cisco-ios.sublime-syntax

%YAML 1.2
---

# Copyright 2017 Glen Harmon

name: Cisco IOS
file_extensions:
  - cisco-ios
  - ios
first_line_match: |
  (?xi)
    \s*
    [#!]
    .*
    (?:
      (?:ios\b)
    )
scope: text.network.cisco.ios text.network.cisco.configure_terminal


variables:
  comment: '(?:[!#])'
  pop_ctx: '^\s*exit\s*$'
  pop_address_family_ctx: '^\s*(?:exit-address-family)\s*$'
  command_end: '(?:\s|{{comment}}|$)'
  line_number: '^\s*\d+'
  security_tag_id: '\d+'
  route_target: '\d+:\d+'
  type_5_password: \S+
  type_7_password: \S+
  snmp_notification_types: |
    (?xi)
    (?:
      (?:aaa\s+server)|
      (?:adslline)|
      (?:atm)|
      (?:auth-framework)|
      (?:authenticate-fail)|
      (?:bgp)|
      (?:bridge)|
      (?:bstun)|
      (?:bulkstat)|
      (?:c6kxbar)|
      (?:callhome)|
      (?:calltracker)|
      (?:casa)|
      (?:ccme)|
      (?:cef)|
      (?:chassis)|
      (?:cnpd)|
      (?:config)|
      (?:config-copy)|
      (?:config-ctid)|
      (?:cpu)|
      (?:csg)|
      (?:deauthenticate)|
      (?:dhcp-snooping)|
      (?:director)|
      (?:disassociate)|
      (?:dlsw)|
      (?:dnis)|
      (?:dot11-mibs)|
      (?:dot11-qos)|
      (?:dot1x)|
      (?:ds1)|
      (?:ds1-loopback)|
      (?:dspu)|
      (?:eigrp)|
      (?:energywise)|
      (?:entity)|
      (?:entity-diag)|
      (?:envmon)|
      (?:errdisable)|
      (?:ethernet-cfm)|
      (?:event-manager)|
      (?:firewall)|
      (?:flash)|
      (?:flexlinks)|
      (?:flowmon)|
      (?:frame-relay)|
      (?:fru-ctrl)|
      (?:hsrp)|
      (?:icsudsu)|
      (?:iplocalpool)|
      (?:ipmobile)|
      (?:ipmulticast)|
      (?:ipsec)|
      (?:isakmp)|
      (?:isdn)|
      (?:l2tc)|
      (?:l2tun-pseudowire-status)|
      (?:l2tun-session)|
      (?:license)|
      (?:llc2)|
      (?:mac-notification)|
      (?:memory)|
      (?:module)|
      (?:module-auto-shutdown)|
      (?:mpls-fast-reroute)|
      (?:mpls-ldp)|
      (?:mpls-traffic-eng)|
      (?:mpls-vpn)|
      (?:msdp)|
      (?:mvpn)|
      (?:nhrp)|
      (?:ospf)|
      (?:p2mp-traffic-eng)|
      (?:pim)|
      (?:port-security)|
      (?:power-ethernet)|
      (?:public storm-control)|
      (?:pw-vc)|
      (?:repeater)|
      (?:resource-policy)|
      (?:rf)|
      (?:rogue-ap)|
      (?:rsrb)|
      (?:rsvp)|
      (?:rtr)|
      (?:sdlc)|
      (?:sdllc)|
      (?:slb)|
      (?:snmp)|
      (?:sonet)|
      (?:srp)|
      (?:srst)|
      (?:stpx)|
      (?:stun)|
      (?:switch-over)|
      (?:syslog)|
      (?:syslog)|
      (?:tty)|
      (?:udp-port)|
      (?:vlan-mac-limit)|
      (?:vlancreate)|
      (?:vlandelete)|
      (?:voice)|
      (?:vrrp)|
      (?:vsimaster)|
      (?:vswitch)|
      (?:vtp)|
      (?:wlan-wep)|
      (?:x25)|
      (?:xgcp)
    )
  ascii_character: |
    (?xi)
    (?:[\x00-\x7F])
  month_name: |
    (?xi)
    (?:
      (?:january)|
      (?:february)|
      (?:march)|
      (?:april)|
      (?:may)|
      (?:june)|
      (?:july)|
      (?:august)|
      (?:september)|
      (?:october)|
      (?:november)|
      (?:december)
    )
  month_short_name: |
    (?xi)
    (?:
      (?:jan)|
      (?:feb)|
      (?:mar)|
      (?:apr)|
      (?:may)|
      (?:jun)|
      (?:jul)|
      (?:aug)|
      (?:sep)|
      (?:oct)|
      (?:nov)|
      (?:dec)
    )
  hostname: |
    (?xi)
    (?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}
  mac_address: |
    (?xi)
    (?:
      (?:[a-f0-9]{1,4}\.){2}[a-f0-9]{1,4}
    )

  ah_transform: |
    (?xi)
    (?:
      (?:ah-md5-hmac)|
      (?:ah-sha-hmac)
    )
  logging_level: |
    (?xi)
    (?:
      (?:emergencies)|
      (?:alerts)|
      (?:critical)|
      (?:errors)|
      (?:warnings)|
      (?:notifications)|
      (?:informational)|
      (?:debugging)|
      (?:[0-7])
    )
  logging_level_digits: |
    (?xi)
    (?:
      (?:[0-7])
    )
  logging_facilities: |
    (?xi)
    (?:
      \b
      (?:
        (?:auth)|
        (?:cron)|
        (?:daemon)|
        (?:kern)|
        (?:local[0-7])|
        (?:lpr)|
        (?:mail)|
        (?:news)|
        (?:sys9)|
        (?:sys1[0-4])|
        (?:syslog)|
        (?:user)|
        (?:uucp)
      )
      \b
    )
  number_range_1_15: |
    (?xi)
    (?:
      \b
      (?:
        (?:[1-9])|
        (?:1[0-5])
      )
      \b
    )
  number_range_1_31: |
    (?xi)
    (?:
      \b
      (?:
        (?:[1-3]\d)|
        (?:[1-9])
      )
      \b
    )
  number_range_0_63: |
    (?xi)
    (?:
      \b
      (?:
        (?:6[1-3])|
        (?:[0-5]\d)|
        (?:\d)
      )
      \b
    )
  number_range_1_100: |
    (?xi)
    (?:
      \b
      (?:
        (?:100)|
        (?:[1-9]\d)|
        (?:[1-9])
      )
      \b
    )
  number_range_0_255: |
    (?xi)
    (?:
      \b
      (?:
        (?:25[0-5])|
        (?:2[0-4]\d)|
        (?:[0-1]?\d{1,2})
      )
      \b
    )
  number_range_1_1024: |
    (?xi)
    (?:
      \b
      (?:
        (?:102[0-4])|
        (?:10[0-1]\d)|
        (?:\d{2,3})|
        (?:[1-9])
      )
      \b
    )
  number_range_1_1440: |
    (?xi)
    (?:
      \b
      (?:
        (?:1440)|
        (?:14[0-3]\d)|
        (?:1[0-3]\d{2})|
        (?:\d{2,3})|
        (?:[1-9])
      )
      \b
    )
  number_range_1_4097: |
    (?xi)
    (?:
      \b
      (?:
        (?:409[0-7])|
        (?:40[0-8]\d)|
        (?:[1-3]\d{3})|
        (?:\d{2,3})|
        (?:[1-9])
      )
      \b
    )
  number_range_1_1000: |
    (?xi)
    (?:
      \b
      (?:
        (?:1000)|
        (?:\d{2,3})|
        (?:[1-9])
      )
      \b
    )
  number_range_1_10000: |
    (?xi)
    (?:
      \b
      (?:
        (?:10000)|
        (?:\d{2,4})|
        (?:[1-9])
      )
      \b
    )
  number_range_0_60000: |
    (?xi)
    (?:
      \b
      (?:
        (?:60000)|
        (?:[1-5]?\d{1,4})
      )
      \b
    )
  number_range_1_160000: |
    (?xi)
    (?:
      \b
      (?:
        (?:160000)|
        (?:1[0-5]\d{4})|
        (?:\d{1,5})
      )
      \b
    )
  number_range_484_8192: |
    (?xi)
    (?:
      \b
      (?:
        (?:819[0-2])|
        (?:81[0-8]\d)|
        (?:80\d{2})|
        (?:[0-7]\d{3})|
        (?:48[0-4])|
        (?:4[0-7]\d)|
        (?:[0-3]\d{2})
      )
      \b
    )
  number_range_64_1280000: |
    (?xi)
    (?:
      \b
      (?:
        (?:1280000)|
        (?:12[0-7]\d{4})|
        (?:\d{3,6})|
        (?:7\d+)|
        (?:6[4-9])
      )
      \b
    )
  number_range_0_42949671: |
    (?xi)
    (?:
      \b
      (?:
        (?:4294967[0-1])|
        (?:429496[0-6]\d)|
        (?:42949[0-5]\d{2})|
        (?:4294[0-8]\d{3})|
        (?:429[0-3]\d{4})|
        (?:42[0-8]\d{5})|
        (?:4[0-1]\d{6})|
        (?:[0-3]\d{7})|
        (?:\d{1,7})
      )
      \b
    )

  number_range_0_604800000: |
    (?xi)
    (?:
      \b
      (?:
        (?:604800000)|
        (?:604[0-7]\d{5})|
        (?:60[0-3]\d{6})|
        (?:[0-5]\d{8})|
        (?:\d{1,8})
      )
      \b
    )
  number_range_4096_2147483647: |
    (?xi)
    (?:
      \b
      (?:
        (?:214748364[0-7])|
        (?:21474836[0-3]\d)|
        (?:2147483[0-5]\d{2})|
        (?:214748[0-2]\d{3})|
        (?:21474[0-7]\d{4})|
        (?:2147[0-3]\d{5})|
        (?:214[0-6]\d{6})|
        (?:21[0-3]\d{7})|
        (?:20\d{8})|
        (?:1\d{9})|
        (?:\d{5,9})|
        (?:409[6-9])|
        (?:4[1-9]\d{2})|
        (?:[5-9]\d{3})
      )
      \b
    )
  # 1 - 255
  number_8_bit: |
    (?xi)
    (?:
      \b
      (?:
        (?:25[0-5])|
        (?:2[0-4]\d)|
        (?:[0-1]?\d{1,2})
      )
      \b
    )
  # 1 - 65535
  number_16_bit: |
    (?xi)
    (?:
      \b
      (?:
        (?:6553[0-5])|
        (?:655[0-2]\d)|
        (?:65[0-4]\d{2})|
        (?:6[0-4]\d{3})|
        (?:[0-5]\d{4})|
        (?:\d{2,4})|
        (?:[1-9])
      )
      \b
    )
  # 1 - 4,294,967,295
  number_32_bit: |
    (?xi)
    (?:
      \b
      (?:
        (?:4294967295)|
        (?:[0-3]\d{9})|
        (?:4[0-1]\d{8})|
        (?:42[0-8]\d{7})|
        (?:429[0-3]\d{6})|
        (?:4294[0-8]\d{5})|
        (?:42949[0-5]\d{4})|
        (?:429496[0-6]\d{3})|
        (?:4294967[0-1]\d{2})|
        (?:42949672[0-8]\d{1})|
        (?:429496729[0-5])|
        (?:\d{1,9})
      )
      \b
    )
  number_32_bit_wo_zero: |
    (?xi)
    (?:
      \b
      (?:
        (?:4294967295)|
        (?:[0-3]\d{9})|
        (?:4[0-1]\d{8})|
        (?:42[0-8]\d{7})|
        (?:429[0-3]\d{6})|
        (?:4294[0-8]\d{5})|
        (?:42949[0-5]\d{4})|
        (?:429496[0-6]\d{3})|
        (?:4294967[0-1]\d{2})|
        (?:42949672[0-8]\d{1})|
        (?:429496729[0-5])|
        (?:\d{2,9})|
        (?:[1-9])
      )
      \b
    )
  authentication_methods: |
    (?xi)
    (?:
      (?:auth-guest)|
      (?:enable)|
      (?:guest)|
      (?:if-authenticated)|
      (?:if-needed)|
      (?:krb5)|
      (?:krb-instance)|
      (?:krb-telnet)|
      (?:line)|
      (?:local)|
      (?:none)|
      (?:radius)|
      (?:rcmd)|
      (?:tacacsplus)|
      (?:tacacs)
    )
  esp_encryption_transform: |
    (?xi)
    (?:
      (?:esp-des)|
      (?:esp-null)|
      (?:esp-3des)
    )
  pkey_types: |
    (?xi)
    (?:
      (?:rsa)
    )
  esp_authentication_transform: |
    (?xi)
    (?:
      (?:esp-md5-hmac)|
      (?:esp-sha-hmac)
    )
  tos: |
    (?xi)
    (?:
      (?:[0-1]?\d)|
      (?:max-reliability)|
      (?:max-throughput)|
      (?:min-delay)|
      (?:min-monetary-cost)|
      (?:normal)
    )
  tos_precedence: |
    (?xi)
    (?:
      (?:[0-7])|
      (?:flash-override)|
      (?:flash)|
      (?:immediate)|
      (?:internet)|
      (?:network)|
      (?:priority)|
      (?:routine)
    )
  ip_options: |
    (?xi)
    (?:
      (?:{{number_8_bit}})|
      (?:add-ext)|
      (?:any-options)|
      (?:com-security)|
      (?:dps)|
      (?:encode)|
      (?:eool)|
      (?:ext-ip)|
      (?:ext-security)|
      (?:finn)|
      (?:imitd)|
      (?:lsr)|
      (?:match-all)|
      (?:match-any)|
      (?:mtup)|
      (?:mtur)|
      (?:no-op)|
      (?:psh)|
      (?:nsapa)|
      (?:reflect)|
      (?:record-route)|
      (?:rst)|
      (?:router-alert)|
      (?:sdb)|
      (?:security)|
      (?:ssr)|
      (?:stream-id)|
      (?:syn)|
      (?:timestamp)|
      (?:traceroute)|
      (?:ump)|
      (?:visa)|
      (?:zsu)
    )
  ttl_match_values: |
    (?xi)
    (?:
      (?:eq)|
      (?:gt)|
      (?:lt)|
      (?:neq)|
      (?:range)
    )
  dscp_w_value: |
    (?xi)
    (?:
      (?:{{dscp}})|
      (?:6[0-3])|
      (?:[0-5]?\d)
    )
  dscp: |
    (?xi)
    (?:
      (?:AF11)|
      (?:AF12)|
      (?:AF13)|
      (?:AF21)|
      (?:AF22)|
      (?:AF23)|
      (?:AF31)|
      (?:AF32)|
      (?:AF33)|
      (?:AF41)|
      (?:AF42)|
      (?:AF43)|
      (?:CS1)|
      (?:CS2)|
      (?:CS3)|
      (?:CS4)|
      (?:CS5)|
      (?:CS6)|
      (?:CS7)|
      (?:EF)
    )
  month_names: |
    (?xi)
    (?:
      (?:jan(?:uary)?)|
      (?:feb(?:uary)?)|
      (?:mar(?:ch)?)|
      (?:apr(?:il)?)|
      (?:may)|
      (?:jun(?:e)?)|
      (?:july)|
      (?:aug(?:ust)?)|
      (?:sept(?:ember)?)|
      (?:oct(?:ober)?)|
      (?:nov(?:ember)?)|
      (?:dec(?:ember)?)
    )
  military_clock_hour_minute: |
    (?xi)
    (?:
      (?:
        (?:
          2[0-3]
        )|
        (?:
          [0-1]?\d+
        )
      )?
    )
    :
    [0-5]\d+
  day_of_week_names: |
    (?xi)
    (?:
      (?:mon(?:day)?)|
      (?:tues(?:day)?)|
      (?:wed(?:nesday)?)|
      (?:thurs(?:day)?)|
      (?:fri(?:day)?)|
      (?:sat(?:urday)?)|
      (?:sun(?:day)?)
    )
  utc_offset_hour: |
    (?xi)
    [-+]?
    (?:
      (?:1[0-4])|
      (?:[0-9])
    )
  authentication_methods_dot1x: |
    (?xi)
    (?:
      (?:enable)|
      (?:group\s+radius)|
      (?:line)|
      (?:local-case)|
      (?:local)|
      (?:none)
    )
  utc_offset_minute: '[1-6]?[0-9]'
  # Source: https://en.wikipedia.org/wiki/List_of_time_zone_abbreviations
  # Single Letter Timezones: https://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf012.html#wpxref70983
  timezones: |
    (?xi)
    (?:
      (?:ACDT)|
      (?:ACST)|
      (?:ACT)|
      (?:ACT)|
      (?:ACWST)|
      (?:ADT)|
      (?:AEDT)|
      (?:AEST)|
      (?:AFT)|
      (?:AKDT)|
      (?:AKST)|
      (?:AMST)|
      (?:AMT)|
      (?:AMT)|
      (?:ART)|
      (?:AST)|
      (?:AST)|
      (?:AWST)|
      (?:AZOST)|
      (?:AZOT)|
      (?:AZT)|
      (?:BDT)|
      (?:BIOT)|
      (?:BIT)|
      (?:BOT)|
      (?:BRST)|
      (?:BRT)|
      (?:BST)|
      (?:BST)|
      (?:BST)|
      (?:BTT)|
      (?:CAT)|
      (?:CCT)|
      (?:CDT)|
      (?:CDT)|
      (?:CEST)|
      (?:CET)|
      (?:CHADT)|
      (?:CHAST)|
      (?:CHOT)|
      (?:CHOST)|
      (?:CHST)|
      (?:CHUT)|
      (?:CIST)|
      (?:CIT)|
      (?:CKT)|
      (?:CLST)|
      (?:CLT)|
      (?:COST)|
      (?:COT)|
      (?:CST)|
      (?:CST)|
      (?:CST)|
      (?:CT)|
      (?:CVT)|
      (?:CWST)|
      (?:CXT)|
      (?:DAVT)|
      (?:DDUT)|
      (?:DFT)|
      (?:EASST)|
      (?:EAST)|
      (?:EAT)|
      (?:ECT)|
      (?:ECT)|
      (?:EDT)|
      (?:EEST)|
      (?:EET)|
      (?:EGST)|
      (?:EGT)|
      (?:EIT)|
      (?:EST)|
      (?:FET)|
      (?:FJT)|
      (?:FKST)|
      (?:FKT)|
      (?:FNT)|
      (?:GALT)|
      (?:GAMT)|
      (?:GET)|
      (?:GFT)|
      (?:GILT)|
      (?:GIT)|
      (?:GMT)|
      (?:GST)|
      (?:GST)|
      (?:GYT)|
      (?:HDT)|
      (?:HAEC)|
      (?:HST)|
      (?:HKT)|
      (?:HMT)|
      (?:HOVST)|
      (?:HOVT)|
      (?:ICT)|
      (?:IDLW)|
      (?:IDT)|
      (?:IOT)|
      (?:IRDT)|
      (?:IRKT)|
      (?:IRST)|
      (?:IST)|
      (?:IST)|
      (?:IST)|
      (?:JST)|
      (?:KALT)|
      (?:KGT)|
      (?:KOST)|
      (?:KRAT)|
      (?:KST)|
      (?:LHST)|
      (?:LHST)|
      (?:LINT)|
      (?:MAGT)|
      (?:MART)|
      (?:MAWT)|
      (?:MDT)|
      (?:MET)|
      (?:MEST)|
      (?:MHT)|
      (?:MIST)|
      (?:MIT)|
      (?:MMT)|
      (?:MSK)|
      (?:MST)|
      (?:MST)|
      (?:MUT)|
      (?:MVT)|
      (?:MYT)|
      (?:NCT)|
      (?:NDT)|
      (?:NFT)|
      (?:NPT)|
      (?:NST)|
      (?:NT)|
      (?:NUT)|
      (?:NZDT)|
      (?:NZST)|
      (?:OMST)|
      (?:ORAT)|
      (?:PDT)|
      (?:PET)|
      (?:PETT)|
      (?:PGT)|
      (?:PHOT)|
      (?:PHT)|
      (?:PKT)|
      (?:PMDT)|
      (?:PMST)|
      (?:PONT)|
      (?:PST)|
      (?:PST)|
      (?:PYST)|
      (?:PYT)|
      (?:RET)|
      (?:ROTT)|
      (?:SAKT)|
      (?:SAMT)|
      (?:SAST)|
      (?:SBT)|
      (?:SCT)|
      (?:SDT)|
      (?:SGT)|
      (?:SLST)|
      (?:SRET)|
      (?:SRT)|
      (?:SST)|
      (?:SST)|
      (?:SYOT)|
      (?:TAHT)|
      (?:THA)|
      (?:TFT)|
      (?:TJT)|
      (?:TKT)|
      (?:TLT)|
      (?:TMT)|
      (?:TRT)|
      (?:TOT)|
      (?:TVT)|
      (?:ULAST)|
