netstack 0.1.1 → 0.2.0

data/lib/netstack/wireless/security_policy.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class SecurityPolicy < Data.define(:key, :global_settings, :blacklist, :whitelist, :blocked_clients)
+      def initialize(key:, global_settings: {}, blacklist: [], whitelist: [], blocked_clients: [])
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, global_settings: global_settings, blacklist: blacklist, whitelist: whitelist, blocked_clients: blocked_clients))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/service_template.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class ServiceTemplate < Data.define(:key, :name, :ssid, :vlan_id, :enabled, :authentication_type, :configuration)
+      def initialize(key:, name:, ssid: nil, vlan_id: nil, enabled: nil, authentication_type: nil, configuration: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, name: name, ssid: ssid, vlan_id: vlan_id, enabled: enabled, authentication_type: authentication_type, configuration: configuration))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/service_template_bindings.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    # One service template binding per radio; VLAN is a property of that identity.
+    module ServiceTemplateBindings
+      module_function
+
+      def identity(binding)
+        unless binding.is_a?(Hash) && binding[:name].is_a?(String) && !binding[:name].strip.empty?
+          raise InvalidSnapshot, "invalid service template binding"
+        end
+        binding[:name].strip.downcase
+      end
+
+      def validate!(bindings)
+        raise InvalidSnapshot, "service template bindings must be an Array" unless bindings.is_a?(Array)
+        keys = bindings.map { |binding| identity(binding) }
+        raise InvalidSnapshot, "duplicate service template binding" unless keys.uniq.size == keys.size
+      end
+
+      def merge(previous, incoming)
+        validate!(previous)
+        validate!(incoming)
+        values = previous.to_h { |binding| [identity(binding), binding] }
+        incoming.each do |binding|
+          key = identity(binding)
+          values[key] = values.key?(key) ? values[key].merge(binding.reject { |_, value| value.nil? }) : binding
+        end
+        values.values
+      end
+
+      def overlay(explicit, inherited)
+        validate!(explicit)
+        validate!(inherited)
+        (explicit + inherited).uniq { |binding| identity(binding) }
+      end
+
+      def validate_radios!(radios)
+        raise InvalidSnapshot, "configured radios must be a Hash" unless radios.is_a?(Hash)
+        radios.each_value { |settings| validate_settings!(settings) }
+      end
+
+      def validate_settings!(settings)
+        raise InvalidSnapshot, "radio configuration must be a Hash" unless settings.is_a?(Hash)
+        validate!(settings[:service_templates]) if settings.key?(:service_templates)
+      end
+
+      def validate_groups!(groups)
+        groups.each do |group|
+          group.model_profiles.each_value { |profile| validate_radios!(profile.fetch(:radios, {})) }
+        end
+      end
+    end
+  end
+end

data/lib/netstack/wireless/snapshot.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    # 单次观察的完整性与身份边界；未传入的维度明确标记为未请求。
+    # 只有相关维度完整时，才能用缺失关系判定对象不存在。
+    class Snapshot < Data.define(:target, :dimensions, :observed_at)
+      RECORD_TYPES = {
+        access_points: AccessPoint, radios: Radio, clients: Client, bsses: Bss, configuration: Configuration,
+        ap_groups: ApGroup, service_templates: ServiceTemplate, dot1x_connections: AuthenticationConnection,
+        mab_connections: AuthenticationConnection, blocked_clients: Hash, lldp: Neighbor
+      }.freeze
+      DIMENSIONS = RECORD_TYPES.keys.freeze
+
+      def initialize(target:, dimensions:, observed_at: Time.now.utc)
+        raise InvalidSnapshot, "wireless target must be a Target" unless target.is_a?(Target)
+        raise InvalidSnapshot, "wireless dimensions must be an Array" unless dimensions.is_a?(Array)
+        raise InvalidSnapshot, "wireless dimensions must be Dimension values" unless dimensions.all?(Dimension)
+        raise InvalidSnapshot, "duplicate wireless dimension" unless dimensions.map(&:name).uniq.size == dimensions.size
+        raise InvalidSnapshot, "unknown wireless dimension" unless (dimensions.map(&:name) - DIMENSIONS).empty?
+
+        dimensions = DIMENSIONS.map { |name| dimensions.find { |dimension| dimension.name == name } || Dimension.new(name: name, status: :not_requested) }
+        dimensions.each { |dimension| validate_dimension!(dimension) }
+        validate_relationships!(dimensions)
+        validate_radio_and_bss_relationships!(dimensions)
+        observed_at = Values.time(observed_at, name: "wireless snapshot observation")
+        if dimensions.any? { |dimension| dimension.completed_at && dimension.completed_at > observed_at }
+          raise InvalidSnapshot, "wireless observation precedes collection completion"
+        end
+        super(target: Values.copy(target), dimensions: Values.copy(dimensions), observed_at: observed_at)
+      end
+
+      def dimension(name) = dimensions.find { |dimension| dimension.name == name.to_sym } || raise(InputError, "unknown wireless dimension")
+      def records(name) = dimension(name).records
+      def complete? = dimensions.reject { |dimension| dimension.status == :not_requested }.all?(&:complete?) && dimensions.any?(&:complete?)
+      def view = View.new(self)
+
+      private
+
+      def validate_dimension!(dimension)
+        type = RECORD_TYPES.fetch(dimension.name)
+        raise InvalidSnapshot, "invalid wireless record type" unless dimension.records.all?(type)
+        keys = dimension.records.map { |record| record.is_a?(Hash) ? record[:key] : record.key }
+        raise InvalidSnapshot, "missing or duplicate wireless identity" if keys.any? { |key| !key.is_a?(String) || key.empty? } || keys.uniq.size != keys.size
+        dimension.records.each { |record| validate_identity!(record) }
+        unique!(dimension.records, :ap_id, :mac_address, :serial_id) if dimension.name == :access_points
+        unique!(dimension.records, :mac_address) if dimension.name == :clients
+        unique!(dimension.records, :bssid) if dimension.name == :bsses
+        dimension.records.each { |record| ServiceTemplateBindings.validate_settings!(record.configuration) } if dimension.name == :radios
+        ServiceTemplateBindings.validate_groups!(dimension.records) if dimension.name == :ap_groups
+        return unless dimension.name == :configuration
+        raise InvalidSnapshot, "multiple wireless configurations" if dimension.records.size > 1
+        config = dimension.records.first
+        return unless config
+        unique!(config.ap_groups, :name)
+        unique!(config.service_templates, :name)
+        config.access_points.each { |name, ap| raise InvalidSnapshot, "configured AP identity mismatch" unless ap[:name] == name }
+        config.access_points.each_value { |ap| ServiceTemplateBindings.validate_radios!(ap.fetch(:radios, {})) }
+        ServiceTemplateBindings.validate_groups!(config.ap_groups)
+        serials = config.access_points.values.filter_map { |ap| ap[:serial_id] }
+        raise InvalidSnapshot, "duplicate configured AP serial" unless serials.uniq.size == serials.size
+
+
+      end
+
+      def validate_identity!(record)
+        if record.is_a?(Data)
+          record.to_h.each do |field, value|
+            next if value.nil?
