def add_routing_instance(self, ri_conf):
ri_name = ri_conf.get("ri_name")
vn = ri_conf.get("vn")
is_l2 = ri_conf.get("is_l2", False)
is_l2_l3 = ri_conf.get("is_l2_l3", False)
import_targets = ri_conf.get("import_targets", set())
export_targets = ri_conf.get("export_targets", set())
prefixes = ri_conf.get("prefixes", [])
gateways = ri_conf.get("gateways", [])
router_external = ri_conf.get("router_external", False)
interfaces = ri_conf.get("interfaces", [])
vni = ri_conf.get("vni", None)
fip_map = ri_conf.get("fip_map", None)
network_id = ri_conf.get("network_id", None)
static_routes = ri_conf.get("static_routes", {})
no_vrf_table_label = ri_conf.get("no_vrf_table_label", False)
restrict_proxy_arp = ri_conf.get("restrict_proxy_arp", False)
highest_enapsulation_priority = \
ri_conf.get("highest_enapsulation_priority") or "MPLSoGRE"
self.routing_instances[ri_name] = ri_conf
ri_config = self.ri_config or RoutingInstances(
comment=DMUtils.routing_instances_comment())
policy_config = self.policy_config or PolicyOptions(
comment=DMUtils.policy_options_comment())
ri = Instance(name=ri_name)
if vn:
is_nat = True if fip_map else False
ri.set_comment(DMUtils.vn_ri_comment(vn, is_l2, is_l2_l3, is_nat))
ri_config.add_instance(ri)
ri_opt = None
if router_external and is_l2 == False:
ri_opt = RoutingInstanceRoutingOptions(static=Static(route=[
Route(name="0.0.0.0/0",
next_table="inet.0",
comment=DMUtils.public_vrf_route_comment())
]))
ri.set_routing_options(ri_opt)
# for both l2 and l3
ri.set_vrf_import(DMUtils.make_import_name(ri_name))
ri.set_vrf_export(DMUtils.make_export_name(ri_name))
has_ipv6_prefixes = DMUtils.has_ipv6_prefixes(prefixes)
has_ipv4_prefixes = DMUtils.has_ipv4_prefixes(prefixes)
if not is_l2:
if ri_opt is None:
ri_opt = RoutingInstanceRoutingOptions()
ri.set_routing_options(ri_opt)
if prefixes and fip_map is None:
static_config = ri_opt.get_static()
if not static_config:
static_config = Static()
ri_opt.set_static(static_config)
rib_config_v6 = None
static_config_v6 = None
for prefix in prefixes:
if ':' in prefix and not rib_config_v6:
static_config_v6 = Static()
rib_config_v6 = RIB(name=ri_name + ".inet6.0")
rib_config_v6.set_static(static_config_v6)
ri_opt.set_rib(rib_config_v6)
if ':' in prefix:
static_config_v6.add_route(
Route(name=prefix, discard=''))
else:
static_config.add_route(Route(name=prefix, discard=''))
if router_external:
self.add_to_global_ri_opts(prefix)
ri.set_instance_type("vrf")
if not no_vrf_table_label:
ri.set_vrf_table_label('') # only for l3
if fip_map is None:
for interface in interfaces:
ri.add_interface(Interface(name=interface.name))
if static_routes:
self.add_static_routes(ri_opt, static_routes)
if has_ipv4_prefixes:
ri_opt.set_auto_export(
AutoExport(family=Family(inet=FamilyInet(unicast=''))))
if has_ipv6_prefixes:
ri_opt.set_auto_export(
AutoExport(family=Family(inet6=FamilyInet6(unicast=''))))
else:
if highest_enapsulation_priority == "VXLAN":
ri.set_instance_type("virtual-switch")
elif highest_enapsulation_priority in ["MPLSoGRE", "MPLSoUDP"]:
ri.set_instance_type("evpn")
if fip_map is not None:
if ri_opt is None:
ri_opt = RoutingInstanceRoutingOptions()
ri.set_routing_options(ri_opt)
static_config = ri_opt.get_static()
if not static_config:
static_config = Static()
ri_opt.set_static(static_config)
static_config.add_route(
Route(name="0.0.0.0/0",
next_hop=interfaces[0].name,
comment=DMUtils.fip_ingress_comment()))
ri.add_interface(Interface(name=interfaces[0].name))
