08-27-2009 05:39 AM
Hello,
I know there are a few posts on here regarding this but I wasn't able to get my question answered...
I'm working on establishing my router baseline template for LMS 3.2. I've figured out how to require certain commands to be in the config and to remove other ones... but what I would like to do is ensure there's not an "Extra" config in there.
An example of this is my remote routers should only have 1 static route, a floating static used for ISDN backup... I would like to create a regex that says somthing similar to, if the router is NOT <my route>, mark it as non compliant.
I've tried a couple different syntaxes without luck.
The Route it want: ip route 0.0.0.0 0.0.0.0 192.168.252.1 150
I'm trying:
- [#ip route (!0.0.0.0 0.0.0.0 192.168.252.1 150)#]
- ip route[#!0.0.0.0 0.0.0.0 192.168.252.1 150#]
This same idea would apply to the SNMP config. I can look to ensure that the necessary SNMP views/groups/hosts are there, but I would like to ensure that any "Extras" that don't match my current standard, are marked as non compliant.
Example:
My SNMP host:
+ snmp-server host 192.168.<ip> version 3 auth <SNMP v3 uname>
And I want to make sure, there are NO other snmp-server hosts besides the 1 that i designate.
I found this post that was helpful: http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&topicID=.ee71a02&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40^1%40%40.2cc1dcca/4#selected_message
But I haven't been able to apply it to this situation. Any thoughts? Thanks.
Solved! Go to Solution.
08-27-2009 09:01 AM
- [#snmp-server host (?!192\.168\.x\.x).*#]
08-27-2009 07:52 AM
Ok, One other problem:
How can I reference a range of ports on a switch? Our standard switch setup has ports 1-5 configured as VLANA, 6-23 configured with VLANB etc.
I've gotten the thing to look at ports 1-5 on a 3750. In the "Sub mode" field I put this in:
interface [#FastEthernet1/0/[1-5]#]
However, when I try similar on a second port range:
interface [#FastEthernet1/0/[6-23]#]
The compliance audit flags and looks at ALL ports on the switch, including the VLAN interface(s) and Gigabit interfaces. THis confuses me, because I'm defining "FastEthernet", so why is it matching VLAN and GigabitEthernet?
08-27-2009 08:01 AM
Ok, Nevermind on the 2nd issue. I forgot my regex basics... i can only match single digit numbers with ranges....
replaced:
interface [#FastEthernet1/0/[6-23]#]
with:
interface [#FastEthernet1/0/([6-9]|1[0-9]|2[0-3])#]
to achieve what I wanted.
08-27-2009 09:01 AM
- [#snmp-server host (?!192\.168\.x\.x).*#]
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: