Ansible工具在网络自动化的应用

目录

一、抓取思科与华为设备的信息（测试）

Step 1：在Hosts文件中定义思科与华为的IP地址

Step 2：play-book 脚本

Step 3：执行结果

 二、使用Ansible备份思科华为配置（测试）

Step 1：Hosts文件不动，延用章节一中的配置，思科华为各一台

Step 2：play-book脚本

Step 3: 执行结果（思科的一次OK，华为报错调试了很久忘记截图了） 

Step 4：Ansible troubleshooting  ，脚本执行到华为设备时报错，一起来troubleshooting吧

Step 5：排错后，继续执行

 三、批量修改思科华为管理IP，添加管理VLAN，添加静态路由（实际业务）

Step 1：准备好hosts地址，也就是需要修改的主机清单，清单中包括新的IP地址，接口地址每行代表一台主机，第一个IP是主机目前的管理地址，new_ip为新IP地址，interface指定现有的trunk接口。

Step 2：思科的play-book， 此次变更数量比较多且第一次尝试在实际业务中，思科与华为分开写的play，思科采用的是module方式。

Step 3: 华为play-book，此次华为采用的是command方式。

Step 4：分开执行思科华为脚本

四、ansible文档

4.1 cisco ios module 

4.2 huawei ce module

4.3 Ansible for Network Automation

————————————————————————————————————————

一、抓取思科与华为设备的信息（测试）

Step 1：在Hosts文件中定义思科与华为的IP地址

只是测试，思科华为各拿一台主机

1.  
   # This is the default ansible 'hosts' file.
2.  
   #
3.  
   # It should live in /etc/ansible/hosts
4.  
   #
5.  
   # - Comments begin with the '#' character
6.  
   # - Blank lines are ignored
7.  
   # - Groups of hosts are delimited by [header] elements
8.  
   # - You can enter hostnames or ip addresses
9.  
   # - A hostname/ip can be a member of multiple groups
10.  
    [cisco] #思科设备3台
11.  
    10.26.255.1
12.  
    #10.26.255.2
13.  
    #10.26.255.3
14.  
     
15.  
    [hw] #华为设备1台
16.  
    10.26.255.100
17.  
     
18.  
    [cisco:vars] #思科设备的变量
19.  
    ansible_user=admin #用户名
20.  
    ansible_password=cisco123 #密码
21.  
    ansible_connection=network_cli #连接方式，目前普遍使用network_cli
22.  
    ansible_network_os=ios #os类型
23.  
    ansible_port=22 #连接端口
24.  
     
25.  
    [hw:vars] #同上
26.  
    ansible_user=admin
27.  
    ansible_password=huawei123
28.  
    ansible_connection=network_cli
29.  
    ansible_network_os=community.network.ce
30.  
    ansible_port=22

Step 2：play-book 脚本

1.  
   --- #YAML语句的起始标志
2.  
    
3.  
   - name: For Cisco
4.  
   connection: network_cli
5.  
   gather_facts: false
6.  
   hosts: cisco #调用hosts文件中cisco主机
7.  
   tasks:
8.  
    
9.  
   - name: Check the network reachability of the CISCO #task 1
10.  
    cisco.ios.ios_ping: #使用的module
11.  
    dest: 10.26.255.130 #module 参数
12.  
    #task 1: 调用ping module,检测与10.26.255.130这个dest目标主机的连通性
13.  
     
14.  
    - name: Show ip inter brief #task 2
15.  
    cisco.ios.ios_command:
16.  
    commands: show ip inter brief
17.  
    register: show_ip_inter_brief
18.  
    #task 2: 调用command module,模块参数使用commands,执行命令 show ip inter brief,结果保存到变量
19.  
    show_ip_inter_brief
20.  
     
21.  
    - name: print the show ip inter brief #task 3
22.  
    debug:
23.  
    msg: "{{show_ip_inter_brief.stdout_lines}}"
24.  
    #task 3: 调用debug module, 输出变量show_ip_inter_brief
25.  
     
