engine_routing - Routing configurations on NGFW¶

New in version 2.5.

Synopsis
Requirements (on host that executes module)
Options
Examples
Return Values
Notes
- Author
- Status

Synopsis ¶

Use this module to add or remove static routes, antispoofing, BGP, OSPF or netlink elements to routing nodes on an engine. You can use engine_facts to dump the engine configuration or use engine_routing_facts to specifically dump only the routing table

Requirements (on host that executes module)¶

smc-python

Options ¶

parameter required default choices comments

antispoofing_network

no

List of static routes

**Dictionary object antispoofing_network**
parameter	required	default	choices	comments
destination	no			Destinations associated with this antispoofing entry. Multiple element types can be used as a destination
interface_id	yes			The interface id to add the antispoofing network. Can be VLAN id if specified 1.23

bgp_peering

no

List of dict describing the BGP peering to add

**Dictionary object bgp_peering**
parameter	required	comments
interface_id	yes	The interface id to add the peering. Can be VLAN id if specified 1.23
destination	no	Destination is the BGP peer associated with this BGP Peering. This can be either another NGFW engine or an external_bgp_peer element. Both element types must preexist in the SMC.
network	no	Optional network to bind the BGP Peer to. Only relevant if multiple IP addresses are assigned to the given interface and you only want to bind to one.
name	yes	Name of the BGP peering element in SMC

name

yes

The name of the firewall cluster to access routing table

netlink

no

List of dict describing the netlinks

**Dictionary object netlink**
parameter	required	comments
interface_id	yes	The interface id to add the netlink. Can be VLAN id if specified 1.23
destination	no	Destinations associated with this netlink. Multiple element types can be used as a destination
network	no	Optional network to bind the netlink. Only relevant if multiple IP addresses are assigned to the given interface and you only want to bind to one.
name	yes	Name of the netlink element in SMC

ospfv2_area

no

List of dict describing the OSPF areas to add

**Dictionary object ospfv2_area**
parameter	required	comments
interface_id	yes	The interface id to add the OSPF area. Can be VLAN id if specified 1.23
destination	no	Destination is the element referenced can be an OSPF Area interface setting element from SMC. This can be used to override the default interface settings for OSPF. This is optional.
network	no	Optional network to bind the OSPF area to. Only relevant if multiple IP addresses are assigned to the given interface and you only want to bind to one.
name	yes	Name of the OSPF area element in SMC

smc_address

no

FQDN with port of SMC. The default value is the environment variable SMC_ADDRESS

smc_alt_filepath

no

Provide an alternate path location to read the credentials from. File is expected to be stored in ~.smcrc. If provided, url and api_key settings are not required and will be ignored.

smc_api_key

no

API key for api client. The default value is the environment variable SMC_API_KEY Required if url

smc_api_version

no

Optional API version to connect to. If none is provided, the latest SMC version API will be used based on the Management Center version. Can be set though the environment variable SMC_API_VERSION

smc_domain

no

Optional domain to log in to. If no domain is provided, 'Shared Domain' is used. Can be set throuh the environment variable SMC_DOMAIN

smc_extra_args

no

Extra arguments to pass to login constructor. These are generally only used if specifically requested by support personnel.

**Dictionary object smc_extra_args**
parameter	required	default	choices	comments
verify	no	True	yes no	Is the connection to SMC is HTTPS, you can set this to True, or provide a path to a client certificate to verify the SMC SSL certificate. You can also explicitly set this to False.

smc_logging

no

Optionally enable SMC API logging to a file

**Dictionary object smc_logging**
parameter	required	default	choices	comments
path	yes			Full path to the log file
level	no			Log level as specified by the standard python logging library, in int format. Default setting is logging.DEBUG.

smc_timeout

no

Optional timeout for connections to the SMC. Can be set through environment SMC_TIMEOUT

state

no

present

present
absent

Add or remove the routing entry. If state=absent any defined routing configurations are considered a removal action

static_route

no

List of static routes

**Dictionary object static_route**
parameter	required	comments
interface_id	yes	The interface id to add the static route. Can be VLAN id if specified 1.23
destination	no	Destinations associated with this static route. Multiple element types can be used as a destination
network	no	Optional network to bind the route. Only relevant if multiple IP addresses are assigned to the given interface and you only want to bind to one.
name	yes	Name of the router element to use as the next hop for the static route. Note that this MUST be a router type element from SMC.

Examples ¶

- name: Engine routing configuration
  hosts: localhost
  gather_facts: no
  tasks:
  - name: Add routing elements to engine sg_vm
    engine_routing:
      smc_logging:
        level: 10
        path: ansible-smc.log
      name: sg_vm
      bgp_peering:
      - destination:
        - name: bgppeer
          type: external_bgp_peer
        interface_id: '1000'
        name: bgppeering
      ospfv2_area:
      - interface_id: '2.1'
        name: myarea
        network: 21.21.21.0/24
        destination:
        - name: myinterface
          type: ospfv2_interface_settings
      - name: myarea2
        interface_id: 1
      netlink:
      - destination:
        - name: IP_10.3.3.1
          type: host
        interface_id: '2.1'
        name: netlink-21.21.21.0
      static_route:
      - destination:
        - name: Any network
          type: network
        interface_id: 0
        network: '1.1.1.0/24'
        name: myrouter # Must be element of type Router
      antispoofing_network:
      - destination:
        - name: foonet
          type: network
        interface_id: 0

- name: Engine routing configuration
  hosts: localhost
  gather_facts: no
  tasks:
  - name: Remove specific antispoofing network from engine sg_vm
    engine_routing:
      smc_logging:
        level: 10
        path: ansible-smc.log
      name: sg_vm
      antispoofing_network:
      - destination:
        - name: foonet
          type: network
        interface_id: 0
      state: absent

Return Values ¶

Common return values are documented Return Values, the following are the fields unique to this module:

name	description	returned	type	sample
state	The current state of the element		dict
changed	Whether or not the change succeeded	always	bool

Notes ¶

Note

Login credential information is either obtained by providing them directly to the task/play, specifying an alt_filepath to read the credentials from to the play, or from environment variables (in that order). See http://smc-python.readthedocs.io/en/latest/pages/session.html for more information.

Author ¶

David LePage (@gabstopper)

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.