#!/usr/bin/env python3 """BF-Netzwerk -> Nautobot: CRS326-Portplan + sw1-Belegung (TP15 As-built, 2026-07-23). Ergaenzt ingest-baseline.py: schreibt den Ist-Stand des CRS326-Bring-ups (Governance-Auflage "intended config zurueckschreiben") sowie die vom User verifizierte sw1-Belegung nach Nautobot. crs326-branch : volle SOLL-Portbelegung (produktiv), mgmt 10.40.99.13, Status Active crs326-core : Bring-up-Interfaces + geplantes Layout (tentativ), mgmt 10.40.99.11, Status Planned sw1 (ALLNET) : verifizierte 16-Port-Belegung (loest "UNVERIFIZIERT" auf) sw2 (ES208G) : Status -> Decommissioning (wird durch crs326-branch ersetzt) Muster wie ingest-baseline.py: get-or-create + Delta-PATCH, idempotent. Verifikation NUR per GraphQL (tagged_vlans liest sich per REST als null). """ import json, os, sys, urllib.request, urllib.error, urllib.parse BASE = "http://10.40.20.154:8080/api" TOKEN = os.environ.get("NAUTOBOT_TOKEN", "") DRY = "--apply" not in sys.argv log = [] def req(method, path, data=None): url = path if path.startswith("http") else f"{BASE}{path}" body = json.dumps(data).encode() if data is not None else None r = urllib.request.Request(url, data=body, method=method) r.add_header("Authorization", f"Token {TOKEN}") r.add_header("Content-Type", "application/json") r.add_header("Accept", "application/json") try: with urllib.request.urlopen(r, timeout=30) as resp: raw = resp.read() return json.loads(raw) if raw else {} except urllib.error.HTTPError as e: print(f"!! {method} {url}\n payload={json.dumps(data)}\n -> {e.code} {e.read().decode()[:500]}") raise def find(path, **params): q = "&".join(f"{k}={urllib.parse.quote(str(v))}" for k, v in params.items()) res = req("GET", f"{path}?{q}&limit=2") return res["results"][0] if res.get("count") else None def goc(path, match, payload, label=None): name = label or payload.get("name") or str(match) obj = find(path, **match) if obj: log.append(f" = {name}") return obj if DRY: log.append(f" + {name} (dry-run)") return {"id": f"DRY-{name}"} obj = req("POST", path + "/", payload) log.append(f" + {name}") return obj def patch(path, obj, payload, label): delta = {} for k, v in payload.items(): cur = obj.get(k) cur_id = cur.get("id") if isinstance(cur, dict) else cur if cur_id != v: delta[k] = v if not delta: log.append(f" = {label} (unveraendert)") return obj if DRY: log.append(f" ~ {label}: {list(delta)} (dry-run)") return obj out = req("PATCH", f"{path}/{obj['id']}/", delta) log.append(f" ~ {label}: {list(delta)}") return out def sid(name): return find("/extras/statuses", name=name)["id"] ETH, SFP, VIRT, BR = "1000base-t", "10gbase-x-sfpp", "virtual", "bridge" S_ACTIVE = sid("Active") S_PLANNED = sid("Planned") S_DECOM = sid("Decommissioning") # VLAN-Objekte (aus ingest-baseline angelegt) vg = find("/ipam/vlan-groups", name="BF") V = {} for vid in (1, 10, 20, 30, 40, 50, 90, 99, 100): V[vid] = find("/ipam/vlans", vid=vid, vlan_group=vg["id"]) ns_global = find("/ipam/namespaces", name="Global")["id"] D = {n: find("/dcim/devices", name=n) for n in ("crs326-branch", "crs326-core", "sw1", "sw2")} def iface(dev, name, typ, desc, mode=None, untagged=None, tagged=None): """Interface get-or-create + Attribute-PATCH (Mode/VLANs).""" obj = goc("/dcim/interfaces", {"device": dev, "name": name}, {"device": D[dev]["id"], "name": name, "type": typ, "status": S_ACTIVE, "description": desc}, label=f"{dev}:{name}") p = {"description": desc, "type": typ} if mode: p["mode"] = mode if untagged is not None: p["untagged_vlan"] = V[untagged]["id"] if not DRY and not str(obj["id"]).startswith("DRY"): obj = patch("/dcim/interfaces", obj, p, f"{dev}:{name}") if tagged is not None: req("PATCH", f"/dcim/interfaces/{obj['id']}/", {"tagged_vlans": [V[t]["id"] for t in tagged]}) return obj def set_mgmt(dev, ifname, addr, desc): ip = find("/ipam/ip-addresses", address=addr) if not ip: ip = goc("/ipam/ip-addresses", {"address": addr}, {"address": addr, "status": S_ACTIVE, "description": desc, "namespace": ns_global}, label=addr) if DRY or str(ip["id"]).startswith("DRY"): return intf = find("/dcim/interfaces", device=dev, name=ifname) if not find("/dcim/interfaces", device=dev, name=ifname, ip_addresses=ip["id"]): try: req("POST", "/ipam/ip-address-to-interface/", {"ip_address": ip["id"], "interface": intf["id"]}) log.append(f" + {addr} -> {dev}:{ifname}") except urllib.error.HTTPError: log.append(f" = {addr} -> {dev}:{ifname} (bereits)") req("PATCH", f"/dcim/devices/{D[dev]['id']}/", {"primary_ip4": ip["id"]}) TRUNK_BRANCH = [10, 20, 30, 40, 50, 90, 99] # kein VLAN100 auf branch (WAN nur zu ap1) print("== crs326-branch: SOLL-Portplan (produktiv)") patch("/dcim/devices", D["crs326-branch"], {"status": S_ACTIVE}, "crs326-branch status") iface("crs326-branch", "bridge", BR, "vlan-filtering=yes; VLAN1 untagged, 10-99 tagged") iface("crs326-branch", "ether1", ETH, "Uplink-Trunk -> sw1 #8 (native VLAN1 + tagged 10/20/30/40/50/90/99, KEIN 100)", mode="tagged", untagged=1, tagged=TRUNK_BRANCH) iface("crs326-branch", "ether2", ETH, "NAS #1 (tagged VLAN20)", mode="tagged", tagged=[20]) iface("crs326-branch", "ether3", ETH, "Drucker (Access VLAN10)", mode="access", untagged=10) iface("crs326-branch", "ether4", ETH, "Monitor/Dock Laptop (Access VLAN10)", mode="access", untagged=10) iface("crs326-branch", "ether5", ETH, "Sonos (Access VLAN40)", mode="access", untagged=40) iface("crs326-branch", "ether6", ETH, "Sonos (Access VLAN40)", mode="access", untagged=40) iface("crs326-branch", "ether7", ETH, "Mac mini (Access VLAN20)", mode="access", untagged=20) iface("crs326-branch", "ether8", ETH, "NAS #2 (tagged VLAN20)", mode="tagged", tagged=[20]) for n in range(9, 24): iface("crs326-branch", f"ether{n}", ETH, "frei (disabled)") iface("crs326-branch", "ether24", ETH, "ap2 (Trunk; native VLAN1 + tagged 10-99)", mode="tagged", untagged=1, tagged=TRUNK_BRANCH) iface("crs326-branch", "sfp-sfpplus1", SFP, "frei (disabled)") iface("crs326-branch", "sfp-sfpplus2", SFP, "frei (disabled)") iface("crs326-branch", "vlan99", VIRT, "Mgmt SVI (VLAN99)", mode="tagged", tagged=[99]) if not DRY: v99 = find("/dcim/interfaces", device="crs326-branch", name="vlan99") br = find("/dcim/interfaces", device="crs326-branch", name="bridge") req("PATCH", f"/dcim/interfaces/{v99['id']}/", {"parent_interface": br["id"]}) set_mgmt("crs326-branch", "vlan99", "10.40.99.13/24", "TP15 Bring-up-Mgmt (geplanter Renumber -> 10.40.99.12 nach Austausch beider Switches)") req_patch = {"comments": "TP15 2026-07-23: grundkonfiguriert via REST (RouterOS). MAC 04:F4:1C:B4:15:58, " "software-id RGZJ-UK0T, Serial HKA0AJJA52F. Ersetzt sw2 (Technik OG). Bring-up-Mgmt 10.40.99.13 " "(+ VLAN1-Temp 10.40.41.213 waehrend Bring-up); Ziel 10.40.99.12. ap2 an ether24."} if not DRY: req("PATCH", f"/dcim/devices/{D['crs326-branch']['id']}/", req_patch) print("== crs326-core: Bring-up + geplantes Layout (tentativ, Status bleibt Planned)") iface("crs326-core", "bridge", BR, "vlan-filtering=yes") iface("crs326-core", "ether1", ETH, "Uplink-Trunk -> sw1 #12 (Bring-up-Pfad; native VLAN1 + tagged 10-100)", mode="tagged", untagged=1, tagged=[10, 20, 30, 40, 50, 90, 99, 100]) iface("crs326-core", "ether2", ETH, "Bring-up: Temp-Downlink zu branch ether1. GEPLANT (tentativ): Sonos VLAN40", mode="tagged", untagged=1, tagged=[10, 20, 30, 40, 50, 90, 99, 100]) iface("crs326-core", "ether3", ETH, "GEPLANT (tentativ): Sonos VLAN40 untagged") iface("crs326-core", "ether4", ETH, "GEPLANT: ap1-Uplink-Trunk (ap1 wandert #15->#4 in Core-Swap-Session)") iface("crs326-core", "ether5", ETH, "GEPLANT (tentativ): Sonos VLAN40 untagged") iface("crs326-core", "vlan99", VIRT, "Mgmt SVI (VLAN99)", mode="tagged", tagged=[99]) if not DRY: v99c = find("/dcim/interfaces", device="crs326-core", name="vlan99") brc = find("/dcim/interfaces", device="crs326-core", name="bridge") req("PATCH", f"/dcim/interfaces/{v99c['id']}/", {"parent_interface": brc["id"]}) set_mgmt("crs326-core", "vlan99", "10.40.99.11/24", "TP15 Bring-up-Mgmt-Ziel (VLAN99)") if not DRY: req("PATCH", f"/dcim/devices/{D['crs326-core']['id']}/", {"comments": "TP15 2026-07-23: grundkonfiguriert via REST (Bring-up-Level, NICHT produktiv). " "MAC 04:F4:1C:B4:17:76, software-id 4W04-URHT, Serial HKA0AREXJFM. Ersetzt sw1 = kuenftiger L3-Router. " "Aktuell an sw1 #12. Mgmt 10.40.99.11 (VLAN99, erreichbar erst wenn sw1 #12 99T traegt) + VLAN1-Temp " "10.40.41.211. Port-Layout ab ether3 tentativ (VLAN99 pro Port unter Vorbehalt), final in Core-Swap-Session."}) print("== sw1 (ALLNET): verifizierte Belegung (User-Survey 2026-07-22) -> loest UNVERIFIZIERT") SW1 = [ ("GE1", "Trunk (native VLAN1)"), ("GE2", "Sonos (Access VLAN40) - Wohnzimmer"), ("GE3", "Hybrid VLAN1 - Wohnzimmer Sideboard"), ("GE4", "Trunk all (1U,10-100T) - ALT.-Standort ap1 (WLAN) - Wohnzimmer Sideboard"), ("GE5", "Sonos (Access VLAN40) - Schlafzimmer"), ("GE6", "Sonos (Access VLAN40) - Schlafzimmer"), ("GE7", "Hybrid VLAN1 - Arbeitszimmer (Leitung evtl. tot)"), ("GE8", "Trunk (1U,10-99T) -> crs326-branch Uplink - Arbeitszimmer"), ("GE9", "Sonos (Access VLAN40) - Kinderzimmer"), ("GE10", "Hybrid VLAN1 - Kinderzimmer"), ("GE11", "cudy1 (Access VLAN10) - Technik UG"), ("GE12", "crs326-core Bring-up/Config (aktuell Hybrid 1U, Ziel Trunk 1U,20-99T) - Technik UG"), ("GE13", "pve (Trunk 1U,20-99T) - Technik UG"), ("GE14", "Sonoff Dongle-M (Access VLAN30) - Technik UG"), ("GE15", "ap1 (Trunk 1U,10-100T) - Technik UG"), ("GE16", "Arris-Kabelmodem (Access VLAN100/WAN) - Technik UG"), ] for name, desc in SW1: iface("sw1", name, ETH, desc) print("== sw2 (ES208G): -> Decommissioning") patch("/dcim/devices", D["sw2"], {"status": S_DECOM}, "sw2 status") if not DRY: req("PATCH", f"/dcim/devices/{D['sw2']['id']}/", {"comments": "TP15 2026-07-23: wird durch crs326-branch ersetzt (Technik OG). Physischer Tausch = " "sw2-Geraetekabel auf branch ether1-8, Uplink auf sw1 #8, dann sw2 stromlos/ausgebaut."}) print("\n".join(log)) print(f"\n{'DRY-RUN - nichts geschrieben. Mit --apply ausfuehren.' if DRY else 'ANGEWENDET.'}")