search

aristanetworks / avd

Arista Validated Designs
https://avd.arista.com
Apache License 2.0
279 stars 201 forks source link

Fix(eos_cli_config_gen): Comply with EOS tacacs servers configuration order #3708

Closed mmaaloul closed 6 months ago

mmaaloul commented 6 months ago

Enhancement summary

AFAIK, EOS is not sorting tacacs server IPs in config: they are listed according the order they are configured with. On the other hand, AVD is sorting (use of arista.avd.natural_sort filter). This creates an unnecessary diff when I use CVPRAC function "validate_configlets_for_device"

Which component of AVD is impacted

eos_cli_config_gen

Use case example

1/ Running config:

tacacs-server host 10.114.169.108 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F
tacacs-server host 10.114.134.66 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F

2/ AVD generated config:

tacacs-server host 10.114.134.66 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F
tacacs-server host 10.114.169.108 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F

3/ The validation of AVD generated config against the running one using CVPRAC "validate_configlets_for_device":

    {
      "command": "tacacs-server host 10.114.169.108 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F",
      "rowId": 154,
      "lineNum": 152,
      "parentRowId": 0,
      "filterCode": "UNSPECIFIED",
      "blockId": "blockId_154r",
      "code": "RED", <<<<<<<<<<<< RED = RECONCILE
      "shouldReconcile": false
    },
    ...
    {
      "command": "tacacs-server host 10.114.169.108 vrf OOB-SPK-REA80-001 key 7 052A0F0E226C5C060C024F3E0F0F",
      "rowId": 156,
      "lineNum": 155,
      "parentRowId": 0,
      "filterCode": "UNSPECIFIED",
      "blockId": "blockId_156d",
      "code": "GREEN", <<<<<<<<<<<< GREEN = NEW
      "shouldReconcile": false
    }

As interpreted by my code:

"global": {
    "mismatch": [
        {
            "new": "snmp-server contact expertiseirs.pole@orange.com",
            "old": "snmp-server contact air.erci@orange.com"
        }
    ],
    "new": [
        "tacacs-server host 10.114.169.108 vrf ADMIN key 7 052A0F0E226C5C060C024F3E0F0F"
    ],
    "reconcile": [
        "tacacs-server host 10.114.169.108 vrf ADMIN key 7 052A0F0E226C5C060C024F3E0F0F"
    ]
}

Describe the solution you would like

Remove the sorting filter in tacacs-servers.j2 template from the following line:

{%     for host in tacacs_servers.hosts | arista.avd.natural_sort %}

It will be up to the customer to define the order...

Describe alternatives you have considered

No response

Additional context

No response

Contributing Guide

carlbuchmann commented 6 months ago

Thanks @mmaaloul for raising this issue. We will treat this as a bug fix since the order does matter:

From EOS documentation: You can enter this command up to four times to identify multiple TACACS servers. The controller tries to connect to each server in the order in which they are configured.