{%- macro render_augments(augments, indent="") -%}
{%- for aug_type, aug in (augments or {}).items() -%}
{%-   if aug_type == "cisco_device_tracking_policy" %}
{{ indent }}device-tracking attach-policy {{ aug.policy_name.value }}
{%-   elif aug_type == "cisco_service_policy" %}
{%-     if aug.input_policy %}
{{ indent }}service-policy input {{ aug.input_policy.value }}
{%-     endif %}
{%-     if aug.output_policy %}
{{ indent }}service-policy output {{ aug.output_policy.value }}
{%-     endif %}
{%-   elif aug_type == "cisco_vtp_primary_server" %}
{%-     if aug.enabled and aug.enabled.value %}
{{ indent }}vtp primary server
{%-     endif %}
{%-   endif %}
{%- endfor -%}
{%- endmacro -%}
service timestamps debug datetime msec
service timestamps log datetime msec
{%- set pwe = (configuration.system.config.augments or {}).get('cisco_service_password_encryption') %}
{%- if pwe and pwe.enabled.value %}
service password-encryption
{%- else %}
no service password-encryption
{%- endif %}

service compress-config
!
{%- if configuration.system.config.hostname %}
hostname {{ configuration.system.config.hostname.value }}
{%- endif %}
!
boot-start-marker
boot-end-marker
!
!
{%- if configuration.system.logging -%}
{%-   if configuration.system.logging.config and configuration.system.logging.config.get('buffer_size') %}
logging buffered {{ configuration.system.logging.config['buffer_size'].value | default(4096) }}
{%-   endif %}
{%-   set logging_console = (configuration.system.logging.config.augments or {}).get('cisco.console_logging') %}
{%-   if logging_console and logging_console.enabled and not logging_console.enabled.value %}
no logging console
{%-   endif %}
{%-   set logging_trap = (configuration.system.logging.config.augments or {}).get('cisco.trap_logging') %}
{%-   if logging_trap %}
logging trap {{ logging_trap.severity.value }}
{%-   endif %}
{%- endif %}
!
{%- for ni in configuration.network_instances.values() %}
{%-   if ni.name.value != "global" %}
vrf definition {{ ni.name.value }}
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
{%-   endif %}
{%- endfor %}
!
!
{%- if configuration.system.aaa.config is defined and configuration.system.aaa.config.enabled %}
aaa new-model
{%-   if configuration.system.aaa.server_groups %}
{%-     for group_name, group in configuration.system.aaa.server_groups.items() %}
{%-       if group.enable and group.enable.value %}
{%-         if group.tacacs %}
!
aaa group server tacacs+ {{ group_name }}
{%-           for server_name in group.tacacs.keys() %}
 server name {{ server_name }}
{%-           endfor %}
{%-         endif %}
{%-         if group.radius %}
!
aaa group server radius {{ group_name }}
{%-           for server_name in group.radius.keys() %}
 server name {{ server_name }}
{%-           endfor %}
{%-         endif %}
{%-       endif %}
{%-     endfor %}
{%-   endif %}
{%- else %}
no aaa new-model
{%- endif %}
!
{%- set svc_augments = (configuration.system.services.config.augments or {}) %}
{%- for aug_type, aug in svc_augments.items() %}
{%-   if aug_type.startswith("cisco_access_session_filter_list") %}
access-session attributes filter-list list {{ aug.name }}
{%-     for item in aug['items'] %}
 {{ item }}
{%-     endfor %}
!
{%-   endif %}
{%- endfor %}
{%- for aug_type, aug in svc_augments.items() %}
{%-   if aug_type.startswith("cisco_control_subscriber_policy_map") %}
policy-map type control subscriber {{ aug.name }}
{%-     for event_type, event in aug.events.items() %}
 event {{ event_type }} {{ event.match_type }}
{%-       for prio, cls in event.classes.items() %}
  {{ prio }} class {{ cls.class_name }} {{ cls.mode }}
{%-         for action_prio, act in cls.actions.items() %}
   {{ action_prio }} {{ act.action }}
{%-         endfor %}
{%-       endfor %}
{%-     endfor %}
!
{%-   endif %}
{%- endfor %}
{%- for aug_type, aug in svc_augments.items() %}
{%-   if aug_type.startswith("cisco_device_sensor_filter_list") %}
device-sensor filter-list {{ aug.protocol }} list {{ aug.name }}
{%-     for item in aug['items'] %}
{%-       if aug.protocol == "dhcp" %}
 option name {{ item }}
{%-       else %}
 tlv name {{ item }}
{%-       endif %}
{%-     endfor %}
!
{%-   endif %}
{%- endfor %}
{%- for aug_type, aug in svc_augments.items() %}
{%-   if aug_type.startswith("cisco_device_sensor_filter_spec") %}
device-sensor filter-spec {{ aug.protocol }} include list {{ aug.filter_list_name }}
{%-   endif %}
{%- endfor %}
{%- for aug_type, aug in svc_augments.items() %}
{%-   if aug_type == "cisco_access_session_authentication" %}
{%-     for list_name in aug.filter_lists.keys() %}
access-session authentication attributes filter-spec include list {{ list_name }}
{%-     endfor %}
{%-   elif aug_type == "cisco_access_session_accounting" %}
{%-     for list_name in aug.filter_lists.keys() %}
access-session accounting attributes filter-spec include list {{ list_name }}
{%-     endfor %}
{%-   elif aug_type == "cisco_service_policy_control_subscriber" %}
service-policy type control subscriber {{ aug.policy_name }}
{%-   elif aug_type == "cisco_access_session_monitor" %}
{%-     if aug.enabled and aug.enabled.value %}
access-session monitor
{%-     endif %}
{%-   elif aug_type == "cisco_device_sensor_notify" %}
{%-     if aug.all_changes %}
device-sensor notify all-changes
{%-     endif %}
{%-   endif %}
{%- endfor %}
!
{%- if configuration.system.clock.config %}
clock timezone {{ configuration.system.clock.config.timezone.value | upper }}
{%- endif %}
!
!
!
!
!
!
!
{%- if configuration.system.config.domain_name is defined and configuration.system.config.domain_name %}
ip domain-name {{ configuration.system.config.domain_name.value }}
{%- endif %}
{%- if configuration.cef is not defined or configuration.cef %}
ip cef
{%- endif %}
no ipv6 cef
!
{%- set dhcp_snoop = configuration.system.dhcp.snooping %}
{%- if dhcp_snoop and dhcp_snoop.enabled and dhcp_snoop.enabled.value %}
ip dhcp snooping
{%-   for vlan_id in dhcp_snoop.vlans.keys() %}
ip dhcp snooping vlan {{ vlan_id }}
{%-   endfor %}
{%-   if dhcp_snoop.option82 and not dhcp_snoop.option82.value %}
no ip dhcp snooping information option
{%-   endif %}
{%-   set track = (dhcp_snoop.augments or {}).get('cisco_dhcp_snooping_track_server') %}
{%-   if track %}
{%-     if track.all_dhcp_acks %}
ip dhcp snooping track server all-dhcp-acks
{%-     else %}
ip dhcp snooping track server
{%-     endif %}
{%-   endif %}
{%- endif %}
!
spanning-tree mode pvst
spanning-tree extend system-id
!
{%- if configuration.system.vtp and configuration.system.vtp.config -%}
{%-   set vtp = configuration.system.vtp.config %}
{%-   if vtp.domain_name %}
vtp domain {{ vtp.domain_name.value }}
{%-   endif %}
{%-   if vtp.mode %}
vtp mode {{ vtp.mode.value }}
{%-   endif %}
{%-   if vtp.version %}
vtp version {{ vtp.version.value }}
{%-   endif %}
{%-   if vtp.password %}
vtp password {{ vtp.password.value }}
{%-   elif vtp.password_hashed %}
vtp password {{ vtp.password_hashed.value }} hidden
{%-   endif %}
{{- render_augments(vtp.get('augments')) -}}
{%- endif %}
!
