mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-09-14 17:09:11 +02:00
* iosacl.cpp (safetyNetInstall): fixed bug (no #): when "safety
net install" option is used, temporary access list must be generated only once even when firewall object has multiple rulesets. ;
This commit is contained in:
Vadim Kurland
@@ -1,5 +1,10 @@
|
||||
2009-03-18 vadim <vadim@vk.crocodile.org>
|
||||
|
||||
* iosacl.cpp (safetyNetInstall): fixed bug (no #): when "safety
|
||||
net install" option is used, temporary access list must be
|
||||
generated only once even when firewall object has multiple
|
||||
rulesets.
|
||||
|
||||
* PolicyCompiler_iosacl.cpp (PolicyCompiler_iosacl::prolog): fixed
|
||||
bug (no #): temporary access list created for IOS when option
|
||||
"safety net install" is used and ipv6 address is provided should
|
||||
|
||||
@@ -84,163 +84,6 @@ int PolicyCompiler_iosacl::prolog()
|
||||
|
||||
output << "!################" << endl;
|
||||
|
||||
if ( fw->getOptionsObject()->getBool("iosacl_acl_substitution") )
|
||||
{
|
||||
/* Generate short temporary ACL and assign it to all
|
||||
* interfaces. This ACL permits IPSEC (IP proto 50 and UDP port 500)
|
||||
as well as ssh from given subnet to any.
|
||||
*/
|
||||
|
||||
string temp_acl = "tmp_acl";
|
||||
string temp_acl_addr = fw->getOptionsObject()->getStr(
|
||||
"iosacl_acl_temp_addr");
|
||||
|
||||
if (temp_acl_addr.empty())
|
||||
{
|
||||
abort("Missing address for management host or subnet for temporary ACL.\nPlease enter it in the tab 'Script options' in 'Firewall Settings' dialog");
|
||||
}
|
||||
|
||||
// if templ_acl_addr is ipv4 address, then we can not create this
|
||||
// temporary ACL while compiling ipv6 policy. And vice versa.
|
||||
|
||||
bool create_temp_acl = false;
|
||||
if (temp_acl_addr.find(":")!=string::npos)
|
||||
{
|
||||
//looks like ipv6
|
||||
create_temp_acl = ipv6;
|
||||
} else
|
||||
{
|
||||
// not ipv6, assume ipv4
|
||||
create_temp_acl = !ipv6;
|
||||
}
|
||||
|
||||
if (create_temp_acl)
|
||||
{
|
||||
string::size_type slash_idx = temp_acl_addr.find('/');
|
||||
string addr = temp_acl_addr;
|
||||
string netmask = "255.255.255.255";
|
||||
bool tmp_acl_v6 = false;
|
||||
|
||||
// check if addr is v6
|
||||
|
||||
try
|
||||
{
|
||||
InetAddr addrv6(AF_INET6, temp_acl_addr);
|
||||
tmp_acl_v6 = true;
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
// Assume cnf->maddr is ipv4
|
||||
if (slash_idx!=string::npos)
|
||||
{
|
||||
addr = temp_acl_addr.substr(0,slash_idx);
|
||||
netmask = temp_acl_addr.substr(slash_idx+1);
|
||||
try
|
||||
{
|
||||
if (netmask.find(".")!=string::npos)
|
||||
{
|
||||
InetAddr nm(netmask);
|
||||
nm.getLength(); // to avoid warning abt unused var
|
||||
} else
|
||||
{
|
||||
int nm_length;
|
||||
istringstream str(netmask);
|
||||
str >> nm_length;
|
||||
InetAddr nm(nm_length);
|
||||
netmask = nm.toString();
|
||||
}
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
abort("Invalid netmask for management subnet: '"+netmask+"'");
|
||||
}
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
InetAddr a(addr);
|
||||
a.isAny();
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
abort("Invalid address for management subnet: '"+addr+"'");
|
||||
}
|
||||
}
|
||||
|
||||
string xml_element = "clear_ip_acl";
|
||||
if (ipv6) xml_element = "clear_ipv6_acl";
|
||||
|
||||
string clearACLcmd = Resources::platform_res[platform]->getResourceStr(
|
||||
string("/FWBuilderResources/Target/options/")+
|
||||
"version_"+version+"/iosacl_commands/" + xml_element);
|
||||
|
||||
output << endl;
|
||||
|
||||
string addr_family_prefix = "ip";
|
||||
|
||||
if (ipv6 && tmp_acl_v6)
|
||||
{
|
||||
addr_family_prefix = "ipv6";
|
||||
output << clearACLcmd << " " << temp_acl << endl;
|
||||
output << "ipv6 access-list " << temp_acl << endl;
|
||||
if (slash_idx!=string::npos)
|
||||
output << " permit ipv6 " << addr << " any " << endl;
|
||||
else
|
||||
output << " permit ipv6 host " << addr << " any " << endl;
|
||||
output << " deny ipv6 any any " << endl;
|
||||
output << "exit" << endl;
|
||||
output << endl;
|
||||
}
|
||||
|
||||
if (!ipv6 && !tmp_acl_v6)
|
||||
{
|
||||
// cisco uses "wildcards" instead of netmasks
|
||||
|
||||
//long nm = InetAddr(netmask).to32BitInt();
|
||||
//struct in_addr na;
|
||||
//na.s_addr = ~nm;
|
||||
InetAddr nnm( ~(InetAddr(netmask)) );
|
||||
addr_family_prefix = "ip";
|
||||
output << clearACLcmd << " " << temp_acl << endl;
|
||||
output << "ip access-list extended " << temp_acl << endl;
|
||||
output << " permit ip "
|
||||
<< addr << " " << nnm.toString() << " any " << endl;
|
||||
output << " deny ip any any " << endl;
|
||||
output << "exit" << endl;
|
||||
output << endl;
|
||||
}
|
||||
|
||||
|
||||
// find management interface
|
||||
int nmi = 0;
|
||||
list<FWObject*> ll = fw->getByType(Interface::TYPENAME);
|
||||
for (FWObject::iterator i=ll.begin(); i!=ll.end(); i++)
|
||||
{
|
||||
Interface *intf = Interface::cast( *i );
|
||||
if (intf->isManagement())
|
||||
{
|
||||
nmi++;
|
||||
output << "interface " << intf->getName() << endl;
|
||||
output << " no " << addr_family_prefix << " ";
|
||||
output << getAccessGroupCommandForAddressFamily();
|
||||
output << " in" << endl;
|
||||
|
||||
output << " no " << addr_family_prefix << " ";
|
||||
output << getAccessGroupCommandForAddressFamily();
|
||||
output << " out" << endl;
|
||||
|
||||
output << " " << addr_family_prefix << " ";
|
||||
output << getAccessGroupCommandForAddressFamily();
|
||||
output << " " << temp_acl << " in" << endl;
|
||||
output << "exit" << endl;
|
||||
}
|
||||
}
|
||||
if (nmi==0)
|
||||
{
|
||||
abort("One of the interfaces of the firewall must be marked as management interface.");
|
||||
}
|
||||
}
|
||||
|
||||
output << endl;
|
||||
}
|
||||
|
||||
return PolicyCompiler::prolog();
|
||||
}
|
||||
|
||||
@@ -467,7 +310,7 @@ string PolicyCompiler_iosacl::printAccessGroupCmd(ciscoACL *acl)
|
||||
|
||||
str << "interface " << acl->getInterface()->getName() << endl;
|
||||
str << " " << addr_family_prefix << " ";
|
||||
str << getAccessGroupCommandForAddressFamily();
|
||||
str << getAccessGroupCommandForAddressFamily(ipv6);
|
||||
str << " " << acl->workName() << " " << dir << endl;
|
||||
str << "exit" << endl;
|
||||
}
|
||||
@@ -492,7 +335,7 @@ void PolicyCompiler_iosacl::epilog()
|
||||
}
|
||||
}
|
||||
|
||||
string PolicyCompiler_iosacl::getAccessGroupCommandForAddressFamily()
|
||||
string PolicyCompiler_iosacl::getAccessGroupCommandForAddressFamily(bool ipv6)
|
||||
{
|
||||
if (ipv6) return "traffic-filter";
|
||||
return "access-group";
|
||||
|
||||
@@ -249,7 +249,6 @@ namespace fwcompiler {
|
||||
|
||||
virtual std::string myPlatformName();
|
||||
std::string printAccessGroupCmd(ciscoACL *acl);
|
||||
std::string getAccessGroupCommandForAddressFamily();
|
||||
|
||||
public:
|
||||
|
||||
@@ -263,6 +262,8 @@ namespace fwcompiler {
|
||||
virtual void compile();
|
||||
virtual void epilog();
|
||||
|
||||
static std::string getAccessGroupCommandForAddressFamily(bool ipv6);
|
||||
|
||||
};
|
||||
|
||||
|
||||
|
||||
@@ -118,6 +118,185 @@ void usage(const char *name)
|
||||
cout << "Usage: " << name << " [-tvV] [-f filename.xml] [-d destdir] [-o output.fw] firewall_object_name" << endl;
|
||||
}
|
||||
|
||||
string safetyNetInstall(Firewall *fw)
|
||||
{
|
||||
ostringstream output;
|
||||
if ( fw->getOptionsObject()->getBool("iosacl_acl_substitution") )
|
||||
{
|
||||
/* Generate short temporary ACL and assign it to all
|
||||
* interfaces. This ACL permits IPSEC (IP proto 50 and UDP port 500)
|
||||
as well as ssh from given subnet to any.
