Package: netbox-capirca-plugin
NetBox Capirca PluginThis plugin tries to implement a simple abstraction for Access Control Lists
(ACLs) in NetBox by leveraging the capirca ACL abstraction.ACLs are generated from multiple data sources.a directory that contain static network and service definitionsjinja2 templates for policiesper ACL network and service definitionsterms that are put into the policy templateACLs can either exist on their own or can be assigned to interfaces, either as
ingress or egress ACL.
ACLs can be rendered with the capirca generators. Currently only Cisco IOS and
IOS XR are supported. If you need more, just add an issue. Supporting an other
generator is relativly easy.ScreenshotsInstallationInstall the package in your NetBox environment. How to do this depends on
the way you have build your NetBox environment.The easiest way is probably the installation via pip:pip install netbox_capirca_pluginCreate a directory for your capirca network and service definitions and
policy templates.CompatibilityTo be compatible with NetBox 3 version 2 of this plugin is required.
Version 1 only supports NetBox 2.ConfigurationAdd the plugin to the NetBox config.
Thenetbox_extensions_pluginalso needs to be loaded.PLUGINS = [
	"netbox_capirca_plugin",
	"netbox_extensions_plugin",
]This plugin has there configuration parameters:policy_base_path- The directory in which the policies aredefinitions_path- The directory where the definitions aredefault_policy_template- The default template for policies (relative topolicy_base_path)In the configuration this looks e.g. like thisPLUGINS_CONFIG = {
    'netbox_capirca_plugin': {
        'default_policy_template': 'main.pol.j2',
        'policy_base_path': '/opt/capirca/policies/',
        'definitions_path': '/opt/capirca/defs',
    }
}Policy-TemplatesThe policy templates are Jinja2 Templates that are rendered into capirca policy
files.
The ACL object can be accessed asaclin the template.
The important keys of the ACL object arename,descriptionandterms.
There is also thetargetandoptionsvariables.
They specify for which capirca target and with options this ACL has to be
rendered. To render a ACL for IPv4 you usually have to supply the optioninet4(except forstandard/extendedfor cisco) orinet6for IPv6.
A simple template looks like this:header {
	comment:: "{{ acl.description }}"
	target:: {{ target }} {{ acl.name }} {{ options }}
}
{{ acl.terms }}Handling unique ACL names for IPv4 and IPv6 on Cisco IOSCisco ACL names have to be unique. This means that if there is an extended ACL
calledfoothere can't be a IPv6 ACL calledfoo.
A trick to get around this limitation is to give the resulting ipv6 ACL a
slightly different name, e.g.ipv6-foo. This can be done in the template like
this:header {
        comment:: "{{ acl.description }}"
        {% if target %}
        target:: {{ target }} {% if "inet6" in options and target in ["cisco", "ciscoxr", "ciscoasa"]%}ipv6-{% endif %}{{ acl.name }} {{ options }}
        {% endif %}
}
{{ acl.terms }}APIACLs and ACLInterfaceAssignments can also be managed via the API. The API docs
can be found where the regular NetBox API docs of your installation are.Data FlowThe data flow for ACL rendering can be seen in this diagram: