victorock / demopoc

Summary

Collection to provision disposable topologies.

Introduction

Roles

The content of this repository is subdivided in the following categories:

1. build

• Manipulation of local artifacts, mainly files operatios.

2. provision

• Provisonning of resources in an cloud provider.

3. deploy

• Setup of environments in the provisionned instances.

4. test

• Validation of the environments from end-to-end.

Topology

Subnets

name	cidr
mgmt	10.1.0.0
outside	10.1.1.0
inside	10.1.2.0

IP Allocation Ranges

Range	Start	End
Network	10.1.X.254	10.1.X.124
Host	10.1.X.123	10.1.X.1

Network Devices

Firewalls

mgmt	outside	inside	groups	inventory_hostname
10.1.0.254	10.1.1.254	10.1.2.254	panos	fw01-panos
10.1.0.253	10.1.1.253	10.1.2.253	asa	fw01-asa
10.1.0.252	10.1.1.252	10.1.2.252	fortios	fw01-fortios

Load Balancers

mgmt	outside	inside	groups	inventory_hostname
10.1.0.200	10.1.1.200	10.1.2.200	tmos	lb01-tmos

Routers

mgmt	outside	inside	groups	inventory_hostname
10.1.0.150	10.1.1.150	10.1.2.150	ios	rtr01-ios
10.1.0.149	10.1.1.149	10.1.2.149	ios	rtr02-ios
10.1.0.148	10.1.1.148	10.1.2.148	ios	rtr03-ios
10.1.0.147	10.1.1.147	10.1.2.147	ios	rtr04-ios
10.1.0.146	10.1.1.146	10.1.2.146	ios	rtr05-ios
10.1.0.145	10.1.1.145	10.1.2.145	ios	rtr06-ios

Host Devices

mgmt	inside	groups	inventory_hostname
10.1.0.100	10.1.2.100	tower	host01-tower
10.1.0.99	10.1.2.99	linux	host01-linux
10.1.0.98	10.1.2.98	windows	host01-windows
10.1.0.97	10.1.2.97	nios	host01-nios
10.1.0.96	10.1.2.96	splunk	host01-splunk

Preparation

Installation of the following packages:

• ansible
• netaddr
• boto
• boto3
• passlib

Installation as normal user:

pip --user install ansible netaddr boto boto3 passlib

Installation as privileged user or from inside a virtualenv:

pip install ansible netaddr boto boto3 passlib

Licenses and Subscriptions

Environment	Instructions
AWS	AWS Support ticket to increase Elastic IPs to 30. Default: 5 (Reference)
Ansible Tower	Red Hat Ansible Tower license (required). - Save the license file in files/licenses/tower.
Infoblox	- NIOS CP (required). - NIOS TE (optional).
Cisco	- ASAv BYOL (required). - ASAv (optional).
F5	- BigIP PAYG (required). - BigIP BYOL (optional)
PaloAlto	- Firewall BYOL (required). - Firewall 1 (optional). - Firewall 2 (optional)
Splunk	- Enterprise (required). - Insights for Infrastructure (optional).
Fortinet	- Fortigate (required).

Howtos

Create my own topology

NOTE: In Ansible Tower do standard WEBUI manipulation of Inventories.

1. Copy the directory inventories/full to inventories/mytopology.

cp -ap inventories/full inventories/mytopology

2. Edit the file inventories/mytopology/hosts to choose the nodes in your topology.

vi inventories/mytopology/hosts

3. Edit the file inventories/mytopology/group_vars/all.yaml to customize subnets, vpcs, regions...

vi inventories/mytopoly/group_vars/all.yaml

NOTE: For multisite topology, consult cisco_ios

Define my own ssh-keys

1. Save the public ssh_key in files/keychain/<ec2_vpc_name>.pub.

cp <my key>.pub files/keychain/site1.pub
cp <my key>.pub files/keychain/site2.pub
cp <my key>.pub files/keychain/site3.pub

2. Save the private ssh_key in files/keychain/<ec2_vpc_name>.

cp <my key> files/keychain/site1
cp <my key> files/keychain/site2
cp <my key> files/keychain/site3

NOTE: if missing, ssh-keys are generated automatically during build

Spawn the entire topology

./playbooks/main.yaml -i inventories/full

_NOTE: By default everything is provisioned in site1.

Provision all nodes from topology

./playbooks/provision.yaml -i inventories/full

_NOTE: ssh-key are only generated during build.

