-
Notifications
You must be signed in to change notification settings - Fork 0
/
vpnsecure.yml
271 lines (242 loc) · 8.52 KB
/
vpnsecure.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
- hosts: asahosts
connection: local
gather_facts: no
vars:
rg: VPNetWestRG
vnet: VPNetWest
vnetiprange: 172.21.0.0/16
subnet1name: VPNSubnet1
subnet1iprange: 172.21.3.0/24
gwsubnetiprange: 172.21.9.0/27
pubip: VNetGW1PubIP
vnetgw: VNetGW1
localnetgw: ASALAB
localnetgwaddrprefix: 192.168.0.0/24
localnetgwaddrnet: 192.168.0.0
localnetgwpeeraddr: 192.168.1.2
localnetgwpeeraddrnet: "192.168.1.0 mask 255.255.255.252"
vpnconn: AzureLabConn
vpnrouteip: 192.168.1.3
keyvaulturl: "keyvault-address-here"
tasks:
- name: Get project secret variables from KeyVault
azure.azcollection.azure_rm_keyvaultsecret_info:
vault_uri: "{{ keyvaulturl }}"
name: "{{ item }}"
loop:
- "ASAUserName"
- "ASAUserPassword"
- "EnablePassword"
- "VPNSharedKey"
register: secrets
- name: Set asa cli and vpn shared key variables
set_fact:
cli:
host: "{{ inventory_hostname }}"
authorize: yes
username: "{{ secrets.results[0]['secrets'][0]['secret'] }}"
password: "{{ secrets.results[1]['secrets'][0]['secret'] }}"
auth_pass: "{{ secrets.results[2]['secrets'][0]['secret'] }}"
vpnsharedkey: "{{ secrets.results[3]['secrets'][0]['secret'] }}"
- name: Create resource group
azure_rm_resourcegroup:
name: "{{ rg }}"
location: westus
- name: Create virtual network
azure_rm_virtualnetwork:
resource_group: "{{ rg }}"
name: "{{ vnet }}"
address_prefixes: "{{ vnetiprange }}"
- name: Add subnet
azure_rm_subnet:
resource_group: "{{ rg }}"
name: "{{ subnet1name }}"
address_prefix: "{{ subnet1iprange }}"
virtual_network: "{{ vnet }}"
- name: Add GatewaySubnet
azure_rm_subnet:
resource_group: "{{ rg }}"
name: "GatewaySubnet"
address_prefix: "{{ gwsubnetiprange }}"
virtual_network: "{{ vnet }}"
- name: Create VNetGW public IP address
azure_rm_publicipaddress:
resource_group: "{{ rg }}"
allocation_method: Dynamic
name: "{{ pubip }}"
- name: Create virtual network gateway with bgp
azure_rm_virtualnetworkgateway:
resource_group: "{{ rg }}"
name: "{{ vnetgw }}"
sku: "VpnGw1"
ip_configurations:
- name: "vnetgwipconfig"
private_ip_allocation_method: Dynamic
public_ip_address_name: "{{ pubip }}"
enable_bgp: yes
virtual_network: "{{ vnet }}"
bgp_settings:
asn: 65515
- name: Get virtual network gateway info via API request
azure_rm_resource_info:
resource_group: "{{ rg }}"
provider: network
resource_type: virtualNetworkGateways
resource_name: "{{ vnetgw }}"
api_version: "2020-11-01"
register: vnetgwvar
- name: Set bgpPeeringAddress and tunnelIpAddresses public ip variables
set_fact:
azvpnpeeraddress: "{{ vnetgwvar['response'][0]['properties']['bgpSettings']['bgpPeeringAddress'] }}"
azvpnpubip: "{{ vnetgwvar['response'][0]['properties']['bgpSettings']['bgpPeeringAddresses'][0]['tunnelIpAddresses'][0] }}"
- name: Display Azure private peer ip for ping testing
ansible.builtin.debug:
msg: "ping -t {{ azvpnpeeraddress }}"
- name: Get on-prem public ip
ansible.builtin.shell: "dig +short myip.opendns.com @resolver1.opendns.com"
register: shres
- name: Set on-prem public ip variable
set_fact:
asapubip: "{{ shres.stdout }}"
- name: Create Local Network Gateway and VPN-Connection from template
azure_rm_deployment:
resource_group: "{{ rg }}"
name: LocalNetGWVPNConnDeployment
parameters:
LocalNetGWName:
value: "{{ localnetgw }}"
gatewayIpAddress:
value: "{{ asapubip }}"
addressPrefixes:
value: "{{ localnetgwaddrprefix }}"
asn:
value: 65000
bgpPeeringAddress:
value: "{{ localnetgwpeeraddr }}"