|
||||
*/
|
||||
|
||||
string platform = fw->getStr("platform");
|
||||
string version = fw->getStr("version");
|
||||
|
||||
string temp_acl = "tmp_acl";
|
||||
string temp_acl_addr = fw->getOptionsObject()->getStr(
|
||||
"iosacl_acl_temp_addr");
|
||||
|
||||
if (temp_acl_addr.empty())
|
||||
{
|
||||
cerr << "Missing address for management host or subnet for temporary ACL.\nPlease enter it in the tab 'Script options' in 'Firewall Settings' dialog"
|
||||
<< endl;
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
// if templ_acl_addr is ipv4 address, then we can not create this
|
||||
// temporary ACL while compiling ipv6 policy. And vice versa.
|
||||
|
||||
bool create_temp_acl = false;
|
||||
bool tmp_acl_ipv6 = false;
|
||||
if (temp_acl_addr.find(":")!=string::npos)
|
||||
{
|
||||
//looks like ipv6
|
||||
create_temp_acl = true;
|
||||
tmp_acl_ipv6 = true;
|
||||
} else
|
||||
{
|
||||
// not ipv6, assume ipv4
|
||||
create_temp_acl = true;
|
||||
tmp_acl_ipv6 = false;
|
||||
}
|
||||
|
||||
if (create_temp_acl)
|
||||
{
|
||||
string::size_type slash_idx = temp_acl_addr.find('/');
|
||||
string addr = temp_acl_addr;
|
||||
string netmask = "255.255.255.255";
|
||||
bool tmp_acl_v6 = false;
|
||||
|
||||
// check if addr is v6
|
||||
|
||||
try
|
||||
{
|
||||
InetAddr addrv6(AF_INET6, temp_acl_addr);
|
||||
tmp_acl_v6 = true;
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
// Assume cnf->maddr is ipv4
|
||||
if (slash_idx!=string::npos)
|
||||
{
|
||||
addr = temp_acl_addr.substr(0,slash_idx);
|
||||
netmask = temp_acl_addr.substr(slash_idx+1);
|
||||
try
|
||||
{
|
||||
if (netmask.find(".")!=string::npos)
|
||||
{
|
||||
InetAddr nm(netmask);
|
||||
nm.getLength(); // to avoid warning abt unused var
|
||||
} else
|
||||
{
|
||||
int nm_length;
|
||||
istringstream str(netmask);
|
||||
str >> nm_length;
|
||||
InetAddr nm(nm_length);
|
||||
netmask = nm.toString();
|
||||
}
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
cerr << "Invalid netmask for management subnet: '"+netmask+"'"
|
||||
<< endl;
|
||||
exit(-1);
|
||||
}
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
InetAddr a(addr);
|
||||
a.isAny();
|
||||
} catch(FWException &ex)
|
||||
{
|
||||
cerr << "Invalid address for management subnet: '"+addr+"'"
|
||||
<< endl;
|
||||
exit(-1);
|
||||
}
|
||||
}
|
||||
|
||||
string xml_element = "clear_ip_acl";
|
||||
if (tmp_acl_ipv6) xml_element = "clear_ipv6_acl";
|
||||
|
||||
string clearACLcmd = Resources::platform_res[platform]->getResourceStr(
|
||||
string("/FWBuilderResources/Target/options/")+
|
||||
"version_"+version+"/iosacl_commands/" + xml_element);
|
||||
|
||||
output << endl;
|
||||
|
||||
string addr_family_prefix = "ip";
|
||||
|
||||
string access_group_cmd =
|
||||
PolicyCompiler_iosacl::getAccessGroupCommandForAddressFamily(tmp_acl_v6);
|
||||
|
||||
output << "! temporary access list for \"safety net install\""
|
||||
<< endl;
|
||||
output << endl;
|
||||
|
||||
if (tmp_acl_v6)
|
||||
{
|
||||
addr_family_prefix = "ipv6";
|
||||
output << clearACLcmd << " " << temp_acl << endl;
|
||||
output << "ipv6 access-list " << temp_acl << endl;
|
||||
if (slash_idx!=string::npos)
|
||||
output << " permit ipv6 " << addr << " any " << endl;
|
||||
else
|
||||
output << " permit ipv6 host " << addr << " any " << endl;
|
||||
output << " deny ipv6 any any " << endl;
|
||||
output << "exit" << endl;
|
||||
output << endl;
|
||||
} else
|
||||
{
|
||||
// cisco uses "wildcards" instead of netmasks
|
||||
|
||||
//long nm = InetAddr(netmask).to32BitInt();
|
||||
//struct in_addr na;
|
||||
//na.s_addr = ~nm;
|
||||
InetAddr nnm( ~(InetAddr(netmask)) );
|
||||
addr_family_prefix = "ip";
|
||||
output << clearACLcmd << " " << temp_acl << endl;
|
||||
output << "ip access-list extended " << temp_acl << endl;
|
||||
output << " permit ip "
|
||||
<< addr << " " << nnm.toString() << " any " << endl;
|
||||
output << " deny ip any any " << endl;
|
||||
output << "exit" << endl;
|
||||
output << endl;
|
||||
}
|
||||
|
||||
// find management interface
|
||||
int nmi = 0;
|
||||
list<FWObject*> ll = fw->getByType(Interface::TYPENAME);
|
||||
for (FWObject::iterator i=ll.begin(); i!=ll.end(); i++)
|
||||
{
|
||||
Interface *intf = Interface::cast( *i );
|
||||
if (intf->isManagement())
|
||||
{
|
||||
nmi++;
|
||||
output << "interface " << intf->getName() << endl;
|
||||
output << " no " << addr_family_prefix << " ";
|
||||
output << access_group_cmd;
|
||||
output << " in" << endl;
|
||||
|
||||
output << " no " << addr_family_prefix << " ";
|
||||
output << access_group_cmd;
|
||||
output << " out" << endl;
|
||||
|
||||
output << " " << addr_family_prefix << " ";
|
||||
output << access_group_cmd;
|
||||
output << " " << temp_acl << " in" << endl;
|
||||
output << "exit" << endl;
|
||||
}
|
||||
}
|
||||
if (nmi==0)
|
||||
{
|
||||
cerr << "One of the interfaces of the firewall must be marked as management interface."
|
||||
<< endl;
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
output << endl;
|
||||
}
|
||||
}
|
||||
return output.str();
|
||||
}
|
||||
|
||||
int main(int argc, char * const * argv)
|
||||
{
|
||||
@@ -366,6 +545,9 @@ int main(int argc, char * const * argv)
|
||||
vector<int> ipv4_6_runs;
|
||||
string generated_script;
|
||||
|
||||
generated_script = safetyNetInstall(fw);
|
||||
|
||||
|
||||
// command line options -4 and -6 control address family for which
|
||||
// script will be generated. If "-4" is used, only ipv4 part will
|
||||
// be generated. If "-6" is used, only ipv6 part will be generated.
|
||||
|
||||
@@ -172,7 +172,7 @@
|
||||
<ServiceGroup id="id4511636C23682_userservices" name="Users" comment="" ro="False"/>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="id4511637423682" name="Firewalls" comment="" ro="False">
|
||||
<Firewall id="id46412B5226577" host_OS="ios" inactive="False" lastCompiled="1230498567" lastInstalled="0" lastModified="1230500015" platform="iosacl" version="12.x" name="testios1" comment="" ro="False">
|
||||
<Firewall id="id46412B5226577" host_OS="ios" inactive="False" lastCompiled="1230498567" lastInstalled="0" lastModified="1237438960" platform="iosacl" version="12.x" name="testios1" comment="" ro="False">
|
||||
<NAT id="id46412B5626577" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
|
||||
<Policy id="id46412B5526577" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
||||
<PolicyRule id="id464154BB29061" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
|
||||
@@ -668,10 +668,10 @@
|
||||
<Option name="in_out_code">true</Option>
|
||||
<Option name="ios_ip_address">True</Option>
|
||||
<Option name="ios_set_host_name">True</Option>
|
||||
<Option name="iosacl_acl_basic">True</Option>
|
||||
<Option name="iosacl_acl_basic">False</Option>
|
||||
<Option name="iosacl_acl_no_clear">False</Option>
|
||||
<Option name="iosacl_acl_substitution">False</Option>
|
||||
<Option name="iosacl_acl_temp_addr"></Option>
|
||||
<Option name="iosacl_acl_substitution">True</Option>
|
||||
<Option name="iosacl_acl_temp_addr">10.10.10.1</Option>
|
||||
<Option name="iosacl_add_clear_statements">true</Option>
|
||||
<Option name="iosacl_assume_fw_part_of_any">true</Option>
|
||||
<Option name="iosacl_epilog_script">! This is epilog for testing
|
||||
@@ -679,11 +679,11 @@
|
||||
<Option name="iosacl_generate_logging_commands">False</Option>
|
||||
<Option name="iosacl_include_comments">True</Option>
|
||||
<Option name="iosacl_logging_buffered">False</Option>
|
||||
<Option name="iosacl_logging_buffered_level">0</Option>
|
||||
<Option name="iosacl_logging_buffered_level">2</Option>
|
||||
<Option name="iosacl_logging_console">False</Option>
|
||||
<Option name="iosacl_logging_console_level">0</Option>
|
||||
<Option name="iosacl_logging_console_level">2</Option>
|
||||
<Option name="iosacl_logging_timestamp">False</Option>
|
||||
<Option name="iosacl_logging_trap_level">0</Option>
|
||||
<Option name="iosacl_logging_trap_level">2</Option>
|
||||
<Option name="iosacl_prolog_script">! This is prolog</Option>
|
||||
<Option name="iosacl_regroup_commands">False</Option>
|
||||
<Option name="iosacl_syslog_facility"></Option>
|
||||
@@ -1046,7 +1046,7 @@
|
||||
<Option name="verify_interfaces">true</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall id="id464264CC12807" host_OS="ios" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1178755598" platform="iosacl" version="12.x" name="testios2" comment="" ro="False">
|
||||
<Firewall id="id464264CC12807" host_OS="ios" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1237438938" platform="iosacl" version="12.x" name="testios2" comment="" ro="False">
|
||||
<NAT id="id464265C412807" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
|
||||
<Policy id="id464264D212807" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
||||
<PolicyRule id="id464264D312807" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
|
||||
@@ -1503,17 +1503,19 @@
|
||||
<Option name="iosacl_add_clear_statements">true</Option>
|
||||
<Option name="iosacl_assume_fw_part_of_any">true</Option>
|
||||
<Option name="iosacl_epilog_script"></Option>
|
||||
<Option name="iosacl_generate_logging_commands">False</Option>
|
||||
<Option name="iosacl_include_comments">True</Option>
|
||||
<Option name="iosacl_logging_buffered">False</Option>
|
||||
<Option name="iosacl_logging_buffered_level"></Option>
|
||||
<Option name="iosacl_logging_buffered_level">0</Option>
|
||||
<Option name="iosacl_logging_console">False</Option>
|
||||
<Option name="iosacl_logging_console_level"></Option>
|
||||
<Option name="iosacl_logging_console_level">0</Option>
|
||||
<Option name="iosacl_logging_timestamp">False</Option>
|
||||
<Option name="iosacl_logging_trap_level"></Option>
|
||||
<Option name="iosacl_logging_trap_level">0</Option>
|
||||
<Option name="iosacl_prolog_script"></Option>
|
||||
<Option name="iosacl_regroup_commands">False</Option>
|
||||
<Option name="iosacl_syslog_facility"></Option>
|
||||
<Option name="iosacl_syslog_host"></Option>
|
||||
<Option name="ipv4_6_order">ipv4_first</Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="linux24_ip_forward">1</Option>
|
||||
<Option name="load_modules">true</Option>
|
||||
@@ -1547,6 +1549,7 @@
|
||||
<Option name="pix_use_acl_remarks">true</Option>
|
||||
<Option name="prompt1">$ </Option>
|
||||
<Option name="prompt2"> # </Option>
|
||||
<Option name="scpArgs"></Option>
|
||||
<Option name="solaris_ip_forward">1</Option>
|
||||
<Option name="sshArgs"></Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
@@ -2946,7 +2949,7 @@
|
||||
<Option name="verify_interfaces">True</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall id="id4881X21941" host_OS="ios" inactive="False" lastCompiled="1237092851" lastInstalled="0" lastModified="1237092844" platform="iosacl" version="12.x" name="ccie4u-r1" comment="CCIE4U router R1 2600 " ro="False">
|
||||
<Firewall id="id4881X21941" host_OS="ios" inactive="False" lastCompiled="1237438900" lastInstalled="0" lastModified="1237438894" platform="iosacl" version="12.x" name="ccie4u-r1" comment="CCIE4U router R1 2600 " ro="False">
|
||||
<NAT id="id5087X21941" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
|
||||
<Policy id="id4887X21941" name="r1-ipv4" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
|
||||
<PolicyRule id="id4888X21941" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
|
||||
@@ -3309,7 +3312,7 @@
|
||||
<Interface id="id8437X21941" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="FastEthernet0/1" comment="" ro="False">
|
||||
<IPv4 id="id8438X21941" name="ccie4u-r1:FastEthernet0/1:ip" comment="" ro="False" address="10.1.2.1" netmask="255.255.255.0"/>
|
||||
</Interface>
|
||||
<Management address="1.1.1.1">
|
||||
<Management address="10.1.1.1">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
@@ -3350,18 +3353,18 @@
|
||||
<Option name="iosacl_acl_basic">False</Option>
|
||||
<Option name="iosacl_acl_no_clear">False</Option>
|
||||
<Option name="iosacl_acl_substitution">True</Option>
|
||||
<Option name="iosacl_acl_temp_addr">10.1.1.0/24</Option>
|
||||
<Option name="iosacl_acl_temp_addr">10.1.1.0</Option>
|
||||
<Option name="iosacl_add_clear_statements">true</Option>
|
||||
<Option name="iosacl_assume_fw_part_of_any">true</Option>
|
||||
<Option name="iosacl_epilog_script"></Option>
|
||||
<Option name="iosacl_generate_logging_commands">False</Option>
|
||||
<Option name="iosacl_include_comments">True</Option>
|
||||
<Option name="iosacl_logging_buffered">False</Option>
|
||||
<Option name="iosacl_logging_buffered_level">1</Option>
|
||||
<Option name="iosacl_logging_buffered_level">2</Option>
|
||||
<Option name="iosacl_logging_console">False</Option>
|
||||
<Option name="iosacl_logging_console_level">1</Option>
|
||||
<Option name="iosacl_logging_console_level">2</Option>
|
||||
<Option name="iosacl_logging_timestamp">False</Option>
|
||||
<Option name="iosacl_logging_trap_level">1</Option>
|
||||
<Option name="iosacl_logging_trap_level">2</Option>
|
||||
<Option name="iosacl_prolog_script"></Option>
|
||||
<Option name="iosacl_regroup_commands">False</Option>
|
||||
<Option name="iosacl_syslog_facility"></Option>
|
||||
@@ -3480,7 +3483,7 @@
|
||||
<Option name="verify_interfaces">True</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall id="id12133X53662" host_OS="ios" inactive="False" lastCompiled="1237437336" lastInstalled="0" lastModified="1237437327" platform="iosacl" version="12.x" name="firewall-ipv6-3" comment="test "safety net" install in case when there are many rulesets" ro="False">
|
||||
<Firewall id="id12133X53662" host_OS="ios" inactive="False" lastCompiled="1237438591" lastInstalled="0" lastModified="1237437327" platform="iosacl" version="12.x" name="firewall-ipv6-3" comment="test "safety net" install in case when there are many rulesets" ro="False">
|
||||
<NAT id="id12339X53662" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
|
||||
<Policy id="id12139X53662" name="fw-ipv6-3-ipv4" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="True">
|
||||
<PolicyRule id="id12140X53662" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
|
||||
|
||||
Reference in New Issue
Block a user