!
{%- if configuration.system.logging.files.files -%}
{%-   for file in configuration.system.logging.files.files.values() %}
{%-     if file.augments %}
{%-       for archive in file.augments.values() %}
{%-         if archive.type == 'cisco.archive' and ((archive.enabled is not defined) or archive.enabled.value) %}
archive
{%-         if archive.log_config and archive.log_config.value %}
 log config
  logging enable
{%-         endif %}
{%-         if archive.path and archive.path.value %}
 path {{ archive.path.value }}
{%-         endif %}
{%-         if archive.write_memory and archive.write_memory.value %}
 write-memory
{%-         endif %}
{%-         if archive.time_period and archive.time_period.value %}
 time-period {{ archive.time_period.value }}
{%-         endif %}
{%-         if archive.maximum and archive.maximum.value %}
 maximum {{ archive.maximum.value }}
{%-         endif %}
{%-         if archive.rollback_filter and archive.rollback_filter.value %}
 rollback filter adaptive
{%-         endif %}
{%-         if archive.rollback_retry and archive.rollback_retry.value %}
 rollback retry {{ archive.rollback_retry.value }}
{%-         endif %}
{%-       endif %}
{%-       endfor %}
{%-     endif %}
{%-   endfor %}
{%- endif %}
!
!
!
!
!
!
!
!
!
!
!
{%- if configuration.interface_templates %}
{%-  for tmpl_name, tmpl in configuration.interface_templates.items() %}
template {{ tmpl.name.value }}
{%-    if tmpl.storm_control %}
{%-      if tmpl.storm_control.broadcast_pps %}
{%-        set v = tmpl.storm_control.broadcast_pps.value %}
 storm-control broadcast level pps {% if v % 1000 == 0 %}{{ v // 1000 }}k{% else %}{{ v }}{% endif %}
{%-      endif %}
{%-      if tmpl.storm_control.multicast_pps %}
{%-        set v = tmpl.storm_control.multicast_pps.value %}
 storm-control multicast level pps {% if v % 1000 == 0 %}{{ v // 1000 }}k{% else %}{{ v }}{% endif %}
{%-      endif %}
{%-      if tmpl.storm_control.unknown_unicast_pps %}
{%-        set v = tmpl.storm_control.unknown_unicast_pps.value %}
 storm-control unknown-unicast level pps {% if v % 1000 == 0 %}{{ v // 1000 }}k{% else %}{{ v }}{% endif %}
{%-      endif %}
{%-      if tmpl.storm_control.action %}
 storm-control action {{ tmpl.storm_control.action.value }}
{%-      endif %}
{%-    endif %}
{%-    if (tmpl.stp_edge_port and tmpl.stp_edge_port.value == True) or (tmpl.stp_portfast and tmpl.stp_portfast.value == True) %}
 spanning-tree portfast
{%-    endif %}
{%-    if tmpl.stp_bpdu_guard and tmpl.stp_bpdu_guard.value == True %}
 spanning-tree bpduguard enable
{%-    endif %}
{%-    if tmpl.stp_bpdu_filter and tmpl.stp_bpdu_filter.value == True %}
 spanning-tree bpdufilter enable
{%-    endif %}
{%-    if tmpl.stp_loop_guard and tmpl.stp_loop_guard.value == True %}
 spanning-tree guard loop
{%-    endif %}
{%-    if tmpl.stp_root_guard and tmpl.stp_root_guard.value == True %}
 spanning-tree guard root
{%-    endif %}
{%-    if tmpl.stp_port_priority %}
 spanning-tree port-priority {{ tmpl.stp_port_priority.value }}
{%-    endif %}
{%-    if tmpl.stp_cost %}
 spanning-tree cost {{ tmpl.stp_cost.value }}
{%-    endif %}
{%-    if tmpl.stp_link_type %}
 spanning-tree link-type {{ tmpl.stp_link_type.value }}
{%-    endif %}
{%-    if tmpl.switchport and tmpl.switchport.value %}
 switchport
{%-    endif %}
{%-    if tmpl.switchport_mode and tmpl.switchport_mode.value == "access" %}
 switchport mode access
{%-    endif %}
{%-    if tmpl.switchport_mode and tmpl.switchport_mode.value == "trunk" %}
 switchport mode trunk
{%-    endif %}
{%-    if tmpl.access_vlan %}
 switchport access vlan {{ tmpl.access_vlan.value }}
{%-    endif %}
{%-    if tmpl.native_vlan %}
 switchport trunk native vlan {{ tmpl.native_vlan.value }}
{%-    endif %}
{%-    if tmpl.trunk_allowed_vlans %}
 switchport trunk allowed vlan {{ tmpl.trunk_allowed_vlans.value | join(',') }}
{%-    endif %}
{%-    if tmpl.voice_vlan %}
 switchport voice vlan {{ tmpl.voice_vlan.value }}
{%-    endif %}
{%-    if tmpl.dtp_negotiation and tmpl.dtp_negotiation.value == False %}
 switchport nonegotiate
{%-    endif %}
{%-    if tmpl.mtu %}
 mtu {{ tmpl.mtu.value }}
{%-    endif %}
{%-    if tmpl.speed %}
 speed {{ tmpl.speed.value }}
{%-    endif %}
{%-    if tmpl.duplex %}
 duplex {{ tmpl.duplex.value }}
{%-    endif %}
{%-    if tmpl.negotiation is defined and tmpl.negotiation and tmpl.negotiation.value == False %}
 no negotiation auto
{%-    endif %}
{%-    if tmpl.auto_mdix is defined and tmpl.auto_mdix and tmpl.auto_mdix.value == False %}
 no mdix auto
{%-    endif %}
{%-    if tmpl.logging_link_status and tmpl.logging_link_status.value == False %}
 no logging event link-status
{%-    endif %}
{%-    if tmpl.snmp_link_status_trap and tmpl.snmp_link_status_trap.value == False %}
 no snmp trap link-status
{%-    endif %}
{{- render_augments(tmpl.get('augments'), " ") -}}
{%-    if tmpl.description %}
 description {{ tmpl.description.value }}
{%-    endif %}
{%-    if tmpl.enabled is defined and tmpl.enabled and tmpl.enabled.value == False %}
 shutdown
{%-    endif %}
!
{%-  endfor %}
{%- endif %}
!
{%- for _, intf in configuration.interfaces.items() %}
{%-  if intf.type == "softwareLoopback" %}
interface Loopback{{ intf.index.value }}
{%-    if intf.description %}
 description {{ intf.description.value }}
{%-    endif %}
{%- if 'vrf' in intf %}
 vrf forwarding {{ intf.vrf}}
{%- endif %}
{%-    if intf.ipv4 %}
 ip address {{ intf.ipv4.value|cidr_to_addrmask }}
{%-     endif %}
{%-  endif %}
{%- endfor %}
!