+            if %i[ap_id radio_id client_count online_seconds vlan_id initial_vlan_id authorized_vlan_id].include?(field)
+              raise InvalidSnapshot, "invalid wireless numeric field" unless value.is_a?(Integer) && value >= 0 && (!field.to_s.include?("vlan") || value <= 4094)
+            elsif %i[mac_address bssid].include?(field)
+              raise InvalidSnapshot, "noncanonical wireless MAC identity" unless Normalizer.mac(value) == value
+            end
+          end
+        end
+        expected = case record
+        when AccessPoint then Normalizer.key(Values.text(record.name, name: "AP name"))
+        when Radio then Normalizer.key(Values.text(record.ap_name, name: "radio AP name"), Values.integer(record.radio_id, name: "radio ID", min: 0))
+        when Client then Normalizer.key(Normalizer.mac(record.mac_address))
+        when Bss then Normalizer.key(Normalizer.mac(record.bssid))
+        when ApGroup, ServiceTemplate then Normalizer.key(Values.text(record.name, name: "wireless name"))
+        when AuthenticationConnection
+          raise InvalidSnapshot, "unknown authentication kind" unless %i[dot1x mab].include?(record.kind)
+          Normalizer.key(record.kind, Normalizer.mac(record.mac_address), record.interface, record.bssid)
+        when Neighbor then Normalizer.key(record.ap_name, record.local_interface, record.remote_chassis_id, record.remote_interface)
+        when Hash then Normalizer.key(Normalizer.mac(record.fetch(:mac_address)))
+        when Configuration then "controller"
+        end
+        raise InvalidSnapshot, "wireless record key does not match its identity" unless expected == (record.is_a?(Hash) ? record[:key] : record.key)
+      rescue InputError, KeyError
+        raise InvalidSnapshot, "invalid wireless identity"
+      end
+
+      def unique!(records, *fields)
+        fields.each do |field|
+          values = records.filter_map { |record| record.public_send(field) }
+          raise InvalidSnapshot, "duplicate wireless #{field}" unless values.uniq.size == values.size
+        end
+      end
+
+      def validate_radio_and_bss_relationships!(dimensions)
+        by_name = dimensions.to_h { |dimension| [dimension.name, dimension] }
+        radios = by_name.fetch(:radios)
+        radio_keys = radios.records.map { |radio| [radio.ap_name, radio.radio_id] }
+        bsses = by_name.fetch(:bsses)
+        by_bssid = bsses.records.to_h { |bss| [bss.bssid, bss] }
+        %i[clients bsses dot1x_connections mab_connections].each do |name|
+          by_name.fetch(name).records.each do |record|
+            if radios.complete? && record.ap_name && record.radio_id && !radio_keys.include?([record.ap_name, record.radio_id])
+              raise InvalidSnapshot, "wireless record refers to an absent radio"
+            end
+            next if record.is_a?(Bss) || record.bssid.nil?
+            bss = by_bssid[record.bssid]
+            if bss
+              %i[ap_name ap_id radio_id ssid].each do |field|
+                if record.public_send(field) && bss.public_send(field) && record.public_send(field) != bss.public_send(field)
+                  raise InvalidSnapshot, "wireless record and BSS identity disagree"
+                end
+              end
+            elsif bsses.complete? && record.is_a?(Client)
+              raise InvalidSnapshot, "wireless client refers to an absent BSS"
+            end
+          end
+        end
+      end
+
+      def validate_relationships!(dimensions)
+        aps = dimensions.find { |dimension| dimension.name == :access_points }
+        names = aps.records.to_h { |ap| [ap.name, ap] }
+        ids = aps.records.filter_map { |ap| [ap.ap_id, ap] if ap.ap_id }.to_h
+        dimensions.reject { |dimension| dimension.name == :access_points }.each do |dimension|
+          dimension.records.each do |record|
+            next unless record.respond_to?(:ap_name) || record.respond_to?(:ap_id)
+            name = record.respond_to?(:ap_name) ? record.ap_name : nil
+            id = record.respond_to?(:ap_id) ? record.ap_id : nil
+            by_name = names[name]
+            by_id = ids[id]
+            if (by_name && by_id && by_name != by_id) || (by_name && id && by_name.ap_id && by_name.ap_id != id) || (by_id && name && by_id.name != name)
+              raise InvalidSnapshot, "AP name and ID refer to different access points"
+            end
+            if aps.complete? && (name || id) && !by_name && !by_id
+              raise InvalidSnapshot, "wireless record refers to an absent access point"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/netstack/wireless/state.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    # 保留记录与单次观察各自独立；失败观察没有记录，但不能清空已有状态。
+    class State < Data.define(:target, :records, :watermarks)
+      def initialize(target:, records: {}, watermarks: {})
+        raise InvalidSnapshot, "wireless state target must be a Target" unless target.is_a?(Target)
+        raise InvalidSnapshot, "invalid wireless state dimensions" unless (records.keys - Snapshot::DIMENSIONS).empty? && (watermarks.keys - Snapshot::DIMENSIONS).empty?
