forked from netascode/terraform-iosxe-nac-iosxe
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathiosxe_access_lists.tf
More file actions
194 lines (183 loc) · 20.6 KB
/
Copy pathiosxe_access_lists.tf
File metadata and controls
194 lines (183 loc) · 20.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
locals {
access_lists_standard = flatten([
for device in local.devices : [
for acl in try(local.device_config[device.name].access_lists.standard, []) : {
key = format("%s/%s", device.name, acl.name)
device = device.name
name = try(acl.name, null)
entries = try(length(acl.entries) == 0, true) ? null : [for e in acl.entries : {
sequence = try(e.sequence, local.defaults.iosxe.configuration.access_lists.standard.entries.sequence, null)
remark = try(e.remark, local.defaults.iosxe.configuration.access_lists.standard.entries.remark, null)
deny_prefix = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "deny" ? try(e.prefix, null) : null
deny_prefix_mask = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "deny" ? try(e.prefix_mask, null) : null
deny_any = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "deny" ? try(e.any, false) : null
deny_host = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "deny" ? try(e.host, null) : null
deny_log = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "deny" ? try(e.log, false) : null
permit_prefix = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "permit" ? try(e.prefix, null) : null
permit_prefix_mask = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "permit" ? try(e.prefix_mask, null) : null
permit_any = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "permit" ? try(e.any, false) : null
permit_host = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "permit" ? try(e.host, null) : null
permit_log = try(e.action, local.defaults.iosxe.configuration.access_lists.standard.entries.action, null) == "permit" ? try(e.log, false) : null
}]
}
]
])
}
resource "iosxe_access_list_standard" "access_list_standard" {
for_each = { for e in local.access_lists_standard : e.key => e }
device = each.value.device
name = each.value.name
entries = each.value.entries
}
locals {
access_lists_extended = flatten([
for device in local.devices : [
for acl in try(local.device_config[device.name].access_lists.extended, []) : {
key = format("%s/%s", device.name, acl.name)
device = device.name
name = try(acl.name, null)
entries = try(length(acl.entries) == 0, true) ? null : [for e in acl.entries : {
sequence = try(e.sequence, local.defaults.iosxe.configuration.access_lists.extended.entries.sequence, null)
remark = try(e.remark, local.defaults.iosxe.configuration.access_lists.extended.entries.remark, null)
ace_rule_action = try(e.action, local.defaults.iosxe.configuration.access_lists.extended.entries.action, null)
ace_rule_protocol = try(e.protocol, local.defaults.iosxe.configuration.access_lists.extended.entries.protocol, null)
service_object_group = try(e.service_object_group, local.defaults.iosxe.configuration.access_lists.extended.entries.service_object_group, null)
source_prefix = try(e.source.prefix, local.defaults.iosxe.configuration.access_lists.extended.entries.source.prefix, null)
source_prefix_mask = try(e.source.prefix_mask, local.defaults.iosxe.configuration.access_lists.extended.entries.source.prefix_mask, null)
source_any = try(e.source.any, local.defaults.iosxe.configuration.access_lists.extended.entries.source.any, null)
source_host = try(e.source.host, local.defaults.iosxe.configuration.access_lists.extended.entries.source.host, null)
source_object_group = try(e.source.object_group, local.defaults.iosxe.configuration.access_lists.extended.entries.source.object_group, null)
source_port_equal = try(e.source.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.source.port_type, null) == "equal" ? try(e.source.port, null) : null
source_port_greater_than = try(e.source.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.source.port_type, null) == "greater_than" ? try(e.source.port, null) : null
source_port_lesser_than = try(e.source.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.source.port_type, null) == "lesser_than" ? try(e.source.port, null) : null
source_port_range_from = try(e.source.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.source.port_type, null) == "range" ? try(e.source.port_range_from, null) : null
source_port_range_to = try(e.source.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.source.port_type, null) == "range" ? try(e.source.port_range_to, null) : null
destination_prefix = try(e.destination.prefix, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.prefix, null)
destination_prefix_mask = try(e.destination.prefix_mask, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.prefix_mask, null)
destination_any = try(e.destination.any, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.any, null)
destination_host = try(e.destination.host, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.host, null)
destination_object_group = try(e.destination.object_group, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.object_group, null)
destination_port_equal = try(e.destination.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.port_type, null) == "equal" ? try(e.destination.port, null) : null
