09-29-2017 02:13 AM - edited 03-01-2019 04:00 AM
I'm developing a python based service to manage an ACL. I need to put particular ACL rule entries at particular places. I've seen from the dry-run as well as this template:
https://github.com/NSO-developer/nso-firewall-services/blob/master/templates/firewall-rule.xml
That functionality to do this has been added. What's not clear to me is how to set my python variables to ensure I can control where a few entry is placed within the ACL order.
Can someone provide me with some examples?
Solved! Go to Solution.
10-02-2017 10:21 AM
I replied off-line to Ben, but for the benefit of others, I gave this as an "example" -- using ASA NETSIM...
** I have some rules and i want to "insert" a new one somewhere in the list. We can check CLI to see
how the NED wants to handle this...
admin@ncs% insert rule
Possible completions:
<WORD> - quoted rule beginning with: remark|standard|extended|webtype, followed by options (e.g. log|inactive). For example: "extended permit tcp any any" log
remark - this is the inside out traffic -
extended permit ip host 10.1.1.10 any -
extended permit ip host 10.1.1.12 any -
extended permit ip host 10.1.1.14 any -
remark - this is the hr admin address -
extended permit ip host 10.1.1.40 any -
admin@ncs% insert rule "extended permit tcp port 80 host any" ?
Possible completions:
after before first last
admin@ncs% insert rule "extended permit tcp port 80 host any" before ?
Possible completions:
remark - this is the inside out traffic
extended permit ip host 10.1.1.10 any
extended permit ip host 10.1.1.12 any
extended permit ip host 10.1.1.14 any
remark - this is the hr admin address <---------let's pick this to "insert before" this remark...
extended permit ip host 10.1.1.40 any
admin@ncs% insert rule "extended permit tcp port 80 host any" before "remark - this is the hr admin address"
[ok][2017-09-30 10:06:37]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run
cli {
local-node {
data devices {
device asa0 {
config {
asa:access-list {
access-list-id Corona {
+ # after rule "extended permit ip host 10.1.1.14 any" <--- the NED decided this...
+ rule "extended permit tcp port 80 host any";
}
}
}
}
}
}
}
[ok][2017-09-30 10:06:40]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run outformat xml <--------------- Look at the XML to see how...
result-xml {
local-node {
data <devices xmlns="http://tail-f.com/ns/ncs">
<device>
<name>asa0</name>
<config>
<access-list xmlns="http://cisco.com/ned/asa">
<access-list-id>
<id>Corona</id>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit ip host 10.1.1.14 any']">
<id>extended permit tcp port 80 host any</id>
</rule>
</access-list-id>
</access-list>
</config>
</device>
</devices>
}
}
[ok][2017-09-30 10:06:45]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs%
That's it - a small example
10-02-2017 10:21 AM
I replied off-line to Ben, but for the benefit of others, I gave this as an "example" -- using ASA NETSIM...
** I have some rules and i want to "insert" a new one somewhere in the list. We can check CLI to see
how the NED wants to handle this...
admin@ncs% insert rule
Possible completions:
<WORD> - quoted rule beginning with: remark|standard|extended|webtype, followed by options (e.g. log|inactive). For example: "extended permit tcp any any" log
remark - this is the inside out traffic -
extended permit ip host 10.1.1.10 any -
extended permit ip host 10.1.1.12 any -
extended permit ip host 10.1.1.14 any -
remark - this is the hr admin address -
extended permit ip host 10.1.1.40 any -
admin@ncs% insert rule "extended permit tcp port 80 host any" ?
Possible completions:
after before first last
admin@ncs% insert rule "extended permit tcp port 80 host any" before ?
Possible completions:
remark - this is the inside out traffic
extended permit ip host 10.1.1.10 any
extended permit ip host 10.1.1.12 any
extended permit ip host 10.1.1.14 any
remark - this is the hr admin address <---------let's pick this to "insert before" this remark...
extended permit ip host 10.1.1.40 any
admin@ncs% insert rule "extended permit tcp port 80 host any" before "remark - this is the hr admin address"
[ok][2017-09-30 10:06:37]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run
cli {
local-node {
data devices {
device asa0 {
config {
asa:access-list {
access-list-id Corona {
+ # after rule "extended permit ip host 10.1.1.14 any" <--- the NED decided this...
+ rule "extended permit tcp port 80 host any";
}
}
}
}
}
}
}
[ok][2017-09-30 10:06:40]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs% commit dry-run outformat xml <--------------- Look at the XML to see how...
result-xml {
local-node {
data <devices xmlns="http://tail-f.com/ns/ncs">
<device>
<name>asa0</name>
<config>
<access-list xmlns="http://cisco.com/ned/asa">
<access-list-id>
<id>Corona</id>
<rule xmlns:yang="urn:ietf:params:xml:ns:yang:1"
xmlns:ncs="http://tail-f.com/ns/ncs"
yang:insert="after"
yang:key="[ncs:id='extended permit ip host 10.1.1.14 any']">
<id>extended permit tcp port 80 host any</id>
</rule>
</access-list-id>
</access-list>
</config>
</device>
</devices>
}
}
[ok][2017-09-30 10:06:45]
[edit devices device asa0 config access-list access-list-id Corona]
admin@ncs%
That's it - a small example
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide