Dear Clarke,
I have separate the policy in to two part and tried to run. i.e.
BLOCK.tcl
========
::cisco::eem::event_register_syslog pattern {ip sla 11 reachability Up->Down}
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set arr_einfo [event_reqinfo]
if [catch {cli_open} result] {
error $result $errorInfo
} else {
array set cli1 $result
}
if [catch {cli_exec $cli1(fd) "enable"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "configure term"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "interface fa0/0"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "ip access-group BLOCK out"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "ip access-group BLOCK in"} _cli_result] {
error $_cli_result $errorInfo
}
action_syslog msg "blocking non-critical traffic"
# Close open cli before exit.
catch {cli_close $cli1(fd) $cli1(tty_id)} result
Allow.tcl
=======
::cisco::eem::event_register_syslog pattern {ip sla 11 reachability Down->Up}
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set arr_einfo [event_reqinfo]
if [catch {cli_open} result] {
error $result $errorInfo
} else {
array set cli1 $result
}
if [catch {cli_exec $cli1(fd) "enable"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "configure term"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "interface fa0/0"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "no ip access-group BLOCK out"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "no ip access-group BLOCK in"} _cli_result] {
error $_cli_result $errorInfo
}
action_syslog msg "Allowing non-critical traffic"
# Close open cli before exit.
catch {cli_close $cli1(fd) $cli1(tty_id)} result
When I have run the olicy, the policy is working and action syslog is displayed but the the CLI CMD which i want to execute , are not applied on interface i.e. ip access-group BLOCK out and no ip access-group BLOCK out
We are using TACACS+ with the policy :
aaa new-model
!
!
aaa authentication login local_authen local
aaa authentication login RADIUS_AUTH group tacacs+
aaa authorization config-commands
aaa authorization exec RADIUS_AUTH group tacacs+ local if-authenticated
aaa authorization commands 0 default group tacacs+ local if-authenticated
aaa authorization commands 1 default group tacacs+ local if-authenticated
aaa authorization commands 15 default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
Pls suggest how can i resolve this issue? How can I execute the CLI cmds via TCL script?
Regards
