config block compliance

[dskundric]

hi,

is there a config block comliance feature. For example ... each interface has to have some command configured. So you define BLOCK with start/end command for interface and then seek for these specific command in each block?

br

[Tomas]

Hi,

This is coming in 2.10.0. We are adding "Strict" and "Sequential" matching modes to Compliance rules.

Strict - the block of text in the compliance condition has to be present in the device config exactly as-is
Sequential - each line of the compliance condition has to be present in the device config, in the order that's specified
Presence (current) - each line of the compliance condition just has to be present in the device config somewhere, independent of order

The "Strict" matching mode will do exactly what you are asking for

[dskundric]

and strict mode will suport something like this

for each interface with ip address there must be no ip proxy-arp command

OR

for each line vty segment there must be transport input ssh command?

[Tomas]

for each interface with ip address there must be no ip proxy-arp command

Good news is you can already do this with a combination of MikroTik scripting and even with our current compliance engine. Create a Config Push preset with this Tik script:

Code: Select all

{
/ip address
:foreach i in=[find interface ~ "ether"] do={
  :local iname [get $i interface] 
  :if ([/interface ethernet get $iname arp] ~ "proxy") do={:put "ERROR - Interface $iname has proxy-arp on"}
}
}

Then create a Compliance targeting that Push, and set a condition "Line does not start with" - "ERROR".
This will fail if there are any "proxy-arp" interfaces.