This role facilitates the configuration of authentication authorization acccounting (AAA). It supports the configuration of TACACS for dellos9 and the configuration of RADIUS server and AAA for dellos10 and dellos6. The AAA role requires an SSH connection for connectivity to a Dell EMC Networking device. You can use any of the built-in OS connection variables .
ansible-galaxy install Dell-Networking.dellos-aaa
- Role is abstracted using the ansible_network_os variable that can take dellos6, dellos9 and dellos10 values
- If dellos_cfg_generate is set to true, the variable generates the role configuration commands in a file
- Any role variable with a corresponding state variable set to absent negates the configuration of that variable
- Setting an empty value for any variable negates the corresponding configuration
- Variables and values are case-sensitive
dellos_aaa keys
| Key | Type | Description | Support |
|---|---|---|---|
radius_server |
dictionary | Configures the radius server (see radius_server.*) |
dellos6, dellos9, dellos10 |
radius_server.key |
string (required): 0,7,LINE | Configures the authentication key for the radius server | dellos6, dellos9 |
radius_server.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0 | dellos6, dellos9 |
radius_server.retransmit |
integer | Configures the number of retransmissions | dellos6, dellos9, dellos10 |
radius_server.timeout |
integer | Configures the timeout for retransmissions | dellos6, dellos9, dellos10 |
radius_server.deadtime |
integer | Configures the server dead time | dellos9 |
radius_server.group |
dictionary | Configures the radius servers group (see group.*) |
dellos9 |
group.name |
string (required) | Configures the group name of the radius servers | dellos9 |
group.host |
dictionary | Configures the radius server host in the group (see host.*) |
dellos9 |
host.ip |
string | Configures the radius server host address in the group | dellos9 |
host.key |
string (required): 0,7,LINE | Configures the authentication key | dellos9 |
host.key_string |
string: 7,0 | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 | dellos9 |
host.retransmit |
integer | Configures the number of retransmissions | dellos9 |
host.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos9 |
host.timeout |
integer | Configures the timeout for retransmissions | dellos9 |
host.state |
string: present,absent | Removes the host from group of radius server if set to absent | dellos9 |
group.vrf |
dictionary | Configures the VRF for radius servers in the group (see vrf.*) |
dellos9 |
vrf.vrf_name |
string (required) | Configures the name of VRF for the radius server group | dellos9 |
vrf.source_intf |
integer | Configures the source interface for outgoing packets from servers in the group | dellos9 |
vrf.state |
string: present,absent | Removes the VRF from group of radius servers if set to absent | dellos9 |
group.state |
string: present,absent | Removes the radius server group if set to absent | dellos9 |
radius_server.host |
dictionary | Configures the radius server host (see host.*) |
dellos6,dellos9, dellos10 |
host.ip |
string | Configures the radius server host address | dellos6, dellos9, dellos10 |
host.key |
string (required); 0,7,LINE | Configures the authentication key | dellos6, dellos9, dellos10 |
host.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 | dellos6, dellos9 |
host.retransmit |
integer | Configures the number of retransmissions | dellos6, dellos9 |
host.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos6, dellos9, dellos10 |
host.timeout |
integer | Configures timeout for retransmissions | dellos6, dellos9 |
host.state |
string: present,absent | Removes the radius server host if set to absent | dellos6, dellos9, dellos10 |
radius_server.acct |
dictionary | Configures the radius server acct (see host.*) |
dellos6 |
acct.ip |
string | Configures the radius server acct address | dellos6 |
acct.key |
string (required); 0,7,LINE | Configures the authentication key | dellos6 |
acct.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 | dellos6 |
acct.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos6 |
acct.state |
string: present,absent | Removes the radius server acct if set to absent | dellos6 |
radius_server.auth |
dictionary | Configures the radius server auth (see auth.*) |
dellos6 |
auth.ip |
string | Configures the radius server host address | dellos6 |
auth.key |
string (required); 0,7,LINE | Configures the authentication key | dellos6, dellos9, dellos10 |
auth.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 | dellos6 |
auth.name |
string (required) | Configures the auth name of the radius servers | dellos6 |
auth.usage |
string (required) | Configures the usage type of the radius servers | dellos6 |
auth.priority |
integer | Configures the number of priority | dellos6 |
auth.retransmit |
integer | Configures the number of retransmissions | dellos6 |
auth.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos6 |
auth.timeout |
integer | Configures timeout for retransmissions | dellos6 |
auth.deadtime |
integer | Configures the number of deadtime | dellos6 |
auth.attribute |
dictionary | Configures the radius server auth (see attribute.*) |
dellos6 |
attribute.id |
integer | Configures the radius server attribute id | dellos6 |
auth (see attribute.*) |
dellos6 | ||
attribute.type |
integer | Configures the radius server attribute type based on id | dellos6 |
attribute.state |
string: present,absent | Removes the radius server attribute if set to absent | dellos6 |
auth.state |
string: present,absent | Removes the radius server auth if set to absent | dellos6 |
radius_server.attribute |
dictionary | Configures the radius server auth (see attribute.*) |
dellos6 |
attribute.id |
integer | Configures the radius server attribute id | dellos6 |
auth (see attribute.*) |
dellos6 | ||
attribute.type |
integer | Configures the radius server attribute type based on id | dellos6 |
attribute.state |
string: present,absent | Removes the radius server attribute if set to absent | dellos6 |
tacacs_server |
dictionary | Configures the tacacs server (see tacacs_server.*) |
dellos6, dellos9 |
tacacs_server.key |
string (required): 0,7,LINE | Configures the authentication key for tacacs server | dellos6, dellos9 |
tacacs_server.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if tacacs_server.key is 7 or 0 | dellos6, dellos9 |
tacacs_server.group |
dictionary | Configures the group of tacacs servers (see group.*) |
dellos9 |
group.name |
string (required) | Configures the group name of the tacacs servers | dellos9 |
group.host |
dictionary | Configures the tacacs server host in the group (see host.*) |
dellos9 |
host.ip |
string | Configures the tacacs server host address in the group | dellos9 |
host.key |
string (required): 0,7,LINE | Configures the authentication key of the tacacs server host | dellos9 |
host.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only host.key is 7 or 0 | dellos9 |
host.retransmit |
integer | Configures the number of retransmissions | dellos9 |
host.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos9 |
host.timeout |
integer | Configures timeout for retransmissions | dellos9 |
host.state |
string: present,absent | Removes the host from group of tacacs server if set to absent | dellos9 |
group.vrf |
dictionary | Configures VRF for tacacs servers in the group (see vrf.*) |
dellos9 |
vrf.vrf_name |
string (required) | Configures the name of VRF for tacacs server group | dellos9 |
vrf.source_intf |
integer | Configures source interface for outgoing packets from servers in the group | dellos9 |
vrf.state |
string: present,absent | Removes the VRF from group of tacacs server if set to absent | dellos9 |
group.state |
string: present,absent | Removes the tacacs server group if set to absent | dellos9 |
tacacs_server.host |
dictionary | Configures the tacacs server host (see host.*) |
dellos6, dellos9 |
host.ip |
string | Configures the tacacs sever host address | dellos6, dellos9 |
host.key |
string (required): 0,7,LINE | Configures the authentication key | dellos6, dellos9 |
host.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if host.key is 7 or 0 | dellos6, dellos9 |
host.retransmit |
integer | Configures the number of retransmissions | dellos9 |
host.auth_port |
integer | Configures the authentication port (0 to 65535) | dellos6, dellos9 |
host.timeout |
integer | Configures the timeout for retransmissions | dellos6, dellos9 |
host.state |
string: present,absent | Removes the tacacs server host if set to absent | dellos6, dellos9 |
aaa_accounting |
dictionary | Configures accounting parameters (see aaa_accounting.*) |
dellos6, dellos9 |
aaa_accounting.commands |
list | Configures accounting for exec (shell) and config commands (see commands.*) |
dellos9 |
commands.enable_level |
integer | Configures enable level for accounting of commands | dellos9 |
commands.role_name |
string | Configures user role for accounting of commands; variable is mutually exclusive with enable_level |
dellos9 |
commands.accounting_list_name |
integer | Configures named accounting list for commands | dellos9 |
commands.no_accounting |
boolean | Configures no accounting of commands | dellos9 |
commands.record_option |
string: start-stop,stop-only,wait-start | Configures options to record data | dellos9 |
commands.state |
string: present,absent | Removes the named accounting list for the commands if set to absent | dellos9 |
aaa_accounting.exec |
list | Configures accounting for EXEC (shell) commands (see exec.*) |
dellos9 |
exec.accounting_list_name |
string | Configures named accounting list for exec commands | dellos9 |
exec.no_accounting |
boolean | Configures no accounting of EXEC commands | dellos9 |
exec.record_option |
string: start-stop,stop-only,wait-start | Configures options to record data | dellos9 |
exec.state |
string: present,absent | Removes the named accounting list for the exec commands if set to absent | dellos9 |
aaa_accounting.suppress |
boolean | Suppresses accounting for users with NULL username | dellos9 |
aaa_accounting.dot1x |
string: none,start-stop,stop-only,wait-start | Configures accounting for dot1x events | dellos6, dellos9 |
aaa_accounting.rest |
string:none,start-stop,stop-only,wait-start | Configures accounting for rest interface events | dellos9 |
aaa_authorization |
dictionary | Configures authorization parameters (see aaa_authorization.*) |
dellos6, dellos9 |
aaa_authorization.commands |
list | Configures authorization for EXEC (shell) and config commands (see commands.*) |
dellos9 |
commands.enable_level |
integer | Configures enable level for authorization of commands | dellos9 |
commands.role_name |
string | Configures user role for authorization of commands; mutually exclusive with enable_level |
dellos9 |
commands.authorization_list_name |
string | Configures named authorization list for commands | dellos9 |
commands.authorization_method |
string: none | Configures no authorization of commands | dellos9 |
commands.use_data |
string: local,tacacs+ | Configures data used for authorization | dellos9 |
commands.state |
string: present,absent | Removes the named authorization list for the commands if set to absent | dellos9 |
aaa_authorization.config_commands |
boolean | Configures authorization for configuration mode commands | dellos9 |
aaa_authorization.role_only |
boolean | Configures validation of authentication mode for user role | dellos9 |
aaa_authorization.exec |
list | Configures authorization for EXEC (shell) commands (see exec.*) |
dellos6, dellos9 |
exec.authorization_list_name |
string | Configures named authorization list for EXEC commands | dellos6, dellos9 |
exec.authorization_method |
string: none | Configures no authorization of EXEC commands | dellos6, dellos9 |
exec.use_data |
string: local,tacacs+ | Configures data used for authorization | dellos6, dellos9 |
exec.state |
string: present,absent | Removes the named authorization list for the EXEC commands if set to absent | dellos6, dellos9 |
aaa_authorization.network |
string: none,radius,ias | Configures authorization for network events | dellos6, dellos9 |
aaa_authentication |
dictionary | Configures authentication parameters (see aaa_authentication.*) |
dellos9, dellos10 |
aaa_authentication.local_auth |
dictionary | Configures local authentication parameters (see aaa_authentication.local_auth.*) |
dellos10 |
aaa_authetication.local_auth.radius |
boolean | Configures authentication method as local along with radius if set to true | dellos10 |
aaa_authentication.radius_auth |
dictionary | Configures radius authentication parameters (see aaa_authentication.radius_auth.*) |
dellos10 |
aaa_authetication.radius_auth.local |
boolean | Configures authentication method as radius along with local if set to true | dellos10 |
aaa_authentication.re_authenticate |
boolean | Configures re-authenticate by enable if set to true on dellos10 devices | dellos10 |
aaa_radius |
dictionary | Configures AAA for radius group of servers (see aaa_radius.*) |
dellos9 |
aaa_radius.group |
string | Configures name of the radius group of servers for AAA | dellos9 |
aaa_radius.auth_method |
string: pap,mschapv2 | Configures authentication method of radius group of servers for AAA | dellos9 |
aaa_tacacs |
dictionary | Configures AAA for tacacs group of servers (see aaa_tacacs.*) |
dellos9 |
aaa_tacacs.group |
string | Configures name of the tacacs group of servers for AAA | dellos9 |
aaa_authentication.auth_list |
list | Configures named authentication list for hosts (see host.*) |
dellos6, dellos9 |
auth_list.name |
string | Configures named authentication list | dellos6, dellos9 |
auth_list.login_or_enable |
string: enable,login | Configures authentication list for login or enable | dellos6, dellos9 |
auth_list.server |
string: radius,tacacs+ | Configures AAA to use this list of all server hosts | dellos6, dellos9 |
auth_list.use_password |
string: line,local,enable,none | Configures password to use for authentication | dellos6, dellos9 |
auth_list.state |
string: present,absent | Removes the named authentication list if set to absent | dellos6, dellos9 |
aaa_authentication.dot1x |
string: none,radius,ias | Configures authentication for dot1x events | dellos6, dellos9 |
line_terminal |
dictionary | Configures the terminal line (see line_terminal.*) |
dellos9 |
line_terminal.<terminal> |
dictionary | Configures the primary or virtual terminal line (see <terminal>.*); value can be console <line_number>, vty <line_number> |
dellos9 |
<terminal>.authorization |
dictionary | Configures authorization parameters of line terminal (see authorization.*) |
dellos9 |
authorization.commands |
list | Configures authorization for EXEC (shell) and config commands (see commands.*) |
dellos9 |
commands.enable_level |
integer | Configures enable level for authorization of commands at line terminal | dellos9 |
commands.role_name |
string | Configures user role for authorization of commands at line terminal; mutually exclusive with enable_level |
dellos9 |
commands.authorization_list_name |
string | Configures named authorization list for commands | dellos9 |
commands.state |
string: present,absent | Removes the authorization of commands from line terminal if set to absent | dellos9 |
authorization.exec |
list | Configures authorization for EXEC (shell) commands at line terminal (see exec.*) |
dellos9 |
exec.authorization_list_name |
string | Configures named authorization list for EXEC commands | dellos9 |
exec.state |
string: present,absent | Removes the authorization of EXEC (shell) from line terminal if set to absent | dellos9 |
<terminal>.accounting |
dictionary | Configures accounting parameters of line terminal (see accounting.*) |
dellos9 |
accounting.commands |
list | Configures accounting for EXEC (shell) and config commands (see commands.*) |
dellos9 |
commands.enable_level |
integer | Configures enable level for accounting of commands at line terminal | dellos9 |
commands.role_name |
string | Configures user role for accounting of commands at line terminal; mutually exclusive with enable_level |
dellos9 |
commands.accounting_list_name |
string | Configures named accounting list for commands | dellos9 |
commands.state |
string: present,absent | Removes the accounting of commands from line terminal if set to absent | dellos9 |
accounting.exec |
list | Configures accounting for EXEC (shell) commands at line terminal (see exec.*) |
dellos9 |
exec.accounting_list_name |
string | Configures named accounting list for EXEC commands | dellos9 |
exec.state |
string: present,absent | Removes the accounting of EXEC (shell) from line terminal if set to absent | dellos9 |
<terminal>.authentication |
dictionary | Configures authentication parameters of line terminal (see authentication.*) |
dellos9 |
authentication.enable |
string | Configures the authentication list for privilege-level password authentication | dellos9 |
authentication.login |
string | Configures the authentication list for password checking | dellos9 |
aaa_server |
dictionary | Configures the aaa server (see aaa_server.*) |
dellos6 |
radius |
dictionary | Configures the radius server (see radius.*) |
dellos6 |
dynamic_author |
dictionary | Configures the radius server (see dynamic_author.*) |
dellos6 |
dynamic_author.auth_type |
string | Configures the authentication type for the radius server | dellos6 |
dynamic_author.client |
list | Configures the client for the radius server | dellos6 |
client.ip |
string | Configures the client ip for the radius server | dellos69 |
client.key |
string (required): 0,7,LINE | Configures the authentication key for the radius server | dellos69 |
client.key_string |
string | Configures the user key string; variable takes the hidden user key string if value is 7; variable takes the unencrypted user key (clear-text) if value is 0; variable supported only if radius_server.key is 7 or 0 | dellos6 |
client.state |
string: present,absent | Removes the accounting of client if set to absent | dellos6 |
dynamic_author.state |
string: present,absent | Removes the accounting of client if set to absent | dellos6 |
NOTE: Asterisk (*) denotes the default value if none is specified.
Ansible Dell EMC Networking roles require connection information to establish communication with the nodes in your inventory. This information can exist in the Ansible group_vars or host_vars directories or inventory, or in the playbook itself.
| Key | Required | Choices | Description |
|---|---|---|---|
ansible_host |
yes | Specifies the hostname or address for connecting to the remote device over the specified transport | |
ansible_port |
no | Specifies the port used to build the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_PORT option is used; it defaults to 22 | |
ansible_ssh_user |
no | Specifies the username that authenticates the CLI login for the connection to the remote device; if value is unspecified, the ANSIBLE_REMOTE_USER environment variable value is used | |
ansible_ssh_pass |
no | Specifies the password that authenticates the connection to the remote device. | |
ansible_become |
no | yes, no* | Instructs the module to enter privileged mode on the remote device before sending any commands; if value is unspecified, the ANSIBLE_BECOME environment variable value is used, and the device attempts to execute all commands in non-privileged mode |
ansible_become_method |
no | enable, sudo* | Instructs the module to allow the become method to be specified for handling privilege escalation; if value is unspecified, the ANSIBLE_BECOME_METHOD environment variable value is used. |
ansible_become_pass |
no | Specifies the password to use if required to enter privileged mode on the remote device; if ansible_become is set to no this key is not applicable. |
|
ansible_network_os |
yes | dellos6/dellos9/dellos10, null* | This value is used to load the correct terminal and cliconf plugins to communicate with the remote device. |
NOTE: Asterisk (*) denotes the default value if none is specified.
The dellos-aaa role is built on modules included in the core Ansible code. These modules were added in Ansible version 2.2.0.
This example uses the dellos-aaa role to configure AAA for radius and TACACS servers. It creates a hosts file with the switch details and corresponding variables. The hosts file should define the ansible_network_os variable with the corresponding Dell EMC Networking OS name.
When dellos_cfg_generate is set to true, the variable generates the configuration commands as a .part file in the build_dir path. By default, it is set to false and it writes a simple playbook that only references the dellos-aaa role.
Sample hosts file
leaf1 ansible_host= <ip_address>
Sample host_vars/leaf1
hostname: leaf1
ansible_become: yes
ansible_become_method: xxxxx
ansible_become_pass: xxxxx
ansible_ssh_user: xxxxx
ansible_ssh_pass: xxxxx
ansible_network_os: dellos9
build_dir: ../temp/dellos9
dellos_aaa:
radius_server:
key: radius
retransmit: 5
timeout: 40
deadtime: 2300
group:
- name: RADIUS
host:
- ip: 2001:4898:f0:f09b::1002
key: 0
key_string: aaaa
retransmit: 5
auth_port: 3
timeout: 2
state: present
vrf:
vrf_name: test
source_intf: fortyGigE 1/2
state: absent
state: present
host:
- ip: 2001:4898:f0:f09b::1002
key: xxx
retransmit: 5
auth_port: 3
timeout: 2
state: present
tacacs_server:
key: 7
key_string: 9ea8ec421c2e2e5bec757f44205015f6d81e83a4f0aa52fa
group:
- name: TACACS
host:
- ip: 2001:4898:f0:f09b::1000
key: 0
key_string: aaa
retransmit: 6
auth_port: 3
timeout: 2
state: present
vrf:
vrf_name: tes
source_intf: fortyGigE 1/3
state: present
state: present
host:
- ip: 2001:4898:f0:f09b::1000
key: 0
key_string: aa
retransmit: 5
auth_port: 3
timeout: 2
state: present
aaa_accounting:
commands:
- enable_level: 2
accounting_list_name: aa
record_option: start-stop
state: present
- role_name: netadmin
accounting_list_name: aa
no_accounting: none
suppress: True
exec:
- accounting_list_name: aaa
no_accounting: true
state: present
dot1x: none
rest: none
aaa_authorization:
commands:
- enable_level: 2
authorization_list_name: aa
use_data: local
state: present
- role_name: netadmin
authorization_list_name: aa
authorization_method: none
use_data: local
config_commands: True
role_only:
exec:
- authorization_list_name: aaa
authorization_method: if-authenticated
use_data: local
state: present
aaa_authentication:
auth_list:
- name: default
login_or_enable: login
server: radius
use_password: local
state: present
- name: console
server: tacacs+
login_or_enable: login
use_password: local
aaa_radius:
group: RADIUS
auth_method: pap
aaa_tacacs:
group: TACACS
line_terminal:
vty 0:
authorization:
commands:
- enable_level: 2
authorization_list_name: aa
state: present
- role_name: netadmin
authorization_list_name: aa
state: present
exec:
- authorization_list_name: aa
state: present
accounting:
commands:
- enable_level: 2
accounting_list_name: aa
state: present
- role_name: netadmin
accounting_list_name: aa
state: absent
exec:
accounting_list_name: aa
state: present
authentication:
enable:
login: console
Simple playbook to setup system - leaf.yaml
- hosts: leaf1
roles:
- Dell-Networking.dellos-aaa
Run
ansible-playbook -i hosts leaf.yaml
(c) 2017-2019 Dell Inc. or its subsidiaries. All Rights Reserved.