RE: RANCID filter_audit

Quoting Yuval Ben-Ari <[email protected]>:

> > I've also been thinking of a couple of extensions, partially because
> they are
> > useful and partially because I haven't been coding in a while.
> Slightly
> > different than filter_audit would be something that checks for the
> existence and
> > linkage of the multiple maps Cisco requires for the modular quality o=
f
> service
> > interface.
>=20
> allow me to rant a little bit. I think if IOS was decently coded to
> begin with we did not
> need to spend all this time writing all these tools !!!
> how trivial could it be to check for an existance of a filter before
> applying it ???

I shall join the rant.  Actually, there was a behavior change in IOS 10.3=
.=20
Before then, if you defined an access-group without a corresponding acces=
s-list,
IOS would assume the existence of such a list, composed only of an "impli=
cit
deny all", stopping everything on the interface.

From a security standpoint, thinking of the Principle of Least Privilege,=
 that's
really the theoretically correct behavior. Nevertheless, Cisco changed th=
e
default to "permit all" if there was no corresponding access-list.=20

[cisco voice]
What's this "warning message" you keep mentioning?
[/cisco voice]

Which is a bit unfair, as there are some warning messages during configur=
ation
but, AFAIK, only with a scope of a single command -- if one accepts "bad =
mask"
as a meaningful message for half a dozen conditions

> same for other filter maps reference and MQC
> I am willing to spend the time on filter_audit tool because the given
> situation is that we
> have many IOS devices and I don't see IOS fixed very soon (although XR
> already available).
>=20
> > <br>Perhaps as a less ambitious project, I've also considered writing
> a tool=20
> > that gives a cross-reference to the appearance of certain IP
> addresses, first in
> > a single router configuration, and then across multiple
> configurations.
> > <br>Has anyone tried either of these? Is there interest? Is there
> another tool
> > that does these functions?
>=20
> not sure I fully understand, you mean check for duplicate IP address ?
> AFAIK, IOS will not allow to use duplicate IP on same router, or will
> issue a warning
> regarding duplicate IP on multiple devices, IOS will generate an error
> log which I use to generate email alert, works ok for us.

No, I'm thinking of something that (gasp) I had with the IBM 360 assemble=
r and
other compilers and assemblers.

At the end of a configuration (to start), it would list an address (or a
subnet), and tell you all the statements that referenced it. For example,
        ip address
        access-list (and probably indirect references in maps)
        ospf network statements
        server references
        static routes
as a starting point.  In other words, it tells you EVERYWHERE you need to=
 make
changes when you change an address or something affecting it.

The next step would be to extend the scope beyond a single router, grabbi=
ng the
hostname to prefix the cross-reference. Again, the idea is that if an add=
ress
changes, you have a positive confirmation of every configuration that may=
 need
to be changed.  It's also a debugging tool, because you know which router=
s
affect that address.
>=20