Skip to content

Commit 8b4cf8d

Browse files
author
mhamroz
committed
Added Fabric Extranet Policies feature
1 parent 5462a7b commit 8b4cf8d

3 files changed

Lines changed: 313 additions & 67 deletions

File tree

‎EXTRANET_POLICY_USAGE.md‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
# Extranet Policy Configuration Guide
2+
3+
This document explains how to configure Extranet Policies using the Terraform Catalyst Center NAC module.
4+
5+
## Overview
6+
7+
Extranet Policies enable communication between different virtual networks (VNs) in an SD-Access fabric. The module supports configuring extranet policies at the fabric level with an optional `fabric_sites` parameter to specify which sites the policy applies to:
8+
- **Global fabric policies** - Applied to all fabric sites (when `fabric_sites` is not specified)
9+
- **Site-specific fabric policies** - Applied only to specified fabric sites (when `fabric_sites` is provided)
10+
11+
## YAML Configuration
12+
13+
### Global Extranet Policy
14+
15+
Configure policies that apply to all fabric sites:
16+
17+
```yaml
18+
catalyst_center:
19+
fabric:
20+
extranet_policies:
21+
- name: LISP_extranet_global
22+
provider_VN: Campus
23+
subscriber_VNs:
24+
- Guest
25+
- IoT
26+
```
27+
28+
### Site-Specific Extranet Policy
29+
30+
Configure policies for specific fabric sites using the `fabric_sites` parameter:
31+
32+
```yaml
33+
catalyst_center:
34+
fabric:
35+
extranet_policies:
36+
- name: LISP_extranet
37+
provider_VN: Campus2
38+
subscriber_VNs:
39+
- Guest2
40+
- Printers2
41+
fabric_sites:
42+
- Global/Poland/Krakow
43+
```
44+
45+
## Complete Example
46+
47+
Here's a complete example showing both global and site-specific extranet policies:
48+
49+
```yaml
50+
---
51+
catalyst_center:
52+
fabric:
53+
# Multiple extranet policies with different scopes
54+
extranet_policies:
55+
# Global policy (applies to all sites)
56+
- name: Global_Campus_Extranet
57+
provider_VN: Campus
58+
subscriber_VNs:
59+
- Guest
60+
- IoT
61+
62+
# Site-specific policy (applies only to Boston)
63+
- name: Boston_Local_Extranet
64+
provider_VN: Campus_Boston
65+
subscriber_VNs:
66+
- Guest_Boston
67+
- Printers_Boston
68+
fabric_sites:
69+
- Global/US/Boston
70+
71+
# Multi-site policy (applies to specific sites)
72+
- name: East_Coast_DMZ_Extranet
73+
provider_VN: DMZ_Shared
74+
subscriber_VNs:
75+
- Internal_Boston
76+
- Internal_NYC
77+
fabric_sites:
78+
- Global/US/Boston
79+
- Global/US/NYC
80+
81+
fabric_sites:
82+
- name: Global/US/Boston
83+
l3_virtual_networks:
84+
- Campus_Boston
85+
- Guest_Boston
86+
- Printers_Boston
87+
- Internal_Boston
88+
# ... other site configuration
89+
90+
- name: Global/US/NYC
91+
l3_virtual_networks:
92+
- Campus_NYC
93+
- Internal_NYC
94+
# ... other site configuration
95+
```
96+
97+
## Terraform Configuration
98+
99+
### Basic Usage
100+
101+
```hcl
102+
module "catalystcenter" {
103+
source = "netascode/nac-catalystcenter/catalystcenter"
104+
version = "0.2.0"
105+
106+
yaml_files = ["fabric.yaml"]
107+
}
108+
```
109+
110+
### Advanced Configuration
111+
112+
```hcl
113+
module "catalystcenter" {
114+
source = "netascode/nac-catalystcenter/catalystcenter"
115+
version = "0.2.0"
116+
117+
yaml_directories = ["./data"]
118+
managed_sites = ["Global/US/Boston", "Global/US/NYC"]
119+
manage_global_settings = true
120+
use_bulk_api = true
121+
}
122+
```
123+
124+
## Data Model Structure
125+
126+
### Required Fields
127+
128+
- `name`: Unique name for the extranet policy
129+
- `provider_VN`: Name of the provider virtual network
130+
- `subscriber_VNs`: List of subscriber virtual network names
131+
132+
### Optional Fields
133+
134+
- `fabric_sites`: List of fabric site names where the policy should be applied. If omitted, the policy applies to all fabric sites.
135+
136+
### Field Mapping
137+
138+
The YAML structure maps to the Terraform resource as follows:
139+
140+
| YAML Field | Terraform Resource Field | Description |
141+
|------------|-------------------------|-------------|
142+
| `name` | `extranet_policy_name` | Name of the extranet policy |
143+
| `provider_VN` | `provider_virtual_network_name` | Provider virtual network |
144+
| `subscriber_VNs` | `subscriber_virtual_network_names` | Subscriber virtual networks |
145+
| `fabric_sites` | `fabric_ids` (computed) | List of fabric site IDs (computed from site names) |
146+
147+
## Prerequisites
148+
149+
Before configuring extranet policies, ensure:
150+
151+
1. **Virtual Networks Exist**: All referenced virtual networks must be defined in the configuration
152+
2. **Fabric Sites Configured**: Target fabric sites must be properly configured