public_vrf_ips = {}
for pip in fip_map.values():
if pip["vrf_name"] not in public_vrf_ips:
public_vrf_ips[pip["vrf_name"]] = set()
public_vrf_ips[pip["vrf_name"]].add(pip["floating_ip"])
for public_vrf, fips in public_vrf_ips.items():
ri_public = Instance(name=public_vrf)
ri_config.add_instance(ri_public)
ri_public.add_interface(Interface(name=interfaces[1].name))
ri_opt = RoutingInstanceRoutingOptions()
ri_public.set_routing_options(ri_opt)
static_config = Static()
ri_opt.set_static(static_config)
for fip in fips:
static_config.add_route(
Route(name=fip + "/32",
next_hop=interfaces[1].name,
comment=DMUtils.fip_egress_comment()))
# add policies for export route targets
ps = PolicyStatement(name=DMUtils.make_export_name(ri_name))
ps.set_comment(DMUtils.vn_ps_comment(vn, "Export"))
then = Then()
ps.set_term(Term(name="t1", then=then))
for route_target in export_targets:
comm = Community(
add='',
community_name=DMUtils.make_community_name(route_target))
then.add_community(comm)
if fip_map is not None:
# for nat instance
then.set_reject('')
else:
then.set_accept('')
policy_config.add_policy_statement(ps)
# add policies for import route targets
ps = PolicyStatement(name=DMUtils.make_import_name(ri_name))
ps.set_comment(DMUtils.vn_ps_comment(vn, "Import"))
from_ = From()
term = Term(name="t1", fromxx=from_)
ps.set_term(term)
for route_target in import_targets:
from_.add_community(DMUtils.make_community_name(route_target))
term.set_then(Then(accept=''))
ps.set_then(Then(reject=''))
policy_config.add_policy_statement(ps)
# add firewall config for public VRF
forwarding_options_config = self.forwarding_options_config
firewall_config = self.firewall_config
if router_external and is_l2 == False:
forwarding_options_config = (
self.forwarding_options_config
or ForwardingOptions(DMUtils.forwarding_options_comment()))
firewall_config = self.firewall_config or Firewall(
DMUtils.firewall_comment())
if has_ipv4_prefixes and not self.inet4_forwarding_filter:
#create single instance inet4 filter
self.inet4_forwarding_filter = self.add_inet_public_vrf_filter(
forwarding_options_config, firewall_config, "inet")
if has_ipv6_prefixes and not self.inet6_forwarding_filter:
#create single instance inet6 filter
self.inet6_forwarding_filter = self.add_inet_public_vrf_filter(
forwarding_options_config, firewall_config, "inet6")
if has_ipv4_prefixes:
#add terms to inet4 filter
term = self.add_inet_filter_term(ri_name, prefixes, "inet4")
# insert before the last term
terms = self.inet4_forwarding_filter.get_term()
terms = [term] + (terms or [])
self.inet4_forwarding_filter.set_term(terms)
if has_ipv6_prefixes:
#add terms to inet6 filter
term = self.add_inet_filter_term(ri_name, prefixes, "inet6")
# insert before the last term
terms = self.inet6_forwarding_filter.get_term()
terms = [term] + (terms or [])
self.inet6_forwarding_filter.set_term(terms)
if fip_map is not None:
firewall_config = firewall_config or Firewall(
DMUtils.firewall_comment())
f = FirewallFilter(
name=DMUtils.make_private_vrf_filter_name(ri_name))
f.set_comment(DMUtils.vn_firewall_comment(vn, "private"))
ff = firewall_config.get_family()
if not ff:
ff = FirewallFamily()
firewall_config.set_family(ff)
inet = ff.get_inet()
if not inet:
inet = FirewallInet()
ff.set_inet(inet)
inet.add_filter(f)
term = Term(name=DMUtils.make_vrf_term_name(ri_name))
from_ = From()
for fip_user_ip in fip_map.keys():
from_.add_source_address(fip_user_ip)
term.set_from(from_)
term.set_then(Then(routing_instance=[ri_name]))
f.add_term(term)
term = Term(name="default-term", then=Then(accept=''))
f.add_term(term)
interfaces_config = self.interfaces_config or Interfaces(
comment=DMUtils.interfaces_comment())
irb_intf = Interface(name="irb")
interfaces_config.add_interface(irb_intf)
intf_unit = Unit(name=str(network_id),
comment=DMUtils.vn_irb_fip_inet_comment(vn))
if restrict_proxy_arp:
intf_unit.set_proxy_arp(ProxyArp(restricted=''))
inet = FamilyInet()
inet.set_filter(
InetFilter(
input=DMUtils.make_private_vrf_filter_name(ri_name)))
intf_unit.set_family(Family(inet=inet))
irb_intf.add_unit(intf_unit)
# add L2 EVPN and BD config
bd_config = None
interfaces_config = self.interfaces_config
proto_config = self.proto_config
if (is_l2 and vni is not None
and self.is_family_configured(self.bgp_params, "e-vpn")):
ri.set_vtep_source_interface("lo0.0")
if highest_enapsulation_priority == "VXLAN":
bd_config = BridgeDomains()
ri.set_bridge_domains(bd_config)
bd = Domain(name=DMUtils.make_bridge_name(vni),
vlan_id='none',
vxlan=VXLan(vni=vni))
bd.set_comment(DMUtils.vn_bd_comment(vn, "VXLAN"))
bd_config.add_domain(bd)
for interface in interfaces:
bd.add_interface(Interface(name=interface.name))
if is_l2_l3:
# network_id is unique, hence irb
bd.set_routing_interface("irb." + str(network_id))
ri.set_protocols(
RoutingInstanceProtocols(evpn=Evpn(
encapsulation='vxlan', extended_vni_list='all')))
elif highest_enapsulation_priority in ["MPLSoGRE", "MPLSoUDP"]:
ri.set_vlan_id('none')
if is_l2_l3:
# network_id is unique, hence irb
ri.set_routing_interface("irb." + str(network_id))
evpn = Evpn()
evpn.set_comment(
DMUtils.vn_evpn_comment(vn, highest_enapsulation_priority))
for interface in interfaces:
evpn.add_interface(Interface(name=interface.name))
ri.set_protocols(RoutingInstanceProtocols(evpn=evpn))
interfaces_config = self.interfaces_config or Interfaces(
comment=DMUtils.interfaces_comment())
if is_l2_l3:
irb_intf = Interface(name='irb', gratuitous_arp_reply='')
interfaces_config.add_interface(irb_intf)
if gateways is not None:
intf_unit = Unit(name=str(network_id),
comment=DMUtils.vn_irb_comment(
vn, False, is_l2_l3))
irb_intf.add_unit(intf_unit)
family = Family()
intf_unit.set_family(family)
inet = None
inet6 = None
for (irb_ip, gateway) in gateways:
if ':' in irb_ip:
if not inet6:
inet6 = FamilyInet6()
family.set_inet6(inet6)
addr = Address()
inet6.add_address(addr)
else:
if not inet:
inet = FamilyInet()
family.set_inet(inet)
addr = Address()
inet.add_address(addr)
addr.set_name(irb_ip)
addr.set_comment(DMUtils.irb_ip_comment(irb_ip))
if len(gateway) and gateway != '0.0.0.0':
addr.set_virtual_gateway_address(gateway)
self.build_l2_evpn_interface_config(interfaces_config, interfaces,
vn)
if (not is_l2 and not is_l2_l3 and gateways):
interfaces_config = self.interfaces_config or Interfaces(
comment=DMUtils.interfaces_comment())
ifl_num = str(1000 + int(network_id))
lo_intf = Interface(name="lo0")
interfaces_config.add_interface(lo_intf)
intf_unit = Unit(name=ifl_num,
comment=DMUtils.l3_lo_intf_comment(vn))
lo_intf.add_unit(intf_unit)
family = Family()
intf_unit.set_family(family)
inet = None
inet6 = None
for (lo_ip, _) in gateways:
(ip, _) = lo_ip.split('/')
if ':' in lo_ip:
if not inet6:
inet6 = FamilyInet6()
family.set_inet6(inet6)
addr = Address()
inet6.add_address(addr)
lo_ip = ip + '/' + '128'
else:
if not inet:
inet = FamilyInet()
family.set_inet(inet)
addr = Address()
inet.add_address(addr)
lo_ip = ip + '/' + '32'
addr.set_name(lo_ip)
addr.set_comment(DMUtils.lo0_ip_comment(lo_ip))
ri.add_interface(
Interface(name="lo0." + ifl_num,
comment=DMUtils.lo0_ri_intf_comment(vn)))
# fip services config
services_config = self.services_config
if fip_map is not None:
services_config = self.services_config or Services()
services_config.set_comment(DMUtils.services_comment())
service_name = DMUtils.make_services_set_name(ri_name)
service_set = ServiceSet(name=service_name)
service_set.set_comment(DMUtils.service_set_comment(vn))
services_config.add_service_set(service_set)
nat_rule = NATRules(name=service_name + "-sn-rule")
service_set.add_nat_rules(
NATRules(name=DMUtils.make_snat_rule_name(ri_name),
comment=DMUtils.service_set_nat_rule_comment(
vn, "SNAT")))
service_set.add_nat_rules(
NATRules(name=DMUtils.make_dnat_rule_name(ri_name),
comment=DMUtils.service_set_nat_rule_comment(
vn, "DNAT")))
next_hop_service = NextHopService(
inside_service_interface=interfaces[0].name,
outside_service_interface=interfaces[1].name)
service_set.set_next_hop_service(next_hop_service)
nat = NAT(allow_overlapping_nat_pools='')
nat.set_comment(DMUtils.nat_comment())
services_config.add_nat(nat)
snat_rule = Rule(name=DMUtils.make_snat_rule_name(ri_name),
match_direction="input")
snat_rule.set_comment(DMUtils.snat_rule_comment())
nat.add_rule(snat_rule)
dnat_rule = Rule(name=DMUtils.make_dnat_rule_name(ri_name),
match_direction="output")
dnat_rule.set_comment(DMUtils.dnat_rule_comment())
nat.add_rule(dnat_rule)
for pip, fip_vn in fip_map.items():
fip = fip_vn["floating_ip"]
term = Term(name=DMUtils.make_ip_term_name(pip))
snat_rule.set_term(term)
# private ip
from_ = From(source_address=[pip + "/32"])
term.set_from(from_)
# public ip
then_ = Then()
term.set_then(then_)
translated = Translated(
source_prefix=fip + "/32",
translation_type=TranslationType(basic_nat44=''))
then_.set_translated(translated)
term = Term(name=DMUtils.make_ip_term_name(fip))
dnat_rule.set_term(term)
# public ip
from_ = From(destination_address=[fip + "/32"])
term.set_from(from_)
# private ip
then_ = Then()
term.set_then(then_)
translated = Translated(
destination_prefix=pip + "/32",
translation_type=TranslationType(dnat_44=''))
then_.set_translated(translated)
interfaces_config = self.interfaces_config or Interfaces(
comment=DMUtils.interfaces_comment())
si_intf = Interface(name=interfaces[0].ifd_name,
comment=DMUtils.service_ifd_comment())
interfaces_config.add_interface(si_intf)
intf_unit = Unit(name=interfaces[0].unit,
comment=DMUtils.service_intf_comment("Ingress"))
si_intf.add_unit(intf_unit)
family = Family(inet=FamilyInet())
intf_unit.set_family(family)
intf_unit.set_service_domain("inside")
intf_unit = Unit(name=interfaces[1].unit,
comment=DMUtils.service_intf_comment("Egress"))
si_intf.add_unit(intf_unit)
family = Family(inet=FamilyInet())
intf_unit.set_family(family)
intf_unit.set_service_domain("outside")
self.forwarding_options_config = forwarding_options_config
self.firewall_config = firewall_config
self.policy_config = policy_config
self.proto_config = proto_config
self.interfaces_config = interfaces_config
self.services_config = services_config
self.route_targets |= import_targets | export_targets
self.ri_config = ri_config
def add_routing_instance(self, ri_conf):
ri_name = ri_conf.get("ri_name")
vn = ri_conf.get("vn")
si = ri_conf.get("si")
is_l2 = ri_conf.get("is_l2", False)
is_l2_l3 = ri_conf.get("is_l2_l3", False)
import_targets = ri_conf.get("import_targets", set())
export_targets = ri_conf.get("export_targets", set())
prefixes = ri_conf.get("prefixes", [])
gateways = ri_conf.get("gateways", [])
router_external = ri_conf.get("router_external", False)
interfaces = ri_conf.get("interfaces", [])
vni = ri_conf.get("vni", None)
fip_map = ri_conf.get("fip_map", None)
network_id = ri_conf.get("network_id", None)
static_routes = ri_conf.get("static_routes", {})
no_vrf_table_label = ri_conf.get("no_vrf_table_label", False)
restrict_proxy_arp = ri_conf.get("restrict_proxy_arp", False)
highest_enapsulation_priority = \
ri_conf.get("highest_enapsulation_priority") or "MPLSoGRE"
self.routing_instances[ri_name] = ri_conf
ri_config = self.ri_config or RoutingInstances(comment=DMUtils.routing_instances_comment())
policy_config = self.policy_config or PolicyOptions(comment=DMUtils.policy_options_comment())
ri = Instance(name=ri_name)
if vn:
is_nat = True if fip_map else False
ri.set_comment(DMUtils.vn_ri_comment(vn, is_l2, is_l2_l3, is_nat, router_external))
elif si:
ri.set_comment(DMUtils.si_ri_comment(si))
ri_config.add_instance(ri)
ri_opt = None
if router_external and is_l2 == False:
ri_opt = RoutingInstanceRoutingOptions(
static=Static(route=[Route(name="0.0.0.0/0",
next_table="inet.0",
comment=DMUtils.public_vrf_route_comment())]))
ri.set_routing_options(ri_opt)
# for both l2 and l3
ri.set_vrf_import(DMUtils.make_import_name(ri_name))
ri.set_vrf_export(DMUtils.make_export_name(ri_name))
has_ipv6_prefixes = DMUtils.has_ipv6_prefixes(prefixes)
has_ipv4_prefixes = DMUtils.has_ipv4_prefixes(prefixes)
if not is_l2:
if ri_opt is None:
ri_opt = RoutingInstanceRoutingOptions()
ri.set_routing_options(ri_opt)
if prefixes and fip_map is None:
static_config = ri_opt.get_static()
if not static_config:
static_config = Static()
ri_opt.set_static(static_config)
rib_config_v6 = None
static_config_v6 = None
for prefix in prefixes:
if ':' in prefix and not rib_config_v6:
static_config_v6 = Static()
rib_config_v6 = RIB(name=ri_name + ".inet6.0")
rib_config_v6.set_static(static_config_v6)
ri_opt.set_rib(rib_config_v6)
if ':' in prefix:
static_config_v6.add_route(Route(name=prefix, discard=''))
else:
static_config.add_route(Route(name=prefix, discard=''))
if router_external:
self.add_to_global_ri_opts(prefix)
ri.set_instance_type("vrf")
if not no_vrf_table_label:
ri.set_vrf_table_label('') # only for l3
if fip_map is None:
for interface in interfaces:
ri.add_interface(Interface(name=interface.name))
if static_routes:
self.add_static_routes(ri_opt, static_routes)
family = Family()
if has_ipv4_prefixes:
family.set_inet(FamilyInet(unicast=''))
if has_ipv6_prefixes:
family.set_inet6(FamilyInet6(unicast=''))
if has_ipv4_prefixes or has_ipv6_prefixes:
auto_export = AutoExport(family=family)
ri_opt.set_auto_export(auto_export)
else:
if highest_enapsulation_priority == "VXLAN":
ri.set_instance_type("virtual-switch")
elif highest_enapsulation_priority in ["MPLSoGRE", "MPLSoUDP"]:
ri.set_instance_type("evpn")
if fip_map is not None:
if ri_opt is None:
ri_opt = RoutingInstanceRoutingOptions()
ri.set_routing_options(ri_opt)
static_config = ri_opt.get_static()
if not static_config:
static_config = Static()
ri_opt.set_static(static_config)
static_config.add_route(Route(name="0.0.0.0/0",
next_hop=interfaces[0].name,
comment=DMUtils.fip_ingress_comment()))
ri.add_interface(Interface(name=interfaces[0].name))
public_vrf_ips = {}
for pip in fip_map.values():
if pip["vrf_name"] not in public_vrf_ips:
public_vrf_ips[pip["vrf_name"]] = set()
public_vrf_ips[pip["vrf_name"]].add(pip["floating_ip"])
for public_vrf, fips in public_vrf_ips.items():
ri_public = Instance(name=public_vrf)
ri_config.add_instance(ri_public)
ri_public.add_interface(Interface(name=interfaces[1].name))
ri_opt = RoutingInstanceRoutingOptions()
ri_public.set_routing_options(ri_opt)
static_config = Static()
ri_opt.set_static(static_config)
for fip in fips:
static_config.add_route(Route(name=fip + "/32",
next_hop=interfaces[1].name,
comment=DMUtils.fip_egress_comment()))
# add policies for export route targets
ps = PolicyStatement(name=DMUtils.make_export_name(ri_name))
if vn:
ps.set_comment(DMUtils.vn_ps_comment(vn, "Export"))
elif si:
ps.set_comment(DMUtils.si_ps_comment(si, "Export"))
then = Then()
ps.add_term(Term(name="t1", then=then))
for route_target in export_targets:
comm = Community(add='',
community_name=DMUtils.make_community_name(route_target))
then.add_community(comm)
if fip_map is not None:
# for nat instance
then.set_reject('')
else:
then.set_accept('')
policy_config.add_policy_statement(ps)
# add policies for import route targets
ps = PolicyStatement(name=DMUtils.make_import_name(ri_name))
if vn:
ps.set_comment(DMUtils.vn_ps_comment(vn, "Import"))
elif si:
ps.set_comment(DMUtils.si_ps_comment(si, "Import"))
from_ = From()
term = Term(name="t1", fromxx=from_)
ps.add_term(term)
for route_target in import_targets:
from_.add_community(DMUtils.make_community_name(route_target))
term.set_then(Then(accept=''))
ps.set_then(Then(reject=''))
policy_config.add_policy_statement(ps)
# add firewall config for public VRF
forwarding_options_config = self.forwarding_options_config
firewall_config = self.firewall_config
if router_external and is_l2 == False:
forwarding_options_config = (self.forwarding_options_config or
ForwardingOptions(DMUtils.forwarding_options_comment()))
firewall_config = self.firewall_config or Firewall(DMUtils.firewall_comment())
if has_ipv4_prefixes and not self.inet4_forwarding_filter:
#create single instance inet4 filter
self.inet4_forwarding_filter = self.add_inet_public_vrf_filter(
forwarding_options_config,
firewall_config, "inet")
if has_ipv6_prefixes and not self.inet6_forwarding_filter:
#create single instance inet6 filter
self.inet6_forwarding_filter = self.add_inet_public_vrf_filter(
forwarding_options_config,
firewall_config, "inet6")
if has_ipv4_prefixes:
#add terms to inet4 filter
term = self.add_inet_filter_term(ri_name, prefixes, "inet4")
# insert before the last term
terms = self.inet4_forwarding_filter.get_term()
terms = [term] + (terms or [])
self.inet4_forwarding_filter.set_term(terms)
if has_ipv6_prefixes:
#add terms to inet6 filter
term = self.add_inet_filter_term(ri_name, prefixes, "inet6")
# insert before the last term
terms = self.inet6_forwarding_filter.get_term()
terms = [term] + (terms or [])
self.inet6_forwarding_filter.set_term(terms)
if fip_map is not None:
firewall_config = firewall_config or Firewall(DMUtils.firewall_comment())
f = FirewallFilter(name=DMUtils.make_private_vrf_filter_name(ri_name))
f.set_comment(DMUtils.vn_firewall_comment(vn, "private"))
ff = firewall_config.get_family()
if not ff:
ff = FirewallFamily()
firewall_config.set_family(ff)
inet = ff.get_inet()
if not inet:
inet = FirewallInet()
ff.set_inet(inet)
inet.add_filter(f)
term = Term(name=DMUtils.make_vrf_term_name(ri_name))
from_ = From()
for fip_user_ip in fip_map.keys():
from_.add_source_address(fip_user_ip)
term.set_from(from_)
term.set_then(Then(routing_instance=[ri_name]))
f.add_term(term)
term = Term(name="default-term", then=Then(accept=''))
f.add_term(term)
interfaces_config = self.interfaces_config or Interfaces(comment=DMUtils.interfaces_comment())
irb_intf = Interface(name="irb")
interfaces_config.add_interface(irb_intf)
intf_unit = Unit(name=str(network_id),
comment=DMUtils.vn_irb_fip_inet_comment(vn))
if restrict_proxy_arp:
intf_unit.set_proxy_arp(ProxyArp(restricted=''))
inet = FamilyInet()
inet.set_filter(InetFilter(input=DMUtils.make_private_vrf_filter_name(ri_name)))
intf_unit.set_family(Family(inet=inet))
irb_intf.add_unit(intf_unit)
# add L2 EVPN and BD config
bd_config = None
interfaces_config = self.interfaces_config
proto_config = self.proto_config
if (is_l2 and vni is not None and
self.is_family_configured(self.bgp_params, "e-vpn")):
ri.set_vtep_source_interface("lo0.0")
if highest_enapsulation_priority == "VXLAN":
bd_config = BridgeDomains()
ri.set_bridge_domains(bd_config)
bd = Domain(name=DMUtils.make_bridge_name(vni), vlan_id='none', vxlan=VXLan(vni=vni))
bd.set_comment(DMUtils.vn_bd_comment(vn, "VXLAN"))
bd_config.add_domain(bd)
for interface in interfaces:
bd.add_interface(Interface(name=interface.name))
if is_l2_l3:
# network_id is unique, hence irb
bd.set_routing_interface("irb." + str(network_id))
ri.set_protocols(RoutingInstanceProtocols(
evpn=Evpn(encapsulation='vxlan', extended_vni_list='all')))
elif highest_enapsulation_priority in ["MPLSoGRE", "MPLSoUDP"]:
ri.set_vlan_id('none')
if is_l2_l3:
# network_id is unique, hence irb
ri.set_routing_interface("irb." + str(network_id))
evpn = Evpn()
evpn.set_comment(DMUtils.vn_evpn_comment(vn, highest_enapsulation_priority))
for interface in interfaces:
evpn.add_interface(Interface(name=interface.name))
ri.set_protocols(RoutingInstanceProtocols(evpn=evpn))
interfaces_config = self.interfaces_config or Interfaces(comment=DMUtils.interfaces_comment())
if is_l2_l3:
irb_intf = Interface(name='irb', gratuitous_arp_reply='')
interfaces_config.add_interface(irb_intf)
if gateways is not None:
intf_unit = Unit(name=str(network_id),
comment=DMUtils.vn_irb_comment(vn, False, is_l2_l3))
irb_intf.add_unit(intf_unit)
family = Family()
intf_unit.set_family(family)
inet = None
inet6 = None
for (irb_ip, gateway) in gateways:
if ':' in irb_ip:
if not inet6:
inet6 = FamilyInet6()
family.set_inet6(inet6)
addr = Address()
inet6.add_address(addr)
else:
if not inet:
inet = FamilyInet()
family.set_inet(inet)
addr = Address()
inet.add_address(addr)
addr.set_name(irb_ip)
addr.set_comment(DMUtils.irb_ip_comment(irb_ip))
if len(gateway) and gateway != '0.0.0.0':
addr.set_virtual_gateway_address(gateway)
self.build_l2_evpn_interface_config(interfaces_config, interfaces, vn)
if (not is_l2 and not is_l2_l3 and gateways):
interfaces_config = self.interfaces_config or Interfaces(comment=DMUtils.interfaces_comment())
ifl_num = str(1000 + int(network_id))
lo_intf = Interface(name="lo0")
interfaces_config.add_interface(lo_intf)
intf_unit = Unit(name=ifl_num, comment=DMUtils.l3_lo_intf_comment(vn))
lo_intf.add_unit(intf_unit)
family = Family()
intf_unit.set_family(family)
inet = None
inet6 = None
for (lo_ip, _) in gateways:
subnet = lo_ip
(ip, _) = lo_ip.split('/')
if ':' in lo_ip:
if not inet6:
inet6 = FamilyInet6()
family.set_inet6(inet6)
addr = Address()
inet6.add_address(addr)
lo_ip = ip + '/' + '128'
else:
if not inet:
inet = FamilyInet()
family.set_inet(inet)
addr = Address()
inet.add_address(addr)
lo_ip = ip + '/' + '32'
addr.set_name(lo_ip)
addr.set_comment(DMUtils.lo0_ip_comment(subnet))
ri.add_interface(Interface(name="lo0." + ifl_num,
comment=DMUtils.lo0_ri_intf_comment(vn)))
# fip services config
services_config = self.services_config
if fip_map is not None:
services_config = self.services_config or Services()
services_config.set_comment(DMUtils.services_comment())
service_name = DMUtils.make_services_set_name(ri_name)
service_set = ServiceSet(name=service_name)
service_set.set_comment(DMUtils.service_set_comment(vn))
services_config.add_service_set(service_set)
nat_rule = NATRules(name=service_name + "-sn-rule")
service_set.add_nat_rules(NATRules(name=DMUtils.make_snat_rule_name(ri_name),
comment=DMUtils.service_set_nat_rule_comment(vn, "SNAT")))
service_set.add_nat_rules(NATRules(name=DMUtils.make_dnat_rule_name(ri_name),
comment=DMUtils.service_set_nat_rule_comment(vn, "DNAT")))
next_hop_service = NextHopService(inside_service_interface = interfaces[0].name,
outside_service_interface = interfaces[1].name)
service_set.set_next_hop_service(next_hop_service)
nat = NAT(allow_overlapping_nat_pools='')
nat.set_comment(DMUtils.nat_comment())
services_config.add_nat(nat)
snat_rule = Rule(name=DMUtils.make_snat_rule_name(ri_name),
match_direction="input")
snat_rule.set_comment(DMUtils.snat_rule_comment())
nat.add_rule(snat_rule)
dnat_rule = Rule(name=DMUtils.make_dnat_rule_name(ri_name),
match_direction="output")
dnat_rule.set_comment(DMUtils.dnat_rule_comment())
nat.add_rule(dnat_rule)
for pip, fip_vn in fip_map.items():
fip = fip_vn["floating_ip"]
term = Term(name=DMUtils.make_ip_term_name(pip))
snat_rule.set_term(term)
# private ip
from_ = From(source_address=[pip + "/32"])
term.set_from(from_)
# public ip
then_ = Then()
term.set_then(then_)
translated = Translated(source_prefix=fip + "/32",
translation_type=TranslationType(basic_nat44=''))
then_.set_translated(translated)
term = Term(name=DMUtils.make_ip_term_name(fip))
dnat_rule.set_term(term)
# public ip
from_ = From(destination_address=[fip + "/32"])
term.set_from(from_)
# private ip
then_ = Then()
term.set_then(then_)
translated = Translated(destination_prefix=pip + "/32",
translation_type=TranslationType(dnat_44=''))
then_.set_translated(translated)
interfaces_config = self.interfaces_config or Interfaces(comment=DMUtils.interfaces_comment())
si_intf = Interface(name=interfaces[0].ifd_name,
comment=DMUtils.service_ifd_comment())
interfaces_config.add_interface(si_intf)
intf_unit = Unit(name=interfaces[0].unit,
comment=DMUtils.service_intf_comment("Ingress"))
si_intf.add_unit(intf_unit)
family = Family(inet=FamilyInet())
intf_unit.set_family(family)
intf_unit.set_service_domain("inside")
intf_unit = Unit(name=interfaces[1].unit,
comment=DMUtils.service_intf_comment("Egress"))
si_intf.add_unit(intf_unit)
family = Family(inet=FamilyInet())
intf_unit.set_family(family)
intf_unit.set_service_domain("outside")
self.forwarding_options_config = forwarding_options_config
self.firewall_config = firewall_config
self.policy_config = policy_config
self.proto_config = proto_config
self.interfaces_config = interfaces_config
self.services_config = services_config
self.route_targets |= import_targets | export_targets
self.ri_config = ri_config
