__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
---
- hosts: ise_servers
gather_facts: false
vars:
itemTest:
name: "Cisco_Ansible_Test_09_12"
accessType: "ACCESS_ACCEPT"
description: "Test"
authzProfileType: "SWITCH"
vlan:
nameID: "172_28_1_0-VN_IOT"
tagID: 1
trackMovement: false
agentlessPosture: false
serviceTemplate: false
profileName: "Cisco"
tasks:
## https://github.com/CiscoISE/ansible-ise/issues/72
## post 400
# - name: Get all Network Access Authorization Rules
# cisco.ise.network_access_authorization_rules:
# state: present
# policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
# rule:
# default: false
# #id: d9e67664-799d-4ad9-a407-8365117c18e5
# name: Ansible B TEST
# hitCounts: 0
# rank: 0
# state: enabled
# condition:
# conditionType: ConditionAndBlock
# isNegate: false
# children:
# - conditionType: ConditionReference
# isNegate: false
# name: Wireless_Access
# id: ff6008e0-5c35-48a3-9fab-e0e709983369
# # description: >-
# # Default condition used to match any authentication request from Cisco
# # Wireless LAN Controller.
# - conditionType: ConditionAttributes
# isNegate: false
# dictionaryName: IdentityGroup
# attributeName: Name
# operator: equals
# #dictionaryValue: null
# attributeValue: 'Endpoint Identity Groups:Blocked List'
# profile:
# - Blackhole_Wireless_Access
# #securityGroup: null
# register: result
# - name: Get all Network Access Authorization Rules
# cisco.ise.network_access_authorization_rules_info:
# policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
# register: result
## https://github.com/CiscoISE/ansible-ise/issues/74
# - name: Create or update Authorization profile
# cisco.ise.authorization_profile:
# name: "{{ itemTest.name }}"
# accessType: "{{ itemTest.accessType }}"
# description: "{{ itemTest.description }}"
# authzProfileType: "{{ itemTest.authzProfileType }}"
# vlan:
# nameID: "{{ itemTest.vlan.nameID }}"
# tagID:
# "{{itemTest.vlan.tagID|int}}"
# trackMovement: "{{ itemTest.trackMovement }}"
# agentlessPosture: "{{ itemTest.agentlessPosture }}"
# serviceTemplate: "{{ itemTest.serviceTemplate }}"
# profileName: "{{ itemTest.profileName }}"
# register: result
# - name: Get all Authorization Profile
# cisco.ise.authorization_profile_info:
# name: Cisco_Temporal_Onboard
# register: result
# - name: debug
# debug:
# msg: "{{ itemTest.vlan.tagID | int == 0 }}"
# - name: debug
# debug:
# msg: |
# {{ item.vlanID | int }}
# loop:
# - { "vlanID": "1" }
# - { "vlanID": "2" }
# - { "vlanID": 2 }
# - name: debug
# debug:
# var: |-
# {{ item.vlanID | int }}
# loop:
# - { "vlanID": 1 }
# - { "vlanID": "2" }
## https://github.com/CiscoISE/ansible-ise/issues/76
## Node group creation is not idempotent
## fatal: [localhost]: FAILED! => {"changed": false, "msg": "An error occured when executing operation. The error was: [409] - The request could not be processed because it conflicts with some established rule of the system.\n{\n \"error\" : {\n \"message\" : \"NodeGroup 'TestGroup1' already exist.\"\n },\n \"version\" : \"1.0.0\"\n}"}
# - name: Create test node group.
# cisco.ise.node_group:
# state: present
# description: "Testing creation and idempotency"
# name: "TesAnsible76"
# nodeGroupName: "TesAnsible76"
# forceDelete: true
# register: result
# - name: Get all Node Group
# cisco.ise.node_group_info:
# nodeGroupName: "NodeGroup2"
# register: result
##https://github.com/CiscoISE/ansible-ise/issues/79
## Cannot update
# - name: Create or update an network_access_authentication_rules
# cisco.ise.network_access_authentication_rules:
# state: present
# rule:
# default: false
# name: TestAnsibleIssue79
# hitCounts: 00
# rank: 0
# state: enabled
# #id: b086e85e-6118-4b67-8efc-05d692423afb
# condition:
# conditionType: ConditionReference
# isNegate: false
# dictionaryName: Network Access
# attributeName: EapAuthentication
# operator: equals
# attributeValue: EAP-MSCHAPv2
# name: EAP-MSCHAPv2
# id: c456a490-0429-4fd4-91d7-efd1eb1f855a
# ifAuthFail: REJECT
# ifUserNotFound: REJECT
# ifProcessFail: DROP
# policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
# register: result
##https://github.com/CiscoISE/ansible-ise/issues/77
## Get error
## node_group_node_info
# - name: Get all Node Group Node
# cisco.ise.node_group_node_info:
# nodeGroupName: TesAnsible76
# register: result
##https://github.com/CiscoISE/ansible-ise/issues/81
## Unable to update Authorization Policies
##network_access_authorization_rules
- name: CRUD
cisco.ise.network_access_authorization_rules:
state: present
#state: absent
rule:
default: false
name: TestAnsibleIssue81
rank: 0
state: enabled
condition:
conditionType: ConditionAttributes
isNegate: false
dictionaryName: IdentityGroup
attributeName: Name
operator: equals
attributeValue: 'Endpoint Identity Groups:IAC_Lab1'
profile:
- Blackhole_Wireless_Access
#securityGroup: BYOD
policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
register: result
- name: Print Authorization profile
ansible.builtin.debug:
var: result