26.  
    #解释如上，只是HW调用的模块名称不同
27.  
    - name: For HW
28.  
    connection: network_cli
29.  
    gather_facts: false
30.  
    hosts: hw
31.  
    tasks:
32.  
     
33.  
    - name: HW SHOW
34.  
    community.network.ce_command:
35.  
    commands: "display ip inter br"
36.  
    register: dis_ip_inter_brief
37.  
     
38.  
    - name: print dis_ip_inter_brief
39.  
    debug:
40.  
    msg: "{{dis_ip_inter_brief.stdout_lines}}"

Step 3：执行结果

 二、使用Ansible备份思科华为配置（测试）

Step 1：Hosts文件不动，延用章节一中的配置，思科华为各一台

Step 2：play-book脚本

1.  
   ---
2.  
   - name：Backup Cisco File
3.  
   connection: network_cli
4.  
   gather_facts: false
5.  
   hosts: cisco
6.  
   tasks:
7.  
    
8.  
   - name: Gather all cisco info #task 1: 收集cisco信息，后续使用hostname命名文件
9.  
   ios_facts:
10.  
    gather_subset: all
11.  
     
12.  
    - name: Get current date #task 2: 获取当前date
13.  
    local_action: command date %Y-%m-%d
14.  
    register: date
15.  
     
16.  
    - name: Get current time #task 3: 获取当前time
17.  
    local_action: command date %H:%M
18.  
    register: time
19.  
     
20.  
    - name: Get running-config and save it #task 4： 保存当前配置并备份
21.  
    ios_config: #使用config模块
22.  
    backup: yes #参数：启用备份
23.  
    backup_option:
24.  
    filename: "{{ansible_net_hostname}}_{{ansible_host}}.cfg" #备份文件名称hostname ip
25.  
    dir_path: /usr/{{date.stdout}}_at_{{time.stdout}} #备份文件夹路径
26.  
     
27.  
    - name: Tasks done #task 5: 提示任务完成
28.  
    debug: msg= "All cisco tasks has been done on {{date.stdout}} at {{time.stdout}}"
29.  
     
30.  
    - name：Backup Huawei File
31.  
    connection: network_cli
32.  
    gather_facts: false
33.  
    hosts: hw
34.  
    tasks:
35.  
     
36.  
    - name: Gather hw info
37.  
    community.network.ce_facts:
38.  
    gather_subset: config
39.  
     
40.  
    - name: Get current date
41.  
    local_action: command date %Y-%m-%d
42.  
    register: date
43.  
     
44.  
    - name: Get current time
45.  
    local_action: command date %H:%M
46.  
    register: time
47.  
     
48.  
    - name: Get running-config and save it
49.  
    community.network.ce_config:
50.  
    backup: yes
51.  
    backup_option:
52.  
    filename: "{{hostname}}.cfg"
53.  
    dir_path: /usr/{{date.stdout}}_at_{{time.stdout}}
54.  
     
55.  
    - name: Tasks done
56.  
    debug: msg= "All huawei tasks has been done on {{date.stdout}} at {{time.stdout}}"

Step 3: 执行结果（思科的一次OK，华为报错调试了很久忘记截图了） 

  Step 4：Ansible troubleshooting  ，脚本执行到华为设备时报错，一起来troubleshooting吧

1）排错第一步，打开ansible的debug跟log功能

1.  
   直接在系统层面执行以下两句语句
2.  
   # Specify the location for the log file
3.  
   export ANSIBLE_LOG_PATH=~/ansible.log
4.  
   # Enable Debug
5.  
   export ANSIBLE_DEBUG=True

