Cisco automation

To login and run multiple commands on cisco switch
1. Download plinkx86 app from internet
2. Browse windows cli to folder where plinkx86 is downloaded
3. Run below command
Plinkx86 -ssh -l USERNAME -pw PASSWORD DEVICE IP "COMMAND" >> output.txt

Create similar command for other cisco commmand and run it one by one to get all the outputs

Note: replace
USERNAME with username to login with eg admin
PASSWORD with user password
DEVICE IP with actual device ip or hostname
COMMAND with cisco command eg: "sh int status"
You can also connect with telnet protocol instead of ssh for older devices

Ansible Installation and basic commands

To install and setup Ansible on orable VM Box
sudo apt-get update
sudo apt-get install software-properties-common
sudo apt-add-repository ppa:ansible/ansible
sudo apt-get update
sudo apt-get install ansible

/etc/ansible/hosts --> ansible host inventory and format
[group name 1]
ip address/hostname
[group name 2]
ip address/hostname

Basic commands
ansible all -m ping
ansible [group name] -m command -a "ls"  --> ping all hosts in group
ansible -i inventory all -m command -a 'iptables -F" --become--ask-become-pass   --> flush iptables rules for all hosts in inventory
ansible all -m setup  -->capture info of all hosts
ansible-doc setup  -->extract facts from documents setup

create f5 ltm virtual pool node using tmsh with input from csv

$inputCSV = "C:\path\ltm_input.csv"
$outputFile = "C:\path\ltm_output.txt"
$i=1
Import-Csv $inputCSV | ForEach-Object {

$policy = $_.policy
if ($i -eq 1)
{
 Add-Content -PassThru $outputFile -Value "modify ltm policy $policy create-draft"
 }
 $i++
}
Import-Csv $inputCSV | ForEach-Object {
 $vipportno = $_.vipportno
 $poolportno1 = $_.poolportno1
 $poolportno2 = $_.poolportno2
 $poolportno3 = $_.poolportno3
 $appname = $_.appname
 $nodeip1 = $_.nodeip1
 $nodeip2 = $_.nodeip2
 $nodeip3 = $_.nodeip3
 $vipip = $_.vipip
 $poolmember1 = $_.nodeip1 + ":"+ $_.poolportno1
 $poolmember2 = $_.nodeip2 + ":"+ $_.poolportno2
 $poolmember3 = $_.nodeip3 + ":"+ $_.poolportno3
 $fullappname = $_.vipip + ":" + $_.vipportno
 $vsname = $_.appname + "-" + $_.vipportno
 $url = $_.url
 $monitor = $_.monitor
 $persistance = $_.persistance
 $policy = $_.policy

 Add-Content -Path $outputFile -Value "create ltm node $nodeip1 fqdn { autopopulate enabled interval ttl name $nodeip1.company.com }"
 Add-Content -Path $outputFile -Value "create ltm node $nodeip2 fqdn { autopopulate enabled interval ttl name $nodeip2.company.com }"
 Add-Content -Path $outputFile -Value "create ltm node $nodeip3 fqdn { autopopulate enabled interval ttl name $nodeip3.company.com }"
 Add-Content -Path $outputFile -Value "create ltm pool pl-$appname members add { $poolmember1 $poolmember2 $poolmember3 } monitor $monitor"
 Add-Content -Path $outputFile -Value "create ltm virtual vs-$vsname destination $fullappname profiles add { wilcard-company company-program-http serverssl-insecure-compatible } pool pl-$appname description $url source-address-translation { pool Internal_SNAT } translate-address enabled vlans-enabled vlans add { External } persist replace-all-with { $persistance } source-address-translation { type snat }"
 Add-Content -Path $outputFile -Value "modify ltm policy /Common/Drafts/$policy rules add { rl-$appname { actions add { 0 { forward select virtual /Common/vs-$vsname } } conditions add { 0 { http-host host values {$url} } } description $url } }"
  }
 Add-Content -PassThru $outputFile -Value "publish ltm policy /Common/Drafts/$policy"
 Add-Content -PassThru $outputFile -Value "save sys config"
create a csv file named ltm-input.csv with columns as per the variables called

vipportno appname nodeip1 nodeip2 nodeip3 vipip poolportno1 poolportno2 poolportno3 policy persistance monitor url

create f5 vip pool node from tmsh shell

port-no

app-name

nodeip

rl-app-name                 app-name.company.com

create ltm node nodeip fqdn { autopopulate enabled interval ttl name nodeip }

create ltm pool pl-app-name members add { nodeip:443 } monitor mn-https

create ltm virtual vs-app-name-port-no destination 10.10.10.10:port-no profiles add { wilcard-company company-http serverssl-insecure-compatible } pool pl-app-name description app-name.company.com source-address-translation { pool Internal_SNAT } translate-address enabled vlans-enabled vlans add { External } persist replace-all-with { company-nisp-cookie } source-address-translation { type snat }

TIP: user find/replace to customize the command replacing the bold keywords

Address object creation script for fortigate using powershell

1. Create a  csv file named Server.csv with below format with all the address objects to be created
do not change the column names as they are refereed in the script

Assetname

IPAddress

ad-(ip address)

(Ip address)

2. Create a notepad file and copy the below test and save it as script.ps1

$inputCSV = "c:\Servers.csv"
$outputFile = "c:\Addresses.txt"
Add-Content -PassThru $outputFile -Value "config firewall address"
Import-Csv $inputCSV | ForEach-Object {
 $Name = $_.Assetname
 $IP = $_.IPAddress
 Add-Content -Path $outputFile -Value "edit $Name"
 Add-Content -Path $outputFile -Value "set subnet $IP 255.255.255.255"
 Add-Content -Path $outputFile -Value "next"
}
Add-Content -PassThru $outputFile -Value "end"

3. Save the Servers.csv and script.ps1 files in C: on machine
4. open power shell and goto c drive and run .\script.ps1

F5 irules

simple permanent redirect
when HTTP_REQUEST {
    if { [HTTP::host] equals "www.xyz.com" } {
        HTTP::respond 301 Location "https://www.xyz.com"
    }
}
to select different ssl profile based on source IP
when CLIENT_ACCEPTED {
  if { [class match [IP::client_addr] equals clientIPList ]} {
    log local0. "MATCH! Profile client-ssl-profile selected for [IP::client_addr]"
    SSL::profile client-ssl-profile
  } else {
    #log local0. "Profile clientssl selected for [IP::client_addr]"
    SSL::profile wilcard-company
  }
}
irule to respond 200 ok without any pool
when HTTP_REQUEST {
if { ( [IP::addr [IP::client_addr] equals 10.0.0.0/8] ) or ( [IP::addr [IP::client_addr] equals 172.16.0.0/12] ) or ( [IP::addr [IP::client_addr] equals 192.168.0.0/16] )} {
HTTP::respond 200 content "Connection" "ok"
}
}
HTTP URI path based redirection for multiple URI
when HTTP_REQUEST {
    if { [HTTP::host] equals "www.company.com" } {
        switch -glob [HTTP::uri] {
            "/about-ie/newsroom/trials-medical-panel*" {
                HTTP::respond 301 Location "https://www.company.com/news-and-stories"
            }
            "/about-/newsroom/customer-improvements-move-next-stage*" {
                HTTP::respond 301 Location "https://www.company.com/news-and-stories"
            }
            "/about/profile/vivek-bhatia*" {
                HTTP::respond 301 Location "https://www.company.com/about-us/our-people/our-group-leadership-teama"
}
URI path redirection to different pool
when HTTP_REQUEST {
if {
[string tolower [HTTP::uri]]  contains "/scim1450" }
{
HTTP::uri [string map -nocase {"/SCIM1450/" "/"} [HTTP::uri]]
pool pl-SCIM1450}
elseif {
[string tolower [HTTP::uri]]  contains "/scim1451" }
{
HTTP::uri [string map -nocase {"/SCIM1451/" "/"} [HTTP::uri]]
pool pl-SCIM1451}
Display maintenance page if all pools members are down or disabled.
when HTTP_REQUEST {
if { [active_members [LB::server pool]] == 0 }
   { set http_reply "You have reached [HTTP::host],


Our website is offline while we make some important updates. Please check back again soon.

 Please contact helpdesk if you continue to experience issues after this maintenance window."
        HTTP::respond 200 content $http_reply

}
}
use maintenance page uploaded to f5 ifile with name maintenance-page
when HTTP_REQUEST {
if {[active_members [LB::server pool]] < 1} {

    switch [HTTP::uri] {
          default {HTTP::respond 200 content [ifile get "maintenance-page.html"] }
        }
    }
}

F5 UCS backup to FTP script

# BIG-IP Backup Script
#
# This script automates LTM Backups and saves the files with hostname and date
# off to an FTP server
# version 1.0
# Author: Yusuf
# Original Date: 03/09/18
#save this file to /etc/cron.daily for daily backup
#remember to change permission to read/write/execute using
#chmod 777
tmsh save /sys ucs /var/tmp/BIG-IP_backup
export a='date +"%y%m%d"'
export aa=$HOSTNAME.$a.ucs
export b=/var/tmp/$aa
mv /var/tmp/BIG-IP_backup.ucs $b
tar -cf /var/tmp/certs.tar /config/ssl
export ff=$HOSTNAME.$a.certs.tar
export f=/var/tmp/$ff
mv /var/tmp/certs.tar $f
export c=$HOSTNAME.$a.crontab
export cc=/var/tmp/$c
cp /etc/crontab $cc
export MName=
export Log=/var/tmp/log.bigip
export UserName=
export UserPassword=
export Machine1f2=$aa
export Machine1f3=$c
export Machine1f4=$ff
ftp -nvd ${MName} <&2 > ${Log}
user ${UserName} ${UserPassword}
bin
put ${b} ${Machine1f2}
put ${cc} ${Machine1f3}
put ${f} ${Machine1f4}
quit
END
rm -f ${b}
rm -f ${cc}
rm -f ${f}
RTN_CODE=$?
exit $RTN_CODE