+
+        dimensions = records.map { |name, values| Dimension.new(name: name, status: :partial, records: values) }
+        Snapshot.new(target: target, dimensions: dimensions)
+        super(target: Values.copy(target), records: Values.copy(records),
+          watermarks: Values.copy(watermarks.transform_values { |time| Values.time(time, name: "wireless watermark") }))
+      end
+
+      def self.from_snapshot(snapshot)
+        new(target: snapshot.target, records: snapshot.dimensions.to_h { |dimension| [dimension.name, dimension.records] },
+          watermarks: snapshot.dimensions.filter_map { |dimension| [dimension.name, dimension.completed_at] if dimension.completed_at }.to_h)
+      end
+    end
+  end
+end

data/lib/netstack/wireless/view.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/hash/deep_merge"
+
+module Netstack
+  module Wireless
+    # A derived controller view. Original runtime/configuration dimensions retain their own completeness.
+    class View
+      attr_reader :access_points, :radios, :clients, :bsses, :ap_groups, :service_templates, :security_policy, :diagnostics
+
+      def initialize(snapshot)
+        @snapshot = snapshot
+        @diagnostics = []
+        configuration = snapshot.records(:configuration).first || Configuration.new
+        @ap_groups = (snapshot.records(:ap_groups) + configuration.ap_groups).uniq(&:name)
+        @service_templates = (snapshot.records(:service_templates) + configuration.service_templates).uniq(&:name)
+        runtime = snapshot.records(:access_points).to_h { |ap| [ap.name, ap] }
+        @access_points = (runtime.keys | configuration.access_points.keys).sort.map do |name|
+          configured = configuration.access_points.fetch(name, {})
+          ap = runtime[name] || AccessPoint.new(key: Normalizer.key(name), name: name)
+          group = group_for(ap, configured)
+          settings = (group&.configuration || {}).deep_merge(configured.reject { |key, _| %i[name model serial_id radios].include?(key) })
+          ap.with(model: configured[:model] || ap.model, serial_id: configured[:serial_id] || ap.serial_id,
+            group_name: ap.group_name || group&.name, configuration: ap.configuration.deep_merge(settings))
+        end
+        @radios = build_radios(configuration)
+        @bsses = snapshot.records(:bsses).map do |bss|
+          template = service_template_for(bss)
+          matched_ap = access_points.find { |candidate| candidate.ap_id && candidate.ap_id == bss.ap_id }
+          bss.with(service_template: bss.service_template || template&.name, ap_name: bss.ap_name || matched_ap&.name)
+        end
+        @security_policy = SecurityPolicy.new(key: "controller", global_settings: configuration.global_settings,
+          blacklist: configuration.blacklist, whitelist: configuration.whitelist, blocked_clients: snapshot.records(:blocked_clients))
+        @clients = Values.copy(snapshot.records(:clients).map { |client| enrich_client(client) })
+        @access_points = Values.copy(@access_points)
+        @radios = Values.copy(@radios)
