template_switch_initial_config.yml

---

# Copyright 2019 Broadcom. All rights reserved.
# The term 'Broadcom' refers to Broadcom Inc. and/or its subsidiaries.
# GNU General Public License v3.0+
# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)


- hosts: san_eng_zone_seed_san_a
  gather_facts: False

  vars:
    credential:
      fos_ip_addr: "{{fos_ip_addr}}"
      fos_user_name: "{{fos_user_name}}"
      fos_password: "{{fos_password}}"
      https: "{{fos_https}}"

  tasks:

  - name: disable switch before settings some attributes that require switch disable
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-switch"
      list_name: "fibrechannel-switch"
      entries:
        - enabled_state: False

  - name: switch configuration
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-switch"
      list_name: "fibrechannel-switch"
      entries:
        - user_friendly_name: "switch_name"
          fabric_user_friendly_name: "fabric_name"
          domain_id: 1
          banner: "AUTHORIZED USERS ONLY"
          dynamic_load_sharing: "lossless-dls"
          dns_servers:
            dns_server:
              - "8.8.8.8"
              - "8.8.4.4"

  - name: switch configuration
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-switch"
      list_name: "fibrechannel-switch"
      entries:
        - domain_name: "yahoo.com"

  - name: fabric configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-configuration"
      obj_name: "fabric"
      attributes:
        insistent_domain_id_enabled: True
        in_order_delivery_enabled: False
        fabric_principal_enabled: True
        fabric_principal_priority: "0x3"
    register: result

#  - debug: var=result

  - name: port configuration. if running on a platform where credit recovery is supported, the line can be uncommented to update the mode.
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-configuration"
      obj_name: "port-configuration"
      attributes:
        dynamic_portname_format: "I.T.A.R"
        portname_mode: "dynamic"
#        credit_recovery_mode: "onLrOnly"

  - name: enable switch after settings some attributes that require switch disable
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-fibrechannel-switch"
      list_name: "fibrechannel-switch"
      entries:
        - enabled_state: True

  - name: chassis configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-chassis"
      obj_name: "chassis"
      attributes:
        chassis_user_friendly_name: "chassis_name"
        telnet_timeout: 30

  - name: FC ports configuration
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-interface"
      list_name: "fibrechannel"
      all_entries: False
      entries:
        - name: "0/0"
          enabled_state: False 
          npiv_pp_limit: 126
        - name: "0/1"
          persistent_disable: True

  # pause for 15 seconds to make sure fabric is stable for
  # zoning commit
  - pause: seconds=15

  - name: zoning configuration
    brocade_zoning_default_zone:
      credential: "{{credential}}"
      vfid: -1
      default_zone_access: allaccess

  # if using IP addresses that are not available as clock servers
  # the module may timeout returning failure
  - name: clock server configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-time"
      obj_name: "clock-server"
      attributes:
        ntp_server_address:
          server_address:
            - "10.38.2.80"

  - name: time zone configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-time"
      obj_name: "time-zone"
      attributes:
        name: "America/Chicago"

  - name: audit configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-logging"
      obj_name: "audit"
      attributes:
        audit_enabled: True
        filter_class_list:
          filter_class:
          - "zone"
          - "security"
          - "configuration"
          - "firmware"
          - "fabric"
          - "ls"
          - "cli"
          - "maps"
        severity_level: "info"

  - name: syslog configuration
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-logging"
      list_name: "syslog-server"
      entries:
        - port: 514
          secure_mode: False
          server: "10.155.2.151"

  - name: snmp system configuration
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-snmp"
      obj_name: "system"
      attributes:
        audit_interval: 60
        contact: "Field Support."
        description: "DemoSwitch"
        encryption_enabled: False
        informs_enabled: True
        location: "San Jose"
        security_get_level: 0
        security_set_level: 3
        snmpv1_enabled: True

  - name: snmp v1 accounts
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-snmp"
      list_name: "v1-account"
      entries:
        - index: 1
          community_name: "secret code"
        - index: 2
          community_name: "oem"
        - index: 3
          community_name: "private"
        - index: 4
          community_name: "public"
        - index: 5
          community_name: "common"
        - index: 6
          community_name: "FibreChannel"

  - name: snmp v1 traps
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-snmp"
      list_name: "v1-trap"
      all_entries: False
      entries:
        - index: 1
          host: "10.10.10.10"
          port_number: 1010
          trap_severity_level: "warning"

  - name: snmp v3 accounts - setup non-password attributes
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-snmp"
      list_name: "v3-account"
      all_entries: False
      entries:
        - index: 1
          authentication_protocol: "md5"
          manager_engine_id: "00:00:00:00:00:00:00:00:00"
          privacy_protocol: "aes128"
          user_name: "asc-test"
        - index: 2
          authentication_protocol: "sha"
          manager_engine_id: "00:00:00:00:00:00:00:00:00"
          privacy_protocol: "des"
          user_name: "snmpadmin2"

  - name: snmp v3 traps
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-snmp"
      list_name: "v3-trap"
      entries:
        - trap_index: 1
          host: "10.10.10.11"
          informs_enabled: true
          port_number: 1011
          trap_severity_level: "warning"
          usm_index: 1
        - trap_index: 2
          host: "10.10.10.12"
          informs_enabled: false
          port_number: 1012
          trap_severity_level: "critical"
          usm_index: 2
        - trap_index: 3
          host: "0.0.0.0"
          informs_enabled: false
          port_number: 162
          trap_severity_level: "none"
          usm_index: 3
        - trap_index: 4
          host: "0.0.0.0"
          informs_enabled: false
          port_number: 162
          trap_severity_level: "none"
          usm_index: 4
        - trap_index: 5
          host: "0.0.0.0"
          informs_enabled: false
          port_number: 162
          trap_severity_level: "none"
          usm_index: 5
        - trap_index: 6
          host: "0.0.0.0"
          informs_enabled: false
          port_number: 162
          trap_severity_level: "none"
          usm_index: 6

  - name: ipfilter policy is created or present
    brocade_security_ipfilter_policy:
      credential: "{{credential}}"
      vfid: -1
      ipfilter_policies:
        - name: "ipv4_telnet_http"
          ip_version: "IPv4"

  - name: ipfilter rules are created or present
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-security"
      list_name: "ipfilter-rule"
      all_entries: False
      entries:
        - policy_name: "ipv4_telnet_http"
          index: 1
          destination_end_port: 22
          destination_ip: "any"
          destination_start_port: 22
          permission: "permit"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 2
          destination_end_port: 23
          destination_ip: "any"
          destination_start_port: 23
          permission: "deny"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 3
          destination_end_port: 80
          destination_ip: "any"
          destination_start_port: 80
          permission: "permit"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 4
          destination_end_port: 443
          destination_ip: "any"
          destination_start_port: 443
          permission: "permit"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 5
          destination_end_port: 161
          destination_ip: "any"
          destination_start_port: 161
          permission: "permit"
          protocol: "udp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 6
          destination_end_port: 123
          destination_ip: "any"
          destination_start_port: 123
          permission: "permit"
          protocol: "udp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 7
          destination_end_port: 1023
          destination_ip: "any"
          destination_start_port: 600
          permission: "permit"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 8
          destination_end_port: 1023
          destination_ip: "any"
          destination_start_port: 600
          permission: "permit"
          protocol: "udp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 9
          destination_end_port: 389
          destination_ip: "any"
          destination_start_port: 389
          permission: "permit"
          protocol: "tcp"
          source_ip: "any"
        - policy_name: "ipv4_telnet_http"
          index: 10
          destination_end_port: 389
          destination_ip: "any"
          destination_start_port: 389
          permission: "permit"
          protocol: "udp"
          source_ip: "any"

  - name: ipfilter policy is activated or active already
    brocade_security_ipfilter_policy:
      credential: "{{credential}}"
      vfid: -1
      active_policy: "ipv4_telnet_http"

  - name: disable root & user, and add new accounts
    brocade_list_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-security"
      list_name: "user-config"
      all_entries: False
      entries:
        - name: "user"
          account_enabled: False
        - name: "root"
          account_enabled: False
        - name: "myaccount"
          password: "mypassword"
          virtual_fabric_role_id_list:
            role_id:
              - "admin=1-128"
          chassis_access_role: "admin"
        - name: "youraccount"
          password: "mypassword"
          virtual_fabric_role_id_list:
            role_id:
              - "admin=1-128"
          chassis_access_role: "admin"

  - name: configure relay server
    brocade_singleton_obj:
      credential: "{{credential}}"
      vfid: -1
      module_name: "brocade-maps"
      obj_name: "maps-config"
      attributes:
        relay_ip_address: "10.10.10.10"
        domain_name: "d.com"
        sender_address: "s@d.com"
        recipient_address_list:
          recipient_address:
            - "r@d.com"
            - "r@r.com"