You can use the community.routeros.api module to connect to a RouterOS device with the RouterOS API. More specific module to modify certain entries are the community.routeros.api_modify and community.routeros.api_find_and_modify modules. The community.routeros.api_info module allows to retrieve information on specific predefined paths that can be used as input for the community.routeros.api_modify module, and the community.routeros.api_facts module allows to retrieve Ansible facts using the RouterOS API.
You can use the community.routeros.api module to connect to a RouterOS device with the RouterOS API. More specific module to modify certain entries are the community.routeros.api_modify and community.routeros.api_find_and_modify modules. The community.routeros.api_info module allows to retrieve information on specific predefined paths that can be used as input for the community.routeros.api_modify module, and the community.routeros.api_facts module allows to retrieve Ansible facts using the RouterOS API.
No special setup is needed; the module needs to be run on a host that can connect to the device’s API. The most common case is that the module is run on localhost, either by using hosts: localhost in the playbook, or by using delegate_to: localhost for the task. The following example shows how to run the equivalent of /ip address print:
---
- name: RouterOS test with API
@@ -181,7 +181,7 @@
localhost : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Check out the documenation of the community.routeros.api module for details on the options.
+Check out the documentation of the community.routeros.api module for details on the options.
community.routeros.api module defaults groupTo avoid having to specify common parameters for all the API based modules in every task, you can use the community.routeros.api module defaults group:
Setting to false (default) disables hostname verification during certificate validation. This is needed if the hostnames specified in the certificate do not match the hostname used for connecting (usually the device’s IP). It is recommended to set up the certificate correctly and set this to true; the default false is chosen for backwards compatibility to an older version of the module.
If you are not using a commerically trusted CA certificate to sign your device’s certificate, or have not included your CA certificate in Python’s truststore, you need to point this option to the CA certificate.
+If you are not using a commercially trusted CA certificate to sign your device’s certificate, or have not included your CA certificate in Python’s truststore, you need to point this option to the CA certificate.
We recommend to create a CA certificate that is used to sign the certificates for your RouterOS devices, and have the certificates include the correct hostname(s), including the IP of the device. That way, you can fully enable TLS and be sure that you always talk to the correct device.
@@ -245,7 +245,7 @@Installing the certificate is best done with the SSH connection. (See the How to connect to RouterOS devices with SSH guide for more information.) Once the certificate has been installed, and the HTTPS API enabled, it’s easier to work with the API, since it has a quite a few less problems, and returns data as JSON objects instead of text you first have to parse.
-First you have to convert the certificate and its private key to a PKCS #12 bundle. This can be done with the community.crypto.openssl_pkcs12. The following playbook assumes that the certificate is available as keys/{{ inventory_hostname }}.pem, and its private key is available as keys/{{ inventory_hostname }}.key. It generates a random passphrase to protect the PKCS#12 file.
First you have to convert the certificate and its private key to a PKCS #12 bundle. This can be done with the community.crypto.openssl_pkcs12. The following playbook assumes that the certificate is available as keys/{{ inventory_hostname }}.pem, and its private key is available as keys/{{ inventory_hostname }}.key. It generates a random passphrase to protect the PKCS#12 file.
---
- name: Install certificates on devices
hosts: routers
diff --git a/branch/main/docsite/ssh-guide.html b/branch/main/docsite/ssh-guide.html
index 6507b17..80b4882 100644
--- a/branch/main/docsite/ssh-guide.html
+++ b/branch/main/docsite/ssh-guide.html
@@ -137,7 +137,7 @@
The community.routeros.facts module gathers facts about a RouterOS device;
The community.routeros.command module executes commands on a RouterOS device.
The modules need the ansible.netcommon.network_cli connection plugin for this.
+The modules need the ansible.netcommon.network_cli connection plugin for this.
When using the community.routeros.command module module, make sure to not specify too long commands. Alternatively, add something like +cet512w to the username (replace admin with admin+cet512w) to tell RouterOS to not wrap before 512 characters in a line (see issue for details).
The ansible.netcommon.network_cli connection plugin uses paramiko by default to connect to devices with SSH. You can set its ssh_type option to libssh to use ansible-pylibssh instead, which offers Python bindings to libssh. See its documentation for details.
The ansible.netcommon.network_cli connection plugin uses paramiko by default to connect to devices with SSH. You can set its ssh_type option to libssh to use ansible-pylibssh instead, which offers Python bindings to libssh. See its documentation for details.
User is not allowed to login via SSH by password to modern Mikrotik if SSH key for the user is added!
This tells Ansible that you have a RouterOS device called router with IP 192.168.2.1. Ansible should use the ansible.netcommon.network_cli connection plugin together with the the community.routeros.routeros cliconf plugin. The credentials are stored as ansible_user and ansible_ssh_pass in the inventory.
This tells Ansible that you have a RouterOS device called router with IP 192.168.2.1. Ansible should use the ansible.netcommon.network_cli connection plugin together with the the community.routeros.routeros cliconf plugin. The credentials are stored as ansible_user and ansible_ssh_pass in the inventory.