2）复现问题：继续执行play-book脚本，加上-vvv参数就能看到ansible每个task的执行过程，哪里报错，报错原因等。

ansible-playbook backup.yml -vvv

3）报错日志分析，定位问题点（前面的截图找不到了，重新拿了个playbook模拟），大概的排错流程就是这样。

1.  
   root@rachel-virtual-machine:/etc/ansible# ansible-playbook first_playbook.yml -vvv
2.  
   ansible-playbook [core 2.12.8]
3.  
   config file = /etc/ansible/ansible.cfg
4.  
   configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
5.  
   ansible python module location = /usr/lib/python3/dist-packages/ansible
6.  
   ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
7.  
   executable location = /usr/bin/ansible-playbook
8.  
   python version = 3.8.10 (default, Jun 22 2022, 20:18:18) [GCC 9.4.0]
9.  
   jinja version = 2.10.1
10.  
    libyaml = True
11.  
    Using /etc/ansible/ansible.cfg as config file
12.  
    host_list declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
13.  
    script declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
14.  
    auto declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
15.  
    Parsed /etc/ansible/hosts inventory source with ini plugin
16.  
    Skipping callback 'default', as we already have a stdout callback.
17.  
    Skipping callback 'minimal', as we already have a stdout callback.
18.  
    Skipping callback 'oneline', as we already have a stdout callback.
19.  
     
20.  
    PLAYBOOK: first_playbook.yml *************************************************************************************************
21.  
    2 plays in first_playbook.yml
22.  
     
23.  
    PLAY [HW] ********************************************************************************************************************
24.  
    skipping: no hosts matched
25.  
     
26.  
    PLAY [Cisco] *****************************************************************************************************************
27.  
    META: ran handlers
28.  
     
29.  
    TASK [Get cisco info] ********************************************************************************************************
30.  
    task path: /etc/ansible/first_playbook.yml:23
31.  
    redirecting (type: connection) ansible.builtin.network_cli to ansible.netcommon.network_cli
32.  
    redirecting (type: terminal) ansible.builtin.ce to community.network.ce
33.  
    redirecting (type: cliconf) ansible.builtin.ce to community.network.ce
34.  
    redirecting (type: become) ansible.builtin.enable to ansible.netcommon.enable
35.  
    <192.168.237.100> ESTABLISH LOCAL CONNECTION FOR USER: root
36.  
    <192.168.237.100> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-local-56413fcuyatyk `"&& mkdir "` echo /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773 `" && echo ansible-tmp-1665453960.7583842-56418-232110089926773="` echo /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773 `" ) && sleep 0'
37.  
    Using module file /usr/lib/python3/dist-packages/ansible_collections/cisco/ios/plugins/modules/ios_facts.py
38.  
    <192.168.237.100> PUT /root/.ansible/tmp/ansible-local-56413fcuyatyk/tmp0zniwxqh TO /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773/AnsiballZ_ios_facts.py
39.  
    <192.168.237.100> EXEC /bin/sh -c 'chmod u x /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773/ /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773/AnsiballZ_ios_facts.py && sleep 0'
40.  
    <192.168.237.100> EXEC /bin/sh -c '/usr/bin/python3 /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773/AnsiballZ_ios_facts.py && sleep 0'
41.  
     
42.  
    <192.168.237.100> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-local-56413fcuyatyk/ansible-tmp-1665453960.7583842-56418-232110089926773/ > /dev/null 2>&1 && sleep 0'
43.  
    The full traceback is:
44.  
    File "/tmp/ansible_cisco.ios.ios_facts_payload__u2fn_f8/ansible_cisco.ios.ios_facts_payload.zip/ansible_collections/ansible/netcommon/plugins/module_utils/network/common/network.py", line 251, in get_capabilities
45.  
    capabilities = Connection(module._socket_path).get_capabilities()
46.  
    File "/tmp/ansible_cisco.ios.ios_facts_payload__u2fn_f8/ansible_cisco.ios.ios_facts_payload.zip/ansible/module_utils/connection.py", line 200, in __rpc__
47.  
    raise ConnectionError(to_text(msg, errors='surrogate_then_replace'), code=code)
48.  
    fatal: [192.168.237.100]: FAILED! => {
49.  
    "changed": false,
50.  
    "invocation": {
51.  
    "module_args": {
52.  
    "available_network_resources": false,
53.  
    "gather_network_resources": null,
54.  
    "gather_subset": [
55.  
    "all"
56.  
    ],
57.  
    "provider": null
58.  
    }
59.  
    },
60.  
    "msg": "command timeout triggered, timeout value is 30 secs.\nSee the timeout setting options in the Network Debug and Troubleshooting Guide."
61.  
    }
62.  
     
63.  
    PLAY RECAP *******************************************************************************************************************
64.  
    192.168.237.100 : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

可以看到此play-book脚本中包含两个play，一个HW一个Cisco，HW无匹配的主机直接跳过，执行Cisco剧本。

 Cisco剧本中的第一个task，可以看到类型重定向到了community.network.ce，这是hw的ios类型（故意在hosts文件中将os改为了ce) 

4）修改问题点，继续测试

修改为ios

 

Step 5：排错后，继续执行

hosts文件整了5台

执行命令：

ansible-playbook backup.yml -vvv

执行结果：

 

 三、批量修改思科华为管理IP，添加管理VLAN，添加静态路由（实际业务）

Step 1：准备好hosts地址，也就是需要修改的主机清单，清单中包括新的IP地址，接口地址每行代表一台主机，第一个IP是主机目前的管理地址，new_ip为新IP地址，interface指定现有的trunk接口。

1.  
   # This is the default ansible 'hosts' file.
2.  
   #
3.  
   # It should live in /etc/ansible/hosts
4.  
   #
5.  
   # - Comments begin with the '#' character
6.  
   # - Blank lines are ignored
7.  
   # - Groups of hosts are delimited by [header] elements
8.  
   # - You can enter hostnames or ip addresses
9.  
   # - A hostname/ip can be a member of multiple groups
10.  
    [cisco]
11.  
    #3F
12.  
    192.168.3.238 new_ip="192.168.255.238 255.255.255.0" interface="Port-channel10"
13.  
    192.168.3.191 new_ip="192.168.255.191 255.255.255.0" interface="Port-channel5"
14.  
    192.168.3.232 new_ip="192.168.255.232 255.255.255.0" interface="Port-channel1"
15.  
    192.168.3.237 new_ip="192.168.255.237 255.255.255.0" interface="Port-channel10"
16.  
    192.168.3.190 new_ip="192.168.255.190 255.255.255.0" interface="Port-channel10"
17.  
    192.168.3.193 new_ip="192.168.255.193 255.255.255.0" interface="Port-channel2"
18.  
    [hw]
19.  
    #3F
20.  
    192.168.3.240 new_ip="192.168.255.240 24" interface="Eth-Trunk10"
21.  
    192.168.3.239 new_ip="192.168.255.239 24" interface="Eth-Trunk11"
22.  
    192.168.3.245 new_ip="192.168.255.245 24" interface="Eth-Trunk12"
23.  
    192.168.3.244 new_ip="192.168.255.244 24" interface="Eth-Trunk13"
24.  
    192.168.3.243 new_ip="192.168.255.243 24" interface="Eth-Trunk14"
25.  
    192.168.3.242 new_ip="192.168.255.242 24" interface="Eth-Trunk15"
26.  
    192.168.3.225 new_ip="192.168.255.225 24" interface="GigabitEthernet0/0/52"
27.  
    192.168.3.226 new_ip="192.168.255.226 24" interface="GigabitEthernet0/0/52"
28.  
    192.168.3.227 new_ip="192.168.255.227 24" interface="GigabitEthernet0/0/52"
29.  
    [cisco:vars]
30.  
    ansible_user=admin
31.  
    ansible_password=admin123
32.  
    ansible_connection=network_cli
33.  
    ansible_network_os=ios
34.  
    ansible_port=22
35.  
    #ansible_become=yes
36.  
    #ansible_become_method=enable
37.  
    #ansible_become_password=admin123
38.  
     