+        @bsses = Values.copy(@bsses)
+        @ap_groups = Values.copy(@ap_groups)
+        @service_templates = Values.copy(@service_templates)
+        @diagnostics = Values.copy(@diagnostics)
+        freeze
+      end
+
+      def clients_for(ap_name:, radio_id: nil)
+        clients.select { |client| client.ap_name == ap_name && (radio_id.nil? || client.radio_id == radio_id) }.freeze
+      end
+
+      def authentications_for(client)
+        %i[dot1x_connections mab_connections].flat_map { |name| @snapshot.records(name) }.select do |connection|
+          connection.mac_address == client.mac_address && (!connection.ap_name || !client.ap_name || connection.ap_name == client.ap_name) &&
+            (!connection.bssid || !client.bssid || connection.bssid == client.bssid) &&
+            (!connection.ap_id || !client.ap_id || connection.ap_id == client.ap_id) &&
+            (!connection.radio_id || !client.radio_id || connection.radio_id == client.radio_id)
+        end.freeze
+      end
+
+      def neighbors_for(ap_name:) = @snapshot.records(:lldp).select { |neighbor| neighbor.ap_name == ap_name }.freeze
+      def radios_for(ap_name:) = radios.select { |radio| radio.ap_name == ap_name }.freeze
+      def bsses_for(ap_name:) = bsses.select { |bss| bss.ap_name == ap_name }.freeze
+
+      def blocked?(mac)
+        mac = Normalizer.mac(mac)
+        (security_policy.blacklist + security_policy.blocked_clients).any? { |record| record[:mac_address] == mac }
+      end
+
+      def whitelisted?(mac)
+        mac = Normalizer.mac(mac)
+        security_policy.whitelist.any? { |record| record[:mac_address] == mac }
+      end
+
+      private
+
+      def group_for(access_point, configured)
+        return ap_groups.find { |group| group.name == access_point.group_name } if access_point.group_name
+
+        groups = ap_groups.select { |group| group.ap_names.include?(access_point.name) || (configured[:serial_id] && group.serial_ids.include?(configured[:serial_id])) }
+        if groups.size > 1
+          @diagnostics << { code: :ambiguous_ap_group, record_key: access_point.key }
+          return nil
+        end
+        groups.first
+      end
+
+      def build_radios(configuration)
+        runtime = @snapshot.records(:radios).group_by(&:ap_name)
+        access_points.flat_map do |ap|
+          configured = configuration.access_points.fetch(ap.name, {})
+          group = ap_groups.find { |candidate| candidate.name == ap.group_name }
+          inherited = group&.model_profiles&.dig(ap.model, :radios) || {}
+          explicit = configured.fetch(:radios, {})
+          observed = (runtime[ap.name] || []).to_h { |radio| [radio.radio_id, radio] }
+          (inherited.keys | explicit.keys | observed.keys).sort.map do |id|
+            settings = inherited.fetch(id, {}).deep_merge(explicit.fetch(id, {}))
+            bindings = ServiceTemplateBindings.overlay(explicit.dig(id, :service_templates) || [], inherited.dig(id, :service_templates) || [])
+            settings[:service_templates] = bindings if !bindings.empty?
+            radio = observed[id] || Radio.new(key: Normalizer.key(ap.name, id), ap_name: ap.name, radio_id: id)
+            radio.with(configuration: settings.deep_merge(radio.configuration))
+          end
+        end
+      end
+
+      def enrich_client(client)
+        bss = bsses.find { |candidate| candidate.bssid == client.bssid } if client.bssid
+        candidates = if bss&.service_template
+          service_templates.select { |template| template.name == bss.service_template }
+        else
+          service_templates.select { |template| client.ssid && template.ssid == client.ssid }
+        end
+        template = candidates.size == 1 ? candidates.first : nil
+        @diagnostics << { code: :ambiguous_service_template, record_key: client.key } if candidates.size > 1
+        connections = authentications_for(client)
+        auth_type = if connections.any? { |connection| connection.kind == :dot1x }
+          :dot1x
+        elsif connections.any? { |connection| connection.kind == :mab }
+          :mab
+        elsif template
+          template.authentication_type
+        else
+          runtime_authentication_type(client)
+        end
+        matched_ap = access_points.find { |candidate| candidate.ap_id && candidate.ap_id == client.ap_id }
+        client.with(ap_name: client.ap_name || matched_ap&.name, authentication: client.authentication.merge(
+          authentication_type: auth_type, service_template: template&.name,
+          configured_security: template&.configuration, connection_keys: connections.map(&:key)),
+          attributes: client.attributes.merge(blocked: blocked?(client.mac_address), whitelisted: whitelisted?(client.mac_address)))
+      end
+
+      def runtime_authentication_type(client)
+        mode = client.authentication[:akm_mode].to_s
+        return :dot1x if /(?:802\.1x|dot1x)/i.match?(mode)
+        return :psk if /psk/i.match?(mode)
+
+        nil
+      end
+
+      def service_template_for(bss)
+        candidates = if bss.service_template
+          service_templates.select { |template| template.name == bss.service_template }
+        elsif bss.ssid
+          service_templates.select { |template| template.ssid == bss.ssid }
+        else
+          []
+        end
+        if candidates.size > 1
+          @diagnostics << { code: :ambiguous_service_template, record_key: bss.key }
+          nil
+        else
+          @diagnostics << { code: :unknown_service_template, record_key: bss.key } if candidates.empty? && bss.service_template
+          candidates.first
+        end
+      end
+    end
+  end
+end

data/lib/netstack.rb

@@ -1,8 +1,15 @@
 # frozen_string_literal: true
 
-require_relative "netstack/version"
+require "zeitwerk"
 
+# 网络观察、可审查的意图与显式的单目标执行。
+# 加载常量不会建立会话，也不会启动由宿主管理的后台任务。
 module Netstack
-  class Error < StandardError; end
-  # Your code goes here...
+  LOADER = Zeitwerk::Loader.for_gem
+  LOADER.inflector.inflect("textfsm" => "TextFSM", "ipv4" => "IPv4", "ipv6" => "IPv6")
+  LOADER.setup
+
+  def self.eager_load!
+    LOADER.eager_load
+  end
 end

data/resources/configuration/cisco-bootstrap.erb

@@ -0,0 +1,118 @@
+! Cisco NX-OS bootstrap: <%= hostname %>
+! Device role: <%= device_role %>
+configure terminal
+hostname <%= hostname %>
+clock timezone <%= system.timezone %> 8 0
+ip domain-name <%= system.domain_name %>
+feature tacacs+
+feature interface-vlan
+feature lacp
+feature lldp
+feature netconf
+<% if underlay_enabled %>feature ospf
+<% end %><% if overlay_enabled %>feature bgp
+feature nv overlay
+feature vn-segment-vlan-based
+nv overlay evpn
+<% end %><% if vpc_enabled %>feature vpc
+cfs ipv4 distribute
+<% end %>interface mgmt0
+ vrf member management
+ ip address <%= mgmt %>
+ no shutdown
+vrf context management
+ ip route 0.0.0.0/0 <%= mgmt_gateway %>
