feat(tl1): Infinera and Cisco ONS templates, and TL1 stops being a Ciena exception (RCO-1454)

CHANGELOG.md

@@ -18,6 +18,41 @@ A major version here means paths changed. Every rename and deletion is mapped in
 - `juniper/juniper-junos-ssh-noenable-kex.yml`, adding the new `kexOverride` /
   `kexAlgorithms` connect keys to force a legacy KEX algorithm list for JunOS devices
   that don't negotiate cleanly against phpseclib's modern defaults.
+- **Infinera DTN-X TL1 templates** (`infinera/infinera-dtnx-tl1-ssh.yml`,
+  `infinera/infinera-dtnx-tl1-telnet.yml`) and an `infinera/README.md`. A DTN-X presents `>`
+  rather than `<`, pages its neighbour response, and answers a routed command under its own
+  system name instead of the TID addressed. All three break assumptions carried over from Ciena.
+- **Cisco ONS 15454 TL1 templates** (`cisco/cisco-ons15454-tl1-ssh.yml`,
+  `cisco/cisco-ons15454-tl1-telnet.yml`), shipped `untested-starter`. Built from the Cisco ONS
+  SONET TL1 Command Guide R9.1 and Oracle's TL1 reference, **not from a session capture**. Its
+  records are positional rather than keyword-based, and it is the one TL1 platform that reports a
+  real model per element.
+- **`connect.tl1Vendor`**, the 48th key: `ciena` (default), `infinera` or `cisco-ons`. Selects the
+  neighbour verb, the record format, the prompt, and whether a routed reply's SID can be verified.
+  An unrecognised value fails the collection rather than falling back.
+- **`docs/TL1.md`**, a vendor-neutral guide to TL1: in-band login, gateways and dual-homed
+  elements, connection limits, and a table of what actually differs between the three platforms.
+- `cisco/README.md` rewritten from 15 lines of caveats into a full template table, the ONS 15454
+  section, and the existing FTD and WLC guidance with its typos fixed.
+
+### Changed
+- **The "TL1 templates live in `ciena/`" exception is gone.** TL1 templates live with their
+  vendor, like every other template here, which makes `cisco/` a mixed-edition directory.
+  Edition follows the capability a template uses, never the directory. Restated in
+  `docs/EDITIONS.md` and `pro-features/README.md`.
+- Ciena templates now carry `tl1Vendor: ciena` and no longer set `tl1NeighbourCmd`. The old
+  default, `RTRV-NBR:ALL`, named a command no shipped node answers; each vendor's real command is
+  the default now. rConfig substitutes it and logs a warning for templates still naming the old
+  verb.
+- `ciena/README.md` keeps only what is Ciena-specific. The shared TL1 concepts it used to state as
+  universal moved to `docs/TL1.md`.
+- `scripts/validate_templates.py` now requires a vendor template's filename to start with its
+  directory name. Every file in the library already did; it is worth enforcing now that one
+  protocol spans three vendor directories.
+- Key counts corrected to 48 across `docs/TEMPLATES.md`, `docs/EDITIONS.md`,
+  `docs/CONTRIBUTING.md` and `README.md`, which disagreed with each other at 47/13/14.
+- README badges corrected to 38 vendors and 74 templates. The template count was already one
+  short before this change.
 
 ## [2.0.0] - 2026-08-16
 

README.md

@@ -10,8 +10,8 @@
 
   <!-- Shields.io badges -->
   <p align="center">
-    <img src="https://img.shields.io/badge/vendors-37-blueviolet?style=for-the-badge&logo=yaml&logoColor=white" alt="Vendors Badge"/>
-    <img src="https://img.shields.io/badge/templates-69-blue?style=for-the-badge&logo=yaml&logoColor=white" alt="Templates Badge"/>
+    <img src="https://img.shields.io/badge/vendors-38-blueviolet?style=for-the-badge&logo=yaml&logoColor=white" alt="Vendors Badge"/>
+    <img src="https://img.shields.io/badge/templates-74-blue?style=for-the-badge&logo=yaml&logoColor=white" alt="Templates Badge"/>
   </p>
 
   <p align="center">
@@ -134,12 +134,18 @@ hardware model belongs in the filename and when it does not.
 ## Template keys
 
 This README carries no key documentation. The full reference lives in
-[docs/TEMPLATES.md](docs/TEMPLATES.md): 47 keys across 7 sections, each with its type, accepted
+[docs/TEMPLATES.md](docs/TEMPLATES.md): 48 keys across 7 sections, each with its type, accepted
 values, default, and which protocols read it.
 
 If your device needs behaviour no existing key can express, open a
 [new key request](https://github.com/rconfig/rConfig-templates/issues/new?template=new-key-request.yml).
 
+## Optical transport (TL1)
+
+Ciena 6500, Infinera DTN-X and Cisco ONS 15454 are managed over TL1 rather than a CLI, which
+behaves differently enough to have its own guide: [docs/TL1.md](docs/TL1.md). Their templates sit
+with their vendor like everything else. TL1 is Pro only on every platform.
+
 ## Community
 
 - Open an [issue](https://github.com/rconfig/rConfig-templates/issues) for a bug, a question, or a template request

ciena/README.md

@@ -7,61 +7,55 @@ Covers Ciena 6500 optical nodes, managed over TL1 rather than a conventional CLI
 | `ciena-6500-tl1-ssh.yml` | 6500 nodes reached over SSH, TL1 carried on the SSH channel |
 | `ciena-6500-tl1-telnet.yml` | 6500 nodes reached over raw TCP on a TL1 port, typically 3082/3083 |
 
-Typical retrieval commands to attach in an rConfig Command Group:
+**Read [docs/TL1.md](../docs/TL1.md) first.** It covers what TL1 is, in-band `ACT-USER` login,
+gateways and dual-homed elements, and `tl1MaxConnections`, none of which is Ciena-specific. What
+follows is only what is particular to a 6500.
 
-```text
-RTRV-EQPT::ALL:100;
-RTRV-ALM-ALL::ALL:101;
-RTRV-SW-VER:::102;
-```
+## The password quoting quirk
 
-## TL1 is not a CLI
+A 6500 rejects a complex password sent bare, which is what prompted rConfig to quote TL1 passwords
+in the first place. rConfig now quotes on every vendor, so this is history rather than
+configuration, but it is the reason the behaviour exists.
 
-There is no enable mode, no pager to turn off, and no configuration save step, so these templates
-leave all three empty. Login is in-band: the node opens on a bare `<` prompt and waits for an
-`ACT-USER` command, which rConfig sends itself. Every command is terminated by `;` and correlated
-by a CTAG that the node echoes back.
+## Neighbour discovery
 
-Passwords are always sent quoted. A 6500 rejects a complex password sent bare, and quoting also
-keeps a password containing `:` — the TL1 field separator — from mis-framing the command.
+A 6500 answers `RTRV-NE-LIST` with one quoted record per remote NE:
 
-## Gateway and remote NEs
+``text
+"SHELF-1::SID=\"RNE-LIMERICK\",NENAME=\"RNE-LIMERICK\",GNE=NO,GNEIPADDR=,INETADDR=10.0.254.3,COST=30,NETYPE=00011600"
+``
 
-Optical networks are reached through a **Gateway NE (GNE)**, the node you actually connect to,
-which fronts **Remote NEs (RNEs)** that have no management access of their own. Set
-`tl1Gateway: "on"` on the GNE's template and rConfig runs `tl1NeighbourCmd` after collecting it,
-discovers the RNEs behind it, and creates a device record for each one. RNEs are then collected
-by addressing their TID in-band over a session to the GNE.
+`RTRV-NODES` reports the same set under different field names (`TID=`, `REMOTESHELF`, `IPADDR`,
+`MEMBER`, `SITEID`) and rConfig parses either, so a template may use whichever a given release
+answers.
 