39.  
    [hw:vars]
40.  
    ansible_user=admin
41.  
    ansible_password=admin123
42.  
    ansible_connection=network_cli
43.  
    ansible_network_os=community.network.ce
44.  
    ansible_port=22

Step 2：思科的play-book， 此次变更数量比较多且第一次尝试在实际业务中，思科与华为分开写的play，思科采用的是module方式。

大概流程就是：
1）    创建vlan 255
2）    创建interface vlan 255并设置IP地址
3）    Enable interface vlan 255
4）    Trunk链路中允许vlan 255通过
5）    添加新的静态路由

1.  
   ---
2.  
   - name: For Cisco
3.  
   connection: network_cli
4.  
   gather_facts: false
5.  
   hosts: cisco
6.  
    
7.  
   tasks:
8.  
    
9.  
   - name: Create VLAN
10.  
    cisco.ios.ios_vlans: #module name
11.  
    config:
12.  
    - name: vlan_255_management #vlan名称
13.  
    shutdown: disabled #vlan no shutdown
14.  
    state: active #状态激活
15.  
    vlan_id: 255 #vlan id 255 (必填参数)
16.  
     
17.  
    - name: Add vlan 255 ip address #设置interface vlan 255 的IP地址
18.  
    cisco.ios.ios_l3_interfaces:
19.  
    config:
20.  
    - name: vlan 255 #设置interface vlan 255
21.  
    ipv4: #设置ipv4参数
22.  
    - address: "{{ new_ip }}" #使用hosts文件中的new_ip变量赋给address
23.  
     
24.  
    - name: enable vlan 255 interface
25.  
    cisco.ios.ios_interfaces:
26.  
    config:
27.  
    - name: vlan 255
28.  
    enabled: true #no shutdown
29.  
     
30.  
    - name: add vlan 255 to interface
31.  
    cisco.ios.ios_l2_interfaces:
32.  
    config:
33.  
    - name: "{{ interface }}" #eg: interface port-channel 10
34.  
    mode: trunk
35.  
    trunk:
36.  
    allowed_vlans: 255 #trunk允许通过的vlan列表中添加vlan 255
37.  
     
38.  
    - name: add static router
39.  
    cisco.ios.ios_static_routes:
40.  
    config:
41.  
    - address_families:
42.  
    - afi: ipv4
43.  
    routes:
44.  
    - dest: 0.0.0.0/0 # ip route 0.0.0.0 0.0.0.0
45.  
    next_hops:
46.  
    - forward_router_address: 192.168.255.253 #下一跳网关
47.  
     
48.  
    - name: write configuration #保存配置
49.  
    cisco.ios.ios_command:
50.  
    commands: write #write

Step 3: 华为play-book，此次华为采用的是command方式。

1.  
   ---
2.  
   - name: For Huawei
3.  
   connection: network_cli
4.  
    
5.  
   gather_facts: false
6.  
   hosts: hw
7.  
    
8.  
   tasks:
9.  
   - name: Huawei Create VLAN
10.  
    community.network.ce_command:
11.  
    commands:
12.  
    - system-view
13.  
    - vlan 255
14.  
    - interface vlan 255
15.  
    - ip address {{ new_ip }}
16.  
    - undo shutdown
17.  
    - quit
18.  
    - interface {{ interface }}
19.  
    - port trunk allow-pass vlan 255
20.  
    - quit
21.  
    - ip route-static 0.0.0.0 0.0.0.0 192.168.255.253
22.  
    - save
23.  
    - y
24.  
    #- undo ip route-static 0.0.0.0 0.0.0.0 192.168.3.253

Step 4：分开执行思科华为脚本

Ansible-playbook -i hosts_1 cisco.yml

Ansible-playbook -i hosts_1 huawei.yml

四、ansible文档

4.1 cisco ios module 

Cisco.Ios — Ansible Documentation

4.2 huawei ce module

Community.Network — Ansible Documentation

4.3 Ansible for Network Automation

Ansible for Network Automation — Ansible Documentation

ansible官方module文档写的非常好，包含例子等说明

这篇好文章是转载于：学新通技术网