destination_port_equal_2 = try(e.destination.additional_equal_ports[0], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[0], null)
destination_port_equal_3 = try(e.destination.additional_equal_ports[1], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[1], null)
destination_port_equal_4 = try(e.destination.additional_equal_ports[2], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[2], null)
destination_port_equal_5 = try(e.destination.additional_equal_ports[3], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[3], null)
destination_port_equal_6 = try(e.destination.additional_equal_ports[4], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[4], null)
destination_port_equal_7 = try(e.destination.additional_equal_ports[5], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[5], null)
destination_port_equal_8 = try(e.destination.additional_equal_ports[6], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[6], null)
destination_port_equal_9 = try(e.destination.additional_equal_ports[7], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[7], null)
destination_port_equal_10 = try(e.destination.additional_equal_ports[8], local.defaults.iosxe.configuration.access_lists.extended.entries.destination.additional_equal_ports[8], null)
destination_port_greater_than = try(e.destination.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.port_type, null) == "greater_than" ? try(e.destination.port, null) : null
destination_port_lesser_than = try(e.destination.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.port_type, null) == "lesser_than" ? try(e.destination.port, null) : null
destination_port_range_from = try(e.destination.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.port_type, null) == "range" ? try(e.destination.port_range_from, null) : null
destination_port_range_to = try(e.destination.port_type, local.defaults.iosxe.configuration.access_lists.extended.entries.destination.port_type, null) == "range" ? try(e.destination.port_range_to, null) : null
ack = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "ack") ? true : try(e.ack, local.defaults.iosxe.configuration.access_lists.extended.entries.ack, null)
fin = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "fin") ? true : try(e.fin, local.defaults.iosxe.configuration.access_lists.extended.entries.fin, null)
psh = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "psh") ? true : try(e.psh, local.defaults.iosxe.configuration.access_lists.extended.entries.psh, null)
rst = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "rst") ? true : try(e.rst, local.defaults.iosxe.configuration.access_lists.extended.entries.rst, null)
syn = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "syn") ? true : try(e.syn, local.defaults.iosxe.configuration.access_lists.extended.entries.syn, null)
urg = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.extended.entries.tcp_flags, []), "urg") ? true : try(e.urg, local.defaults.iosxe.configuration.access_lists.extended.entries.urg, null)
established = try(e.established, local.defaults.iosxe.configuration.access_lists.extended.entries.established, null)
dscp = try(e.dscp, local.defaults.iosxe.configuration.access_lists.extended.entries.dscp, null)
fragments = try(e.fragments, local.defaults.iosxe.configuration.access_lists.extended.entries.fragments, null)
precedence = try(e.precedence, local.defaults.iosxe.configuration.access_lists.extended.entries.precedence, null)
tos = try(e.tos, local.defaults.iosxe.configuration.access_lists.extended.entries.tos, null)
icmp_named_msg_type = can(tonumber(try(e.icmp_message_type, local.defaults.iosxe.configuration.access_lists.extended.entries.icmp_message_type, ""))) ? null : try(e.icmp_message_type, local.defaults.iosxe.configuration.access_lists.extended.entries.icmp_message_type, null)
icmp_msg_type = can(tonumber(try(e.icmp_message_type, local.defaults.iosxe.configuration.access_lists.extended.entries.icmp_message_type, ""))) ? try(e.icmp_message_type, local.defaults.iosxe.configuration.access_lists.extended.entries.icmp_message_type, null) : null
icmp_msg_code = try(e.icmp_message_code, local.defaults.iosxe.configuration.access_lists.extended.entries.icmp_message_code, null)
log = try(e.log, local.defaults.iosxe.configuration.access_lists.extended.entries.log, null)
log_input = try(e.log_input, local.defaults.iosxe.configuration.access_lists.extended.entries.log_input, null)
}]
}
]
])
}
resource "iosxe_access_list_extended" "access_list_extended" {
for_each = { for e in local.access_lists_extended : e.key => e }
device = each.value.device
name = each.value.name
entries = each.value.entries
}
locals {
as_path_access_lists = flatten([
for device in local.devices : [
for acl in try(local.device_config[device.name].access_lists.as_path, []) : {
key = format("%s/%s", device.name, acl.number)
device = device.name
name = try(acl.number, null)
entries = try(length(acl.entries) == 0, true) ? null : [for e in acl.entries : {
action = try(e.action, local.defaults.iosxe.configuration.access_lists.as_path.entries.action, null)
regex = try(e.regex, local.defaults.iosxe.configuration.access_lists.as_path.entries.regex, null)
}]
}
]
])
}
resource "iosxe_as_path_access_list" "as_path_access_list" {
for_each = { for e in local.as_path_access_lists : e.key => e }
device = each.value.device
name = each.value.name
entries = each.value.entries
}
locals {
role_based_access_lists = flatten([
for device in local.devices : [
for acl in try(local.device_config[device.name].access_lists.role_based, []) : {
key = format("%s/%s", device.name, acl.name)
device = device.name
name = try(acl.name, null)
entries = try(length(acl.entries) == 0, true) ? null : [for e in acl.entries : {
sequence = try(e.sequence, local.defaults.iosxe.configuration.access_lists.role_based.entries.sequence, null)
remark = try(e.remark, local.defaults.iosxe.configuration.access_lists.role_based.entries.remark, null)
ace_rule_action = try(e.action, local.defaults.iosxe.configuration.access_lists.role_based.entries.action, null)
ace_rule_protocol = try(e.protocol, local.defaults.iosxe.configuration.access_lists.role_based.entries.protocol, null)
ack = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "ack") ? true : try(e.ack, local.defaults.iosxe.configuration.access_lists.role_based.entries.ack, null)
fin = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "fin") ? true : try(e.fin, local.defaults.iosxe.configuration.access_lists.role_based.entries.fin, null)
psh = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "psh") ? true : try(e.psh, local.defaults.iosxe.configuration.access_lists.role_based.entries.psh, null)
rst = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "rst") ? true : try(e.rst, local.defaults.iosxe.configuration.access_lists.role_based.entries.rst, null)
syn = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "syn") ? true : try(e.syn, local.defaults.iosxe.configuration.access_lists.role_based.entries.syn, null)
urg = contains(try(e.tcp_flags, local.defaults.iosxe.configuration.access_lists.role_based.entries.tcp_flags, []), "urg") ? true : try(e.urg, local.defaults.iosxe.configuration.access_lists.role_based.entries.urg, null)
established = try(e.established, local.defaults.iosxe.configuration.access_lists.role_based.entries.established, null)
fragments = try(e.fragments, local.defaults.iosxe.configuration.access_lists.role_based.entries.fragments, null)
dscp = try(e.dscp, local.defaults.iosxe.configuration.access_lists.role_based.entries.dscp, null)
precedence = try(e.precedence, local.defaults.iosxe.configuration.access_lists.role_based.entries.precedence, null)
tos = try(e.tos, local.defaults.iosxe.configuration.access_lists.role_based.entries.tos, null)
option = try(e.option, local.defaults.iosxe.configuration.access_lists.role_based.entries.option, null)
time_range = try(e.time_range, local.defaults.iosxe.configuration.access_lists.role_based.entries.time_range, null)
log = try(e.log, local.defaults.iosxe.configuration.access_lists.role_based.entries.log, null)
log_input = try(e.log_input, local.defaults.iosxe.configuration.access_lists.role_based.entries.log_input, null)
match_all_plusack = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+ack") ? true : null
match_all_plusfin = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+fin") ? true : null
match_all_pluspsh = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+psh") ? true : null
match_all_plusrst = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+rst") ? true : null
match_all_plussyn = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+syn") ? true : null
match_all_plusurg = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "+urg") ? true : null
match_all_minusack = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-ack") ? true : null
match_all_minusfin = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-fin") ? true : null
match_all_minuspsh = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-psh") ? true : null
match_all_minusrst = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-rst") ? true : null
match_all_minussyn = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-syn") ? true : null
match_all_minusurg = contains(try(e.match_all, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_all, []), "-urg") ? true : null
match_any_plusack = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+ack") ? true : null
match_any_plusfin = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+fin") ? true : null
match_any_pluspsh = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+psh") ? true : null
match_any_plusrst = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+rst") ? true : null
match_any_plussyn = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+syn") ? true : null
match_any_plusurg = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "+urg") ? true : null
match_any_minusack = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-ack") ? true : null
match_any_minusfin = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-fin") ? true : null
match_any_minuspsh = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-psh") ? true : null
match_any_minusrst = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-rst") ? true : null
match_any_minussyn = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-syn") ? true : null
match_any_minusurg = contains(try(e.match_any, local.defaults.iosxe.configuration.access_lists.role_based.entries.match_any, []), "-urg") ? true : null
}]
}
]
])
}
resource "iosxe_access_list_role_based" "access_list_role_based" {
for_each = { for e in local.role_based_access_lists : e.key => e }
device = each.value.device
name = each.value.name
entries = each.value.entries
}