Ansible驱动华为CE交换机VLAN自动化从零构建高效运维体系如果你还在为数据中心里成百上千台交换机的VLAN配置而头疼每天重复着登录设备、输入命令、检查状态的机械劳动那么是时候换个思路了。我管理过多个大型数据中心的网络从最初的手工配置到后来的脚本批量处理再到如今全面拥抱Ansible自动化这条路走了好几年。最让我感慨的是当团队新来的工程师还在为配置几台交换机的VLAN端口而加班时我已经用一杯咖啡的时间完成了整个机房的批量部署和验证。华为CE系列交换机在企业数据中心中占据着重要地位其稳定性和性能有口皆碑。但传统的CLI配置方式在面对大规模、频繁变更的网络环境时效率瓶颈日益明显。Ansible作为一款无代理的自动化工具与华为官方提供的CloudEngine-Ansible模块结合为网络工程师打开了一扇新的大门。这不是简单的命令替代而是整个运维思维的转变——从手动操作到声明式配置从单点管理到批量协同。1. 环境搭建与基础准备在开始自动化之旅前我们需要搭建一个稳定可靠的Ansible控制环境。很多工程师在这一步就遇到了各种“坑”其实只要理清依赖关系整个过程可以很顺畅。1.1 Ansible控制节点部署我推荐使用CentOS 8或者Ubuntu 20.04 LTS作为控制节点操作系统这两个系统对Python 3的支持比较完善。Ansible本身是用Python编写的所以Python环境的稳定性至关重要。# 在CentOS 8上安装Ansible sudo dnf install epel-release -y sudo dnf install ansible -y # 验证安装 ansible --version安装完成后你会看到类似这样的输出ansible 2.9.27 config file /etc/ansible/ansible.cfg configured module search path [/home/user/.ansible/plugins/modules, /usr/share/ansible/plugins/modules] ansible python module location /usr/lib/python3.6/site-packages/ansible executable location /usr/bin/ansible python version 3.6.8 (default, Aug 24 2020, 17:57:11) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]注意Ansible 2.9.x版本对网络设备模块的支持比较成熟建议使用这个版本。太老的版本可能缺少必要的网络模块太新的版本如2.10在模块组织方式上有较大变化需要额外安装集合collections。1.2 CloudEngine-Ansible模块安装华为官方为CE交换机开发了专门的Ansible模块这些模块以“ce_”开头覆盖了交换机配置的各个方面。安装方式有两种通过GitHub直接下载或者通过Ansible Galaxy安装。# 方法一从GitHub克隆并安装 git clone https://github.com/HuaweiSwitch/CloudEngine-Ansible.git cd CloudEngine-Ansible sudo python setup.py install # 方法二通过pip安装推荐 pip install ansible-netcommon pip install ncclient安装完成后可以通过以下命令验证模块是否可用# 查看所有华为CE相关模块 ansible-doc -l | grep ^ce_ | head -10正常应该能看到类似这样的模块列表ce_aaa_server Manages AAA server global configuration on HUAWEI CloudEngine switches ce_aaa_server_host Manages AAA server host configuration on HUAWEI CloudEngine switches ce_acl Manages base ACL configuration on HUAWEI CloudEngine switches ce_acl_advance Manages advanced ACL configuration on HUAWEI CloudEngine switches ce_acl_interface Manages applying ACLs to interfaces on HUAWEI CloudEngine switches1.3 交换机端配置准备要让Ansible能够管理CE交换机交换机上需要开启相应的服务。很多工程师在这里会遇到连接问题大部分是因为交换机端的配置不完整。登录到CE交换机执行以下配置# 进入系统视图 system-view # 开启netconf服务Ansible模块通过netconf协议与交换机通信 netconf server enable # 配置SSH服务确保Ansible可以通过SSH连接 stelnet server enable ssh server enable ssh user ansibleadmin ssh user ansibleadmin authentication-type password ssh user ansibleadmin service-type all # 创建本地用户并授权 aaa local-user ansibleadmin password irreversible-cipher YourSecurePassword123 local-user ansibleadmin service-type ssh local-user ansibleadmin level 15 local-user ansibleadmin state active quit # 配置VTY用户界面支持SSH协议 user-interface vty 0 4 authentication-mode aaa protocol inbound ssh quit提示在实际生产环境中建议使用更复杂的密码策略并考虑使用SSH密钥认证代替密码认证提高安全性。1.4 库存Inventory文件配置Ansible通过库存文件来管理目标设备。对于网络设备我们需要特别配置连接参数。我习惯将交换机按照功能区域分组这样在后续的Playbook中可以针对不同区域执行不同的配置策略。创建inventory/huawei_ce.yml文件# 数据中心核心交换机 [core_switches] ce-core-01 ansible_host192.168.1.101 ce-core-02 ansible_host192.168.1.102 # 接入层交换机 [access_switches] ce-acc-01 ansible_host192.168.1.201 ce-acc-02 ansible_host192.168.1.202 ce-acc-03 ansible_host192.168.1.203 ce-acc-04 ansible_host192.168.1.204 # 所有交换机的通用变量 [all:vars] ansible_connectionlocal ansible_network_osce ansible_useransibleadmin ansible_passwordYourSecurePassword123 ansible_becomeno这里有几个关键点需要注意ansible_connectionlocal因为网络设备模块通常在控制节点本地执行而不是在目标设备上ansible_network_osce告诉Ansible使用华为CE的模块ansible_becomeno网络设备通常不需要特权提升2. VLAN配置自动化实战VLAN配置是网络运维中最常见也最繁琐的任务之一。传统方式下工程师需要登录每台交换机逐个端口进行配置。通过Ansible我们可以将这个过程标准化、自动化。2.1 基础VLAN创建与批量部署假设我们需要在数据中心创建一批标准的VLAN用于不同的业务部门。手动配置不仅耗时还容易出错。下面是一个创建VLAN的Playbook示例创建playbooks/vlan_basic.yml--- - name: 批量创建基础VLAN配置 hosts: access_switches gather_facts: no vars: vlans: - { id: 10, name: VLAN_Server } - { id: 20, name: VLAN_User } - { id: 30, name: VLAN_VM } - { id: 40, name: VLAN_Storage } - { id: 99, name: VLAN_Management } tasks: - name: 创建VLAN community.network.ce_vlan: vlan_id: {{ item.id }} vlan_name: {{ item.name }} state: present loop: {{ vlans }} register: vlan_result - name: 显示创建结果 debug: msg: 在 {{ inventory_hostname }} 上创建了VLAN {{ item.vlan_id }} ({{ item.vlan_name }}) loop: {{ vlan_result.results }} when: item.changed执行这个Playbookansible-playbook -i inventory/huawei_ce.yml playbooks/vlan_basic.yml你会看到类似这样的输出PLAY [批量创建基础VLAN配置] **************************************************** TASK [创建VLAN] *************************************************************** changed: [ce-acc-01] (item{id: 10, name: VLAN_Server}) changed: [ce-acc-01] (item{id: 20, name: VLAN_User}) changed: [ce-acc-01] (item{id: 30, name: VLAN_VM}) changed: [ce-acc-01] (item{id: 40, name: VLAN_Storage}) changed: [ce-acc-01] (item{id: 99, name: VLAN_Management}) TASK [显示创建结果] *********************************************************** ok: [ce-acc-01] (item{changed: True, vlan_id: 10, vlan_name: VLAN_Server}) { msg: 在 ce-acc-01 上创建了VLAN 10 (VLAN_Server) }2.2 端口VLAN成员分配策略创建VLAN只是第一步更复杂的是将端口划分到相应的VLAN中。不同的端口类型接入端口、中继端口需要不同的配置策略。我通常将端口配置分为几个类别每个类别有不同的VLAN分配规则端口类型典型位置VLAN配置描述接入端口服务器连接单个VLAN服务器通常属于一个特定的VLAN中继端口交换机互联多个VLAN承载多个VLAN的流量混合端口虚拟化主机多个VLAN带标签支持带标签和不带标签的VLAN管理端口带外管理管理VLAN用于设备管理的专用VLAN基于这个分类我们可以创建更精细化的Playbook--- - name: 配置交换机端口VLAN成员 hosts: access_switches gather_facts: no vars: port_configs: - interface: 10GE1/0/1 port_type: access vlan_id: 10 description: Web-Server-01 - interface: 10GE1/0/2 port_type: access vlan_id: 20 description: User-PC-01 - interface: 10GE1/0/3 port_type: trunk native_vlan: 99 allowed_vlans: 10,20,30,40 description: Uplink-to-Core - interface: 10GE1/0/4 port_type: hybrid untagged_vlan: 30 tagged_vlans: 40,99 description: VM-Host-01 tasks: - name: 配置接入端口 community.network.ce_interface: interface_name: {{ item.interface }} description: {{ item.description }} mode: {{ access if item.port_type access else trunk }} access_vlan: {{ item.vlan_id if item.port_type access else omit }} trunk_vlans: {{ item.allowed_vlans if item.port_type trunk else omit }} native_vlan: {{ item.native_vlan if item.port_type trunk else omit }} state: present loop: {{ port_configs }} when: item.port_type in [access, trunk] - name: 配置混合端口需要特殊处理 community.network.ce_command: commands: - interface {{ item.interface }} - description {{ item.description }} - port link-type hybrid - port hybrid untagged vlan {{ item.untagged_vlan }} - port hybrid tagged vlan {{ item.tagged_vlans }} loop: {{ port_configs }} when: item.port_type hybrid注意华为CE交换机的混合端口配置比较特殊标准的ce_interface模块可能不支持所有参数这时候可以使用ce_command模块直接发送CLI命令。2.3 VLAN批量迁移与变更管理在实际运维中经常遇到需要批量修改VLAN配置的情况。比如业务部门重组、服务器迁移、网络架构调整等。手动操作这些变更既容易出错又难以保证一致性。下面是一个VLAN批量迁移的示例场景将原来在VLAN 10的服务器迁移到VLAN 50同时更新相关的中继端口配置。--- - name: VLAN批量迁移 - 从VLAN10迁移到VLAN50 hosts: {{ target_switches | default(access_switches) }} gather_facts: no vars: old_vlan: 10 new_vlan: 50 new_vlan_name: VLAN_Migrated_Server tasks: - name: 检查当前VLAN配置 community.network.ce_command: commands: - display vlan {{ old_vlan }} - display vlan brief register: vlan_status - name: 显示当前VLAN使用情况 debug: msg: | 当前VLAN {{ old_vlan }} 使用情况 {{ vlan_status.stdout_lines[0] | join(\n) }} - name: 创建新的VLAN community.network.ce_vlan: vlan_id: {{ new_vlan }} vlan_name: {{ new_vlan_name }} state: present - name: 查找所有使用旧VLAN的接入端口 community.network.ce_command: commands: display vlan {{ old_vlan }} register: vlan_ports changed_when: false - name: 解析端口列表并迁移 block: - name: 提取端口信息 set_fact: ports_to_migrate: {{ vlan_ports.stdout[0] | regex_findall((10GE\\d/\\d/\\d)) }} - name: 批量迁移端口到新VLAN community.network.ce_interface: interface_name: {{ item }} access_vlan: {{ new_vlan }} state: present loop: {{ ports_to_migrate }} when: ports_to_migrate | length 0 - name: 更新中继端口允许的VLAN列表 community.network.ce_command: commands: - interface {{ item.interface }} - undo port trunk allow-pass vlan {{ old_vlan }} - port trunk allow-pass vlan {{ new_vlan }} loop: {{ trunk_ports }} vars: trunk_ports: - { interface: 10GE1/0/24, description: Uplink } - { interface: 10GE1/0/48, description: Peer-Link } rescue: - name: 迁移失败时回滚 debug: msg: 端口迁移失败请手动检查配置 - name: 验证迁移结果 community.network.ce_command: commands: - display vlan {{ new_vlan }} - display interface brief | include {{ new_vlan }} register: verify_result - name: 输出验证结果 debug: msg: | 迁移验证结果 新VLAN {{ new_vlan }} 配置{{ verify_result.stdout_lines[0] | join(\n) }} 相关端口状态{{ verify_result.stdout_lines[1] | join(\n) }}这个Playbook展示了几个重要的自动化概念预检查在执行变更前先检查当前状态原子操作每个任务都是独立的可以单独重试错误处理使用rescue块处理可能的失败验证机制变更后立即验证结果3. 状态检查与合规验证配置自动化只是第一步确保配置正确性和一致性同样重要。我见过太多因为配置错误导致的网络中断所以状态检查和合规验证是自动化运维中不可或缺的一环。3.1 实时状态监控与报告Ansible不仅可以配置设备还可以收集设备的状态信息。通过定期执行状态检查Playbook我们可以建立实时的网络配置监控。创建playbooks/vlan_audit.yml--- - name: VLAN配置审计与合规检查 hosts: all gather_facts: no vars: required_vlans: [10, 20, 30, 40, 99] required_vlan_names: 10: VLAN_Server 20: VLAN_User 30: VLAN_VM 40: VLAN_Storage 99: VLAN_Management tasks: - name: 收集所有VLAN信息 community.network.ce_command: commands: display vlan brief register: vlan_info - name: 解析VLAN信息 set_fact: current_vlans: {{ vlan_info.stdout[0] | regex_findall(^(\\d)\\s\\S) | map(int) | list }} vlan_details: {{ vlan_info.stdout[0].split(\\n)[2:] | select(match, ^\\d) | list }} - name: 检查必需VLAN是否存在 debug: msg: 缺少必需VLAN: {{ item }} loop: {{ required_vlans }} when: item not in current_vlans - name: 检查VLAN命名规范 block: - name: 获取每个VLAN的详细信息 community.network.ce_command: commands: display vlan {{ item }} loop: {{ current_vlans }} register: vlan_detail_info - name: 验证VLAN名称 debug: msg: VLAN {{ item.item }} 名称不匹配。当前: {{ item.stdout[0] | regex_search(VLAN\\s\\d\\s(\\S), \\1) | default(未命名) }}期望: {{ required_vlan_names[item.item | string] }} loop: {{ vlan_detail_info.results }} when: - item.item | string in required_vlan_names.keys() - item.stdout[0] | regex_search(VLAN\\s\\d\\s(\\S), \\1) | default(未命名) ! required_vlan_names[item.item | string] when: current_vlans | length 0 - name: 检查端口VLAN成员 community.network.ce_command: commands: display vlan {{ item }} loop: {{ required_vlans }} register: vlan_member_ports - name: 生成VLAN审计报告 template: src: templates/vlan_audit_report.j2 dest: /tmp/vlan_audit_{{ inventory_hostname }}_{{ ansible_date_time.date }}.md delegate_to: localhost - name: 发送审计报告可选 mail: subject: VLAN配置审计报告 - {{ inventory_hostname }} body: {{ lookup(file, /tmp/vlan_audit_ inventory_hostname _ ansible_date_time.date .md) }} to: network-teamexample.com from: ansible-automationexample.com delegate_to: localhost when: audit_report_changed | default(false)对应的Jinja2模板templates/vlan_audit_report.j2# VLAN配置审计报告 **设备名称**: {{ inventory_hostname }} **审计时间**: {{ ansible_date_time.iso8601 }} **审计人员**: Ansible自动化系统 ## 1. VLAN存在性检查 | VLAN ID | 是否必需 | 是否存在 | 状态 | |---------|---------|---------|------| {% for vlan in required_vlans %} | {{ vlan }} | 是 | {{ ✅ 存在 if vlan in current_vlans else ❌ 缺失 }} | {{ 合规 if vlan in current_vlans else 不合规 }} | {% endfor %} ## 2. VLAN命名规范检查 {% for result in vlan_detail_info.results if result.item in required_vlans %} - VLAN {{ result.item }}: - 当前名称: {{ result.stdout[0] | regex_search(VLAN\\s\\d\\s(\\S), \\1) | default(未命名) }} - 期望名称: {{ required_vlan_names[result.item | string] }} - 状态: {{ ✅ 合规 if (result.stdout[0] | regex_search(VLAN\\s\\d\\s(\\S), \\1) | default(未命名)) required_vlan_names[result.item | string] else ❌ 不合规 }} {% endfor %} ## 3. 端口成员统计 {% for item in vlan_member_ports.results %} ### VLAN {{ item.item }}{{ item.stdout[0] }}{% endfor %} ## 4. 总结与建议 **总体合规率**: {{ ((current_vlans | intersect(required_vlans) | length) / required_vlans | length * 100) | round(2) }}% **主要问题**: {% for vlan in required_vlans if vlan not in current_vlans %} - VLAN {{ vlan }} 缺失需要创建 {% endfor %} **建议操作**: 1. 运行VLAN修复Playbook补全缺失VLAN 2. 检查命名不规范的VLAN并进行修正 3. 验证端口VLAN成员配置是否符合安全策略3.2 配置备份与版本控制网络配置的版本控制同样重要。Ansible可以轻松实现配置的自动备份和版本管理。--- - name: 交换机配置备份与版本管理 hosts: all gather_facts: no vars: backup_dir: /backup/network/{{ inventory_hostname }} max_backups: 30 # 保留最近30个备份 tasks: - name: 创建备份目录 file: path: {{ backup_dir }} state: directory mode: 0755 delegate_to: localhost - name: 备份当前运行配置 community.network.ce_config: backup: yes backup_options: filename: config_{{ ansible_date_time.date }}_{{ ansible_date_time.time }}.cfg dir_path: {{ backup_dir }} - name: 备份启动配置 community.network.ce_command: commands: display saved-configuration register: startup_config - name: 保存启动配置到文件 copy: content: {{ startup_config.stdout[0] }} dest: {{ backup_dir }}/startup_{{ ansible_date_time.date }}_{{ ansible_date_time.time }}.cfg delegate_to: localhost - name: 清理旧备份文件保留最近{{ max_backups }}个 find: paths: {{ backup_dir }} patterns: *.cfg age: 30d register: old_backups - name: 删除过期备份 file: path: {{ item.path }} state: absent loop: {{ old_backups.files[max_backups:] }} delegate_to: localhost when: old_backups.files | length max_backups - name: 生成备份报告 template: src: templates/backup_report.j2 dest: {{ backup_dir }}/backup_report_{{ ansible_date_time.date }}.md delegate_to: localhost - name: 计算配置哈希值用于变更检测 community.network.ce_command: commands: display current-configuration register: current_config - name: 保存配置哈希值 lineinfile: path: {{ backup_dir }}/config_hashes.csv line: {{ ansible_date_time.iso8601 }},{{ inventory_hostname }},{{ current_config.stdout[0] | hash(sha256) }} create: yes delegate_to: localhost3.3 自动化健康检查定期执行健康检查可以提前发现潜在问题。下面是一个综合性的健康检查Playbook--- - name: 交换机健康状态检查 hosts: all gather_facts: no tasks: - name: 检查设备基本信息 community.network.ce_command: commands: - display version - display device - display cpu-usage - display memory-usage register: system_info - name: 检查接口状态 community.network.ce_command: commands: display interface brief register: interface_status - name: 检查VLAN状态 community.network.ce_command: commands: display vlan summary register: vlan_status - name: 检查生成树状态 community.network.ce_command: commands: display stp brief register: stp_status - name: 检查MAC地址表 community.network.ce_command: commands: display mac-address | include GE|10GE register: mac_table - name: 分析接口错误统计 community.network.ce_command: commands: display interface | include error|discard|CRC register: interface_errors - name: 生成健康检查报告 template: src: templates/health_check_report.j2 dest: /tmp/health_check_{{ inventory_hostname }}_{{ ansible_date_time.date }}.html delegate_to: localhost - name: 检查关键指标阈值 assert: that: - system_info.stdout[2] | regex_search(CPU usage.*?(\\d)%) | int 80 - system_info.stdout[3] | regex_search(Memory Using Percentage.*?(\\d)%) | int 85 - error not in interface_errors.stdout[0].lower() or 0 in interface_errors.stdout[0] success_msg: 所有关键指标正常 fail_msg: 发现异常指标请检查详细报告4. 高级技巧与最佳实践在实际使用Ansible管理华为CE交换机的过程中我积累了一些宝贵的经验和技巧这些往往在官方文档中不会详细说明。4.1 性能优化与批量操作当管理的交换机数量很多时Playbook的执行性能就变得很重要。以下是一些优化技巧--- - name: 高性能批量配置示例 hosts: {{ switch_group | default(all) }} strategy: free # 使用free策略并行执行 serial: 10 # 每次同时操作10台设备 gather_facts: no vars: # 使用变量文件分离配置数据 vlan_config: {{ lookup(file, vars/vlans.yml) | from_yaml }} port_config: {{ lookup(file, vars/ports.yml) | from_yaml }} tasks: - name: 批量创建VLAN使用async避免超时 community.network.ce_vlan: vlan_id: {{ item.id }} vlan_name: {{ item.name }} state: present loop: {{ vlan_config }} async: 45 # 异步执行超时45秒 poll: 0 # 不等待立即返回 register: vlan_async_result - name: 等待所有VLAN创建完成 async_status: jid: {{ item.ansible_job_id }} loop: {{ vlan_async_result.results }} register: vlan_job_result until: vlan_job_result.finished retries: 30 delay: 2 - name: 批量配置端口使用批处理减少连接次数 block: - name: 生成批量配置命令 set_fact: batch_commands: | {% for port in port_config[inventory_hostname] %} interface {{ port.interface }} description {{ port.description }} port link-type {{ port.type }} {% if port.type access %} port default vlan {{ port.vlan }} {% elif port.type trunk %} port trunk allow-pass vlan {{ port.allowed_vlans }} {% endif %} quit {% endfor %} - name: 执行批量配置 community.network.ce_config: lines: {{ batch_commands.split(\n) }} when: port_config[inventory_hostname] is defined4.2 错误处理与回滚机制自动化运维必须考虑错误处理。一个好的Playbook应该能够优雅地处理失败并在必要时回滚。--- - name: 带完整错误处理的VLAN配置 hosts: access_switches gather_facts: no vars: target_vlans: - { id: 100, name: VLAN_Test_1 } - { id: 200, name: VLAN_Test_2 } tasks: - name: 备份当前配置 community.network.ce_config: backup: yes backup_options: filename: pre_change_{{ inventory_hostname }}.cfg dir_path: /tmp register: config_backup changed_when: false - name: 记录变更前状态 community.network.ce_command: commands: display current-configuration | include vlan register: pre_change_state changed_when: false - name: 执行VLAN配置变更 block: - name: 创建VLAN community.network.ce_vlan: vlan_id: {{ item.id }} vlan_name: {{ item.name }} state: present loop: {{ target_vlans }} register: vlan_creation - name: 验证VLAN创建 community.network.ce_command: commands: display vlan {{ item.id }} loop: {{ target_vlans }} register: vlan_verify failed_when: VLAN not in item.stdout[0] - name: 测试网络连通性可选 wait_for: host: {{ test_host | default(8.8.8.8) }} port: 53 timeout: 5 delegate_to: localhost when: test_connectivity | default(false) rescue: - name: 配置失败开始回滚 debug: msg: VLAN配置失败正在回滚... - name: 恢复备份配置 community.network.ce_config: config: {{ lookup(file, config_backup.backup_path) }} when: config_backup.backup_path is defined - name: 验证回滚结果 community.network.ce_command: commands: display current-configuration | include vlan register: post_rollback_state - name: 比较回滚前后状态 assert: that: pre_change_state.stdout[0] post_rollback_state.stdout[0] fail_msg: 回滚失败配置状态不一致 success_msg: 回滚成功配置已恢复 - name: 发送告警通知 debug: msg: VLAN配置失败已回滚请检查日志 # 在实际环境中这里可以调用邮件、短信、微信等通知接口 - name: 始终失败确保Playbook标记为失败 fail: msg: VLAN配置任务失败并已回滚 always: - name: 清理临时备份文件 file: path: {{ config_backup.backup_path }} state: absent delegate_to: localhost when: config_backup.backup_path is defined - name: 记录操作日志 lineinfile: path: /var/log/ansible/network_changes.log line: {{ ansible_date_time.iso8601 }} - {{ inventory_hostname }} - VLAN配置 - 状态: {{ 成功 if not ansible_failed else 失败已回滚 }} create: yes delegate_to: localhost4.3 与CI/CD流水线集成将网络自动化集成到DevOps流水线中可以实现真正的网络即代码Network as Code。# Jenkinsfile示例 - 网络配置流水线 pipeline { agent any parameters { choice( name: ENVIRONMENT, choices: [dev, test, prod], description: 选择部署环境 ) string( name: VLAN_ID, defaultValue: 100, description: 要创建的VLAN ID ) string( name: VLAN_NAME, defaultValue: VLAN_New, description: VLAN名称 ) } stages { stage(代码检查) { steps { script { // 检查Playbook语法 sh ansible-playbook --syntax-check playbooks/create_vlan.yml // 运行ansible-lint进行代码质量检查 sh ansible-lint playbooks/create_vlan.yml } } } stage(测试环境部署) { when { expression { params.ENVIRONMENT dev || params.ENVIRONMENT test } } steps { script { // 在测试环境执行 sh ansible-playbook \ -i inventory/${params.ENVIRONMENT} \ -e vlan_id${params.VLAN_ID} \ -e vlan_name${params.VLAN_NAME} \ playbooks/create_vlan.yml } } } stage(人工审批) { when { expression { params.ENVIRONMENT prod } } steps { input message: 确认在生产环境部署, ok: 确认部署 } } stage(生产环境部署) { when { expression { params.ENVIRONMENT prod } } steps { script { // 在生产环境执行使用串行执行确保安全 sh ansible-playbook \ -i inventory/prod \ -e vlan_id${params.VLAN_ID} \ -e vlan_name${params.VLAN_NAME} \ --limit prod_switches[0] \ playbooks/create_vlan.yml // 验证第一批设备 sh ansible-playbook \ -i inventory/prod \ --limit prod_switches[0] \ playbooks/verify_vlan.yml // 如果验证通过部署剩余设备 sh ansible-playbook \ -i inventory/prod \ -e vlan_id${params.VLAN_ID} \ -e vlan_name${params.VLAN_NAME} \ --limit prod_switches[1:] \ playbooks/create_vlan.yml } } } stage(验证与报告) { steps { script { // 生成部署报告 sh ansible-playbook \ -i inventory/${params.ENVIRONMENT} \ -e vlan_id${params.VLAN_ID} \ playbooks/verify_deployment.yml // 收集日志和指标 archiveArtifacts artifacts: reports/*.html, logs/*.log } } } } post { always { // 清理工作空间 cleanWs() } success { // 部署成功通知 emailext ( subject: 网络配置部署成功 - ${env.JOB_NAME}, body: VLAN ${params.VLAN_ID} (${params.VLAN_NAME}) 在 ${params.ENVIRONMENT} 环境部署成功, to: network-teamexample.com ) } failure { // 部署失败通知 emailext ( subject: 网络配置部署失败 - ${env.JOB_NAME}, body: VLAN ${params.VLAN_ID} (${params.VLAN_NAME}) 在 ${params.ENVIRONMENT} 环境部署失败请检查日志, to: network-teamexample.com ) } } }4.4 自定义模块开发虽然华为提供了丰富的CE模块但有时候我们需要一些特定的功能。