153+
3. **Provider Dependencies**: The module will automatically handle dependencies between resources
154+
155+
## Behavior and Logic
156+
157+
### Global vs Site-Specific Policies
158+
159+
- **Global policies** (`fabric.extranet_policy`): Applied to all managed fabric sites
160+
- **Site-specific policies** (`fabric_sites[].extranet_policy`): Applied only to the specific fabric site
161+
162+
### Resource Naming
163+
164+
- Global policies: Use the policy `name` as the resource key
165+
- Site-specific policies: Use `{name}_{site_name}` as the resource key
166+
167+
### Dependency Management
168+
169+
The module automatically handles dependencies:
170+
- Fabric sites must exist before applying policies
171+
- L3 virtual networks must be configured before extranet policies
172+
- Provider virtual networks are validated during planning
173+
174+
## Validation Rules
175+
176+
The module includes validation to ensure:
177+
- Policy names are unique within their scope
178+
- Provider and subscriber virtual networks are defined
179+
- No circular dependencies between policies
180+
- Fabric sites exist for site-specific policies
181+
182+
## Common Use Cases
183+
184+
### 1. Campus-Guest Connectivity
185+
186+
Allow guest network access to campus services:
187+
188+
```yaml
189+
extranet_policy:
190+
- name: Campus_Guest_Access
191+
provider_VN: Campus
192+
subscriber_VNs:
193+
- Guest
194+
```
195+
196+
### 2. Multi-Tenant Shared Services
197+
198+
Enable multiple tenant VNs to access shared services:
199+
200+
```yaml
201+
extranet_policy:
202+
- name: Shared_Services_Access
203+
provider_VN: Shared_Services
204+
subscriber_VNs:
205+
- Tenant_A
206+
- Tenant_B
207+
- Tenant_C
208+
```
209+
210+
### 3. Site-Specific DMZ Access
211+
212+
Configure DMZ access for specific sites:
213+
214+
```yaml
215+
fabric_sites:
216+
- name: Global/DC/Primary
217+
extranet_policy:
218+
- name: DMZ_Internal_Access
219+
provider_VN: Internal
220+
subscriber_VNs:
221+
- DMZ
222+
```
223+
224+
## Troubleshooting
225+
226+
### Common Issues
227+
228+
1. **Virtual Network Not Found**: Ensure all referenced VNs are defined in `l3_virtual_networks`
229+
2. **Fabric Site Not Managed**: Check that the site is in the `managed_sites` list
230+
3. **Duplicate Policy Names**: Use unique names for policies within their scope
231+
4. **Provider/Subscriber Conflict**: A VN cannot be both provider and subscriber in the same policy
232+
233+
### Validation Commands
234+
235+
```bash
236+
# Validate YAML structure
237+
nac-validate data/
238+
239+
# Plan to see what resources will be created
240+
terraform plan
241+
242+
# Check for naming conflicts
243+
terraform plan | grep "catalystcenter_extranet_policy"
244+
```
245+
246+
## Related Configuration
247+
248+
Extranet policies work in conjunction with:
249+
- L3 Virtual Networks
250+
- Fabric Sites
251+
- Anycast Gateways
252+
- Security Group Tags (if configured)
253+
254+
Ensure these components are properly configured in your YAML model.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,10 @@ module "catalystcenter" {
101101
| [catalystcenter_discovery.discovery](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/discovery) | resource |
102102
| [catalystcenter_dns_settings.dns_settings](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/dns_settings) | resource |
103103
| [catalystcenter_dns_settings.global_dns_settings](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/dns_settings) | resource |
104+
| [catalystcenter_extranet_policy.extranet_policy](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/extranet_policy) | resource |
104105
| [catalystcenter_fabric_device.border_device](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_device) | resource |
105106
| [catalystcenter_fabric_device.edge_device](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_device) | resource |
106107
| [catalystcenter_fabric_device.wireless_controller](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_device) | resource |
107-
| [catalystcenter_fabric_devices.fabric_devices](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_devices) | resource |
108108
| [catalystcenter_fabric_ewlc.ewlc_device](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_ewlc) | resource |
109109
| [catalystcenter_fabric_l2_handoff.l2_handoff](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_l2_handoff) | resource |
110110
| [catalystcenter_fabric_l2_handoff.l2_handoff_no_anycast](https://registry.terraform.io/providers/CiscoDevNet/catalystcenter/latest/docs/resources/fabric_l2_handoff) | resource |

0 commit comments

Comments
 (0)