Skip to content

Terraform で aci_rest を使わずに ACI 上に L3out/OSPF の Tenant を作成する

以前に Terraform で ACI 上に L3out (OSPF) を含む Tenant を作成する というメモを書きました。 このメモでは aci_rest を利用していました。 今回は現時点で最新の ACI 用 Terraform Provider 0.7.1 で aci_rest を使わない .tf ファイルをメモしておきます。

ACI 用 Terraform Provider の変更履歴

ACI 用 Terraform Provider の変更履歴は下記で確認出来ます。

過去のメモでは「Logical Interface に SVI を設定する」や「L3Out への OSPF 設定関連」で aci_rest を使っていましたが、今回は下記などを利用するように変更しました。

構成図

今回は以下の構成を Terraform で設定します。 尚、VRF で Policy Control Enforcement Preference 設定は Unenforced に設定しています。

file

.tf ファイル

aci_rest を使わないように書き直した .tf ファイルは以下の通りです。

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# Tenant
resource "aci_tenant" "tenant1" {
  name = "Tenant1"
}

# VRF
resource "aci_vrf" "vrf1" {
  tenant_dn   = "${aci_tenant.tenant1.id}"
  name        = "Vrf1"
  pc_enf_pref = "unenforced"
}

# OSPF Interface Policy
resource "aci_ospf_interface_policy" "ospf_if_p2p" {
  tenant_dn    = "${aci_tenant.tenant1.id}"
  name         = "Point-to-Point"
  cost         = "unspecified"
  nw_t         = "p2p"
  prio         = "1"
  pfx_suppress = "inherit"
  hello_intvl  = "10"
  dead_intvl   = "40"
  rexmit_intvl = "5"
  xmit_delay   = "1"
}

# Domain
data "aci_l3_domain_profile" "l3dom" {
  name = "ExtRoutedDom"
}

# L3Out
resource "aci_l3_outside" "l3out1" {
  tenant_dn                    = "${aci_tenant.tenant1.id}"
  name                         = "L3Out1"
  relation_l3ext_rs_ectx       = "${aci_vrf.vrf1.id}"
  relation_l3ext_rs_l3_dom_att = "${data.aci_l3_domain_profile.l3dom.id}"
}

resource "aci_l3out_ospf_external_policy" "l3out1_ospf" {
  l3_outside_dn = "${aci_l3_outside.l3out1.id}"
  area_cost     = "1"
  area_ctrl     = "redistribute,summary"
  area_id       = "0.0.0.0"
  area_type     = "regular"
}

resource "aci_logical_node_profile" "l3out1_lnprof1" {
  l3_outside_dn = "${aci_l3_outside.l3out1.id}"
  name          = "L3Out1_NodeProf"
}

resource "aci_logical_node_to_fabric_node" "l3out1_lnode1" {
  logical_node_profile_dn  = "${aci_logical_node_profile.l3out1_lnprof1.id}"
  tdn                      = "topology/pod-1/node-201"
  rtr_id                   = "10.0.254.201"
  rtr_id_loop_back         = "no"
}

resource "aci_logical_interface_profile" "l3out1_lifprof1" {
  logical_node_profile_dn           = "${aci_logical_node_profile.l3out1_lnprof1.id}"
  name                              = "L3Out1_IntProf"
}

resource "aci_l3out_path_attachment" "lifprof1_port1" {
  logical_interface_profile_dn = "${aci_logical_interface_profile.l3out1_lifprof1.id}"
  target_dn                    = "topology/pod-1/paths-201/pathep-[eth1/1]"
  if_inst_t                    = "ext-svi"
  addr                         = "10.0.101.254/24"
  autostate                    = "enabled"
  encap                        = "vlan-101"
  mtu                          = "1500"
}

resource "aci_l3out_ospf_interface_profile" "ospf_if_prof1" {
  logical_interface_profile_dn = "${aci_logical_interface_profile.l3out1_lifprof1.id}"
  relation_ospf_rs_if_pol      = "${aci_ospf_interface_policy.ospf_if_p2p.id}"
  auth_key                     = ""
}

# L3Out1 External EPG
resource "aci_external_network_instance_profile" "l3out1_epg1" {
  l3_outside_dn       = "${aci_l3_outside.l3out1.id}"
  name                = "ExtEpg1"
}

resource "aci_l3_ext_subnet" "l3out1_subnet1" {
  external_network_instance_profile_dn = "${aci_external_network_instance_profile.l3out1_epg1.id}"
  ip                                   = "0.0.0.0/0"
  scope                                = ["import-security"]
}

# BD
resource "aci_bridge_domain" "bd1" {
  tenant_dn                = "${aci_tenant.tenant1.id}"
  name                     = "Bd1"
  relation_fv_rs_ctx       = "${aci_vrf.vrf1.id}"
  relation_fv_rs_bd_to_out = ["${aci_l3_outside.l3out1.id}"]
}

resource "aci_subnet" "bd1_subnet" {
  parent_dn = "${aci_bridge_domain.bd1.id}"
  ip        = "10.0.102.254/24"
  scope     = ["public"]
}

# Application Profile
resource "aci_application_profile" "ap1" {
  tenant_dn = "${aci_tenant.tenant1.id}"
  name      = "Ap1"
}

# Domain
data "aci_physical_domain" "physdom" {
  name = "PhysDom"
}

# EPG
resource "aci_application_epg" "epg1" {
  application_profile_dn = "${aci_application_profile.ap1.id}"
  name                   = "Epg1"
  relation_fv_rs_bd      = "${aci_bridge_domain.bd1.id}"
}

resource "aci_epg_to_domain" "epg1_physdom" {
  application_epg_dn = "${aci_application_epg.epg1.id}"
  tdn                = "${data.aci_physical_domain.physdom.id}"
}

resource "aci_epg_to_static_path" "egp1_port1" {
  application_epg_dn = "${aci_application_epg.epg1.id}"
  tdn                = "topology/pod-1/paths-202/pathep-[eth1/1]"
  encap              = "vlan-102"
}

L3 Switch 側の設定

L3Out の接続先 L3 Switch の設定例は以下の通りです。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
ip vrf 101
!
interface GigabitEthernet1/0/1
 switchport trunk allowed vlan 101
 switchport mode trunk
 spanning-tree portfast trunk
 no shutdown
!
interface Vlan101
 ip vrf forwarding 101
 ip address 10.0.101.1 255.255.255.0
 ip mtu 1500
 ip ospf network point-to-point
 ip ospf 101 area 0.0.0.0
!
router ospf 101 vrf 101
 router-id 10.0.101.1
!
end