Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CASMNET-2273 - CMN missing from mgmt access control list #594

Merged
merged 5 commits into from
Jan 8, 2025

Conversation

spillerc-hpe
Copy link
Contributor

@spillerc-hpe spillerc-hpe commented Jan 6, 2025

Summary and Scope

Add the CMN to the mgmt access list to permit SSH, HTTPS, and SNMP over the CMN.

  • I have added new tests to cover the new code
  • If adding a new file, I have updated pyinstaller.py
  • I have added entries in CHANGELOG.md for the changes in this PR

Issues and Related PRs

  • Resolves: [CASMNET-2273](https://jira-pro.it.hpe.com:8443/browse/CASMNET-2273)

Testing

Generated new configuration using data from hela, verified the CMN is now present in the access list.

$ diff orig/sw-spine-001.cfg new/sw-spine-001.cfg
7c7
< # CANU version: 1.9.6.dev59+gd3b6bc3
---
> # CANU version: 1.9.6.dev59+gd3b6bc3.d20250106
30,39c30,43
<     60 comment ALLOW SNMP FROM HMN METALLB SUBNET
<     70 permit udp 10.94.100.0/255.255.255.0 any eq snmp
<     80 permit udp 10.94.100.0/255.255.255.0 any eq snmp-trap
<     90 comment BLOCK SSH, HTTPS, AND SNMP FROM EVERYWHERE ELSE
<     100 deny tcp any any eq ssh
<     110 deny tcp any any eq https
<     120 deny udp any any eq snmp
<     130 deny udp any any eq snmp-trap
<     140 comment ALLOW ANYTHING ELSE
<     150 permit any any any
---
>     60 permit tcp 10.102.66.0/255.255.255.128 any eq ssh
>     70 permit tcp 10.102.66.0/255.255.255.128 any eq https
>     80 permit udp 10.102.66.0/255.255.255.128 any eq snmp
>     90 permit udp 10.102.66.0/255.255.255.128 any eq snmp-trap
>     100 comment ALLOW SNMP FROM HMN METALLB SUBNET
>     110 permit udp 10.94.100.0/255.255.255.0 any eq snmp
>     120 permit udp 10.94.100.0/255.255.255.0 any eq snmp-trap
>     130 comment BLOCK SSH, HTTPS, AND SNMP FROM EVERYWHERE ELSE
>     140 deny tcp any any eq ssh
>     150 deny tcp any any eq https
>     160 deny udp any any eq snmp
>     170 deny udp any any eq snmp-trap
>     180 comment ALLOW ANYTHING ELSE
>     190 permit any any any

@spillerc-hpe spillerc-hpe requested a review from a team as a code owner January 6, 2025 12:54
@spillerc-hpe spillerc-hpe requested a review from trad511 January 6, 2025 13:03
spillerc-hpe and others added 3 commits January 8, 2025 16:47
Signed-off-by: Chris Spiller <86013738+spillerc-hpe@users.noreply.github.com>
@spillerc-hpe spillerc-hpe merged commit e81f051 into main Jan 8, 2025
21 checks passed
@spillerc-hpe spillerc-hpe deleted the CASMNET-2273 branch January 8, 2025 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants