Feat(eos_validate_state): Added the validation for IP security connections

ansible_collections/arista/avd/molecule/eos_validate_state/intended/test_catalogs/dc1-wan1-catalog.yml

@@ -262,6 +262,24 @@ anta.tests.security:
     profile: eAPI_SSL_Profile
     result_overwrite:
       custom_field: 'eAPI HTTPS SSL Profile: eAPI_SSL_Profile'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.255.10
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.255.10 VRF: default'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.255.20
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.255.20 VRF: default'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.1.2
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.1.2 VRF: default'
 - VerifySSHStatus: null
 - VerifySSHIPv4Acl:
     number: 3

ansible_collections/arista/avd/molecule/eos_validate_state/intended/test_catalogs/dc1-wan2-catalog.yml

@@ -262,6 +262,24 @@ anta.tests.security:
     profile: eAPI_SSL_Profile
     result_overwrite:
       custom_field: 'eAPI HTTPS SSL Profile: eAPI_SSL_Profile'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.255.10
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.255.10 VRF: default'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.255.20
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.255.20 VRF: default'
+- VerifySpecificIPSecConn:
+    ip_security_connections:
+    - peer: 10.255.1.1
+      vrf: default
+    result_overwrite:
+      custom_field: 'IPv4 Peer: 10.255.1.1 VRF: default'
 - VerifySSHStatus: null
 - VerifySSHIPv4Acl:
     number: 3

ansible_collections/arista/avd/molecule/eos_validate_state/reports/test_results/dc1-wan1-results.json

@@ -529,6 +529,33 @@
     ],
     "description": "Verifies IPv4 security connections for a peer."
   },
+  {
+    "name": "dc1-wan1",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.1.2 VRF: default"
+  },
+  {
+    "name": "dc1-wan1",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.255.10 VRF: default"
+  },
+  {
+    "name": "dc1-wan1",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.255.20 VRF: default"
+  },
   {
     "name": "dc1-wan1",
     "test": "VerifySSHIPv4Acl",

ansible_collections/arista/avd/molecule/eos_validate_state/reports/test_results/dc1-wan2-results.json

@@ -529,6 +529,33 @@
     ],
     "description": "Verifies IPv4 security connections for a peer."
   },
+  {
+    "name": "dc1-wan2",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.1.1 VRF: default"
+  },
+  {
+    "name": "dc1-wan2",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.255.10 VRF: default"
+  },
+  {
+    "name": "dc1-wan2",
+    "test": "VerifySpecificIPSecConn",
+    "categories": [
+      "security"
+    ],
+    "description": "Verifies IPv4 security connections for a peer.",
+    "custom_field": "IPv4 Peer: 10.255.255.20 VRF: default"
+  },
   {
     "name": "dc1-wan2",
     "test": "VerifySSHIPv4Acl",

ansible_collections/arista/avd/roles/eos_validate_state/ANTA-Preview.md

@@ -151,6 +151,9 @@ title: Ansible Collection Role eos_validate_state - Preview Integration with ANT
 - (New) AvdTestAPIHttpsSSL (No Ansible tags, use the new `skipped_tests` variable instead)
   - VerifyAPIHttpsSSL: Validate eAPI HTTPS SSL profile status.
 
+- (New) AvdTestIPSecurity (No Ansible tags, use the new `skipped_tests` variable instead)
+  - VerifySpecificIPSecConn: Validates the establishment of IP security connections for a peer within the default VRF. This test exclusively examines IPsec connections defined in the router's path selection configuration.
+
 ## Input variables
 
 ```yaml

ansible_collections/arista/avd/roles/eos_validate_state/python_modules/constants.py

@@ -9,6 +9,7 @@
     AvdTestHardware,
     AvdTestInbandReachability,
     AvdTestInterfacesState,
+    AvdTestIPSecurity,
     AvdTestLLDPTopology,
     AvdTestLoopback0Reachability,
     AvdTestMLAG,
@@ -36,6 +37,7 @@
     AvdTestInbandReachability: {"legacy_ansible_tags": ["loopback_reachability", "loopback0_reachability", "optional"]},
     AvdTestLoopback0Reachability: {"legacy_ansible_tags": ["loopback_reachability", "loopback0_reachability"]},
     AvdTestAPIHttpsSSL: {},
+    AvdTestIPSecurity: {},
 }
 """
 A dict of all AVD eos_validate_state test classes with their equivalent legacy Ansible tags.

ansible_collections/arista/avd/roles/eos_validate_state/python_modules/tests/__init__.py

@@ -6,7 +6,7 @@
 from .avdtestinterfaces import AvdTestInterfacesState
 from .avdtestmlag import AvdTestMLAG
 from .avdtestrouting import AvdTestBGP, AvdTestRoutingTable
-from .avdtestsecurity import AvdTestAPIHttpsSSL
+from .avdtestsecurity import AvdTestAPIHttpsSSL, AvdTestIPSecurity
 from .avdtestsystem import AvdTestNTP, AvdTestReloadCause
 
 __all__ = [
@@ -22,4 +22,5 @@
     "AvdTestRoutingTable",
     "AvdTestBGP",
     "AvdTestAPIHttpsSSL",
+    "AvdTestIPSecurity",
 ]

ansible_collections/arista/avd/roles/eos_validate_state/python_modules/tests/avdtestsecurity.py

@@ -36,3 +36,53 @@ def test_definition(self) -> dict | None:
         anta_tests.append({"VerifyAPIHttpsSSL": {"profile": profile, "result_overwrite": {"custom_field": f"eAPI HTTPS SSL Profile: {profile}"}}})
 
         return {self.anta_module: anta_tests}
+
+
+class AvdTestIPSecurity(AvdTestBase):
+    """
+    AvdTestIPSecurity class for IP security connection tests.
+    It validates the state of IPv4 security connections for a specified peer, ensuring they are established.
+    It specifically focuses on IPv4 security connections within the default VRF and examines connections defined in the router's path selection configuration.
+
+    """
+
+    anta_module = "anta.tests.security"
+
+    @cached_property
+    def test_definition(self) -> dict | None:
+        """
+        Generates the proper ANTA test definition for all IP security connection tests.
+
+        Returns:
+            test_definition (dict): ANTA test definition.
+        """
+        anta_tests = []
+
+        # Check if there are any path groups with static peers
+        if (path_groups := get(self.structured_config, "router_path_selection.path_groups")) is None:
+            LOGGER.info("No router path-group configured to collect the static peer. %s is skipped.", self.__class__.__name__)
+            return None
+
+        added_peers = set()
+        for group_idx, path_group in enumerate(path_groups):
+            if not self.validate_data(data=path_group, data_path=f"router_path_selection.path_groups.[{group_idx}]", required_keys="static_peers"):
+                continue
+
+            for peer_idx, peer in enumerate(path_group["static_peers"]):
+                if self.validate_data(
+                    data=peer, data_path=f"router_path_selection.path_groups.[{group_idx}].static_peers.[{peer_idx}]", required_keys="router_ip"
+                ):
+                    peer_address = peer["router_ip"]
+                    vrf = "default"  # TODO: Keeping the vrf name static for now. We may need to change later on.
+                    if (peer_address, vrf) not in added_peers:
+                        anta_tests.append(
+                            {
+                                "VerifySpecificIPSecConn": {
+                                    "ip_security_connections": [{"peer": peer_address, "vrf": vrf}],
+                                    "result_overwrite": {"custom_field": f"IPv4 Peer: {peer_address} VRF: {vrf}"},
+                                }
+                            }
+                        )
+                        added_peers.add((peer_address, vrf))
+
+        return {self.anta_module: anta_tests} if anta_tests else None