cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1523
Views
10
Helpful
13
Replies

Compliance Checks

brandon5150
Level 1
Level 1

I'm looking at trying to write a compliance check with a couple dependencies. I seem to be going around in circles with this.

I want to write it so there is a prerequisite at the global level which then determines if it should walk the interfaces. Then if it finds a matching interface look for a second command.

So basically, if the global matches:

+ spanning-tree portfast default

Then verify if the interface is a trunk

Submode [#inteface .#]

+ switchport mode trunk

And if it is a trunk, consider it a compliance failure if the portfast isn't disabled.

+spanning-tree portfast diabled

The problem I run in to is. I can't make a commandlet that is already a prerequisite to be a prerequisite for another commandlet. I don't know if this is by design or not. So I tried creating a parent that includes the [#inteface .*#] but I keep getting back devices that I know are not compliant as compliant.

Here's what it looks like:

---------------------------------

Name: isSpanningTreePortfastGlobalDefault SubMode: No isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: none

+ spanning-tree portfast default

Name: interfaceParent SubMode: Yes isPrerequisite: No

Ordered : No Prerequisite-Commandset : isSpanningTreePortfastGlobalDefault Parent: isSpanningTreePortfastGlobalDefault

[#interface .*#]

#To check for existence of command enter

Name: isTrunk SubMode: No isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: interfaceParent

+ switchport mode trunk

Name: isPortfastDisabled SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : isTrunk Parent: isTrunk

+ spanning-tree portfast disabled

13 Replies 13

Joe Clarke
Cisco Employee
Cisco Employee

What version of RME are you using?

Resource Manager Essentials 4.2.0 13 Feb 2009, 02:30:55 GMT

Joe Clarke
Cisco Employee
Cisco Employee

This should work:

Name: Global SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : none Parent: none

Name: isPortfastEnabled SubMode: No isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: none

+ spanning-tree portfast default

Name: trunkPortSubmode SubMode: Yes isPrerequisite: No

Ordered : No Prerequisite-Commandset : isPortfastEnabled Parent: none

interface [#.*Ethernet#]

#Left empty on purpose

Name: isTrunk SubMode: No isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: trunkPortSubmode

+ switchport mode trunk

Name: portFastDisabled SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : isTrunk Parent: isTrunk

+ spanning-tree portfast disabled

No such luck. I tried a couple variations in this and still can't seem to get it to work. Odd. I can get each of the independent checks to work. I just can't seem to get them to work when they are made prerequisites.

Did you try this and get it to work? I'm working on 3750s. I have a test device that I have set with the global default and I have the two gigabit trunks one with it enabled and one with it disabled.

With what you have and some variations I tried, it walks all interfaces and ignores if it's a trunk or not. All interfaces that do not have "spanning-tree portfast disable" come back non-compliant.

There are some variances I've seen that come back compliant but they don't give enough detail on the check results or how it steps through to let me why it passes when it should fail.

I had thought I had it working, but my test was inaccurate. Someone had configured additional trunks on my 3560, and those did not have spanning-tree portfast disable. So, I looked at the code, and found that RME wasn't recursing through the children of commandlets when the child was a prereq. I thought what you wanted to do was pretty useful, so I added some code to do the recursion, and it appears to be working. If you contact TAC, and have your engineer contact me directly, I can provide you an experimental patch to try.

Thanks Joe. I've opened a case.

Hmmm... I tried the patch and didn't have any luck. I still see it recurse the interfaces that do not have 'mode trunk' configured.

btw... a couple things I had to fix in the syntax

interface [#.*Ethernet.*#]

or it wouldn't try any interfaces. And...

+ spanning-tree portfast disable

There's no (d) at the end.

Right, my fault. This is the template I used with the patch, and it did work:

Name: Global SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : none Parent: none

Name: isPortfastEnabled SubMode: No isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: none

+ spanning-tree portfast default

Name: PortFastDefault SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : isPortfastEnabled Parent: none

+ spanning-tree portfast default

Name: isTrunk SubMode: Yes isPrerequisite: Yes

Ordered : No Prerequisite-Commandset : none Parent: PortFastDefault

interface [#.*Ethernet.*#]

+ switchport mode trunk

Name: portFastDisabled SubMode: No isPrerequisite: No

Ordered : No Prerequisite-Commandset : isTrunk Parent: isTrunk

+ spanning-tree portfast disable

Be sure not to edit an existing template as that may cause problems. Instead, create a new template using the above model.

Just so there can be no typos, I exported my template. Just import this, and it should work for you.

Thanks.

That did work. What is the issue with using existing templates?

Due to the nature of the code, this particular flow is required. Ideally, it should be possible to make prereqs which have prereqs of their own. But in lieu of that, the patch plus this template effectively allows for this flow:

if (condition) :

if (submode.condition) :

assert(submode.contains(PATTERN);

endif

endif

Will this patch be made available to the public, or included in the next release (3.3) ?

It is slated for the next release of LMS.