mirror of https://github.com/ansible/ansible.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
247 lines
7.1 KiB
YAML
247 lines
7.1 KiB
YAML
---
|
|
- block:
|
|
- debug: msg="START cli/nxapi_ssl.yaml"
|
|
|
|
- name: Configure NXAPI HTTPs w/weak ciphers
|
|
nxos_nxapi: &configure_https_weak_ciphers
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: no
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc ciphers
|
|
register: result
|
|
|
|
- name: Assert weak ciphers configuration
|
|
assert: &weak_ciphers
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl ciphers weak'
|
|
|
|
- name: Configure NXAPI HTTP w/weak ciphers again
|
|
nxos_nxapi: *configure_https_weak_ciphers
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: &assert_false
|
|
that:
|
|
- result.changed == false
|
|
|
|
- name: Configure NXAPI HTTPs w/strong ciphers
|
|
nxos_nxapi: &configure_https_strong_ciphers
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: yes
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc ciphers
|
|
register: result
|
|
|
|
- name: Assert strong ciphers configuration
|
|
assert: &strong_ciphers
|
|
that:
|
|
- result.stdout_lines[0][0] == 'no nxapi ssl ciphers weak'
|
|
|
|
- name: Configure NXAPI HTTPs w/strong ciphers again
|
|
nxos_nxapi: *configure_https_strong_ciphers
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs w/default TLSv1
|
|
nxos_nxapi: &configure_https_default
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/default TLSv1 configuration
|
|
assert: &default_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1'
|
|
|
|
- name: Configure NXAPI HTTPs w/default again
|
|
nxos_nxapi: *configure_https_default
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs TLSv1.1 -default TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_1
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
tlsv1_1: yes
|
|
tlsv1_0: no
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLSv1.1 configuration
|
|
assert: &tlsv1_1_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1.1'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLSv1.1 -default TLSv1 again
|
|
nxos_nxapi: *configure_https_tlsv1_1
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs TLSv1.2 -default TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_2
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
tlsv1_2: yes
|
|
tlsv1_0: no
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLSv1.2 configuration
|
|
assert: &tlsv1_2_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1.2'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLSv1.2 -default TLSv1 again
|
|
nxos_nxapi: *configure_https_tlsv1_2
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 +default TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_2_default
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: yes
|
|
tlsv1_2: yes
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLS1.2 +default TLSv1 configuration
|
|
assert: &tlsv1_2_default_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1 TLSv1.2'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 again
|
|
nxos_nxapi: *configure_https_tlsv1_2_default
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 TLS1.1 -default TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_2_tlsv1_1
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: yes
|
|
tlsv1_0: no
|
|
tlsv1_1: yes
|
|
tlsv1_2: yes
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLS1.2 TLS1.2 -default TLSv1 configuration
|
|
assert: &tlsv1_2_tlsv1_1_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1.1 TLSv1.2'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 TLS1.1 -default TLSv1 again
|
|
nxos_nxapi: *configure_https_tlsv1_2_tlsv1_1
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 TLS1.1 +default TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_2_tlsv1_1_default
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: yes
|
|
tlsv1_1: yes
|
|
tlsv1_2: yes
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLS1.2 TLS1.1 +default TLSv1 configuration
|
|
assert: &tlsv1_2_tlsv1_1_default_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1 TLSv1.1 TLSv1.2'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 TLS1.1 +default TLSv1 again
|
|
nxos_nxapi: *configure_https_tlsv1_2_tlsv1_1_default
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
- name: Configure NXAPI HTTPs with explicit TLS1.2 TLS1.1 TLSv1
|
|
nxos_nxapi: &configure_https_tlsv1_2_tlsv1_1_tlsv1_0
|
|
enable_https: yes
|
|
enable_sandbox: "{{nxapi_sandbox_option|default(omit)}}"
|
|
ssl_strong_ciphers: yes
|
|
tlsv1_0: yes
|
|
tlsv1_1: yes
|
|
tlsv1_2: yes
|
|
register: result
|
|
|
|
- nxos_command:
|
|
commands:
|
|
- show run all | inc nxapi | inc protocols
|
|
register: result
|
|
|
|
- name: Assert NXAPI HTTPs w/TLS1.2 TLS1.2 TLSv1 configuration
|
|
assert: &tlsv1_2_tlsv1_1_tlsv1_0_configuration
|
|
that:
|
|
- result.stdout_lines[0][0] == 'nxapi ssl protocols TLSv1 TLSv1.1 TLSv1.2'
|
|
|
|
- name: Configure NXAPI HTTPs w/TLS1.2 TLS1.1 TLSv1 again
|
|
nxos_nxapi: *configure_https_tlsv1_2_tlsv1_1_tlsv1_0
|
|
register: result
|
|
|
|
- name: Assert configuration is idempotent
|
|
assert: *assert_false
|
|
|
|
always:
|
|
- name: Cleanup - Disable NXAPI
|
|
nxos_nxapi:
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Cleanup - Re-enable NXAPI
|
|
nxos_nxapi:
|
|
state: present
|
|
register: result
|
|
|
|
- debug: msg="END cli/nxapi_ssl.yaml"
|
|
|
|
when: (platform is match("N9K") or platform is match("N3K") or platform is match("N9K-F") or platform is match("N35") or platform is match("N3L")) and major_version is version('9.2', '>=')
|