Provision specific group from topology

./playbooks/provision.yaml -i inventories/full --limit linux

_NOTE: ssh-key are only generated during build.

Spawn different topology

./playbooks/main.yaml -i inventories/redhat_rhel

_HINT: Topologies are build from inventories

Terminate specific group of nodes (ex: site1)

./playbooks/terminate.yaml -i inventories/cisco_ios --limit site1

Provision specific group of nodes (ex: tower)

./playbooks/provision.yaml -i inventories/cisco_ios --limit tower

Reprovision specific node (ex: rtr01-ios)

./playbooks/reprovision.yaml -i inventories/cisco_ios --limit rtr01-ios

Reprovision specific group of nodes (ex: ios)

./playbooks/reprovision.yaml -i inventories/cisco_ios --limit ios

Stack topologies

This is straighforward for topologies following the guideline for groups and vpc names.

1. To spawn the cisco_ios with 3 sites:

./playbooks/main.yaml -i inventories/cisco_ios --limit site1
./playbooks/main.yaml -i inventories/cisco_ios --limit site2  
./playbooks/main.yaml -i inventories/cisco_ios --limit site3

NOTE: Multiple sites cannot be provisioned in parallel as part of the same play, because of race conditions
NOTE: Mutiple sites can be provisioned in parallel from different terminals with different --limit.
NOTE: Multiple instances are provisioned in parallel.

2. To provision Infoblox on top of the previous topology:

./playbooks/main.yaml -i inventories/infoblox_nios

3. To provision Splunk on top of the previous topology:

./playbooks/main.yaml -i inventories/splunk_es

Integration with Ansible Tower

1. Create project for https://www.github.com/victorock/demopoc.
2. Create inventory and define a source from project for inventories/cisco_ios/hosts.
3. Create job template and choose a playbook from playbooks folder (ex: playbooks/main.yaml).

FAQ

What topologies are available?

inventories/
.
├── cisco_ios
│   ├── group_vars
│   │   ├── site1.yaml
│   │   ├── site2.yaml
│   │   └── site3.yaml
│   └── hosts
├── f5_tmos
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
├── full
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
├── infoblox_nios
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
├── microsoft_windows
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
├── paloalto_panos
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
├── redhat_rhel
│   ├── group_vars
│   │   └── all.yaml
│   └── hosts
└── splunk_es
    ├── group_vars
    │   └── all.yaml
    └── hosts

Why the public access to Infoblox's WEBUI is not working?

Due to a limitation in the Infoblox's image, the Infoblox AMI is only accessible through the inside interface (LAN1)..
As alternative, create a SSH tunnel through Ansible Tower to access Infoblox's WEBUI:

1. Add ssh-key to ssh-agent:

ssh-add files/keychain/<ssh_private_key_file>

2. Establish SSH Tunnel (localhost:8443 -> 10.1.2.97:443):

ssh -l ec2-user@<tower_public_ip> -L 8443:10.1.2.97:443

3. Open Browser:

open -a "Google Chrome" https://localhost:8443/

What are the overall steps happening in background?

1. Build: Run locally, calling the role build.
2. Provision: Run locally, calling the role provision.
3. Deploy: Run against the provisioned device, calling the role deploy.

What happens behind the scenes when i run main.yaml?

• main.yaml:
  • build.yaml:
    • roles:
      • build:
        • download
  • provision.yaml:
    • roles:
      • provision:
        • provision_ec2:
          • playbooks/group_vars/all/ec2.yaml
          • playbooks/group_vars/tower/ec2.yaml
          • playbooks/group_vars/linux/ec2.yaml
          • playbooks/host_vars/host01-tower/ec2.yaml
          • playbooks/host_vars/host01-linux/ec2.yaml
  • deploy.yaml:
    • roles:
      • deploy_tower:
        • deploy_linux:
          • network configuration
          • baseline packages
          • repositories (redhat-rhui)
          • subscription (optional)
        • tower_setup:
          • playbooks/group_vars/tower/ansible_tower_setup.yaml
        • tower_configure:
          • playbooks/group_vars/tower/ansible_tower_config.yaml
        • tower_facts
  • test.yaml:
    • roles:
      • test_tower:
        • application tests

Additional Details

• Playbooks
• Roles

TODO

deploy_<environment> for the following:

• asa
• fortios

Performing the following tasks:

• configure environment administrative password according to the value of variable deploy_password.

Disclaimer

Don't use any of the content from this repository to manage real production environments.