VPNConnName:
value: "{{ vpnconn }}"
VNetGW:
value: "{{ vnetgw }}"
vpnSharedKey:
value: "{{ vpnsharedkey }}"
template_link: 'https://github.com/raw/Better-Computing-Consulting/azure-devops-ci-ansible-vpn-deployment/master/LocalNetGW-VPNConn.json'
- name: crypto ikev2 policy 10
cisco.asa.asa_config:
lines:
- encryption aes-gcm-256 aes-gcm-192 aes-gcm
- integrity null
- group 14 5 2
- prf sha512 sha384 sha256 sha
- lifetime seconds 86400
match: line
parents: [crypto ikev2 policy 10]
provider: "{{ cli }}"
- name: crypto ikev2 policy 20
cisco.asa.asa_config:
lines:
- encryption aes-256 aes-192 aes
- integrity sha512 sha384 sha256 sha
- group 14 5 2
- prf sha512 sha384 sha256 sha
- lifetime seconds 86400
match: line
parents: [crypto ikev2 policy 20]
provider: "{{ cli }}"
- name: crypto ikev2 enable outside
cisco.asa.asa_config:
lines:
- crypto ikev2 enable outside
match: line
provider: "{{ cli }}"
- name: crypto ipsec ikev2 ipsec-proposal AZURE-PROPOSAL
cisco.asa.asa_config:
lines:
- protocol esp encryption aes-256
- protocol esp integrity sha-256
match: line
parents: [crypto ipsec ikev2 ipsec-proposal AZURE-PROPOSAL]
provider: "{{ cli }}"
- name: crypto ipsec profile AZURE-PROPOSAL
cisco.asa.asa_config:
lines:
- set ikev2 ipsec-proposal AZURE-PROPOSAL
match: line
parents: [crypto ipsec profile AZURE-PROPOSAL]
provider: "{{ cli }}"
- name: group-policy AZURE internal
cisco.asa.asa_config:
lines:
- group-policy AZURE internal
match: line
provider: "{{ cli }}"
- name: group-policy AZURE attributes
cisco.asa.asa_config:
lines:
- vpn-tunnel-protocol ikev2
match: line
parents: [group-policy AZURE attributes]
provider: "{{ cli }}"
- name: "tunnel-group {{ azvpnpubip }} type ipsec-l2l"
cisco.asa.asa_config:
lines:
- "tunnel-group {{ azvpnpubip }} type ipsec-l2l"
match: line
provider: "{{ cli }}"
- name: "tunnel-group {{ azvpnpubip }} general-attributes"
cisco.asa.asa_config:
lines:
- default-group-policy AZURE
match: line
parents: ["tunnel-group {{ azvpnpubip }} general-attributes"]
provider: "{{ cli }}"
- name: "tunnel-group {{ azvpnpubip }} ipsec-attributes"
cisco.asa.asa_config:
lines:
- "ikev2 remote-authentication pre-shared-key {{ vpnsharedkey }}"
- "ikev2 local-authentication pre-shared-key {{ vpnsharedkey }}"
match: line
parents: ["tunnel-group {{ azvpnpubip }} ipsec-attributes"]
provider: "{{ cli }}"
- name: interface Tunnel1
cisco.asa.asa_config:
lines:
- nameif AZURE
- "ip address {{ localnetgwpeeraddr }} 255.255.255.252"
- tunnel source interface outside
- "tunnel destination {{ azvpnpubip }}"
- tunnel mode ipsec ipv4
- tunnel protection ipsec profile AZURE-PROPOSAL
- no shutdown
match: line
parents: [interface Tunnel1]
provider: "{{ cli }}"
- name: "route AZURE {{ azvpnpeeraddress }} 255.255.255.255 {{ vpnrouteip }} 1"
cisco.asa.asa_config:
lines:
- "route AZURE {{ azvpnpeeraddress }} 255.255.255.255 {{ vpnrouteip }} 1"
match: line
provider: "{{ cli }}"
- name: router bgp 65000
cisco.asa.asa_config:
lines:
- bgp log-neighbor-changes
- bgp graceful-restart
match: line
parents: [router bgp 65000]
provider: "{{ cli }}"
- name: router bgp 65000, address-family ipv4 unicast
cisco.asa.asa_config:
lines:
- "neighbor {{ azvpnpeeraddress }} remote-as 65515"
- "neighbor {{ azvpnpeeraddress }} ebgp-multihop 255"
- "neighbor {{ azvpnpeeraddress }} activate"
- "network {{ localnetgwaddrnet }}"
- "network {{ localnetgwpeeraddrnet }}"
- no auto-summary
- no synchronization
- exit-address-family
match: line
parents:
- router bgp 65000
- address-family ipv4 unicast
provider: "{{ cli }}"