      (?:ULAT)|
      (?:UTC)|
      (?:UYST)|
      (?:UYT)|
      (?:UZT)|
      (?:VET)|
      (?:VLAT)|
      (?:VOLT)|
      (?:VOST)|
      (?:VUT)|
      (?:WAKT)|
      (?:WAST)|
      (?:WAT)|
      (?:WEST)|
      (?:WET)|
      (?:WIT)|
      (?:WST)|
      (?:YAKT)|
      (?:YEKT)|
      (?:Y)|
      (?:X)|
      (?:W)|
      (?:V)|
      (?:U)|
      (?:T)|
      (?:S)|
      (?:R)|
      (?:Q)|
      (?:P)|
      (?:O)|
      (?:N)|
      (?:Z)|
      (?:A)|
      (?:B)|
      (?:C)|
      (?:D)|
      (?:E)|
      (?:F)|
      (?:G)|
      (?:H)|
      (?:I)|
      (?:K)|
      (?:L)|
      (?:M)|
      (?:\S+)
    )
  hashing_algorithms: |
    (?xi)
    (?:
      (?:md5)
    )
  configure_terminal_ctx_words: |
    (?xi)
    \s*
    (?:
      (?:aaa)|
      (?:access-list)|
      (?:alias)|
      (?:banner)|
      (?:boot)|
      (?:boot-end-marker)|
      (?:boot-start-marker)|
      (?:building)|
      (?:class-map)|
      (?:clock)|
      (?:control-plane)|
      (?:conf(?:igure)?\s+t(?:erminal)?)|
      (?:diagnostic)|
      (?:enable)|
      (?:exception)|
      (?:hostname)|
      (?:interface)|
      (?:ip\s+
        (?:
          (?:access-list)|
          (?:arp)|
          (?:vrf)|
          (?:route)|
          (?:domain)|
          (?:sla)|
          (?:dhcp)
        )
      )|
      (?:line)|
      (?:logging)|
      (?:login)|
      (?:mls)|
      (?:mpls)|
      (?:multilink)|
      (?:ntp)|
      (?:object-group)|
      (?:policy-map)|
      (?:redundancy)|
      (?:router)|
      (?:route-map)|
      (?:service)|
      (?:snmp-server)|
      (?:spanning-tree)|
      (?:tacacs-server)|
      (?:udld)|
      (?:username)|
      (?:vrf)|
      (?:vlan)|
      (?:vtp)
    )
  policy_map_ctx_words: |
    (?xi)
    \s*
    (?:
      (?:class)|
      (?:{{configure_terminal_ctx_words}})
    )
  vrf_definition_ctx_words: |
    (?xi)
    \s*
    (?:
      {{configure_terminal_ctx_words}}
    )|
    (?:
      (?:route-target)|
      (?:rd)|
      (?:address-family)
    )
  bgp_address_family_ctx_words: |
    (?xi)
    \s*
    (?:
      {{configure_terminal_ctx_words}}
    )|
    (?:
      (?:address-family)|
      (?:template)|
      (?:bgp)|
      (?:timers)
    )
  ip: '(?:(?:(?:[0-2]?\d?\d)\.){3}(?:[0-2]?\d?\d))'
  wildcard_mask: |
    (?xi)
    (?:
      (?:127\.255\.255\.255)|
      (?:63\.255\.255\.255)|
      (?:31\.255\.255\.255)|
      (?:15\.255\.255\.255)|
      (?:7\.255\.255\.255)|
      (?:3\.255\.255\.255)|
      (?:1\.255\.255\.255)|
      (?:0\.255\.255\.255)|
      (?:0\.127\.255\.255)|
      (?:0\.63\.255\.255)|
      (?:0\.31\.255\.255)|
      (?:0\.15\.255\.255)|
      (?:0\.7\.255\.255)|
      (?:0\.3\.255\.255)|
      (?:0\.1\.255\.255)|
      (?:0\.0\.255\.255)|
      (?:0\.0\.127\.255)|
      (?:0\.0\.63\.255)|
      (?:0\.0\.31\.255)|
      (?:0\.0\.15\.255)|
      (?:0\.0\.7\.255)|
      (?:0\.0\.3\.255)|
      (?:0\.0\.1\.255)|
      (?:0\.0\.0\.255)|
      (?:0\.0\.0\.127)|
      (?:0\.0\.0\.63)|
      (?:0\.0\.0\.31)|
      (?:0\.0\.0\.15)|
      (?:0\.0\.0\.7)|
      (?:0\.0\.0\.3)|
      (?:0\.0\.0\.1)|
      (?:0\.0\.0\.0)
    )
  subnet_mask: |
    (?xi)
    (?:
        (?:0\.0\.0\.0)|
        (?:128\.0\.0\.0)|
        (?:192\.0\.0\.0)|
        (?:224\.0\.0\.0)|
        (?:240\.0\.0\.0)|
        (?:248\.0\.0\.0)|
        (?:252\.0\.0\.0)|
        (?:254\.0\.0\.0)|
        (?:255\.0\.0\.0)|
        (?:255\.128\.0\.0)|
        (?:255\.192\.0\.0)|
        (?:255\.224\.0\.0)|
        (?:255\.240\.0\.0)|
        (?:255\.248\.0\.0)|
        (?:255\.252\.0\.0)|
        (?:255\.254\.0\.0)|
        (?:255\.255\.0\.0)|
        (?:255\.255\.128\.0)|
        (?:255\.255\.192\.0)|
        (?:255\.255\.224\.0)|
        (?:255\.255\.240\.0)|
        (?:255\.255\.248\.0)|
        (?:255\.255\.252\.0)|
        (?:255\.255\.254\.0)|
        (?:255\.255\.255\.0)|
        (?:255\.255\.255\.128)|
        (?:255\.255\.255\.192)|
        (?:255\.255\.255\.224)|
        (?:255\.255\.255\.240)|
        (?:255\.255\.255\.248)|
        (?:255\.255\.255\.252)|
        (?:255\.255\.255\.254)|
        (?:255\.255\.255\.255)
    )
  ipv4_prefix_length: '(?:\b(?:(?:[0-2]?\d)|(?:3[0-2]))\b)'
  ip_prefix: '(?:{{ip}}/{{ipv4_prefix_length}})'
  ipv6_prefix_length: |
    (?xi)
    (?:
      /
      (?:
        (?:12[0-8])|
        (?:1[0-1]\d)|
        (?:\d{1,2})
      )
    )
  ipv6_prefix: '(?:(?:(?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:[0-9A-Fa-f]{1,4}|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::[0-9A-Fa-f]{1,4}|(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,2})|:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,3})|(?:(?::[0-9A-Fa-f]{1,4})?:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,4})|(?:(?::[0-9A-Fa-f]{1,4}){0,2}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,5})|(?:(?::[0-9A-Fa-f]{1,4}){0,3}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){1}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|(?:(?::[0-9A-Fa-f]{1,4}){0,4}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?::(?:(?:(?::[0-9A-Fa-f]{1,4}){1,7})|(?:(?::[0-9A-Fa-f]{1,4}){0,5}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:)))(?:%.+)?{{ipv6_prefix_length}}|::/0))'
  ipv6: '(?:(?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:[0-9A-Fa-f]{1,4}|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::[0-9A-Fa-f]{1,4}|(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,2})|:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,3})|(?:(?::[0-9A-Fa-f]{1,4})?:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,4})|(?:(?::[0-9A-Fa-f]{1,4}){0,2}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,5})|(?:(?::[0-9A-Fa-f]{1,4}){0,3}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){1}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|(?:(?::[0-9A-Fa-f]{1,4}){0,4}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?::(?:(?:(?::[0-9A-Fa-f]{1,4}){1,7})|(?:(?::[0-9A-Fa-f]{1,4}){0,5}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:)))(?:%.+)?)'
  vlan_id: |
    (?xi)
    (?:
      (?:[0-3]\d{2,3})|
      (?:40[0-9][0-5])|
      (?:\d{2,3})|
      [1-9]
    )
  vlan_range: |
    (?xi)
    (?:
      {{vlan_id}}
      (?:
        (?:
          (?:-)|(?:,)
        )
        {{vlan_id}}
      )*
    )
  network_address: '(?:{{ip}})\s+(?:{{wildcard_mask}})'
  interface_names: |
    (?xi)
    (?:
      (?:BVI)|
      (?:Ethernet)|
      (?:Et)|
      (?:FastEthernet)|
      (?:Fa)|
      (?:FortyGigE)|
      (?:FortyGigabitEthernet)|
      (?:Fo)|
      (?:GigabitEthernet)|
      (?:Gi)|
      (?:HundredGigE)|
      (?:loopback)|
      (?:lo)|
      (?:port-channel)|
      (?:po)|
      (?:serial)|
      (?:se)|
      (?:TwentyFiveGigabitEthernet)|
      (?:Twe)|
      (?:TwoGigabitEthernet)|
      (?:Tw)|
      (?:TenGigabitEthernet)|
      (?:Te)|
      (?:tunnel)|
      (?:Dot11Radio)|
      (?:tu)|
      (?:vlan)|
      (?:vl)
    )
  interface_numbers: |
    (?xi)
    (?:\d+(?:/\d+)*(?:\.\d+)?)?
  interface_number_ranged: |
    (?xi)
    (?:\d+(?:/\d+)*(?:\.\d+)?)(?:\s*-\s*\d+)?
  network_target: |
    (?xi)
    (?:
      (?:{{network_address}})|
      (?:{{ip}})|
      (?:any)
    )
  protocol_target: |
    (?xi)
    (?:
      (?:ip)|
      (?:tcp)|
      (?:udp)|
      (?:esp)|
      (?:icmp)
    )
  port_numbers: '(?:(?:[1-6]?\d{1,4}))'
  port_names: |
    (?xi)
    (?:
      (?:bgp)|
      (?:bootps)|
      (?:bootpc)|
      (?:cmd)|
      (?:ssh)|
      (?:ftp-data)|
      (?:ftp)|
      (?:domain)|
      (?:ntp)|
      (?:snmptrap)|
      (?:sunrpc)|
      (?:syslog)|
      (?:telnet)|
      (?:tacacs)|
      (?:isakmp)|
      (?:snmp)|
      (?:www)
    )
  operators: |
    (?xi)
    (?:
      (?:eq)|
      (?:neq)|
      (?:ge)|
      (?:gt)|
      (?:lt)|
      (?:le)
    )
  port_target: '(?:(?:{{port_numbers}})|(?:{{port_names}}))'
  drives: |
    (?xi)
    (?:
      (?:(?:(?:running)|(?:startup))-config)|
      (?:flash)|
      (?:disk(?:[0-3])?)
    )
  uri: '(?<protocol>(?:t?ftp)|scp)(?<protocol_seperator>://)(?<hostname>(?:\d+\.){3}\d+)(?<path>\/\S*)'
  locations: '(?:{{drives}}|{{uri}})'

contexts:

  main:
    - include: show
    - include: enable
    - include: configure_terminal
    - include: configure_terminal_scope
    - include: do_show
    - include: scope


  prototype:
    - include: device_comment
    - include: pop_ctx_word
    - include: comment
    - include: pipe
    - include: scope

  scope:
    - include: removal
    - include: pop_ctx_word
    - include: comment

  partials:
    - match: |
        (?xi)
        (?:
          ^\s*
          (?:
            (?:access-class)|
            (?:address-family)|
            (?:channel-group)|
            (?:default)|
            (?:deny)|
            (?:description)|
            (?:encapsulation)|
            (?:end)|
            (?:exit)|
            (?:exit-address-family)|
            (?:export)|
            (?:hostname)|
            (?:interface)|
            (?:ipv6)|
            (?:line)|
            (?:logout)|
            (?:name)|
            (?:neighbor)|
            (?:network)|
            (?:no)|
            (?:permit)|
            (?:port-channel)|
            (?:rd)|
            (?:route-target)|
            (?:router)|
            (?:shutdown)|
            (?:snmp-server)|
            (?:standby)|
            (?:switchport)|
            (?:transport)|
            (?:vlan)|
            (?:vrf)|
            (?:write)
          )
          \s
          [^$]*
        )
      scope: text.network.cisco.partial

  pop_on_policy_map_context:
    - match: |
        (?xi)
        (?=
          ^\s*
          {{policy_map_ctx_words}}
        )
      pop: true

  pop_on_configure_terminal_context:
    - match: |
        (?xi)
        (?=
          ^\s*
          {{configure_terminal_ctx_words}}
        )
      pop: true

  pop_on_vrf_definition_context:
    - match: |
        (?xi)
        (?=
          ^\s*
          (?:{{vrf_definition_ctx_words}})
        )
      pop: true

  pop_on_bgp_address_family_context:
    - match: |
        (?xi)
        (?=
          ^\s*
          (?:{{bgp_address_family_ctx_words}})
        )
      pop: true

  removal:
    - meta_include_prototype: false
    - match: ^\s*(no\s[^{{comment}}]*)
      scope: text.network.cisco.removal
      captures:
        1: keyword.other

  pop_ctx_word:
    - match: ^(!)$
      captures:
        1: comment.line
      pop: true
    - match: ({{pop_ctx}})
      pop: true
      captures:
        1: comment.line
    - match: '^\s*(end)\s*$'
      captures:
        1: comment.block.documentation
      pop: true

  pop_context_on_unknown:
    - match: '(?=^\s*[^{{comment}}\s].*$)'
      pop: true

  configure_terminal:
    - match: ^\s*(?:(conf(?:igure)?)\s*(t(?:erminal)?))
      # with_prototype:
      #   - include: do_show
      #   - include: scope
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
      # push:
        # - meta_content_scope: text.network.cisco.configure_terminal
        # - include: configure_terminal_scope

  configure_terminal_scope:
    - include: bgp
    - include: ospf
    - include: vty
    - include: vrf
    - include: login
    - include: snmp
    - include: ntp
    - include: vlan
    - include: ip_http
    - include: ip_scp
    - include: banner
    - include: ip_subnet_zero
    - include: ip_cef
    - include: aaa_session_id
    - include: vtp
    - include: spanning_tree
    - include: logging
    - include: service
    - include: clock
    - include: monitor
    - include: hostname
    - include: line_con
    - include: username
    - include: line_aux
    - include: ip_route
    - include: crypto
    - include: ip_ssh
    - include: interface
    - include: errdisable
    - include: policy_map
    - include: class_map
    - include: aaa_group
    - include: prefix_list
    - include: vrf_upgrade
    - include: ntp_server
    - include: object_group
    - include: igmp_snooping_querier
    - include: ip_name_server
    - include: ip_domain_name
    - include: ip_dhcp_pool
    - include: ip_classless
    - include: aaa_new_model
    - include: system_version
    - include: enable_secret
    - include: enable_password
    - include: aaa_authentication
    - include: aaa_authorization
    - include: aaa_accounting
    - include: ipv6_unicast_routing
    - include: ipv6_general_prefix
    - include: access_list_compiled
    - include: extended_acl
    - include: standard_acl
    - include: ip_sla
    - include: extended_acl_old
    - include: route_map
    - include: configure_terminal_ip_dhcp_snooping
    - include: aaa_server_radius_dynamic_author
    # - include: partials


  device_comment:
    - match: |
        (?xi)
        ^(
          \s*
          {{comment}}
          \s+
          (?:
            (?:on)|
            (?:devices?)
          )
          \s+
          \S.*
        )$
      scope: text.network.cisco.comment
      captures:
        0: cisco.scope
        1: comment.line

  comment:
    - match: ({{comment}}.*)$
      scope: text.network.cisco.comment
      captures:
        1: comment.line

  system_version:
    - match: |
        (?xi)
        ^\s*
        (version)\s+(\d+\.\d+)
      scope: text.network.cisco.ios.version
      captures:
        1: support.constant
        2: constant.numeric

  ip_name_server:
    - match: |
        (?xi)
        ^\s*
        (ip)\s+(name-server)\s+(\S+)
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted

  ntp_server:
    - match: |
        (?xi)
        ^\s*
        (ntp)\s+(server)\s+(\S+)\s+(prefer)?
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted
        4: support.constant

  access_list_compiled:
    - match: |
        (?xi)
        ^\s*
        (access-list)\s+(compiled)
      captures:
        1: support.constant
        2: support.constant

  igmp_snooping_querier:
    - match: |
        (?xi)
        ^\s*
        (ip)\s+(igmp)\s+(snooping)\s+(querier)?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  ip_domain_name:
    - match: |
        (?xi)
        ^\s*
        (ip)\s+(domain-name)\s+(\S+)
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted.

  username:
    - match: |
        (?xi)
        ^\s*
        (username)
        \s+
        (\S+)
        \s+
        (?:(privilege)\s+(\d+)\s+)?
        (?:
          (?:(secret)\s+(5)\s+(\S+))|
          (?:(secret)\s+(\S+))|
          (?:(password)\s+(secret\s+)?(5)\s+(\S+))|
          (?:(password)\s+(5)\s+(\S+))|
          (?:(password)\s+(7)\s+(\S+))|
          (?:(password)\s+(\d+)\s+(\S+))
        )?
      captures:
        1: support.constant   # username
        2: string.unquoted    # username string
        3: support.constant   # privilege
        4: constant.numeric   # privilege id
        5: support.constant   # secret
        6: constant.numeric   # secret type 5
        7: string.unquoted.cisco.password.type.5    # secret type 5 password string
        8: support.constant   # secret
        9: string.unquoted    # secret password string
        10: support.constant   # password
        11: support.constant   # password secret
        12: constant.numeric   # password type
        13: string.unquoted.cisco.password.type.5    # password string
        14: support.constant   # password
        15: constant.numeric   # password type
        16: string.unquoted.cisco.password.type.5    # password string
        17: support.constant   # password
        18: constant.numeric   # password type
        19: string.unquoted.cisco.password.type.7    # password string
        20: support.constant   # password
        21: constant.numeric   # password type
        22: string.unquoted    # password string

  vrf_upgrade:
    - match: ^\s*(vrf)\s+(upgrade-cli)\s+(multi-af-mode)\s+((?:non-)?common-policies)(?:(?:\s+(vrf)\s+(\S+)(?:\s+(force))?)|(\s+force))?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant
        5: support.constant
        6: string.unquoted
        7: support.constant
        8: support.constant

  enable:
    - include: write
    - include: copy
    - include: logout
    - include: configure_terminal
    - include: show_drives
    - include: terminal_info_current_configuration
    - include: terminal_info_boot_marker


  enable_password:
    - match: |
        (?xi)
        \s*
        (enable)\s+
        (password)\s+
        (?:
          (?:(5)\s+(\S+))|
          (?:(7)\s+(\S+))|
          (?:(\d+)\s+(\S+))|
          (\S+)
        )
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric
        4: string.unquoted.cisco.password.type.5
        5: constant.numeric
        6: string.unquoted.cisco.password.type.7
        7: constant.numeric
        8: string.unquoted
        9: string.unquoted

  enable_secret:
    - match: |
        (?xi)
        \s*
        (enable)\s+
        (secret)\s+
        (?:
          (?:(5)\s+(\S+))|
          (?:(7)\s+(\S+))|
          (?:(\d+)\s+(\S+))|
          (\S+)
        )
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric
        4: string.unquoted.cisco.password.type.5
        5: constant.numeric
        6: string.unquoted.cisco.password.type.7
        7: constant.numeric
        8: string.unquoted
        9: string.unquoted

  aaa_new_model:
    - match: |
        (?xi)
        \s*
        (aaa)\s+
        (new-model)\s+
      captures:
        1: support.constant
        2: support.constant

  interface_snmp:
    - include: snmp_trap_link_status
    - include: snmp_if_monitor

  snmp:
    - include: snmp_host
    - include: snmp_poll
    - include: snmp_inform
    - include: snmp_contact
    - include: snmp_manager
    - include: snmp_location
    - include: snmp_engine_id
    - include: snmp_file_transfer_access_group
    - include: snmp_group
    - include: snmp_dscp
    - include: snmp_ip_precedence
    - include: snmp_packetsize
    - include: snmp_queue_length
    - include: snmp_queue_limit
    - include: snmp_source_interface
    - include: snmp_system_shutdown
    - include: snmp_tftp_server_list
    - include: snmp_trap_authentication_unknown_context
    - include: snmp_trap_authentication_vrf
    - include: snmp_trap_link_ietf
    - include: snmp_trap_link_switchover
    - include: snmp_trap_retry
    - include: snmp_trap_timeout
    - include: snmp_trap_timeout_old
    - include: snmp_trap_source
    - include: snmp_trap_authentication
    - include: snmp_usm_cisco
    - include: snmp_view


  snmp_dscp:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (ip)\s+
        (dscp)\s+
        ({{number_range_0_63}})
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_trap_link_status:
    - match: |
        (?xi)
        \s*
        (snmp)\s+
        (trap)\s+
        (link-status)
        (\s+permit\s+duplicates)?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  snmp_packetsize:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (packetsize)\s+
        ({{number_range_484_8192}})
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric

  snmp_queue_limit:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (queue-limit)\s+
        (
          (?:dispatcher)|
          (?:engine)|
          (?:notification-host)
        )\s+
        ({{number_range_1_1000}})
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_trap_authentication_vrf:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (authentication)\s+
        (vrf)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  snmp_trap_link_ietf:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (link)\s+
        (ietf)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  snmp_trap_link_switchover:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (link)\s+
        (switchover)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  snmp_trap_retry:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (retry)\s+
        (
          \b
          (?:
            (?:10)|
            (?:\d)
          )
          \b
        )
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_trap_timeout_old:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap-timeout)\s+
        ({{number_range_1_1000}})
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric

  snmp_trap_timeout:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (timeout)\s+
        ({{number_range_1_1000}})
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_trap_authentication_unknown_context:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap)\s+
        (authentication)\s+
        (unknown-context)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant

  snmp_source_interface:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (source-interface)\s+
        (
          (?:traps)|
          (?:informs)
        )\s+
        ({{interface_names}})\s*({{interface_numbers}})
      captures:
        1: support.constant
        2: support.constant
        3: constant.language
        4: entity.other.attribute-name
        5: constant.numeric

  snmp_trap_source:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap-source)\s+
        ({{interface_names}})\s*({{interface_numbers}})
      captures:
        1: support.constant
        2: support.constant
        3: entity.other.attribute-name
        4: constant.numeric

  snmp_trap_authentication:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (trap-authentication)
      captures:
        1: support.constant
        2: support.constant

  snmp_usm_cisco:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (usm)\s+
        (cisco)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant

  snmp_view:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (view)\s+
        (\S+)\s+
        (
          (?:[\d\*]+\.)*
          [\d\*]+\.?
        )
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted
        4: constant.numeric

  snmp_if_monitor:
    - match: |
        (?xi)
        \s*
        (snmp)\s+
        (trap)\s+
        (if-monitor)
      captures:
        1: support.constant
        2: support.constant
        3: support.constant

  snmp_tftp_server_list:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (tftp-server-list)\s+
        (?:
          (\d+)|
          (\S+)
        )
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric
        4: string.unquoted

  snmp_system_shutdown:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (system-shutdown)
      captures:
        1: support.constant
        2: support.constant

  snmp_queue_length:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (queue-length)\s+
        (\d+)
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric

  snmp_ip_precedence:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (ip)\s+
        (precedence)\s+
        ([0-7])
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_group:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (group)\s+
        (\S+)\s+
        (?:
          (v1)|
          (v2c)|
          (?:(v3)\s+
            (
              (?:noauth)|
              (?:auth)|
              (?:priv)
            )
          )
        )
        (?:\s+(context)\s+(\S+))?
        (?:\s+(read)\s+(\S+))?
        (?:\s+(write)\s+(\S+))?
        (?:\s+(notify)\s+(\S+))?
        (?:\s+(access)\s+
          (?:
            (?:(ipv6)\s+(\S+))|
            (
              (?:[1-9]\d)|
              (?:[1-9])
            )|
            (\S+)
          )
        )?
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted
        4: constant.language
        5: constant.language
        6: constant.language
        7: entity.other.attribute-name
        8: support.constant
        9: string.unquoted
        10: support.constant
        11: string.unquoted
        12: support.constant
        13: string.unquoted
        14: support.constant
        15: string.unquoted
        16: support.constant
        17: support.constant
        18: string.unquoted
        19: constant.numeric
        20: string.unquoted

  snmp_engine_id:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (engineID)\s+
        (local)\s+
        (\S{1,24})
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: string.unquoted

  snmp_file_transfer_access_group:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (file-transfer)\s+
        (access-group)\s+
        (?:
          ([1-9]?\d)|
          ([1-9])|
          (\S+)|
        )
        (?:
          \s+
          (protocol)
          \s+
          (
            (?:ftp)|
            (?:rcp)|
            (?:scp)|
            (?:sftp)|
            (?:tftp)
          )
        )?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: constant.numeric
        6: string.unquoted
        7: support.constant
        8: constant.language

  snmp_manager:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (manager)
        (?:
          \s+
          (?:
            (session-timeout)\s+(\d+)
          )
        )?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric

  snmp_contact:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (contact)\s+
        (.*)
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted

  snmp_location:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (location)\s+
        (.*)
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted

  monitor:
    - match: |
        (?xi)
        \s*
        (monitor)\s+(session)\s+(\d+)\s+
        (?:
          (?:
            (source)\s+
            (?:
              (interface)\s+
              (?:
                (?:({{interface_names}})\s*(?:({{interface_number_ranged}})|({{interface_numbers}})))
              )
            )
          )|
          (?:
            (destination)\s+
            (?:
              (?:
                (interface)\s+
                (?:
                  (?:({{interface_names}})\s*({{interface_numbers}}))
                )
              )|
              (?:(analysis-module)\s+(\d+)\s+(data-port)\s+(\d+))
            )
          )
        )
      captures:
        1: support.constant             # monitor
        2: support.constant             # monitor session
        3: constant.numeric             # monitor session id
        4: support.constant             # source
        5: support.constant             # source interface
        6: entity.other.attribute-name  # source interface interface name
        7: constant.numeric             # source interface interface name number range
        8: constant.numeric             # source interface interface name number
        9: support.constant             # destination
        10: support.constant            # destination interface
        11: entity.other.attribute-name # destination interface interface name
        12: constant.numeric            # destination interface interface name number
        13: support.constant            # destination analysis-module
        14: constant.numeric            # destination analysis-module id
        15: support.constant            # destination analysis-module data-port
        16: constant.numeric            # destination analysis-module data-port id