-An RNE can be **dual-homed** — reachable through two or more GNEs. rConfig identifies an RNE by
-its TID, so an RNE reported by a second gateway gains a second path rather than a duplicate device
-record. One gateway is the primary; if a session through it cannot be established, the collection
-falls over to another.
+`INETADDR` is the RNE's own management address, so discovered RNEs show their own IP rather than
+the gateway's. `GNE=YES` marks a neighbour that is itself a gateway.
 
-## Connection limits
+A 6500 echoes the addressed TID in the response header, so rConfig can confirm a routed reply came
+from the RNE rather than from the gateway answering as itself. Not every vendor does this.
 
-Every RNE collection opens its **own** session to the gateway. A GNE fronting a hundred RNEs would
-otherwise see a hundred sessions attempted as fast as the queue can run them, and a node that
-refuses connections past its own cap fails whichever collections lose that race.
+## `tl1NeighbourCmd`
 
-`tl1MaxConnections` caps how many sessions rConfig opens to one gateway at a time. It defaults to
-`20` and belongs on the **GNE's** template — RNEs inherit their gateway's limit rather than
-carrying one of their own.
+Optional. Leave it unset and `tl1Vendor: ciena` supplies `RTRV-NE-LIST`. Set it to send a
+different verb, for example to pass an AID a particular node needs, and rConfig sends exactly
+what you wrote.
 
-```yaml
-connect:
-  tl1Gateway: "on"
-  tl1MaxConnections: 20
-```
+**One value is not honoured.** A command beginning with `RTRV-NBR` is replaced with `RTRV-NE-LIST`
+and a warning is written to the activity log. rConfig shipped `RTRV-NBR:ALL` as the default
+before 8.4.0, and that verb and its payload format came from rConfig's own simulator rather than
+from hardware, so honouring it means discovering nothing at all. The substitution exists so an
+estate upgrading from an older release keeps collecting while its templates are updated.
 
-A collection that finds no free slot is not a failure: nothing was dialled, so the device is not
-marked unreachable and no failure notification is sent. It waits and retries, giving up after an
-hour. A dual-homed RNE whose primary gateway is at capacity will use its other gateway instead of
-waiting.
+This is the one place rConfig overrides a value you set deliberately. If you have a node that
+genuinely answers `RTRV-NBR`, say so on the issue tracker and the special case will be removed.
 
-Set it to what the node itself will accept. Too high and the node refuses connections; too low and
-a large gateway takes longer to work through its RNEs. Values outside 1 to 500 are clamped, and
-anything non-numeric falls back to the default, so a typo cannot stop a gateway collecting.
+---
+
+## Terminology
+
+Ciena calls the elements behind a gateway **RNEs** (Remote NEs). Cisco calls them ENEs and
+Infinera calls them remote nodes. They are the same idea, and rConfig's UI uses Ciena's term.
 
 See [docs/TEMPLATES.md](../docs/TEMPLATES.md) for what each key means and
 [docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md) before submitting a change.

ciena/ciena-6500-tl1-ssh.yml

@@ -16,6 +16,6 @@ connect:
   protocol: tl1                                     # Connection protocol: 'ssh', 'telnet', 'script' or 'tl1'
   port: 22000                                       # Port number (range: 1-65535)
   sshAuth: password                                 # SSH transport auth: 'password' (SSH+TL1) or 'none' (TL1-only)
-  tl1Gateway: "on"                                  # GNE only: discover RNEs behind this node via RTRV-NBR ('on'/'off')
-  tl1NeighbourCmd: "RTRV-NBR:ALL"                   # Neighbour-discovery command (TID/AID composable)
+  tl1Vendor: ciena                                  # TL1 dialect: sets the neighbour command and record format
+  tl1Gateway: "on"                                  # GNE only: discover the RNEs behind this node ('on'/'off')
   tl1MaxConnections: 20                             # GNE only: max concurrent TL1 sessions rConfig opens to this node

ciena/ciena-6500-tl1-telnet.yml

@@ -17,6 +17,6 @@ connect:
   tl1Transport: telnet                              # TL1 byte transport: 'ssh' (default) | 'telnet'
   port: 23000                                       # Raw-TCP TL1 port (range: 1-65535)
   sshAuth: none                                     # Ignored when tl1Transport: telnet (no transport auth)
-  tl1Gateway: "on"                                  # GNE only: discover RNEs behind this node via RTRV-NBR ('on'/'off')
-  tl1NeighbourCmd: "RTRV-NBR:ALL"                   # Neighbour-discovery command (TID/AID composable)
+  tl1Vendor: ciena                                  # TL1 dialect: sets the neighbour command and record format
+  tl1Gateway: "on"                                  # GNE only: discover the RNEs behind this node ('on'/'off')
   tl1MaxConnections: 20                             # GNE only: max concurrent TL1 sessions rConfig opens to this node

cisco/README.md

@@ -1,14 +1,81 @@
-# Cisco Cisco 1120 FTD firewalls
-You may use the standard Cisco IOS SSH Template for these devices, BUT when configuring the device within the rConfig UI, please use the following as a prompt for the device. '>'
-A single qupte, greater than and single quote. This will ensure you get a full backup.
+# Cisco
 
-# Cisco WLC Controllers
-There are known problems with scripts and automation software connecting to Cisco WLC Controllers due to their implementation of SSH/ Telnet protocols in their software.
+The largest directory in the library, and now a mixed-edition one: the IOS, ASA, SMB and WLC
+templates run on Core and Pro, and the two ONS 15454 TL1 templates are Pro only. That is the same
+rule every other directory follows, which is that a template lives with its hardware. See
+[docs/EDITIONS.md](../docs/EDITIONS.md).
 
-> You may only use the cisco-wlc-ssh-noenable.yml template in this repository.
+| Template | Use for | Edition |
+| --- | --- | --- |
+| `cisco-ios-ssh-enable.yml` | IOS / IOS-XE over SSH, enable password required | Core, Pro |
+| `cisco-ios-ssh-noenable.yml` | IOS / IOS-XE over SSH, account already at privilege 15 | Core, Pro |
+| `cisco-ios-telnet-enable.yml` | IOS / IOS-XE over telnet, enable password required | Core, Pro |
+| `cisco-ios-telnet-enable-nousername.yml` | IOS / IOS-XE over telnet, password-only login with no username prompt | Core, Pro |
+| `cisco-ios-telnet-noenable.yml` | IOS / IOS-XE over telnet, account already at privilege 15 | Core, Pro |
+| `cisco-asa-ssh-enable.yml` | ASA firewalls over SSH | Core, Pro |
+| `cisco-smb-telnet-noenable.yml` | Small Business switches (SG/SF series) over telnet | Core, Pro |
+| `cisco-wlc-ssh-noenable.yml` | Wireless LAN Controllers, SSH only, see below | Core, Pro |
+| `cisco-ons15454-tl1-ssh.yml` | ONS 15454 optical nodes, TL1 on the SSH channel | **Pro** |
+| `cisco-ons15454-tl1-telnet.yml` | ONS 15454 optical nodes, TL1 over raw TCP | **Pro** |
 
-> You may only use SSH, please configure your devices accordingly.
+## ONS 15454 (TL1)
 
-> You may not run the 'shwo run-config' command, as it takes far to long to print out. You may use the 'show run-config commands' instead for running configuration
+> **Status: `untested-starter`.** These two templates and the parser behind them were built from
+> the Cisco ONS SONET TL1 Command Guide R9.1 and Oracle's ONS 15454 TL1 reference. **Nobody has run
+> them against a real node.** Documented is better than invented and weaker than seen on hardware.
+> If you run these, please report what happened so they can move to `community-tested`.
 
-Related Cisco WLC Information: [https://quickview.cloudapps.cisco.com/quickview/bug/CSCve45024](https://quickview.cloudapps.cisco.com/quickview/bug/CSCve45024)
+Read [docs/TL1.md](../docs/TL1.md) for what TL1 is and how gateways work. What is particular to an
+ONS 15454:
+
+**Cisco calls the elements behind a gateway ENEs** (End NEs). Ciena calls them RNEs, and rConfig's
+UI uses Ciena's term.
+
+**`RTRV-MAP-NETWORK` records are positional**, not keyword-based:
+
+``text
+"172.20.222.225,TID-000,15454"
+ <IPADDR>       ,<NODENAME>,<PRODUCT>
+``
+
+`NODENAME` is the TID. `PRODUCT` is the only place any TL1 vendor reports a real platform per
+element, so discovered ENEs carry their own model rather than the gateway's. The vendor
+documentation notes `PRODUCT` comes back as `UNKNOWN` for a node running a different software
+version; rConfig does not store that as a model.
+
+**A gateway lists itself** in its own network map. rConfig drops that record, so the gateway is not
+reconciled as an element behind itself.
+
+### `tl1NeighbourCmd`
+
+Optional. Leave it unset and `tl1Vendor: cisco-ons` supplies `RTRV-MAP-NETWORK`. Set it to send a
+different verb, for example to pass an AID a particular node needs, and rConfig sends exactly
+what you wrote.
+
+**One value is not honoured.** A command beginning with `RTRV-NBR` is replaced with `RTRV-MAP-NETWORK`
+and a warning is written to the activity log. rConfig shipped `RTRV-NBR:ALL` as the default
+before 8.4.0, and that verb and its payload format came from rConfig's own simulator rather than
+from hardware, so honouring it means discovering nothing at all. The substitution exists so an
+estate upgrading from an older release keeps collecting while its templates are updated.
+
+This is the one place rConfig overrides a value you set deliberately. If you have a node that
+genuinely answers `RTRV-NBR`, say so on the issue tracker and the special case will be removed.
+
+## FTD firewalls (1120 and similar)
+
+Use the standard Cisco IOS SSH template, but set the device's prompt in the rConfig UI to `'>'`:
+a single quote, a greater-than, and a single quote. Without it the backup is truncated.
+
+## WLC controllers
+
+Cisco WLC controllers implement SSH and telnet in a way that breaks most automation. Three rules:
+
+- Use `cisco-wlc-ssh-noenable.yml`. No other template in this directory works.
+- Use SSH. Telnet does not work reliably against these controllers.
+- Do not run `show run-config`; it takes far too long to print. Use `show run-config commands`
+  instead for the running configuration.
+
+Background: [CSCve45024](https://quickview.cloudapps.cisco.com/quickview/bug/CSCve45024).
+
+See [docs/TEMPLATES.md](../docs/TEMPLATES.md) for what each key means and
+[docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md) before submitting a change.

cisco/cisco-ons15454-tl1-ssh.yml

@@ -0,0 +1,23 @@
+# rConfig connection template
+## Edition: pro
+## Status: untested-starter
+## Tested-on: not yet tested, please file a template test report
+## Docs: https://docs.rconfig.com/device-management/connection-templates/
+## Community: https://github.com/rconfig/rConfig-templates
+## Note: all free-text values must be wrapped in double quotes " "
+# UNTESTED: built from the Cisco ONS SONET TL1 Command Guide R9.1 and Oracle's ONS 15454
+# TL1 reference, NOT from a session capture. Nobody has run this against a real node.
+# Read cisco/README.md before relying on it, and please report what happens if you do.
+
+main:
+  name: "Cisco ONS 15454 - TL1 over SSH"            # Template name for Cisco ONS 15454 optical nodes
+  desc: "Cisco ONS 15454 optical node, TL1 in-band ACT-USER login over SSH"  # Description for UI display
+
+connect:
+  timeout: 15                                       # Connection timeout (in seconds)
+  protocol: tl1                                     # Connection protocol: 'ssh', 'telnet', 'script' or 'tl1'
+  port: 22000                                       # Port number (range: 1-65535)
+  sshAuth: password                                 # SSH transport auth: 'password' (SSH+TL1) or 'none' (TL1-only)
+  tl1Vendor: cisco-ons                              # TL1 dialect: sets the neighbour command and record format
+  tl1Gateway: "on"                                  # Gateway only: discover the ENEs behind this node ('on'/'off')
+  tl1MaxConnections: 20                             # Gateway only: max concurrent TL1 sessions rConfig opens to this node