- name: Cập nhật description uplink
  hosts: iosxr
  gather_facts: false
  tasks:
    - name: Đặt description và MTU
      cisco.iosxr.iosxr_config:
        parents: interface GigabitEthernet0/0/0/1
        lines:
          - description to-pe2-hcm
          - mtu 9192
        comment: "CHG-1234 uplink description"
        backup: true
        backup_options:
          dir_path: backup/
          filename: "{{ inventory_hostname }}.cfg"
      register: result
 
    - name: In lệnh đã (hoặc sẽ) gửi
      ansible.builtin.debug:
        var: result.commands

router bgp {{ bgp_asn }}
 neighbor {{ peer_ip }}
  remote-as {{ peer_asn }}
  description {{ peer_desc }}
  address-family ipv4 unicast
   route-policy {{ rpl_in }} in
   route-policy {{ rpl_out }} out

- name: Thêm BGP neighbor từ template
  cisco.iosxr.iosxr_config:
    src: templates/bgp_neighbor.j2
    comment: "CHG-1235 new peer {{ peer_ip }}"

- name: Interface theo kiểu khai báo
  hosts: iosxr
  gather_facts: false
  tasks:
    - name: Description + MTU + bật interface
      cisco.iosxr.iosxr_interfaces:
        config:
          - name: GigabitEthernet0/0/0/1
            description: to-pe2-hcm
            mtu: 9192
            enabled: true
        state: merged
 
    - name: Gán IPv4
      cisco.iosxr.iosxr_l3_interfaces:
        config:
          - name: GigabitEthernet0/0/0/1
            ipv4:
              - address: 192.0.2.0/31
        state: merged

# 1. Chạy thử trên 1 host, xem lệnh sẽ gửi
ansible-playbook -i inventory/hosts.yml push_description.yml --check -l pe1-hni -v
 
# 2. Chạy thật, giới hạn số router cùng lúc
ansible-playbook -i inventory/hosts.yml push_description.yml -f 5
 
# 3. Kiểm tra trên router
#   show configuration commit list detail
#   show configuration commit changes last 1

set system services netconf ssh
set system login user automation class super-user authentication ssh-ed25519 "ssh-ed25519 AAAA... automation"

python3 -m pip install junos-eznc
export NET_USER=automation NET_PASS='***'

import os
from jnpr.junos import Device
 
creds = {"user": os.environ["NET_USER"], "passwd": os.environ["NET_PASS"]}
 
with Device(host="198.51.100.21", port=830, **creds) as dev:
    dev.timeout = 60  # timeout RPC (giây), mặc định 30
    f = dev.facts
    print(f["hostname"], f["model"], f["version"], f["serialnumber"])

user@pe1> show interfaces terse ge-0/0/1 | display xml rpc
<rpc>
    <get-interface-information>
        <terse/>
        <interface-name>ge-0/0/1</interface-name>
    </get-interface-information>
</rpc>

rsp = dev.rpc.get_interface_information(terse=True, interface_name="ge-0/0/1")
for ifl in rsp.findall(".//logical-interface"):
    print(ifl.findtext("name").strip(), ifl.findtext("oper-status").strip())
 
# Lấy config dạng JSON (đã lọc)
cfg = dev.rpc.get_config(
    filter_xml="<configuration><protocols><bgp/></protocols></configuration>",
    options={"format": "json"},
)

import os
from jnpr.junos import Device
from jnpr.junos.utils.config import Config
from jnpr.junos.exception import ConfigLoadError, CommitError, LockError
 
creds = {"user": os.environ["NET_USER"], "passwd": os.environ["NET_PASS"]}
 
with Device(host="198.51.100.21", **creds) as dev:
    try:
        with Config(dev, mode="exclusive") as cu:
            cu.load(path="bgp.set", format="set")   # hoặc format="text" + merge=True
            diff = cu.diff()
            if not diff:
                print("Không có thay đổi")
            else:
                print(diff)
                cu.commit_check()
                cu.commit(comment="CHG-1236 add peer", confirm=5)
                # ... kiểm tra BGP lên bằng dev.rpc.get_bgp_summary_information() ...
                cu.commit(comment="CHG-1236 confirm")
    except LockError:
        print("Config đang bị khoá bởi session khác")
    except (ConfigLoadError, CommitError) as e:
        print("Lỗi:", e)

set protocols bgp group EBGP-PEER neighbor 203.0.113.1 peer-as 64501
set protocols bgp group EBGP-PEER neighbor 203.0.113.1 description to-transit-a
set protocols bgp group EBGP-PEER import TRANSIT-IN
set protocols bgp group EBGP-PEER export TRANSIT-OUT

with Config(dev, mode="exclusive") as cu:
    cu.rollback(rb_id=1)          # nạp lại config trước commit gần nhất
    print(cu.diff())
    cu.commit(comment="rollback 1")

/interfaces/interface[name=GigabitEthernet0/0/0/1]/state/counters/in-octets
/network-instances/network-instance[name=default]/protocols/protocol[identifier=BGP][name=default]/bgp/neighbors/neighbor[neighbor-address=192.0.2.2]/state

Cisco-IOS-XR-infra-statsd-oper:infra-statistics/interfaces/interface/latest/generic-counters
Cisco-IOS-XR-wdsysmon-fd-oper:system-monitoring/cpu-utilization

export GNMIC_USERNAME=automation GNMIC_PASSWORD='***'
export R=198.51.100.11:57400
alias g='gnmic -a $R --skip-verify'      # lab: thêm --insecure nếu gRPC không có TLS

username: automation
# password: để trong biến môi trường GNMIC_PASSWORD, không ghi vào file
skip-verify: true
encoding: json_ietf
targets:
  198.51.100.11:57400: {}
  198.51.100.21:32767:
    encoding: proto
subscriptions:
  if-counters:
    paths:
      - /interfaces/interface/state/counters
    stream-mode: sample
    sample-interval: 10s

netconf-yang agent
 ssh
!
ssh server netconf vrf default

set system services netconf ssh

ssh -p 830 automation@198.51.100.11 -s netconf

python3 -m pip install ncclient
export NET_USER=automation NET_PASS='***'

import os
from ncclient import manager
 
def connect(host: str, platform: str):
    conn = {
        "host": host,
        "port": 830,
        "username": os.environ["NET_USER"],
        "password": os.environ["NET_PASS"],
        "hostkey_verify": False,           # lab; production nên dùng known_hosts
        "device_params": {"name": platform},  # "iosxr" hoặc "junos"
        "timeout": 60,
    }
    return manager.connect(**conn)
 
if __name__ == "__main__":
    with connect("198.51.100.11", "iosxr") as m:
        for cap in m.server_capabilities:
            if "openconfig-interfaces" in cap or ":candidate" in cap or ":xpath" in cap:
                print(cap)

OC_IF = """
<interfaces xmlns="http://openconfig.net/yang/interfaces">
  <interface>
    <name>GigabitEthernet0/0/0/1</name>
  </interface>
</interfaces>
"""
 
with connect("198.51.100.11", "iosxr") as m:
    # subtree filter: chỉ lấy interface có name khớp
    r = m.get_config(source="running", filter=("subtree", OC_IF))
    print(r.data_xml)
 
    # xpath filter: chỉ khi thiết bị có capability :xpath
    r = m.get(filter=("xpath", "/interfaces/interface[name='GigabitEthernet0/0/0/1']/state"))

JUNOS_BGP = "<configuration><protocols><bgp/></protocols></configuration>"
 
with connect("198.51.100.21", "junos") as m:
    r = m.get_config(source="running", filter=("subtree", JUNOS_BGP))
    print(r.data_xml)

from nc_common import connect
 
CFG = """
<config xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <interfaces xmlns="http://openconfig.net/yang/interfaces">
    <interface>
      <name>GigabitEthernet0/0/0/1</name>
      <config>
        <name>GigabitEthernet0/0/0/1</name>
        <description>to-pe2-hcm</description>
      </config>
    </interface>
  </interfaces>
</config>
"""
 
with connect("198.51.100.11", "iosxr") as m:
    with m.locked("candidate"):
        m.edit_config(target="candidate", config=CFG, default_operation="merge")
        m.validate(source="candidate")
        m.commit(confirmed=True, timeout="300")   # tự rollback sau 300s nếu không xác nhận
        # ... kiểm tra bằng m.get(...) ...
        m.commit()                                # xác nhận

<config xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <configuration>
    <interfaces>
      <interface>
        <name>ge-0/0/1</name>
        <description>to-pe1-hni</description>
      </interface>
    </interfaces>
  </configuration>
</config>

import os
from netmiko import ConnectHandler
 
dev = {
    "device_type": "cisco_xr",          # Junos: "juniper_junos"
    "host": "198.51.100.11",
    "username": os.environ["NET_USER"],
    "password": os.environ["NET_PASS"],
}
 
with ConnectHandler(**dev) as conn:
    print(conn.send_command("show ipv4 interface brief"))
 
    conn.send_config_set(
        ["interface GigabitEthernet0/0/0/1", "description to-pe2-hcm"],
        exit_config_mode=False,
    )
    conn.commit(comment="CHG-1234")     # Junos: conn.commit(confirm=True, confirm_delay=5) rồi conn.commit()
    conn.exit_config_mode()

import os
from scrapli import Scrapli
 
dev = {
    "host": "198.51.100.11",
    "auth_username": os.environ["NET_USER"],
    "auth_password": os.environ["NET_PASS"],
    "auth_strict_key": False,           # lab; production nên kiểm tra host key
    "platform": "cisco_iosxr",          # Junos: "juniper_junos"
}
 
with Scrapli(**dev) as conn:
    r = conn.send_command("show ipv4 interface brief")
    print(r.result, r.elapsed_time)
 
    r = conn.send_configs([
        "interface GigabitEthernet0/0/0/1",
        "description to-pe2-hcm",
        "commit comment CHG-1234",
    ])
    if r.failed:
        print("Có lệnh lỗi:", [x.channel_input for x in r if x.failed])

ansible_network_os: cisco.iosxr.iosxr
ansible_connection: ansible.netcommon.network_cli
ansible_user: "{{ lookup('env', 'NET_USER') }}"
ansible_password: "{{ lookup('env', 'NET_PASS') }}"
ansible_command_timeout: 120
ansible_connect_timeout: 60
# ansible_network_cli_ssh_type: paramiko   # bật nếu libssh có vấn đề

ansible_network_os: junipernetworks.junos.junos
ansible_connection: ansible.netcommon.netconf
ansible_port: 830
ansible_user: "{{ lookup('env', 'NET_USER') }}"
ansible_password: "{{ lookup('env', 'NET_PASS') }}"
ansible_command_timeout: 120

# Collection và thư viện Python đang dùng
ansible-galaxy collection list | grep -Ei 'iosxr|junos|netcommon'
python3 -m pip list 2>/dev/null | grep -Ei 'ansible|paramiko|pylibssh|ncclient'
 
# Thử 1 host bằng ad-hoc
ansible -i inventory/hosts.yml pe1-hni -m cisco.iosxr.iosxr_command -a "commands='show version'"
ansible -i inventory/hosts.yml mx1-dng -m junipernetworks.junos.junos_command -a "commands='show version'"
 
# Bật log chi tiết của persistent connection
export ANSIBLE_LOG_PATH=~/ansible-debug.log
export ANSIBLE_DEBUG=True
ansible-playbook -i inventory/hosts.yml site.yml -l pe1-hni -vvvv
grep -Ei 'error|timeout|auth' ~/ansible-debug.log | tail -30
 
# Xem các giá trị cấu hình đã đổi khỏi mặc định
ansible-config dump --only-changed
 
# Dọn socket persistent cũ
rm -f ~/.ansible/pc/*

set system services netconf ssh

python3 -m pip install ncclient jxmlease
ansible-galaxy collection install junipernetworks.junos ansible.netcommon

ansible_network_os: junipernetworks.junos.junos
ansible_connection: ansible.netcommon.netconf
ansible_port: 830
ansible_user: "{{ lookup('env', 'NET_USER') }}"
ansible_password: "{{ lookup('env', 'NET_PASS') }}"

