaa_authentication.local_auth.*) dellos10
aaa_authetication.local_auth.radius boolean Configures authentication method as local along with radius if set to true dellos10
aaa_authentication.radius_auth dictionary Configures radius authentication parameters (see aaa_authentication.radius_auth.*) dellos10
aaa_authetication.radius_auth.local boolean Configures authentication method as radius along with local if set to true dellos10
aaa_authentication.re_authenticate boolean Configures re-authenticate by enable if set to true on dellos10 devices dellos10
aaa_radius dictionary Configures AAA for radius group of servers (see aaa_radius.*) dellos9
aaa_radius.group string Configures name of the radius group of servers for AAA dellos9
aaa_radius.auth_method string: pap,mschapv2 Configures authentication method of radius group of servers for AAA dellos9
aaa_tacacs dictionary Configures AAA for tacacs group of servers (see aaa_tacacs.*) dellos9
aaa_tacacs.group string Configures name of the tacacs group of servers for AAA dellos9
aaa_authentication.auth_list list Configures named authentication list for hosts (see host.*) dellos6, dellos9
auth_list.name string Configures named authentication list dellos6, dellos9
auth_list.login_or_enable string: enable,login Configures authentication list for login or enable dellos6, dellos9
auth_list.server string: radius,tacacs+ Configures AAA to use this list of all server hosts dellos6, dellos9
auth_list.use_password string: line,local,enable,none Configures password to use for authentication dellos6, dellos9
auth_list.state string: present,absent Removes the named authentication list if set to absent dellos6, dellos9
aaa_authentication.dot1x string: none,radius,ias Configures authentication for dot1x events dellos6, dellos9
line_terminal dictionary Configures the terminal line (see line_terminal.*) dellos9
line_terminal.<terminal> dictionary Configures the primary or virtual terminal line (see <terminal>.*); value can be console <line_number>, vty <line_number> dellos9
<terminal>.authorization dictionary Configures authorization parameters of line terminal (see authorization.*) dellos9
authorization.commands list Configures authorization for EXEC (shell) and config commands (see commands.*) dellos9
commands.enable_level integer Configures enable level for authorization of commands at line terminal dellos9
commands.role_name string Configures user role for authorization of commands at line terminal; mutually exclusive with enable_level dellos9
commands.authorization_list_name string Configures named authorization list for commands dellos9
commands.state string: present,absent Removes the authorization of commands from line terminal if set to absent dellos9
authorization.exec list Configures authorization for EXEC (shell) commands at line terminal (see exec.*) dellos9
exec.authorization_list_name string Configures named authorization list for EXEC commands dellos9
exec.state string: present,absent Removes the authorization of EXEC (shell) from line terminal if set to absent dellos9
<terminal>.accounting dictionary Configures accounting parameters of line terminal (see accounting.*) dellos9
accounting.commands list Configures accounting for EXEC (shell) and config commands (see commands.*) dellos9
commands.enable_level integer Configures enable level for accounting of commands at line terminal dellos9
commands.role_name string Configures user role for accounting of commands at line terminal; mutually exclusive with enable_level dellos9
commands.accounting_list_name string Configures named accounting list for commands dellos9
commands.state string: present,absent Removes the accounting of commands from line terminal if set to absent dellos9
accounting.exec list Configures accounting for EXEC (shell) commands at line terminal (see exec.*) dellos9
exec.accounting_list_name string Configures named accounting list for EXEC commands dellos9
exec.state string: present,absent Removes the accounting of EXEC (shell) from line terminal if set to absent dellos9
<terminal>.authentication dictionary Configures authentication parameters of line terminal (see authentication.*) dellos9
authentication.enable string Configures the authentication list for privilege-level password authentication dellos9
authentication.login string Configures the authentication list for password checking dellos9
aaa_server dictionary Configures the aaa server (see aaa_server.*) dellos6
radius dictionary Configures the radius server (see radius.*) dellos6
dynamic_author dictionary Configures the radius server (see dynamic_author.*) dellos6
dynamic_author.auth_type string Configures the authentication type for the radius server dellos6
dynamic_author.client list Configures the client for the radius server dellos6
client.ip string Configures the client ip for the radius server dellos69
client.key string (required): 0,7,LINE Configures the authentication key for the radius server dellos69
client.key_string string Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0 dellos6
client.state string: present,absent Removes the accounting of client if set to absent dellos6
dynamic_author.state string: present,absent Removes the accounting of client if set to absent dellos6

NOTE: Asterisk (*) denotes the default value if none is specified.

Connection variables

Ansible Dell EMC Networking roles require connection information to establish communication with the nodes in your inventory. This information can exist in the Ansible group_vars or host_vars directories or inventory, or in the playbook itself.

Key Required Choices Description
ansible_host yes Specifies the hostname or address for connecting to the remote device over the specified transport
ansible_port no Specifies the port used to build the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_PORT option is used; it defaults to 22
ansible_ssh_user no Specifies the username that authenticates the CLI login for the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_USER environment variable value is used
ansible_ssh_pass no Specifies the password that authenticates the connection to the remote device.
ansible_become no yes, no* Instructs the module to enter privileged mode on the remote device before sending any commands; if value is unspecified, the ANSIBLE_BECOME environment variable value is used, and the device attempts to execute all commands in non-privileged mode
ansible_become_method no enable, sudo* Instructs the module to allow the become method to be specified for handling privilege escalation; if value is unspecified, the ANSIBLE_BECOME_METHOD environment variable value is used.
ansible_become_pass no Specifies the password to use if required to enter privileged mode on the remote device; if ansible_become is set to no this key is not applicable.
ansible_network_os yes dellos6/dellos9/dellos10, null* This value is used to load the correct terminal and cliconf plugins to communicate with the remote device.

NOTE: Asterisk (*) denotes the default value if none is specified.

Dependencies

The dellos-aaa role is built on modules included in the core Ansible code. These modules were added in Ansible version 2.2.0.

Example playbook

This example uses the dellos-aaa role to configure AAA for radius and TACACS servers. It creates a hosts file with the switch details and corresponding variables. The hosts file should define the ansible_network_os variable with the corresponding Dell EMC Networking OS name.

When dellos_cfg_generate is set to true, the variable generates the configuration commands as a .part file in the build_dir path. By default, it is set to false and it writes a simple playbook that only references the dellos-aaa role.

Sample hosts file

leaf1 ansible_host= <ip_address> 

Sample host_vars/leaf1

hostname: leaf1
ansible_become: yes
ansible_become_method: xxxxx
ansible_become_pass: xxxxx
ansible_ssh_user: xxxxx
ansible_ssh_pass: xxxxx
ansible_network_os: dellos9
build_dir: ../temp/dellos9

dellos_aaa:
  radius_server:
      key: radius
      retransmit: 5
      timeout: 40
      deadtime: 2300
      group:
        - name: RADIUS
          host:
            - ip: 2001:4898:f0:f09b::1002
              key: 0
              key_string: aaaa
              retransmit: 5
              auth_port: 3
              timeout: 2
              state: present
          vrf:
            vrf_name: test
            source_intf: fortyGigE 1/2
            state: absent
          state: present
      host:
        - ip: 2001:4898:f0:f09b::1002
          key: xxx
          retransmit: 5
          auth_port: 3
          timeout: 2
          state: present
  tacacs_server:
      key: 7
      key_string: 9ea8ec421c2e2e5bec757f44205015f6d81e83a4f0aa52fa
      group:
        - name: TACACS
          host:
            - ip: 2001:4898:f0:f09b::1000
              key: 0
              key_string: aaa
              retransmit: 6
              auth_port: 3
              timeout: 2
              state: present
          vrf:
            vrf_name: tes
            source_intf: fortyGigE 1/3
            state: present
          state: present
      host:
        - ip: 2001:4898:f0:f09b::1000
          key: 0
          key_string: aa
          retransmit: 5
          auth_port: 3
          timeout: 2
          state: present
  aaa_accounting:
      commands:
          - enable_level: 2
            accounting_list_name: aa
            record_option: start-stop
            state: present
          - role_name: netadmin
            accounting_list_name: aa
            no_accounting: none
      suppress: True
      exec:
          - accounting_list_name: aaa
            no_accounting: true
            state: present
      dot1x: none
      rest: none
  aaa_authorization:
      commands:
          - enable_level: 2
            authorization_list_name: aa
            use_data: local
            state: present
          - role_name: netadmin
            authorization_list_name: aa
            authorization_method: none
            use_data: local
      config_commands: True
      role_only:
      exec:
          - authorization_list_name: aaa
            authorization_method: if-authenticated
            use_data: local
            state: present
  aaa_authentication:
      auth_list:
        - name: default
          login_or_enable: login
          server: radius
          use_password: local
          state: present
        - name: console
          server: tacacs+
          login_or_enable: login
          use_password: local
  aaa_radius:
      group: RADIUS
      auth_method: pap
  aaa_tacacs:
      group: TACACS
  line_terminal:
    vty 0:
      authorization:
        commands:
           - enable_level: 2
             authorization_list_name: aa
             state: present
           - role_name: netadmin
             authorization_list_name: aa
             state: present
        exec:
           - authorization_list_name: aa
             state: present
      accounting:
        commands:
           - enable_level: 2
             accounting_list_name: aa
             state: present
           - role_name: netadmin
             accounting_list_name: aa
             state: absent
        exec:
           accounting_list_name: aa
           state: present
      authentication:
        enable:
        login: console

Simple playbook to setup system - leaf.yaml

- hosts: leaf1
  roles:
     - Dell-Networking.dellos-aaa

Run

ansible-playbook -i hosts leaf.yaml

(c) 2017-2019 Dell Inc. or its subsidiaries. All Rights Reserved.

About

The dellos-aaa role facilitates the configuration of Authentication Authorization Acccounting (AAA) attributes along with TACACS and RADIUS in devices running Dell EMC Networking Operating Systems.

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published