Post by Howard C. BerkowitzPost by Howard C. BerkowitzI've also been thinking of a couple of extensions, partially because
they are
Post by Howard C. Berkowitzuseful and partially because I haven't been coding in a while.
Slightly
Post by Howard C. Berkowitzdifferent than filter_audit would be something that checks for the
existence and
Post by Howard C. Berkowitzlinkage of the multiple maps Cisco requires for the modular quality of
service
allow me to rant a little bit. I think if IOS was decently coded to
begin with we did not
need to spend all this time writing all these tools !!!
how trivial could it be to check for an existance of a filter before
applying it ???
I shall join the rant. Actually, there was a behavior change in IOS 10.3.
Before then, if you defined an access-group without a corresponding access-list,
IOS would assume the existence of such a list, composed only of an "implicit
deny all", stopping everything on the interface.
Post by Howard C. BerkowitzFrom a security standpoint, thinking of the Principle of Least Privilege, that's
really the theoretically correct behavior. Nevertheless, Cisco changed the
default to "permit all" if there was no corresponding access-list.
[cisco voice]
What's this "warning message" you keep mentioning?
[/cisco voice]
Which is a bit unfair, as there are some warning messages during configuration
but, AFAIK, only with a scope of a single command -- if one accepts "bad mask"
as a meaningful message for half a dozen conditions
Post by Howard C. Berkowitzsame for other filter maps reference and MQC
I am willing to spend the time on filter_audit tool because the given
situation is that we
have many IOS devices and I don't see IOS fixed very soon (although XR
already available).
Post by Howard C. Berkowitz<br>Perhaps as a less ambitious project, I've also considered writing
a tool
Post by Howard C. Berkowitzthat gives a cross-reference to the appearance of certain IP
addresses, first in
Post by Howard C. Berkowitza single router configuration, and then across multiple
configurations.
Post by Howard C. Berkowitz<br>Has anyone tried either of these? Is there interest? Is there
another tool
not sure I fully understand, you mean check for duplicate IP address ?
AFAIK, IOS will not allow to use duplicate IP on same router, or will
issue a warning
regarding duplicate IP on multiple devices, IOS will generate an error
log which I use to generate email alert, works ok for us.
No, I'm thinking of something that (gasp) I had with the IBM 360 assembler and
other compilers and assemblers.
At the end of a configuration (to start), it would list an address (or a
subnet), and tell you all the statements that referenced it. For example,
ip address
access-list (and probably indirect references in maps)
ospf network statements
server references
static routes
as a starting point. In other words, it tells you EVERYWHERE you need to make
changes when you change an address or something affecting it.
The next step would be to extend the scope beyond a single router, grabbing the
hostname to prefix the cross-reference. Again, the idea is that if an address
changes, you have a positive confirmation of every configuration that may need
to be changed. It's also a debugging tool, because you know which routers
affect that address.