- name: Đổi description và MTU
  hosts: junos
  gather_facts: false
  tasks:
    - name: Load lệnh set, commit confirmed 5 phút
      junipernetworks.junos.junos_config:
        lines:
          - set interfaces ge-0/0/1 description to-pe2-hcm
          - set interfaces ge-0/0/1 mtu 9192
        comment: "CHG-1234 uplink description"
        confirm: 5
        backup: true
        backup_options:
          dir_path: backup/
          filename: "{{ inventory_hostname }}.conf"
      register: result
 
    - name: Kiểm tra interface sau commit
      junipernetworks.junos.junos_command:
        commands: show interfaces ge-0/0/1 terse
      register: verify
 
    - name: Xác nhận commit (hủy hẹn giờ rollback)
      junipernetworks.junos.junos_config:
        confirm_commit: true
      when: verify.stdout[0] is search('ge-0/0/1\s+up\s+up')

set protocols bgp group {{ bgp_group }} type external
set protocols bgp group {{ bgp_group }} neighbor {{ peer_ip }} peer-as {{ peer_asn }}
set protocols bgp group {{ bgp_group }} neighbor {{ peer_ip }} description "{{ peer_desc }}"
set protocols bgp group {{ bgp_group }} neighbor {{ peer_ip }} import {{ policy_in }}
set protocols bgp group {{ bgp_group }} neighbor {{ peer_ip }} export {{ policy_out }}

- name: Thêm BGP peer từ template set
  junipernetworks.junos.junos_config:
    src: templates/bgp_peer.set.j2
    src_format: set
    comment: "CHG-1235 peer {{ peer_ip }}"
    confirm: 5

- name: Interface theo kiểu khai báo
  hosts: junos
  gather_facts: false
  tasks:
    - name: Description + MTU
      junipernetworks.junos.junos_interfaces:
        config:
          - name: ge-0/0/1
            description: to-pe2-hcm
            mtu: 9192
            enabled: true
        state: merged
 
    - name: IPv4 trên unit 0
      junipernetworks.junos.junos_l3_interfaces:
        config:
          - name: ge-0/0/1
            unit: 0
            ipv4:
              - address: 192.0.2.1/31
        state: merged

# 1. Check mode + diff trên 1 host: load, commit check, rồi bỏ thay đổi
ansible-playbook -i inventory push_set.yml --check --diff -l mx1-hni
 
# 2. Chạy thật, ít host một lúc
ansible-playbook -i inventory push_set.yml --diff -f 5
 
# 3. Kiểm tra trên thiết bị
#   show system commit
#   show configuration | compare rollback 1

python3 -m pip install nornir nornir-utils nornir-netmiko nornir-napalm

inventory:
  plugin: SimpleInventory
  options:
    host_file: inventory/hosts.yaml
    group_file: inventory/groups.yaml
    defaults_file: inventory/defaults.yaml
runner:
  plugin: threaded
  options:
    num_workers: 20
logging:
  log_file: nornir.log

pe1-hni:
  hostname: 198.51.100.11
  groups: [iosxr]
  data: { site: hni, role: pe }
mx1-hcm:
  hostname: 198.51.100.21
  groups: [junos]
  data: { site: hcm, role: pe }

iosxr:
  platform: iosxr            # napalm driver name
  connection_options:
    netmiko:
      platform: cisco_xr     # netmiko device_type
junos:
  platform: junos
  connection_options:
    netmiko:
      platform: juniper_junos
    napalm:
      extras:
        optional_args: { port: 830 }

import os
from nornir import InitNornir
from nornir.core.filter import F
from nornir_netmiko.tasks import netmiko_send_command
from nornir_utils.plugins.functions import print_result
 
nr = InitNornir(config_file="config.yaml")
nr.inventory.defaults.username = os.environ["NET_USER"]
nr.inventory.defaults.password = os.environ["NET_PASS"]
 
pe_hni = nr.filter(F(role="pe") & F(site="hni"))
res = pe_hni.run(task=netmiko_send_command, command_string="show version")
print_result(res)

from nornir.core.task import Task, Result
from nornir_netmiko.tasks import netmiko_send_command
from nornir_napalm.plugins.tasks import napalm_get, napalm_configure
 
def check_bgp(task: Task) -> Result:
    # Sub-task: kết quả con nằm trong MultiResult của host
    r = task.run(task=napalm_get, getters=["bgp_neighbors"])
    peers = r.result["bgp_neighbors"]["global"]["peers"]
    down = [ip for ip, p in peers.items() if not p["is_up"]]
    return Result(host=task.host, result=down, failed=bool(down))
 
def push_desc(task: Task, dry_run: bool = True) -> Result:
    cfg = task.host["desc_cfg"]            # lấy từ data của host
    r = task.run(task=napalm_configure, configuration=cfg, dry_run=dry_run)
    return Result(host=task.host, result=r.result, changed=r.changed, diff=r.diff)

res = nr.run(task=check_bgp, name="BGP down?")
res = nr.filter(site="hni").run(task=push_desc, dry_run=True)   # chỉ xem diff

for host, multi in res.items():
    status = "FAIL" if multi.failed else "OK"
    print(f"{host:12} {status:4} {multi[0].result}")

from nornir_netmiko.tasks import netmiko_send_config, netmiko_commit
 
def xr_desc(task: Task) -> Result:
    task.run(task=netmiko_send_config,
             config_commands=["interface GigabitEthernet0/0/0/1",
                              "description to-pe2-hcm"],
             exit_config_mode=False)
    task.run(task=netmiko_commit, comment="CHG-1234")
    return Result(host=task.host, result="committed", changed=True)
 
nr.filter(F(groups__contains="iosxr")).run(task=xr_desc)

import os
from napalm import get_network_driver
 
driver = get_network_driver("junos")          # iosxr | iosxr_netconf | junos | eos | nxos | ios
with driver("198.51.100.21", os.environ["NET_USER"], os.environ["NET_PASS"],
            optional_args={"port": 830}) as dev:
    print(dev.get_facts()["os_version"])

dev.load_merge_candidate(filename="snippets/desc.set")   # Junos tự nhận dạng set/text/xml
diff = dev.compare_config()
if not diff:
    dev.discard_config()
elif input(diff + "\nCommit? [y/N] ") == "y":
    dev.commit_config(message="CHG-1234", revert_in=300)  # Junos
    # ... kiểm tra ...
    dev.confirm_commit()
else:
    dev.discard_config()

- get_facts:
    os_version: 23.4R2-S3.9
- get_bgp_neighbors:
    global:
      peers:
        203.0.113.1:
          is_up: true

python3 -m pip install pyang
sudo apt install libyang2-tools   # Ubuntu 22.04 (gói có thể tên khác trên bản khác: libyang-tools, yanglint)
 
# Chỉ lấy phần cần trong repo YangModels/yang (repo rất lớn)
git clone --depth 1 --filter=blob:none --sparse https://github.com/YangModels/yang.git
cd yang
git sparse-checkout set vendor/cisco/xr standard/ietf/RFC
ls vendor/cisco/xr/                # thư mục theo release, ví dụ 7111 = 7.11.1
 
# OpenConfig
git clone --depth 1 https://github.com/openconfig/public.git openconfig

XR=yang/vendor/cisco/xr/7111
 
# Cây đầy đủ của một module (-p tìm import/include, mặc định đệ quy vào thư mục con)
pyang -p $XR -f tree $XR/Cisco-IOS-XR-um-interface-cfg.yang | less
 
# Giới hạn độ sâu
pyang -p $XR -f tree --tree-depth 3 $XR/Cisco-IOS-XR-ipv4-bgp-oper.yang
 
# Chỉ in một nhánh (path không cần prefix)
pyang -p openconfig/release/models -f tree \
  --tree-path /interfaces/interface/state/counters \
  openconfig/release/models/interfaces/openconfig-interfaces.yang
 
# Model có augment: đưa cả module augment vào để thấy nhánh được thêm
pyang -p ietf -f tree ietf/ietf-interfaces.yang ietf/ietf-ip.yang

# Liệt kê mọi path dạng XPath có prefix module, lọc bằng grep
pyang -p $XR -f flatten $XR/Cisco-IOS-XR-ipv4-bgp-oper.yang | grep neighbor | head
 
# Kèm kiểu dữ liệu và cờ config/state
pyang -p ietf -f flatten --flatten-type --flatten-flag ietf/ietf-interfaces.yang

M=/usr/local/share/yang/modules     # nơi chứa ietf/ iana/ ; đổi theo máy bạn
 
# Cây một nhánh (path có prefix module)
yanglint -p $M/ietf -f tree -P /ietf-interfaces:interfaces/interface $M/ietf/ietf-interfaces.yang
 
# Validate file JSON config theo các module liên quan
yanglint -p $M/ietf -p $M/iana -t config \
  $M/ietf/ietf-interfaces.yang $M/ietf/ietf-ip.yang $M/iana/iana-if-type.yang if.json
echo $?    # 0 = hợp lệ

{
  "ietf-interfaces:interfaces": {
    "interface": [
      {
        "name": "ge-0/0/0",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": true,
        "ietf-ip:ipv4": { "address": [ { "ip": "192.0.2.1", "prefix-length": 31 } ] }
      }
    ]
  }
}

export NETBOX_URL=https://netbox.example.com
export NETBOX_TOKEN='***'

H=(-H "Authorization: Token $NETBOX_TOKEN" -H "Accept: application/json")
 
# Device theo tên
curl -s "${H[@]}" "$NETBOX_URL/api/dcim/devices/?name=pe1-hni" | jq '.results[0] | {id, name, primary_ip4}'
 
# Interface của device, chỉ lấy tên + description
curl -s "${H[@]}" "$NETBOX_URL/api/dcim/interfaces/?device=pe1-hni&limit=1000" \
  | jq -r '.results[] | [.name, .description] | @tsv'
 
# Đổi description (PATCH theo id)
curl -s -X PATCH "${H[@]}" -H "Content-Type: application/json" \
  "$NETBOX_URL/api/dcim/interfaces/123/" -d '{"description": "to-pe2-hcm"}'

import os
import pynetbox
 
nb = pynetbox.api(os.environ["NETBOX_URL"], token=os.environ["NETBOX_TOKEN"])
# nb.http_session.verify = "/etc/ssl/certs/internal-ca.pem"   # CA nội bộ
 
dev = nb.dcim.devices.get(name="pe1-hni")          # 1 object hoặc None; nhiều kết quả → lỗi
print(dev.id, dev.platform, dev.primary_ip4)
 
for d in nb.dcim.devices.filter(site="hni", status="active"):
    print(d.name, d.primary_ip4.address if d.primary_ip4 else "-")
 
for i in nb.dcim.interfaces.filter(device="pe1-hni"):
    print(i.name, i.description, i.enabled)
 
for ip in nb.ipam.ip_addresses.filter(device="pe1-hni"):
    print(ip.address, ip.assigned_object)
 
print(nb.dcim.devices.count(site="hni"))

intf = nb.dcim.interfaces.get(device="pe1-hni", name="GigabitEthernet0/0/0/1")
intf.description = "to-pe2-hcm"
intf.save()                                    # PATCH các field đã đổi, trả True/False
 
dev = nb.dcim.devices.get(name="pe1-hni")
dev.update({"comments": "CHG-1234"})           # cập nhật nhiều field một lần
 
ip = nb.ipam.ip_addresses.create(
    address="192.0.2.0/31",
    status="active",
    assigned_object_type="dcim.interface",
    assigned_object_id=intf.id,
    description="p2p pe1-pe2",
)
 
# Cấp IP trống tiếp theo trong prefix
pfx = nb.ipam.prefixes.get(prefix="198.51.100.0/24")
new_ip = pfx.available_ips.create({"description": "loopback mới"})

ansible-galaxy collection install netbox.netbox
python3 -m pip install pynetbox pytz      # module của collection cần pynetbox
 
export NETBOX_API=https://netbox.example.com
export NETBOX_TOKEN='***'

plugin: netbox.netbox.nb_inventory
# api_endpoint và token đọc từ NETBOX_API / NETBOX_TOKEN nếu không khai báo
validate_certs: true
config_context: false
interfaces: false          # true = kéo cả interface, chậm hơn nhiều
plurals: false             # biến host dạng đơn: site, platform... (thay vì list)
 
query_filters:
  - status: active
device_query_filters:
  - has_primary_ip: "true"
  - role: pe
  - role: p                # cùng key = OR; khác key = AND
  - tag: automation
 
group_by:
  - site
  - platform
 
keyed_groups:
  - key: platform
    prefix: os
    separator: "_"         # → group os_iosxr, os_junos
 
compose:
  ansible_network_os: >-
    {'iosxr': 'cisco.iosxr.iosxr', 'junos': 'junipernetworks.junos.junos'}[platform]
  ansible_connection: >-
    'ansible.netcommon.netconf' if platform == 'junos' else 'ansible.netcommon.network_cli'

ansible_user: "{{ lookup('env', 'NET_USER') }}"
ansible_password: "{{ lookup('env', 'NET_PASS') }}"
ansible_command_timeout: 120

# Cây group
ansible-inventory -i inventory/netbox.yml --graph
 
# Toàn bộ biến của 1 host (xem tên biến thật: site, platform, role...)
ansible-inventory -i inventory/netbox.yml --host pe1-hni
 
# Xuất ra YAML để so sánh / debug
ansible-inventory -i inventory/netbox.yml --list --yaml > /tmp/inv.yml
 
# Chạy playbook trên 1 group sinh từ NetBox
ansible-playbook -i inventory/netbox.yml collect.yml -l os_iosxr

{% macro iface(name, desc, ip=none, mtu=9192) %}
interface {{ name }}
 description {{ desc }}
 mtu {{ mtu }}
{% if ip %}
 ipv4 address {{ ip }}
{% else %}
 shutdown
{% endif %}
!
{% endmacro %}
{% for i in interfaces | sort(attribute='name') %}
{{ iface(i.name, i.desc | default('unused'), i.ip | default(none)) -}}
{% endfor %}

{% for p in bgp_peers if p.enabled %}
set protocols bgp group {{ p.group }} neighbor {{ p.ip }} peer-as {{ p.asn }}
set protocols bgp group {{ p.group }} neighbor {{ p.ip }} description "{{ p.desc | default('peer-' ~ p.asn) }}"
{% endfor %}

import sys, yaml
from jinja2 import Environment, FileSystemLoader, StrictUndefined
 
env = Environment(loader=FileSystemLoader("templates"), trim_blocks=True,
                  lstrip_blocks=True, undefined=StrictUndefined)  # thiếu biến là lỗi, không in rỗng
data = yaml.safe_load(open(sys.argv[2]))
print(env.get_template(sys.argv[1]).render(**data))
# python3 render.py xr_interfaces.j2 host_vars/pe1-hni.yml

from ntc_templates.parse import parse_output
 
rows = parse_output(platform="cisco_xr", command="show ip interface brief", data=raw)
# [{'interface': 'Loopback0', 'ip_address': '192.0.2.255', 'status': 'Up', 'proto': 'Up', 'vrf': 'default'}, ...]
down = [r["interface"] for r in rows if r["status"] == "Up" and r["proto"] != "Up"]

from ttp import ttp
 
template = """
<group name="interfaces">
interface {{ name }}
 description {{ description | re(".+") }}
 ipv4 address {{ ip }} {{ mask }}
</group>
"""
parser = ttp(data=running_config, template=template)
parser.parse()
print(parser.result(format="json")[0])
# [{"interfaces": [{"name": "GigabitEthernet0/0/0/0", "description": "to-pe2", "ip": "198.51.100.1", "mask": "255.255.255.254"}, ...]}]

from genie.conf.base import Device
 
dev = Device("pe1-hni", os="iosxr")
dev.custom.setdefault("abstraction", {})["order"] = ["os"]
parsed = dev.parse("show bgp summary", output=raw)   # parse offline, không cần kết nối

# Trên thiết bị
show bgp summary | display json
show interfaces terse | display xml rpc     # tên RPC để gọi qua NETCONF/PyEZ

interval: 3600                  # giây giữa hai lần backup một node
use_syslog: false
threads: 20
timeout: 30
retries: 2
rest: 127.0.0.1:8888            # REST + web UI (cần oxidized-web), chỉ bind localhost
username: backup
password: "***"              # file này chứa mật khẩu: chmod 600, không commit
model: junos
vars:
  remove_secret: true           # thay secret trong config bằng <secret hidden>
input:
  default: ssh
output:
  default: git
  git:
    user: oxidized
    email: oxidized@example.com
    repo: "/home/oxidized/.config/oxidized/configs.git"
source:
  default: csv
  csv:
    file: "/home/oxidized/.config/oxidized/router.db"
    delimiter: !ruby/regexp /:/
    map:
      name: 0
      ip: 1
      model: 2

pe1-hni:198.51.100.11:iosxr
pe2-hcm:198.51.100.12:iosxr
mx1-hcm:198.51.100.21:junos

docker run -d --name oxidized --restart unless-stopped \
  -v "$PWD/oxidized:/home/oxidized/.config/oxidized" \
  -p 127.0.0.1:8888:8888 oxidized/oxidized:latest
 
# Bắt backup ngay một node qua REST
curl -s http://127.0.0.1:8888/node/next/pe1-hni
# Xem lịch sử trong repo (bare repo, đọc bằng git --git-dir)
git --git-dir oxidized/configs.git log --oneline -5
git --git-dir oxidized/configs.git show HEAD

- name: Backup running config
  hosts: iosxr:junos
  gather_facts: false
  vars:
    ansible_connection: ansible.netcommon.network_cli
    backup_cmd:
      cisco.iosxr.iosxr: show running-config
      junipernetworks.junos.junos: show configuration | display set
    volatile_re: '^(Building configuration|!! Last configuration change|## Last commit|\w{3} \w{3} +\d+ [\d:.]+ \w+$).*\n'
  tasks:
    - name: Lấy config
      ansible.netcommon.cli_command:
        command: "{{ backup_cmd[ansible_network_os] }}"
      register: cfg
 
    - name: Ghi file, bỏ dòng timestamp
      ansible.builtin.copy:
        content: "{{ cfg.stdout | regex_replace(volatile_re, '', multiline=True) }}\n"
        dest: "configs/{{ inventory_hostname }}.cfg"
      delegate_to: localhost
 
- name: Commit vào Git
  hosts: localhost
  gather_facts: false
  tasks:
    - name: git add + commit nếu có thay đổi
      ansible.builtin.shell: |
        cd configs
        git add -A
        if git diff --cached --quiet; then echo nochange
        else git commit -q -m "backup $(date -u +%Y-%m-%dT%H:%MZ)"; fi
      register: git_out
      changed_when: "'nochange' not in git_out.stdout"

# Lần đầu
mkdir -p configs && git -C configs init
# Chạy định kỳ (cron hoặc systemd timer)
ansible-playbook -i inventory backup.yml -f 20

docker run -d --name batfish -p 9996:9996 batfish/allinone
python3 -m pip install pybatfish

snapshots/candidate/
└── configs/
    ├── pe1-hni.cfg      # config render từ template (bản sẽ đẩy)
    └── mx1-hcm.cfg

import sys
from pybatfish.client.session import Session
 
bf = Session(host="localhost")
bf.set_network("backbone")
bf.init_snapshot("snapshots/candidate", name="candidate", overwrite=True)
 
checks = {
    "parse":     bf.q.fileParseStatus().answer().frame().query("Status != 'PASSED'"),
    "undefined": bf.q.undefinedReferences().answer().frame(),
    "bgp":       bf.q.bgpSessionStatus().answer().frame().query("Established_Status != 'ESTABLISHED'"),
}
failed = False
for name, df in checks.items():
    if not df.empty:
        failed = True
        print(f"--- {name} ---\n{df.to_string()}")
sys.exit(1 if failed else 0)

stages: [lint, validate, dryrun, deploy]
 
lint:
  stage: lint
  script:
    - yamllint -s .
    - ansible-lint playbooks/
 
validate:
  stage: validate
  services:
    - name: batfish/allinone
      alias: batfish
  script:
    - ansible-playbook playbooks/render.yml          # ghi config vào snapshots/candidate/configs
    - python3 ci/batfish_check.py
 
dryrun:
  stage: dryrun
  script:
    - ansible-playbook -i inventory playbooks/deploy.yml --check --diff | tee diff.txt
  artifacts:
    paths: [diff.txt]
 
deploy:
  stage: deploy
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual                                   # người bấm, không tự động hoàn toàn
  script:
    - ansible-playbook -i inventory playbooks/deploy.yml --diff -f 5