admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

TP38: bridge-port comment ungequotet + core place-before->move

Browse Source 
RouterOS exportiert comment=TP38-OOB-MGMT ohne Quotes (kein Leerzeichen),
das Template hatte sie gesetzt -> bridge-port Drift. Fix: unquoten.

Der Deploy-`place-before=[find ...]` wurde von Netmiko ignoriert (Regel
landete hinter dem drop); im Job jetzt add + move.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
Christoph Emsenhuber
2026-09-15 19:33:22 +02:00
parent 177ba100eb
commit e87619e89b
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
nautobot/gc-configplan.py
View File

@@ -398,12 +398,16 @@ def job_tp38_oob():
' . " fw=" . [:tostr [:len [/ip firewall filter find where comment~"TP38"]]] . "/8")', ' . " fw=" . [:tostr [:len [/ip firewall filter find where comment~"TP38"]]] . "/8")',
]) ])
# ⚠️ `add ... place-before=[find ...]` wird ueber Netmiko IGNORIERT (Regel landet am
# Ketten-Ende, also HINTER dem finalen drop = wirkungslos; beim Deploy 2026-09-15 so
# aufgeschlagen). Deshalb: erst add (appends), dann `move` vor die Log-Regel.
core_set = "\n".join([ core_set = "\n".join([
bridge_set, bridge_set,
vlan_set, vlan_set,
'/ip firewall filter add action=accept chain=input comment="TP38: OOB->core mgmt" ' '/ip firewall filter add action=accept chain=input comment="TP38: OOB->core mgmt" '
'dst-port=22,80,8291,8728 in-interface=vlan99 protocol=tcp ' 'dst-port=22,80,8291,8728 in-interface=vlan99 protocol=tcp',
'place-before=[find where log-prefix=TP5-INPUT-WOULD-DROP]', '/ip firewall filter move [find where comment="TP38: OOB->core mgmt"] '
'destination=[find where comment="TP5: input log-only"]',
':log info ("tp38: core pvid=" . [:tostr [/interface bridge port get [find interface=ether23] pvid]]' ':log info ("tp38: core pvid=" . [:tostr [/interface bridge port get [find interface=ether23] pvid]]'
' . " oob=" . [:tostr [:len [/ip firewall filter find where comment="TP38: OOB->core mgmt"]]])', ' . " oob=" . [:tostr [:len [/ip firewall filter find where comment="TP38: OOB->core mgmt"]]])',
]) ])

4
nautobot/mikrotik_routeros.j2
View File

@@ -76,7 +76,7 @@
{% for n in range(17, 23) %} {% for n in range(17, 23) %}
/interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }} /interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }}
{% endfor %} {% endfor %}
/interface bridge port add bridge=bridge comment="TP38-OOB-MGMT" frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99 /interface bridge port add bridge=bridge comment=TP38-OOB-MGMT frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
/interface bridge port add bridge=bridge comment=defconf interface=ether24 /interface bridge port add bridge=bridge comment=defconf interface=ether24
/interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus1 /interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus1
/interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus2 /interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus2
@@ -449,7 +449,7 @@
{% for n in range(9, 23) %} {% for n in range(9, 23) %}
/interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }} pvid=20 /interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }} pvid=20
{% endfor %} {% endfor %}
/interface bridge port add bridge=bridge comment="TP38-OOB-MGMT" frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99 /interface bridge port add bridge=bridge comment=TP38-OOB-MGMT frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
/interface bridge port add bridge=bridge comment=defconf interface=ether24 /interface bridge port add bridge=bridge comment=defconf interface=ether24
/interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1 /interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
/interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus2 /interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus2