Hey Ben
So... i tried this again - from CLI... looked at the XML - and it seems to work - but considering that we need to understand how it's (internally) looking at this... Meaning - what you tried to do (i believe) is use the "after" option.... but keep in mind that once you add a new rule, the "after" position now changes... because any subsequent rule would technically be "after" the new one you just added...
It looks like you can show this, using NSO CLI...
in this example, i added FOUR new rules "before" (i.e. just above) some marked position - in this case (again) a "remark" -- but that doesnt' matter - what matters is i want all four new rules to be inserted just above a line...
again - note the the inserts are all "before" -- but the resulting XML is all "after" syntax...
admin@ncs% edit devices device asa0 config asa:access-list access-list-id Corona
[ok][2017-10-03 11:13:25]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% insert
Possible completions:
after before first last rule
admin@ncs% insert rule
Possible completions:
<WORD> - quoted rule beginning with: remark|standard|extended|webtype, followed by options (e.g. log|inactive).
For example: "extended permit tcp any any" log
remark - this is the inside out traffic -
extended permit ip host 10.1.1.10 any -
extended permit ip host 10.1.1.12 any -
extended permit ip host 10.1.1.14 any -
remark - this is the hr admin address -
extended permit ip host 10.1.1.40 any -
admin@ncs% insert rule "extended permit tcp port 80 host any" before "remark - this is the hr admin address"
[ok][2017-10-03 11:14:50]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% insert rule "extended permit tcp port 81 host any" before "remark - this is the hr admin address"
[ok][2017-10-03 11:14:50]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% insert rule "extended permit tcp port 82 host any" before "remark - this is the hr admin address"
[ok][2017-10-03 11:14:50]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% insert rule "extended permit tcp port 83 host any" before "remark - this is the hr admin address"
[ok][2017-10-03 11:14:50]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run
cli {
local-node {
data devices {
device asa0 {
config {
asa:access-list {
access-list-id Corona {
+ # after rule "extended permit ip host 10.1.1.14 any"
+ rule "extended permit tcp port 80 host any";
+ rule "extended permit tcp port 81 host any";
+ rule "extended permit tcp port 82 host any";
+ rule "extended permit tcp port 83 host any";
}
}
}
}
}
}
}
[ok][2017-10-03 11:14:53]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run | di
^
% Invalid input detected at '^' marker.
admin@ncs% commit dry-run outformat xml
result-xml {
local-node {
data <devices xmlns="http://tail-f.com/ns/ncs">
<device>
<name>asa0</name>
<config>
<access-list xmlns="http://cisco.com/ned/asa">
<access-list-id>
<id>Corona</id>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit ip host 10.1.1.14 any']">
<id>extended permit tcp port 80 host any</id>
</rule>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit tcp port 80 host any']">
<id>extended permit tcp port 81 host any</id>
</rule>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit tcp port 81 host any']">
<id>extended permit tcp port 82 host any</id>
</rule>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit tcp port 82 host any']">
<id>extended permit tcp port 83 host any</id>
</rule>
</access-list-id>
</access-list>
</config>
</device>
</devices>
}
}
[ok][2017-10-03 11:15:05]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs%
so... what we see is NSO converted this "before" request into a series of "after" requests - where each was applied just after the new rule that was just added...
hth
cheers
gregg
