Messages

:)

Depending on how generic the XML system and the Rest API are, it might be quite easy to get something up and running quickly.

The other ansible projects that I mention above involved also a significant effort, and now we can reuse some code.

With a good architecture anybody should be able to help making this project complete. I mean, getting something up and running that it is easy to extend/maintain should be the priority.

I am happy to contribute. I really want an opensource router that it is ansible manageable. And I hope someone else can too.

But I still have some questions with regards to the XML Config API, hope someone can provide some directions.

Thanks for your comments @mj84 and @mimugmail

So far we have that:

- there is a legacy XML API and a new Rest API
- Rest API is far from complete. implementation seems to translate to XML anyway.
- I also noticed in @mj84 comments that all config objects are referenced by UUID, which is not very Ansible playbook friendly.
- There is generic code that can be used form @mj84 work.

In an ideal world we would go with the Rest API which would be 100% complete.

Having to deal with 2 modules interfaces is not the end of the world, provided that those 2 interfaces are generic enough. If the problem extends to the point in which each module has its own proprietary interface then viability is at stake. If OPNSense is pushing for REST API, then I guess we should follow suit, and deal with XML config as "Legacy" type of config.

I am not sure I understand the XML API. By looking at the @fpieters XML based Ansible module, he seems to compose an XML configuration file that it is then sent at once to the OPNSense router. I wonder if there is API to update that XML configuration perhaps by sending XML fragments or how would it work. Or are we thinking about touching the configuration file directly? How would legacy XML module configuraiton be implemented?

I did not get any comments on whether NETCONF seems like a good architecture way to go with. I assumed it is OK based on Ansible modules and Industry buzz around it only. I this option would involve:

- A NETCONF to REST API/XML Config proxy module would be provided (Python?)
- Ansible generic NETCONF client module can be used to start with
- An specialization writen on top of the generic NETCONF Ansible client Module can be written afterwards if that improves friendliness (I notice some vendors do but not sure why)
- The NETCONF proxy module could take care of issues such as Name to UUID translation, REST/Legacy conf etc.

There are other things that NETCONF imposes, such as the existence of multiple configuration files and been capable to go back to a previous one, etc. I haven't really checked that much, but does not seem like a lot of issues here. I am not sure either if OPNSense has this kind of functionality anyway.

Hi!

I would like to adopt an OpenSource router/firewall that can be managed from Ansible, as we already manage everything in our network that way.

Ansible has made a lot of work on the Network device configuration front but still there seems to be no support for a product like OPNSense.

I have found 2 modules in gitlab which configure OPNSense with Ansible. The ansible mofule for HAProxy, developed by @mj84 which was announced in this forum and another module by @fpieters that I found in Github.

They both follow different strategies. one seems to use Ansible XML plugins to compose an XML file that is eventually installed in OPNSense. The other uses the REST api to modify objects in OPNSense, but unfortunately is limited to the HAProxy functionality.

I was wondering if there is a way to provide complete support to OPNSese configuration from Ansible in a generic, and easy to implement way. Perhaps using the previous 2 projects as reference.

I am not familiar with OPNSense development but I am familiar with Ansible development as I did some bindings and ansible module work for OpenNebula.

Looking at the intro in the OPNSense REST API there seems to be generic enough, with calls following the format:

https://opnsense.local/api/<module>/<controller>/<command>/[<param1>/[<param2>/...]]

Ansible has also introduced NETCONF which also seems to be generic client for network devices configuration, with SOAP envelopes but generic get-set statements inside.

The question I am wondering is then weather a generic bridge from NETCONF to OPNSense API could be (easily) developed and whether that would work well enough to develop a good base that covers most OPNSense configuration options.

Before trying to put together a small prototype, I was wondering a few things:

I was wondering if anybody else is working, or interested in working on this.

I am assuming that a NETCONF-RESTAPI bridge would be installed in OPNSense, perhaps as an optional module.

I am not sure with Language should be used for this, but looking at the Development Documentation I see some mentions to Python that should be easy and fit for the job.

I guess integration for the authentication system would also be required, but perhaps there is already python code capable of this.

I was also wondering if there are mockups for the RESTAPI that would facilitate the development.

Any commends or ideas regarding OPNSense and Ansible?

Hi!

I am new to OPNSense, in fact, I am trying to migrate our network from PFSense.

For user access devices we have been using VLAN bridged with WIFI Access point, which we find convenient in this case.

So I am creating a bridge for an VLAN and WIFI access point interfaces. Only the Bridge interface has an IP, and rungs DHCP server, etc.

It seems to be working fine for some devices, however, with some others I get: WPA: EAPOL-Key timeout

I have been searching and reading old threads about this issue in other projects:

Some threads suggested testing without WPA, which I did, and then the bridge seems to work on all devices.

Other threads suggest that the client drivers might be incomplete/outdated, but this very same configuration is working just fine with the PFSense router, which I think is a related project.

My problem is that I dont know how to dig deeper here. What to debug or try.

Any idea what could be going wrong?