graphiant.naas.graphiant_local_extranet module – Manage Graphiant Local Extranet policies

Note

This module is part of the graphiant.naas collection (version 26.10.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install graphiant.naas. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: graphiant.naas.graphiant_local_extranet.

New in graphiant.naas 26.7.0

Synopsis

• Manages Local Extranet policies, which share a LAN segment (the provider/shared-service side) with other LAN segments (the consumer/branch side) across sites within the same enterprise.

• Unlike graphiant.naas.graphiant_data_exchange (cross-enterprise B2B peering), Local Extranet is single-tenant with no counterpart enterprise involved.

• Supports creating, updating, and deleting policies. After a successful create or update, the policy is automatically pushed to devices — there is no separate “apply” step.

Requirements

The below requirements are needed on the host that executes this module.

• python >= 3.7

• graphiant-sdk >= 26.10.0

• tabulate

Parameters

Parameter	Comments
access_token string	Bearer token for API authentication (for example, from graphiant login, which opens a browser for sign-in (SSO or non-SSO) and retrieves the token). If not passed as a module argument, the collection reads GRAPHIANT_ACCESS_TOKEN (set after graphiant login when you source ~/.graphiant/env.sh). When a bearer token is present (module argument or environment), it takes precedence over username and password. If no valid token is available, the module authenticates with username and password when both are supplied.
config_file string	Path to the YAML configuration file for the operation. Required for create_policies, update_policies, and delete_policies operations. Can be an absolute path or relative path. Relative paths are resolved using the configured config_path. Configuration files support Jinja2 templating syntax for dynamic generation. File must contain local_extranet_policies list.
detailed_logs boolean	Enable detailed logging output for troubleshooting and monitoring. When enabled, provides comprehensive logs of all Local Extranet operations. Logs are captured and included in the msg return value for display using ansible.builtin.debug module. Choices: false ← (default) true
host aliases: base_url string / required	Graphiant portal host URL for API connectivity. Example: “https://api.graphiant.com”
operation string / required	The specific Local Extranet operation to perform. create_policies/update_policies: Create or update policies from a YAML config file containing an local_extranet_policies list. Each policy needs a name, a sharedSegment (the provider LAN segment being shared), and targetSegments (the consumer LAN segments allowed to access it). Optional source/branches blocks scope the provider and consumer sides respectively, each supporting sites and prefixSet. prefixSet restricts which subnets are advertised{{ “:” }} omit it to share/allow all prefixes, or provide entries (each with an ipPrefix and optional maskLower/ maskUpper) to restrict shared prefixes to specific subnets. Optional targetDevices limits which devices a policy is pushed to (defaults to all applicable devices). update_policies requires the policy to already exist and supports --check/--diff to preview changes. delete_policies: Delete Local Extranet policies from a YAML configuration file. For query operations (policies_summary, policy_device_status, lan_segments_usage, nat_usage), use graphiant.naas.graphiant_local_extranet_info instead. Choices: "create_policies" "update_policies" "delete_policies"
password string	Graphiant portal password for authentication. Required for password-based login when no valid bearer token is available from access_token or GRAPHIANT_ACCESS_TOKEN.
state string	The desired state of the Local Extranet policies. present: Maps to create_policies when operation not specified. absent: Maps to delete_policies when operation not specified. Choices: "present" ← (default) "absent"
username string	Graphiant portal username for authentication. Required for password-based login when no valid bearer token is available from access_token or GRAPHIANT_ACCESS_TOKEN.

Attributes

Attribute	Support	Description
check_mode	Support: full	Supported. In check mode, no API writes are performed; payloads that would be sent are logged with a [check_mode] prefix.

Notes

Note

• Configuration files support Jinja2 templating syntax for dynamic configuration generation.

• The module automatically resolves names to IDs for LAN segments, sites, and devices.

• All operations are idempotent and safe to run multiple times without creating duplicates.

• Check mode (--check) is supported: config load, validation, and name-to-ID resolution run

• normally, but write operations are skipped and payloads are logged with a [check_mode] prefix.

• Use graphiant.naas.graphiant_local_extranet_info to query policy summaries and device status.

See Also

See also

graphiant.naas.graphiant_global_config

Configure global objects (LAN segments) required for Local Extranet

graphiant.naas.graphiant_sites

Configure sites required for Local Extranet policies

graphiant.naas.graphiant_local_extranet_info

Query Local Extranet policy summaries and device status

graphiant.naas.graphiant_data_exchange

Manage cross-enterprise (B2B) Data Exchange services, customers, matches, and invitations

Examples

- name: Create Local Extranet policies
  graphiant.naas.graphiant_local_extranet:
    operation: create_policies
    config_file: "sample_local_extranet_policies.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: create_result

- name: Display policy creation result
  ansible.builtin.debug:
    msg: "{{ create_result.msg }}"

- name: Preview Local Extranet policy updates (check + diff)
  graphiant.naas.graphiant_local_extranet:
    operation: update_policies
    config_file: "sample_local_extranet_policies_update.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: update_result
  # Run playbook with: ansible-playbook playbook.yml --check --diff

- name: Update Local Extranet policies
  graphiant.naas.graphiant_local_extranet:
    operation: update_policies
    config_file: "sample_local_extranet_policies_update.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: update_result

- name: Display policy update result
  ansible.builtin.debug:
    msg: "{{ update_result.msg }}"

- name: Delete Local Extranet policies
  graphiant.naas.graphiant_local_extranet:
    operation: delete_policies
    config_file: "sample_local_extranet_policies.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
changed boolean	Whether the operation made changes to the system. Returned: always Sample: true
config_file string	The configuration file used for the operation. Returned: when applicable Sample: "sample_local_extranet_policies.yaml"
diff dictionary	Ansible --diff output showing before/after state for each changed item. Returned for create_policies and update_policies when the playbook is run with --diff and at least one item would change. For new items, before is empty and after is the full target config. For updates, before shows current values and after shows target values. Returned: when playbook uses --diff and create_policies or update_policies has changes Sample: {"after": "=== le-policy-1 (policy) ===\n{\"source\": {\"prefixSet\": {\"entries\": [{\"ipPrefix\": \"10.1.1.0/24\", \"maskLower\": 25, \"maskUpper\": 28}]}}}\n", "before": "=== le-policy-1 (policy) ===\n{\"source\": {\"prefixSet\": {\"entries\": [{\"ipPrefix\": \"10.1.1.0/24\", \"maskLower\": 24, \"maskUpper\": 32}]}}}\n"}
msg string	Result message from the operation, including detailed logs when detailed_logs is enabled. Returned: always Sample: "Successfully created 1 Local Extranet policies\n\nDetailed logs:\n2025-11-19 23:08:05,315 - Graphiant_playbook - INFO - Creating policy 'le-policy-1'...\n2025-11-19 23:08:05,450 - Graphiant_playbook - INFO - Successfully created policy 'le-policy-1'\n"
operation string	The operation that was performed. One of create_policies, update_policies, or delete_policies. Returned: always Sample: "create_policies"
result_data dictionary	Result data from the operation. Returned: when applicable Sample: {}

Authors

• Graphiant Team (@graphiant)

Collection links

• Issue Tracker
• Homepage
• Repository (Sources)
• Report an issue
• View source code
• Communication