Discussion:
filter_audit
Yuval Ben-Ari
2006-07-29 11:54:45 UTC
Permalink
Hi,

I just installed filter_audit for our routers config and find it very
cool ;)
I was wondering if it is still being maintained ?
We have quite big config base and we have various config that the tool
does not properly support (many filter reference commands that are not
recognized).
I started adding the missing rules / regexps to filter_audit.awk file.
It would be great if my changes can be included in next release.

Thanks ahead.

---
Yuval Ben-Ari
Network Engineer
***@netvision.net.il
NetVision Ltd.
Joe Abley
2006-07-29 19:22:38 UTC
Permalink
Hi Yuval,

Sorry for not replying to the mail you sent directly to me a while
ago. I've been busy.
Post by Yuval Ben-Ari
I just installed filter_audit for our routers config and find it very
cool ;)
I was wondering if it is still being maintained ?
We have quite big config base and we have various config that the tool
does not properly support (many filter reference commands that are not
recognized).
I started adding the missing rules / regexps to filter_audit.awk file.
It would be great if my changes can be included in next release.
The tool has not been maintained in any systematic way for a long
time; it was intended more as an example to accompany a NANOG talk on
tools/scripting than a product in any conventional sense. The idea
was to give people a starting point from which they could move
forward with their own customisation.

If you're interested in sending me patches, I can certainly look at
them though.

Thanks,


Joe
Howard C. Berkowitz
2006-07-29 19:50:20 UTC
Permalink
Post by Joe Abley
Hi Yuval,
Sorry for not replying to the mail you sent directly to me a while
ago. I've been busy.
Post by Yuval Ben-Ari
I just installed filter_audit for our routers config and find it very
cool ;)
I was wondering if it is still being maintained ?
We have quite big config base and we have various config that the tool
does not properly support (many filter reference commands that are not
recognized).
I started adding the missing rules / regexps to filter_audit.awk file.
It would be great if my changes can be included in next release.
The tool has not been maintained in any systematic way for a long
time; it was intended more as an example to accompany a NANOG talk on
tools/scripting than a product in any conventional sense. The idea
was to give people a starting point from which they could move
forward with their own customisation.
If you're interested in sending me patches, I can certainly look at
them though.
I've also been thinking of a couple of extensions, partially because they are
useful and partially because I haven't been coding in a while. Slightly
different than filter_audit would be something that checks for the existence and
linkage of the multiple maps Cisco requires for the modular quality of service
interface.
<br>Perhaps as a less ambitious project, I've also considered writing a tool
that gives a cross-reference to the appearance of certain IP addresses, first in
a single router configuration, and then across multiple configurations.
<br>Has anyone tried either of these? Is there interest? Is there another tool
that does these functions?
Yuval Ben-Ari
2006-07-29 22:52:25 UTC
Permalink
Post by Joe Abley
Hi Yuval,
Sorry for not replying to the mail you sent directly to me a while
ago. I've been busy.
no problem.
Post by Joe Abley
The tool has not been maintained in any systematic way for a long
time; it was intended more as an example to accompany a NANOG
talk on
tools/scripting than a product in any conventional sense. The idea
was to give people a starting point from which they could move
forward with their own customisation.
ok, currently I have 2 things in mind:
- update the rules in filter_audit.awk to match missing filters
reference/definition methods (IOS is very messy in this and there are
more ways to reference an ACL than you can imagine :-( )
- thinking of adding support to multiple rancid groups (currently only
one group supported)
Post by Joe Abley
If you're interested in sending me patches, I can certainly look at
them though.
I will send you once I have something complete.
Post by Joe Abley
Thanks,
Joe
Yuval Ben-Ari
2006-07-29 23:00:56 UTC
Permalink
Post by Howard C. Berkowitz
I've also been thinking of a couple of extensions, partially because
they are
Post by Howard C. Berkowitz
useful and partially because I haven't been coding in a while.
Slightly
Post by Howard C. Berkowitz
different than filter_audit would be something that checks for the
existence and
Post by Howard C. Berkowitz
linkage of the multiple maps Cisco requires for the modular quality of
service
Post by Howard C. Berkowitz
interface.
allow me to rant a little bit. I think if IOS was decently coded to
begin with we did not
need to spend all this time writing all these tools !!!
how trivial could it be to check for an existance of a filter before
applying it ???
same for other filter maps reference and MQC
I am willing to spend the time on filter_audit tool because the given
situation is that we
have many IOS devices and I don't see IOS fixed very soon (although XR
already available).
Post by Howard C. Berkowitz
<br>Perhaps as a less ambitious project, I've also considered writing
a tool
Post by Howard C. Berkowitz
that gives a cross-reference to the appearance of certain IP
addresses, first in
Post by Howard C. Berkowitz
a single router configuration, and then across multiple
configurations.
Post by Howard C. Berkowitz
<br>Has anyone tried either of these? Is there interest? Is there
another tool
Post by Howard C. Berkowitz
that does these functions?
not sure I fully understand, you mean check for duplicate IP address ?
AFAIK, IOS will not allow to use duplicate IP on same router, or will
issue a warning
regarding duplicate IP on multiple devices, IOS will generate an error
log which I use to generate email alert, works ok for us.
Howard C. Berkowitz
2006-07-29 22:10:20 UTC
Permalink
Post by Howard C. Berkowitz
Post by Howard C. Berkowitz
I've also been thinking of a couple of extensions, partially because
they are
Post by Howard C. Berkowitz
useful and partially because I haven't been coding in a while.
Slightly
Post by Howard C. Berkowitz
different than filter_audit would be something that checks for the
existence and
Post by Howard C. Berkowitz
linkage of the multiple maps Cisco requires for the modular quality of
service
Post by Howard C. Berkowitz
interface.
allow me to rant a little bit. I think if IOS was decently coded to
begin with we did not
need to spend all this time writing all these tools !!!
how trivial could it be to check for an existance of a filter before
applying it ???
I shall join the rant. Actually, there was a behavior change in IOS 10.3.
Before then, if you defined an access-group without a corresponding access-list,
IOS would assume the existence of such a list, composed only of an "implicit
deny all", stopping everything on the interface.
Post by Howard C. Berkowitz
From a security standpoint, thinking of the Principle of Least Privilege, that's
really the theoretically correct behavior. Nevertheless, Cisco changed the
default to "permit all" if there was no corresponding access-list.

[cisco voice]
What's this "warning message" you keep mentioning?
[/cisco voice]

Which is a bit unfair, as there are some warning messages during configuration
but, AFAIK, only with a scope of a single command -- if one accepts "bad mask"
as a meaningful message for half a dozen conditions
Post by Howard C. Berkowitz
same for other filter maps reference and MQC
I am willing to spend the time on filter_audit tool because the given
situation is that we
have many IOS devices and I don't see IOS fixed very soon (although XR
already available).
Post by Howard C. Berkowitz
<br>Perhaps as a less ambitious project, I've also considered writing
a tool
Post by Howard C. Berkowitz
that gives a cross-reference to the appearance of certain IP
addresses, first in
Post by Howard C. Berkowitz
a single router configuration, and then across multiple
configurations.
Post by Howard C. Berkowitz
<br>Has anyone tried either of these? Is there interest? Is there
another tool
Post by Howard C. Berkowitz
that does these functions?
not sure I fully understand, you mean check for duplicate IP address ?
AFAIK, IOS will not allow to use duplicate IP on same router, or will
issue a warning
regarding duplicate IP on multiple devices, IOS will generate an error
log which I use to generate email alert, works ok for us.
No, I'm thinking of something that (gasp) I had with the IBM 360 assembler and
other compilers and assemblers.

At the end of a configuration (to start), it would list an address (or a
subnet), and tell you all the statements that referenced it. For example,
ip address
access-list (and probably indirect references in maps)
ospf network statements
server references
static routes
as a starting point. In other words, it tells you EVERYWHERE you need to make
changes when you change an address or something affecting it.

The next step would be to extend the scope beyond a single router, grabbing the
hostname to prefix the cross-reference. Again, the idea is that if an address
changes, you have a positive confirmation of every configuration that may need
to be changed. It's also a debugging tool, because you know which routers
affect that address.
john heasley
2006-07-29 22:19:03 UTC
Permalink
Post by Howard C. Berkowitz
No, I'm thinking of something that (gasp) I had with the IBM 360 assembler and
other compilers and assemblers.
At the end of a configuration (to start), it would list an address (or a
subnet), and tell you all the statements that referenced it. For example,
ip address
access-list (and probably indirect references in maps)
ospf network statements
server references
static routes
as a starting point. In other words, it tells you EVERYWHERE you need to make
changes when you change an address or something affecting it.
To some degree this is called Juniper/JunOS or Procket. Oh, wait, Cisco
killed off Procket.
Yuval Ben-Ari
2006-07-30 10:23:48 UTC
Permalink
Post by Howard C. Berkowitz
No, I'm thinking of something that (gasp) I had with the IBM
360 assembler and
other compilers and assemblers.
At the end of a configuration (to start), it would list an
address (or a
subnet), and tell you all the statements that referenced it.
For example,
ip address
access-list (and probably indirect references in maps)
ospf network statements
server references
static routes
as a starting point. In other words, it tells you EVERYWHERE
you need to make
changes when you change an address or something affecting it.
The next step would be to extend the scope beyond a single
router, grabbing the
hostname to prefix the cross-reference. Again, the idea is
that if an address
changes, you have a positive confirmation of every
configuration that may need
to be changed. It's also a debugging tool, because you know
which routers
affect that address.
I don't think it's something I can have use for very often. (IP address
changes).
this also sounds it could be tricky to program
I use primitive checks like: "sh run | inc x\.y\.z\." to catch config
that might refer to the subnet.
also on clean config I think you should refere to ip address as least as
possible. (f.e. static route point to interface will not require any
changes)
Howard C. Berkowitz
2006-07-30 09:37:04 UTC
Permalink
Post by Yuval Ben-Ari
Post by Howard C. Berkowitz
No, I'm thinking of something that (gasp) I had with the IBM
360 assembler and
other compilers and assemblers.
At the end of a configuration (to start), it would list an
address (or a
subnet), and tell you all the statements that referenced it.
For example,
ip address
access-list (and probably indirect references in maps)
ospf network statements
server references
static routes
as a starting point. In other words, it tells you EVERYWHERE
you need to make
changes when you change an address or something affecting it.
The next step would be to extend the scope beyond a single
router, grabbing the
hostname to prefix the cross-reference. Again, the idea is
that if an address
changes, you have a positive confirmation of every
configuration that may need
to be changed. It's also a debugging tool, because you know
which routers
affect that address.
I don't think it's something I can have use for very often. (IP address
changes).
Unfortunately, I suppose, it's something I do fairly often, as, for example,
when a small ISP gets its first PI allocation. Alternatively, we can come into
an existing ISP that really hasn't been documenting, and we have to both create
current documentation and rationalize the addressing and performance. I agree
it would be needed much less often in a running ISP, unless you have the
misfortune to have to deal with networks redefined by merger, acquisition, or
divestiture.
Post by Yuval Ben-Ari
this also sounds it could be tricky to program
Agreed. At a minimum, you have to recognize:
1. The /32 address itself
2. The address if contained in a /length or under a subnet mask
3. The address if contained in an inverse mask (access list or ospf
network statment)
Post by Yuval Ben-Ari
I use primitive checks like: "sh run | inc x\.y\.z\." to catch config
that might refer to the subnet.
also on clean config I think you should refere to ip address as least as
possible. (f.e. static route point to interface will not require any
changes)
True about the specifying an interface on a static route, but that does have
different behavior than using a next-hop address. In particular, using the
interface reference can't force recursion, so if that next-hop address is not
adjacent and dynamic routing fails to get it into a routing table, you then have
a recognizable error condition. Of course, you can potentially get out of such
an error by having additional static routes with
Yuval Ben-Ari
2006-07-31 11:21:12 UTC
Permalink
Gentlemen,
If this is going to be an ongoing discussion lets point it to
If making heads/tails of IOS is the issue please tell me
I'm not the only
survivor of a compiler construction class who is reading this
... there must be
a public body of work already done for this and it would
appear that Cisco uses
http://scottstuff.net/blog/articles/tag/cisco
Neal
yes, I did survive a compiler construction class recently, but I don't
think we really want to program at such high level. we only want simple
tool to do config parsing.
Joe Abley
2006-07-31 12:05:39 UTC
Permalink
Gentlemen,
If this is going to be an ongoing discussion lets point it to
This is perfectly on-topic for ***@isc.org. This is precisely
what this list was created for, in fact :-)


Joe

Loading...