{%- for _, intf in configuration.interfaces.items() %}
{%-  if intf.type == "ieee8023adLag" %}
interface {{ intf.name }}
{%-    if intf.description %}
 description {{ intf.description.value }}
{%-    endif %}
{%- if 'vrf' in intf %}
 vrf forwarding {{ intf.vrf}}
{%- endif %}
{%- if 'ipv4' in intf %}
{%-    if intf.ipv4 %}
 ip address {{ intf.ipv4.value|cidr_to_addrmask }}
{%-     endif %}
{%- endif %}
{%-  if intf.switchport and intf.switchport.value %}
{%-    if intf.switchport_mode and intf.switchport_mode.value == "access" %}
 switchport mode access
{%-      if intf.native_vlan %}
 switchport access vlan {{ intf.native_vlan.value }}
{%-      endif %}
{%-    endif %}
{%-    if intf.switchport_mode and intf.switchport_mode.value == "trunk" %}
 switchport mode trunk
{%-      if intf.native_vlan %}
 switchport trunk native vlan {{ intf.native_vlan.value }}
{%-      endif %}
{%-      if intf.trunk_allowed_vlans %}
 switchport trunk allowed vlan {{ intf.trunk_allowed_vlans.value | join(',') }}
{%-      endif %}
{%-    endif %}
{%-  endif %}
{%-    if intf.interface_template %}
 source template {{ intf.interface_template.pointer.split('.') | last }}
{%-    endif %}
{%-  if intf.enabled and intf.enabled.value %}
 no shutdown
{%-    else %}
 shutdown
{%-   endif %}
{%-  endif %}
{%-  if intf.type == "ieee8023adLag" %}
!
{%-  endif %}
{%- endfor %}
!
{%- for intf_name, intf in configuration.interfaces.items() %}
{%-  if intf.type == "ethernetCsmacd" %}
interface {{ intf.name }}
{%-    if intf.description %}
 description {{ intf.description.value }}
{%-    endif %}
{%- if 'vrf' in intf %}
 vrf forwarding {{ intf.vrf}}
{%- endif %}
{%- if 'ipv4' in intf %}
{%-    if intf.ipv4 %}
 ip address {{ intf.ipv4.value|cidr_to_addrmask }}
{%-     endif %}
{%- endif %}
{%-  if intf.access_vlan %}
 switchport access vlan {{ intf.access_vlan.value }}
{%-  endif %}
{%-  if intf.switchport_mode and intf.switchport_mode.value == "access" %}
 switchport mode access
{%-  endif %}
{%-  if intf.switchport_mode and intf.switchport_mode.value == "trunk" %}
 switchport mode trunk
{%-  endif %}
{%-  if intf.native_vlan %}
 switchport trunk native vlan {{ intf.native_vlan.value }}
{%-  endif %}
{%-  if intf.trunk_allowed_vlans %}
 switchport trunk allowed vlan {{ intf.trunk_allowed_vlans.value | join(',') }}
{%-  endif %}
{%-  if intf.voice_vlan %}
 switchport voice vlan {{ intf.voice_vlan.value }}
{%-  endif %}
{%-  if intf.lacp_enabled %}
 channel-group {{ intf.aggregate_id.value }} mode {{ intf.lacp_mode.value | default('active') }}
{%-    if intf.lacp_port_priority %}
 lacp port-priority {{ intf.lacp_port_priority.value }}
{%-    endif %}
{%-    if intf.lacp_interval %}
 lacp rate {{ intf.lacp_interval.value }}
{%-    endif %}
{%-  endif %}
{%-  if intf.dtp_negotiation and intf.dtp_negotiation.value == False %}
 switchport nonegotiate
{%-  endif %}
{%-  if intf.storm_control %}
{%-    if intf.storm_control.broadcast_pps %}
 storm-control broadcast level pps {{ intf.storm_control.broadcast_pps.value }}
{%-    endif %}
{%-    if intf.storm_control.multicast_pps %}
 storm-control multicast level pps {{ intf.storm_control.multicast_pps.value }}
{%-    endif %}
{%-    if intf.storm_control.unknown_unicast_pps %}
 storm-control unknown-unicast level pps {{ intf.storm_control.unknown_unicast_pps.value }}
{%-    endif %}
{%-    if intf.storm_control.action %}
 storm-control action {{ intf.storm_control.action.value }}
{%-    endif %}
{%-  endif %}
{{- render_augments(intf.get('augments'), " ") -}}
{%-  if intf.logging_link_status and intf.logging_link_status.value == False %}
 no logging event link-status
{%-  endif %}
{%-  if intf.snmp_link_status_trap and intf.snmp_link_status_trap.value == False %}
 no snmp trap link-status
{%-  endif %}
{%-  if intf.auto_mdix and intf.auto_mdix.value == False %}
 no mdix auto
{%- endif %}
{%-    if intf.interface_template %}
 source template {{ intf.interface_template.pointer.split('.') | last }}
{%-    endif %}
{%-  if intf.stp_portfast and intf.stp_portfast.value == True %}
 spanning-tree portfast
{%- endif %}
{%-  if intf.enabled and intf.enabled.value == False %}
 shutdown
{%-   endif %}
{%-  endif %}
{%-  if intf.type == "ethernetCsmacd" %}
!
{%-  endif %}
{%- endfor %}
{%- for _, intf in configuration.interfaces.items() %}
{%-  if intf.type == "l3ipvlan" and intf.vlan_id %}
interface vlan{{ intf.vlan_id.value }}
{%-    if intf.description %}
 description {{ intf.description.value }}
{%-    endif %}
{%- if 'vrf' in intf %}
 vrf forwarding {{ intf.vrf}}
{%- endif %}
{%-    if intf.ipv4 %}
 ip address {{ intf.ipv4.value|cidr_to_addrmask }}
{%-     endif %}
{%-    if intf.enabled and intf.enabled.value %}
 no shutdown
{%- else %}
 shutdown
{%-     endif %}
!
{%-  endif %}
{%- endfor %}
!
{%- for _, intf in configuration.interfaces.items() %}
{%-  if intf.type == "ManagementInterface" and intf.name %}
interface {{ intf.name.value }}
{%-    if intf.description %}
 description {{ intf.description.value }}
{%-    endif %}
{%- if 'vrf' in intf %}
 vrf forwarding {{ intf.vrf}}
{%- endif %}
{%-    if intf.ipv4 %}
 ip address {{ intf.ipv4.value|cidr_to_addrmask }}
{%-     endif %}
{%-    if intf.enabled and intf.enabled.value %}
 no shutdown
{%- else %}
 shutdown
{%-     endif %}
{%-  endif %}
{%-  if intf.type == "ManagementInterface" and intf.name %}
!
{%-  endif %}
{%- endfor %}
!
{%- if configuration.system.config.default_gateway is defined and configuration.system.config.default_gateway %}
ip default-gateway {{ configuration.system.config.default_gateway }}
{%- endif %}
ip forward-protocol nd
!
ip http server
ip http secure-server
!
{%- if configuration.acl.ipv4_acls %}
{%- for acl_name, acl in configuration.acl.ipv4_acls.items() %}
{%-   set acl_type = acl.type.value | default('standard') %}
ip access-list {{ acl_type }} {{ acl_name }}
{%-   for entry in acl.acl_entries.values() %}
  {%-     set seq = entry.sequence_id.value if entry.sequence_id else none %}
  {%-     set src = entry.source_address.value if entry.source_address else 'any' %}
  {%-     set dst = entry.destination_address.value if entry.destination_address else 'any' %}
  {%-     if entry.description %}
 {{ seq }} remark {{ entry.description.value }}
  {%-     endif %}
  {%-     if acl_type == 'standard' %}
 {{ seq }} {{ entry.action.value }} {% if src == 'any' %}any{% elif src is string and src.endswith('/32') %}{{ src.split('/') | first }}{% else %}{{ src | cidr_to_addrmask }}{% endif %}
  {%-     else %}
 {{ seq }} {{ entry.action.value }} {% if entry.protocol and entry.protocol.value != 'ip' %}{{ entry.protocol.value }}{% else %}ip{% endif %} {% if src == 'any' %}any{% elif src is string and src.endswith('/32') %}host {{ src.split('/') | first }}{% else %}{{ src | cidr_to_addrmask }}{% endif %} {% if dst == 'any' %}any{% elif dst is string and dst.endswith('/32') %}host {{ dst.split('/') | first }}{% else %}{{ dst | cidr_to_addrmask }}{% endif %}
  {%-     endif %}
  {%-   endfor %}
{%-   endfor %}
{%- endif %}
!
{%- set ssh = configuration.system.ssh.config -%}
{%- if ssh and ssh.get('enable') and ssh.get('enable').value %}
{%-   if ssh.get('protocol_version') %}
ip ssh version {{ ssh.get('protocol_version').value | default(2) }}
{%-   endif %}
{%-   set ssh_logging_events = (configuration.system.logging.config.augments or {}).get('cisco.ssh_logging') %}
{%-   if ssh_logging_events and ssh_logging_events.enabled and ssh_logging_events.enabled.value %}
ip ssh logging events
{%-   endif %}
{%-   if ssh.get('timeout') %}
ip ssh time-out {{ ssh.get('timeout').value }}
{%-   endif %}
{%-   if ssh.get('auth_retries') %}
ip ssh authentication-retries {{ ssh.get('auth_retries').value }}
{%-   endif %}
{%-   if ssh.get('source_interface') %}
ip ssh source-interface {{ ssh['source_interface'] }}
{%-   endif %}
{%- endif %}
!
{%- set snmp = configuration.system.snmp if configuration.system is defined and configuration.system.snmp is defined else none %}
{%- if snmp %}
{%-   set default_snmp_user = (snmp.users.values() | first) if snmp.users else none %}
{%-   for _, group in (snmp.groups or {}).items() %}
{%-     set group_name = group.name.value if group.name else none %}
{%-     set group_view = (group.views.values() | first) if group.views else none %}
{%-     set view_name = group_view.pointer.split('.') | last if group_view and group_view.pointer else none %}
{%-     set access_name = group.access.value if group.access else 'READ_ONLY' %}
{%-     if group_name %}
snmp-server group {{ group_name }} v3 auth{% if view_name %} read {{ view_name }}{% endif %}{% if view_name and access_name in ['READ_WRITE', 'READ_CREATE'] %} write {{ view_name }}{% endif %}{% if group.ipv4acl and group.ipv4acl.pointer %} access {{ group.ipv4acl.pointer.split('.') | last }}{% endif %}
{%-     endif %}
{%-   endfor %}
{%-   for _, view in (snmp.views or {}).items() %}
{%-     for _, oid in (view.oids or {}).items() %}
{%-       if view.name and oid.oid %}
snmp-server view {{ view.name.value }} {{ oid.oid.value }} {% if oid.included and oid.included.value %}included{% else %}excluded{% endif %}
{%-       endif %}
{%-     endfor %}
{%-   endfor %}
{%-   for _, cfg in (snmp.config or {}).items() %}
{%-     if cfg.location %}
snmp-server location {{ cfg.location.value }}
{%-     endif %}
{%-     if cfg.contact %}
snmp-server contact {{ cfg.contact.value }}
{%-     endif %}
{%-   endfor %}
{%-   for _, community in (snmp.communities or {}).items() %}
{%-     if community.community %}
snmp-server community {{ community.community.value }}{% if community.ipv4acl and community.ipv4acl.pointer %} {{ community.ipv4acl.pointer.split('.') | last }}{% endif %}
{%-     endif %}
{%-   endfor %}
{%-   for _, server in (snmp.trap_servers or {}).items() %}
{%-     if server.enabled and server.enabled.value and server.address %}
snmp-server host {{ server.address.value }}{% if server.network_instance and server.network_instance.value != 'global' %} vrf {{ server.network_instance.value }}{% endif %}{% if server.version %} version {{ '3' if server.version.value == 'v3' else server.version.value }}{% endif %}{% if server.version and server.version.value == 'v3' %} auth {% if server.username %}{{ server.username.value }}{% elif default_snmp_user and default_snmp_user.username %}{{ default_snmp_user.username.value }}{% endif %}{% elif server.community %} {{ server.community.value }}{% endif %}
{%-     endif %}
{%-   endfor %}
{%- endif %}
!
{%- for _, group in configuration.system.aaa.server_groups.items() %}
{%-   if group.tacacs %}
{%-     for server_name, server in group.tacacs.items() %}
tacacs server {{ server_name }}
{%-       if server.address %}
 address ipv4 {{ server.address.value }}
{%-       endif %}
{%-       if server.port %}
 port {{ server.port.value }}
{%-       endif %}
{%-       if server.secret_key_hashed %}
 key 7 {{ server.secret_key_hashed.value }}
{%-       elif server.secret_key %}
 key 0 {{ server.secret_key.value }}
{%-       endif %}
{%-       if server.timeout %}
 timeout {{ server.timeout.value }}
{%-       endif %}
!
{%-     endfor %}
{%-   endif %}
{%-   if group.radius %}
{%-     for server_name, server in group.radius.items() %}
radius server {{ server_name }}
{%-       if server.address %}
 address ipv4 {{ server.address.value }}{% if server.auth_port %} auth-port {{ server.auth_port.value }}{% endif %}{% if server.acct_port %} acct-port {{ server.acct_port.value }}{% endif %}
{%-       endif %}
{%-       if server.secret_key_hashed %}
 key 7 {{ server.secret_key_hashed.value }}
{%-       elif server.secret_key %}
 key 0 {{ server.secret_key.value }}
{%-       endif %}
{%-       if server.timeout %}
 timeout {{ server.timeout.value }}
{%-       endif %}
!
{%-     endfor %}
{%-   endif %}
{%- endfor %}
{%- if "lacp" in configuration -%}
{%-   if configuration.lacp.config.system_priority %}
lacp system-priority {{ configuration.lacp.config.system_priority.value }}
{%-   endif %}
{%-   if configuration.lacp.config.system_id_mac %}
lacp system-id mac {{ configuration.lacp.config.system_id_mac.value }}
{%-   endif %}
{%-   if configuration.lacp.config.load_balance_algorithm %}
{%-     set alg = configuration.lacp.config.load_balance_algorithm.value %}
{%-     if alg is string %}
port-channel load-balance {{ alg }}
{%-     elif alg is sequence and alg | length >= 2 %}
port-channel load-balance extended {{ alg | join(' ') }}
{%-     elif alg is sequence and alg | length == 1 %}
port-channel load-balance {{ alg[0] }}
{%-     else %}
port-channel load-balance {{ alg }}
{%-     endif %}
{%-   endif %}
{%- endif %}
!
{%- if configuration.system.ntp.servers -%}
{%- for server in configuration.system.ntp.servers.values() %}
{%-   if server.prefer %}
ntp server {{ server.address.value }} prefer
{%-   else %}
ntp server {{ server.address.value }}
{%-   endif %}
{%- endfor %}
{%- endif %}
!
{%- set dh_min_size = (configuration.system.ssh.config.augments or {}).get('cisco_dh_min_size') %}
{%- if dh_min_size %}
ip ssh dh min size {{ dh_min_size.dh_min_size.value }}
{%- endif %}
!
{%- if configuration.system.logging -%}
{%-   if configuration.system.logging.get('remote_servers') %}
{%-     for server_group in configuration.system.logging.get('remote_servers').values() %}
{%-       for _, server in server_group.items() %}
{%-         if server.host and server.host.value %}
{%-           if server.source_address and server.source_address.value %}
logging source-interface {{ server.source_address.value }}
{%-           endif %}
logging host {{ server.host.value }}
{%-         endif %}
{%-       endfor %}
{%-     endfor %}
{%-   endif %}
{%- endif %}
!
line con 0
 logging synchronous
 exec-timeout 0 0
line vty 0 4
 transport input ssh
!
end