Page 1 of 1
config block compliance
Posted: Fri Jun 26, 2026 6:53 am
by dskundric
hi,
is there a config block comliance feature. For example ... each interface has to have some command configured. So you define BLOCK with start/end command for interface and then seek for these specific command in each block?
br
Re: config block compliance
Posted: Fri Jun 26, 2026 10:51 am
by Tomas
Hi,
This is coming in 2.10.0. We are adding "Strict" and "Sequential" matching modes to Compliance rules.
Strict - the block of text in the compliance condition has to be present in the device config exactly as-is
Sequential - each line of the compliance condition has to be present in the device config, in the order that's specified
Presence (current) - each line of the compliance condition just has to be present in the device config somewhere, independent of order
The "Strict" matching mode will do exactly what you are asking for
Re: config block compliance
Posted: Fri Jun 26, 2026 11:04 am
by dskundric
and strict mode will suport something like this
for each interface with ip address there must be no ip proxy-arp command
OR
for each line vty segment there must be transport input ssh command?
Re: config block compliance
Posted: Sat Jun 27, 2026 12:47 am
by Tomas
dskundric wrote: ↑Fri Jun 26, 2026 11:04 am
for each interface with ip address there must be no ip proxy-arp command
Good news is you can already do this with a combination of MikroTik scripting and even with our current compliance engine. Create a Config Push preset with this Tik script:
Code: Select all
{
/ip address
:foreach i in=[find interface ~ "ether"] do={
:local iname [get $i interface]
:if ([/interface ethernet get $iname arp] ~ "proxy") do={:put "ERROR - Interface $iname has proxy-arp on"}
}
}
Then create a Compliance targeting that Push, and set a condition "Line does not start with" - "ERROR".
This will fail if there are any "proxy-arp" interfaces.
Re: config block compliance
Posted: Mon Jun 29, 2026 5:38 am
by dskundric
this works only for mikrotik? Not Cisco?
Re: config block compliance
Posted: Thu Jul 02, 2026 9:37 pm
by Tommy.c
No, this should work for any device that has scripting in it's CLI, the code is an example for MikroTik, but I am lead to understand similar can be done with Cisco, Juniper and Arista (just to name some of the bigger Manufacture's we support)