这时可以开发自定义模块。#!/usr/bin/python # -*- coding: utf-8 -*- from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.network.common.utils import dict_diff import re def get_vlan_utilization(module, vlan_id): 获取VLAN使用率信息 cmd display vlan {0}.format(vlan_id) result module.connection.send_command(cmd) # 解析输出提取端口数量等信息 port_count 0 for line in result.split(\n): if Untagged in line or Tagged in line: # 统计端口数量 ports re.findall(r(?:10GE|GE|Eth)\d/\d/\d, line) port_count len(ports) return { vlan_id: vlan_id, port_count: port_count, raw_output: result } def main(): 主函数 argument_spec dict( vlan_iddict(typeint, requiredTrue), warning_thresholddict(typeint, default20), critical_thresholddict(typeint, default40) ) module AnsibleModule( argument_specargument_spec, supports_check_modeTrue ) vlan_id module.params[vlan_id] warning module.params[warning_threshold] critical module.params[critical_threshold] try: # 获取VLAN信息 vlan_info get_vlan_utilization(module, vlan_id) port_count vlan_info[port_count] # 假设最大端口数根据交换机型号不同 max_ports 48 # 以48口交换机为例 # 计算使用率 utilization (port_count / max_ports) * 100 # 判断状态 if utilization critical: status CRITICAL changed False elif utilization warning: status WARNING changed False else: status OK changed False # 返回结果 result { changed: changed, vlan_id: vlan_id, port_count: port_count, utilization_percent: round(utilization, 2), status: status, message: VLAN {0} 使用率: {1}% ({2}/{3}端口).format( vlan_id, round(utilization, 2), port_count, max_ports ) } module.exit_json(**result) except Exception as e: module.fail_json(msgstr(e)) if __name__ __main__: main()使用这个自定义模块的Playbook--- - name: 使用自定义模块检查VLAN使用率 hosts: access_switches gather_facts: no tasks: - name: 检查VLAN使用率 ce_vlan_utilization: # 假设模块名为ce_vlan_utilization vlan_id: 10 warning_threshold: 30 critical_threshold: 60 register: vlan_usage - name: 根据使用率采取行动 block: - name: 高使用率告警 debug: msg: VLAN {{ vlan_usage.vlan_id }} 使用率过高: {{ vlan_usage.utilization_percent }}% when: vlan_usage.status CRITICAL - name: 建议扩容 community.network.ce_command: commands: - system-view - vlan {{ new_vlan_id | default(1000) }} - quit when: - vlan_usage.status CRITICAL - expand_vlan | default(false) always: - name: 记录监控数据 lineinfile: path: /var/log/vlan_utilization.csv line: {{ ansible_date_time.iso8601 }},{{ inventory_hostname }},{{ vlan_usage.vlan_id }},{{ vlan_usage.utilization_percent }},{{ vlan_usage.status }} create: yes delegate_to: localhost通过这些高级技巧我们可以构建一个真正强大、可靠、可维护的网络自动化体系。从简单的VLAN配置到复杂的变更管理从基本的健康检查到与CI/CD流水线的深度集成Ansible为华为CE交换机的管理提供了无限的可能性。在实际项目中我建议从小规模开始先自动化一两个最常见的任务比如VLAN创建和端口配置。等团队熟悉了Ansible的工作方式后再逐步扩展到更复杂的场景。记住自动化的目标不是取代工程师而是让工程师从重复劳动中解放出来专注于更有价值的架构设计和问题解决。每次看到Playbook成功运行几十台交换机的配置在几分钟内完成那种成就感是手动配置无法比拟的。