netcfgbu.toml

# -----------------------------------------------------------------------------
#
#                          Network Configuration Backup
#                              Configuration File
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
#                              Default Settings
# -----------------------------------------------------------------------------

[defaults]
    inventory = "$PROJ_DIR/inventory.csv"
    configs_dir = "$PROJ_DIR/configs"
    credentials.username = "$NETWORK_USERNAME"
    credentials.password = "$NETWORK_PASSWORD"

# -----------------------------------------------------------------------------
#
#                          Jumphosts
#
# -----------------------------------------------------------------------------

#[[jumphost]]
     # NOTE: your local SSH config file is not used, so make sure you provide
     # either the IP address of FQDN of the jumphost

#    proxy = "jschulman@my-dc1.com"
#    include = ['host=.*\.dc1']
     # you MUST provide an include filter. For all devices, use
     # ['host=.*']
#    exclude = ['os_name=asa']

# -----------------------------------------------------------------------------
#
#                          Version Control System(s)
#
# Currently only git systems are supported, but others types may be
# supported in the future.  If you have more than one vcs repository you can
# include the `name` field so that you can identify the vcs-repo using the CLI
# --name option.
# -----------------------------------------------------------------------------

[[git]]
    # the first entry does not require a name and it will be treated
    # as a default; i.e. when the --name option is omitted.
    repo = "https://github.mycorp.com/jschulman/test-network-configs.git"
    token = "$GIT_TOKEN"

[[git]]
    # example of using a deployment key that does not use a passphrase
    name = "ssh"
    repo = "git@gitlab.com:jschulman/test-network-configs.git"
    deploy_key = "$HOME/test-config-backups"

[[git]]
    # example of using a deployment key that uses a passphrase
    name = "ssh-pw"
    repo = "git@github.mlbam.net:jschulman/test-network-configs.git"
    deploy_key = "$HOME/pwtest-backups"
    deploy_passphrase = "$GITKEY_PASSWORD"

# -----------------------------------------------------------------------------
#                           Inventory Integrations
# -----------------------------------------------------------------------------

[[inventory]]
    name = 'netbox'
    script = '''$PROJ_DIR/netcfgbu/netbox/netbox_inventory.py \
        --exclude-tag no-backup --exclude-tag no-ssh \
        --output inventory.csv'''

# -----------------------------------------------------------------------------
#                           Global Credentials
# -----------------------------------------------------------------------------

#[[credentials]]
#   username = "superadmin"
#   password = "$ENABLE_PASSWORD"

# -----------------------------------------------------------------------------
#                           Global SSH Configs
# -----------------------------------------------------------------------------

[ssh_configs]
   kex_algs = [
        'ecdh-sha2-nistp256',
        'diffie-hellman-group14-sha1',
        'diffie-hellman-group1-sha1'
   ]

# -----------------------------------------------------------------------------
#
#                       Network OS Specifications
#
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
# Cisco switchs, routers, and firewalls
# -----------------------------------------------------------------------------

[os_name.ios]
    pre_get_config = "terminal length 0"
    linter = "ios"

[os_name.iosxe]
    linter = 'ios'

[os_name.nxos]
    get_config = 'show running-config | no-more'
    linter = "nxos"

[os_name.iosxr]
    linter = "iosxr"

[os_name.asa]
    pre_get_config = 'terminal pager 0'

# -----------------------------------------------------------------------------
# Cisco WLC
# -----------------------------------------------------------------------------

[os_name.aireos]
    # support for 8.5 release requires a special connector to handle the User &
    # Password prompts

    get_config = "show run-config commands"
    pre_get_config = "config paging disable"
    connection = "netcfgbu.connectors.ssh.LoginPromptUserPass"

[os_name.aireos8_10]
    # extending the timeout to 3min due to observations with the 8.10 release
    # resulting in sporatic delays in the output of the config.

    timeout = 300

    get_config = "show run-config commands"
    pre_get_config = "config paging disable"

    # need to explicitly set the Key Exchange algorithms to support the 8.10
    # SSH configured requirements; can be set here or in your ssh_config file.

#    ssh_configs.kex_algs = [
#        'ecdh-sha2-nistp256',
#        'diffie-hellman-group14-sha1'
#    ]

# NOTE: if you do not have these devices in your inventory, delete this section
# otherwise you will get an error if the environment variables are not defined
    [[os_name.aireos8_10.credentials]]
        username = "$WLC_USERNAME"
        password = "$WLC_PASSWORD"

# -----------------------------------------------------------------------------
# Palo Alto PANOS Firewalls
# -----------------------------------------------------------------------------

[os_name.panos]
    pre_get_config = [
        "set cli pager off",
        "configure"
    ]
    get_config = "show"
    linter = "panos"

# -----------------------------------------------------------------------------
# Cumulus Linux
# -----------------------------------------------------------------------------

[os_name.cumulus]
    # NOTE: make sure that the user has password-less sudo access, otherwise the
    # get_config execution will fail. There is no current workaround for this
    # requirement. Also pre_get_config does not work for Cumulus devices at this time.
    #
    # Do not change the order of the cat commands either. This ensures the final
    # file format is recognized by Batfish (https://github.com/batfish/batfish)

    get_config = "( cat /etc/hostname; cat /etc/network/interfaces; cat /etc/cumulus/ports.conf; sudo cat /etc/frr/frr.conf)"

    # example Cumulus prompt value: cumulus@leaf01:mgmt-vrf:~$
    prompt_pattern = '[a-z0-9.\-@:~]{10,65}\s*[#$]'

# -----------------------------------------------------------------------------
# Juniper JUNOS routers, switches and firewalls
# -----------------------------------------------------------------------------

[os_name.junos]
    # NOTE: Do not login as the root user. This will require you to enter CLI mode
    # prior to getting the configuration, which currently does not work for Juniper
    # devices.

    pre_get_config = [
        "set cli screen-length 0"
    ]

    get_config = "show configuration | display set"
    # you can return the configuration in hierarchical format by removing
    # `| display set` from the command above

# -----------------------------------------------------------------------------
#                                 Linters
# -----------------------------------------------------------------------------

[linters.iosxr]
    config_starts_after = 'Building configuration'

[linters.ios]
    config_starts_after = 'Current configuration'

[linters.nxos]
    config_starts_after = '!Time:'

[linters.panos]
    config_ends_at = "[edit]"

# -----------------------------------------------------------------------------
#
#                          Version Control System(s)
#
# Currently only github systems are supported, but others types may be
# supported in the future.  If you have more than one vcs repository you can
# include the `name` field so that you can identify the vcs-repo using the CLI
# --name option.
# -----------------------------------------------------------------------------

[[vcs]]
    repo = "https://github.mycorp.com/jschulman/test-network-configs.git"
    token = "$GIT_TOKEN"

# -----------------------------------------------------------------------------
# Logging - follows Python format as described
#   https://docs.python.org/3/library/logging.config.html
# -----------------------------------------------------------------------------


[logging.loggers.netcfgbu]
    handlers = ["console", "file"]
    level = "INFO"

[logging.loggers.asyncssh]
    # set the level to warning by default.  If you want to enable debugging
    # use the '--debug-ssh' option to set the debug level from [1-3];
    # https://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.set_debug_level

    handlers = ["console"]
    level = "WARNING"

[logging.handlers.console]
    class = "logging.StreamHandler"
    formatter = "basic"
    stream = "ext://sys.stdout"

[logging.handlers.file]
    class = "logging.FileHandler"
    formatter = "basic"
    filename =  "netcfgbu.log"

[logging.formatters.basic]
    format = "%(asctime)s %(levelname)s: %(message)s"