Feat(eos_cli_config_gen): Add permit_response_traffic nat to ip-acces…

…s-lists (#4545)
aristanetworks · Oct 7, 2024 · b965223 · b965223
1 parent b309e7a
commit b965223
Show file tree

Hide file tree

Showing 8 changed files with 30 additions and 0 deletions.
diff --git a/...arista/avd/molecule/eos_cli_config_gen/documentation/devices/ip-access-lists.md b/...arista/avd/molecule/eos_cli_config_gen/documentation/devices/ip-access-lists.md
@@ -55,6 +55,7 @@ ip access-list ACL_SEQUENCE_AND_COUNTERS
    40 permit tcp any gt 1023 host 172.16.16.16 eq 22
    50 permit tcp any range 1000 1100 any range 10 20
    4294967295 deny ip any any
+   permit response traffic nat
 !
 ip access-list ACL_NO_SEQUENCE
    remark test acl without sequence numbers

diff --git a/...e_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ip-access-lists.cfg b/...e_collections/arista/avd/molecule/eos_cli_config_gen/intended/configs/ip-access-lists.cfg
@@ -12,6 +12,7 @@ ip access-list ACL_SEQUENCE_AND_COUNTERS
    40 permit tcp any gt 1023 host 172.16.16.16 eq 22
    50 permit tcp any range 1000 1100 any range 10 20
    4294967295 deny ip any any
+   permit response traffic nat
 !
 ip access-list ACL_NO_SEQUENCE
    remark test acl without sequence numbers

diff --git a/...ollections/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ip-access-lists.yml b/...ollections/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/ip-access-lists.yml
@@ -45,6 +45,7 @@ ip_access_lists:
         protocol: ip
         source: any
         destination: any
+    permit_response_traffic: nat
   - name: ACL_NO_SEQUENCE
     entries:
       - remark: test acl without sequence numbers

diff --git a/..._collections/arista/avd/roles/eos_cli_config_gen/docs/tables/ip-access-lists.md b/..._collections/arista/avd/roles/eos_cli_config_gen/docs/tables/ip-access-lists.md
diff --git a/ansible_collections/arista/avd/roles/eos_designs/docs/tables/ipv4-acls.md b/ansible_collections/arista/avd/roles/eos_designs/docs/tables/ipv4-acls.md
diff --git a/python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/ip-access-lists.j2 b/python-avd/pyavd/_eos_cli_config_gen/j2templates/eos/ip-access-lists.j2
@@ -136,6 +136,9 @@ ip access-list {{ acl.name }}
 {%             endif %}
 {#         END ACL_ENTRY CYCLE: walk over the list of ACL entries #}
 {%         endfor %}
+{%         if acl.permit_response_traffic is arista.avd.defined %}
+   permit response traffic {{ acl.permit_response_traffic }}
+{%         endif %}
 {#     END ACL CYCLE: end walk over the list of defined ACLs #}
 {%     endfor %}
 {% endif %}
diff --git a/python-avd/pyavd/_eos_cli_config_gen/schema/eos_cli_config_gen.schema.yml b/python-avd/pyavd/_eos_cli_config_gen/schema/eos_cli_config_gen.schema.yml
diff --git a/python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/ip_access_lists.schema.yml b/python-avd/pyavd/_eos_cli_config_gen/schema/schema_fragments/ip_access_lists.schema.yml
@@ -150,3 +150,10 @@ keys:
               vlan_mask:
                 type: str
                 description: 0x000-0xFFF VLAN mask.
+        permit_response_traffic:
+          type: str
+          valid_values:
+            - nat
+          description: |-
+            Permit response traffic automatically based on NAT translations.
+            Minimum EOS version requirement 4.32.2F.