+<% system.dns_servers.each do |server| %>ip name-server <%= server %>
+<% end %><% system.ntp_servers.each do |server| %>ntp server <%= server %> use-vrf management
+<% end %><% system.syslog_servers.each do |server| %>logging server <%= server %> use-vrf management
+<% end %>snmp-server community <%= system.snmp_community %> RO
+snmp-server location <%= snmp_location %>
+<% system.tacacs_entries.each do |server| %>tacacs server <%= server.name %>
+ address ipv4 <%= server.address %>
+ key <%= system.tacacs_secret %>
+<% end %>aaa group server tacacs+ TACACS
+<% system.tacacs_entries.each do |server| %> server name <%= server.name %>
+<% end %>aaa authentication login default group TACACS local
+aaa authorization commands default group TACACS local
+ip access-list SSH-MANAGEMENT
+<% system.ssh_acl_entries.each do |entry| %> permit ip <%= entry.wildcard %> any
+<% end %>line vty
+ session-limit 16
+ exec-timeout <%= system.vty_timeout_minutes %>
+ transport input ssh
+ ip access-class SSH-MANAGEMENT in
+<% system.local_users.each do |user| %>username <%= user.username %> privilege <%= user.cisco_privilege %> secret <%= user.password %>
+<% end %><% if system.base_security_enabled %>password strength-check
+<% else %>no password strength-check
+<% end %>
+<% if system.disable_http %>no feature http-server
+<% end %><% if underlay_enabled %>interface loopback0
+ description ROUTER_ID
+ ip address <%= loopback %>
+ ip router ospf <%= ospf_process_id %> area <%= ospf_area %>
+<% fabric_links.each do |link| %>interface <%= link.interface %>
+ description <%= link.description %>
+ mtu <%= fabric_mtu %>
+ no switchport
+ port-type fabric
+ ip address <%= link.address %>
+ ip ospf network point-to-point
+ ip router ospf <%= ospf_process_id %> area <%= ospf_area %>
+ no shutdown
+<% end %>router ospf <%= ospf_process_id %>
+ router-id <%= loopback_ip %>
+ log-adjacency-changes
+<% end %><% if nve_enabled %>interface loopback1
+ description NVE_SOURCE
+ ip address <%= vtep_loopback %>
+<% if vtep_secondary_enabled %> ip address <%= vtep_secondary %> secondary
+<% end %> ip ospf network point-to-point
+ ip router ospf <%= ospf_process_id %> area <%= ospf_area %>
+interface nve1
+ no shutdown
+ host-reachability protocol bgp
+ advertise virtual-rmac
+ source-interface loopback1
+<% end %><% if overlay_enabled %>router bgp <%= local_as %>
+ router-id <%= loopback_ip %>
+ log-neighbor-changes
+ address-family ipv4 unicast
+ address-family l2vpn evpn
+  retain route-target all
+<% if advertise_pip %>  advertise-pip
+<% end %> template peer VTEP_TEMPLATE
+  remote-as <%= remote_as %>
+  update-source loopback0
+  address-family ipv4 unicast
+   send-community
+   send-community extended
+  address-family l2vpn evpn
+   send-community
+   send-community extended
+<% bgp_neighbors.each do |neighbor| %> neighbor <%= neighbor.address %>
+  inherit peer VTEP_TEMPLATE
+<% if route_reflector %>  address-family l2vpn evpn
+   route-reflector-client
+<% end %><% end %><% external_bgp_neighbors.each do |neighbor| %> neighbor <%= neighbor.address %>
+  remote-as <%= neighbor.remote_as %>
+<% if neighbor.description %>  description <%= neighbor.description %>
+<% end %>  address-family ipv4 unicast
+<% end %><% end %><% if vpc_enabled %>vpc domain <%= vpc_domain_id %>
+ peer-switch
+ role priority <%= vpc_role_priority %>
+ peer-keepalive destination <%= vpc_peer_keepalive_destination %> source <%= vpc_peer_keepalive_source %>
+<% if vpc_virtual_peer_link_enabled %> virtual peer-link destination <%= vpc_virtual_peer_link_destination %> source <%= vpc_virtual_peer_link_source %> dscp 56
+<% end %> peer-gateway
+ layer3 peer-router
+ auto-recovery
+ fast-convergence
+ ip arp synchronize
+interface port-channel<%= vpc_peer_link_port_channel %>
+ description VPC_PEER_LINK
+ switchport
+ switchport mode trunk
+ spanning-tree port type network
+ vpc peer-link
+ no shutdown
+<% end %>end
+copy running-config startup-config

data/resources/configuration/cisco-distributed-gateway.erb

@@ -0,0 +1,40 @@
+configure terminal
+! Cisco distributed gateways
+! ============================================================
+! 1. VLAN -> VNI
+! ============================================================
+<% gateways.each do |gateway| %>vlan <%= gateway.vlan %>
+<% if gateway.name %> name <%= gateway.name %>
+<% end %> vn-segment <%= gateway.vni %>
+<% end %>
+! ============================================================
+! 2. VNI -> EVPN
+! ============================================================
+evpn
+<% gateways.each do |gateway| %> vni <%= gateway.vni %> l2
+  rd auto
+  route-target import auto
+  route-target export auto
+<% end %>
+! ============================================================
+! 3. Gateway prefixes and SVI
+! ============================================================
+<% gateways.each do |gateway| %>ip prefix-list VXLAN permit <%= gateway.subnet %>
+<% end %><% gateways.each do |gateway| %>interface Vlan<%= gateway.vlan %>
+ no shutdown
+ mtu <%= gateway.mtu %>
+<% if gateway.acl %> ip access-group <%= gateway.acl %> in
+<% end %> vrf member <%= gateway.vrf %>
+ no ip redirects
+ ip address <%= gateway.gateway_cidr %>
+ fabric forwarding mode anycast-gateway
+<% end %>
+! ============================================================
+! 4. VNI -> NVE
+! ============================================================
+interface nve1
+<% gateways.each do |gateway| %> member vni <%= gateway.vni %>
+  suppress-arp
+  ingress-replication protocol bgp
+<% end %>end
+copy running-config startup-config

data/resources/configuration/cisco-n9k-vpc.erb

@@ -0,0 +1,62 @@
+! Cisco N9K vPC pair
+! Primary switch
+configure terminal
+feature vpc
+hardware access-list tcam region ing-racl 0
+hardware access-list tcam region ing-sup 768
+hardware access-list tcam region ing-flow-redirect 512
+system nve infra-vlans <%= infra_vlan %>
+system nve policy-install-all
+vpc domain <%= vpc_domain_id %>
+ peer-switch
+ role priority <%= primary_role_priority %>
+ peer-keepalive destination <%= secondary_keepalive_ip %> source <%= primary_keepalive_ip %>
+ virtual peer-link destination <%= secondary_virtual_peer_link_ip %> source <%= primary_virtual_peer_link_ip %> dscp 56
+ delay restore 1
+ peer-gateway
+ layer3 peer-router
+ auto-recovery
+ fast-convergence
+ ip arp synchronize
+interface port-channel<%= vpc_peer_link_port_channel %>
+ description VPC_PEER_LINK
+ switchport
+ switchport mode trunk
+ spanning-tree port type network
+ vpc peer-link
+ no shutdown
+<% fabric_interfaces.each do |interface| %>interface <%= interface %>
+ port-type fabric
+<% end %>end
+copy running-config startup-config
+
+! Secondary switch
+configure terminal
+feature vpc
+hardware access-list tcam region ing-racl 0
+hardware access-list tcam region ing-sup 768
+hardware access-list tcam region ing-flow-redirect 512
+system nve infra-vlans <%= infra_vlan %>
+system nve policy-install-all
+vpc domain <%= vpc_domain_id %>
+ peer-switch
+ role priority <%= secondary_role_priority %>
+ peer-keepalive destination <%= primary_keepalive_ip %> source <%= secondary_keepalive_ip %>
+ virtual peer-link destination <%= primary_virtual_peer_link_ip %> source <%= secondary_virtual_peer_link_ip %> dscp 56
+ delay restore 1
+ peer-gateway
+ layer3 peer-router
+ auto-recovery
+ fast-convergence
+ ip arp synchronize
+interface port-channel<%= vpc_peer_link_port_channel %>
+ description VPC_PEER_LINK
+ switchport
+ switchport mode trunk
+ spanning-tree port type network
+ vpc peer-link
+ no shutdown
+<% fabric_interfaces.each do |interface| %>interface <%= interface %>
+ port-type fabric
+<% end %>end
+copy running-config startup-config