  snmp_poll:
    - match: |
        (?xi)
        \s*
        (snmp-server)\s+
        (community)\s+
        (\S+)
        (\s+(?:(?:RO)|(?:RW)))?
        (\s+\S+)?
      captures:
        1: support.constant       # snmp-server
        2: support.constant       # poll community
        3: string.unquoted        # poll community value
        4: support.constant       # RO / RW
        5: string.unquoted        # ACL value

  snmp_inform:
    - match: >
        (?xi)
        \s*
        (snmp-server)\s+
        (inform)
        (?:\s+(pending)\s+({{number_32_bit_wo_zero}}))?
        (?:\s+(retries)\s+({{number_range_1_100}}))?
        (?:\s+(timeout)\s+({{number_range_0_42949671}}))?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.numeric
        7: support.constant
        8: constant.numeric

  snmp_host:
    - match: >
        (?xi)
        \s*
        (snmp-server)\s+
        (host)\s+
        (?:
          ({{ip}})|
          ({{hostname}})
        )
        \s+
        (?:
          (?:(vrf)\s+(\S+))|
          (?:(informs))|
          (?:(traps))|
          (?:
            (version)\s+
            (?:
              (1)|
              (2c)|
              (?:
                (3)\s+
                (
                  (?:auth)|
                  (?:noauth)|
                  (?:priv)
                )
              )
            )
          )
        )
        \s+
        (\S+)
        (?:
          \s+
          (?:
            (?:(udp-port)\s+({{port_numbers}})(?:\s+({{snmp_notification_types}}))?)|
            ({{snmp_notification_types}})
          )
        )?
      captures:
        1: support.constant       # snmp-server
        2: support.constant       # host
        3: constant.numeric.ip.ipv4.address
        4: constant.language
        5: support.constant
        6: string.unquoted
        7: support.constant
        8: support.constant
        9: support.constant
        10: constant.language
        11: constant.language
        12: constant.language
        13: entity.other.attribute-name
        14: string.unquoted
        15: support.constant
        16: constant.numeric
        17: entity.other.attribute-name
        18: entity.other.attribute-name

  hostname:
    - match: ^\s*(hostname)\s*(\S+)
      captures:
        1: support.constant
        2: string.unquoted

  ipv6_general_prefix:
    - match: \s*(ipv6\s+general-prefix)\s+(\S+\s+)?((?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:[0-9A-Fa-f]{1,4}|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::[0-9A-Fa-f]{1,4}|(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,2})|:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,3})|(?:(?::[0-9A-Fa-f]{1,4})?:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,4})|(?:(?::[0-9A-Fa-f]{1,4}){0,2}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,5})|(?:(?::[0-9A-Fa-f]{1,4}){0,3}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?:(?:[0-9A-Fa-f]{1,4}:){1}(?:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|(?:(?::[0-9A-Fa-f]{1,4}){0,4}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(?::(?:(?:(?::[0-9A-Fa-f]{1,4}){1,7})|(?:(?::[0-9A-Fa-f]{1,4}){0,5}:)|:)))(?:%.+)?)(/\d+)(?:\s+(\S.*))?
      scope: ios.ipv6.general-prefix
      captures:
        1: support.constant
        2: string.unquoted
        3: constant.numeric
        4: constant.numeric
        5: invalid.illegal

  logging:
    - include: logging_buffered
    - include: logging_discriminator
    - match: |
        (?xi)
        ^\s*
        (logging\s+host)\s+
        (
          (?:{{ipv6}})|
          (?:{{ip}})
        )
      captures:
        1: support.constant                    # logging
        2: constant.numeric.ip.ipv4.address    # logging ip
    - match: |
        (?xi)
        ^\s*
        (logging)\s+
        (?:
          ({{ip}})|
          (?:
            (facility)\s+
            (
              (?:local5)
            )
          )|
          (?:(source-interface)\s+({{interface_names}})\s*({{interface_numbers}}))
        )
      captures:
        1: support.constant                    # logging
        2: constant.numeric.ip.ipv4.address    # logging ip
        3: support.constant                    # logging facility
        4: support.constant                    # logging facility string
        5: support.constant                    # logging facility string
        6: entity.other.attribute-name         # logging source-interface
        7: constant.numeric                    # logging source-interface interface_type

  logging_buffered:
    - match: |
        (?xi)
        ^\s*
        (logging\s+buffered)
        (?:
          \s+
          (discriminator)\s+(\S{1,8})
        )?
        (?:\s+({{number_range_4096_2147483647}}))?
        (\s+{{logging_level}})?
      captures:
        1: support.constant                    # logging buffered
        2: support.constant
        3: string.unquoted
        4: constant.numeric
        5: constant.numeric


  logging_discriminator:
    - match: |
        (?xi)
        ^\s*
        (logging\s+discriminator)\s+(\S{1,8})
      captures:
        1: support.constant
        2: string.unquoted
      push:
      - match: |
          (?xi)
          (
            (?:\s+facility)?
            (?:\s+mnemonics)?
            (?:\s+msg-body)?
          )
          (?=
            \s+
            (?:
              (?:includes)|
              (?:drops)
            )
          )
        captures:
          1: support.constant
        push:
        - match: |
            (?xi)
            (?:
              \s+
              (?:
                (drops)|
                (includes)
              )
              \s+
            )
          captures:
            1: keyword.other
            2: entity.other.attribute-name
          push: scope:source.regexp.python
          with_prototype:
            - match: |
                (?xi)
                (?=
                  (?:
                    (?:\s*\n)|
                    (?:\s+severity)|
                    (?:\s+rate-limit)
                  )
                )
              pop: true
        - match: |
            (?xi)
            \s*
            (severity)\s+
            (?:
              (?:
                (drops)|
                (includes)
              )
              \s+({{logging_level_digits}})
            )
          captures:
            1: support.constant
            2: keyword.other
            3: entity.other.attribute-name
            4: constant.numeric
        - match: |
            (?xi)
            \s*
            (rate-limit)\s+({{number_range_1_10000}})
          captures:
            1: support.constant
            2: constant.numeric
        - match: (?=(?:\s+)|(?:\n))
          pop: true
      - match: (?=\s*\n)
        pop: true

  standard_acl:
    - match: ^\s*(ip)\s+(access-list)\s+(standard)\s+(?:(\d+)|(\S+))
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.acl.standard
        - include: standard_ace
        # - include: partials
        - include: pop_on_configure_terminal_context

  standard_ace:
    - match: |
        (?xi)
        ^\s*
        ({{line_number}}\s+)?
        (?:(permit)|(deny))\s+
        (?:
          (?:
            (?:({{ip}})\s+({{wildcard_mask}}))|
            ({{ip}})|
            (any)|
            (?:
              (host)\s+({{ip}})
            )
          )
        )
      scope: text.network.cisco.acl.standard.ace
      captures:
        1: constant.numeric
        2: entity.other.attribute-name
        3: keyword.other
        4: constant.numeric.ip.ipv4.address
        5: constant.numeric.network.ipv4.wildcard
        6: constant.numeric.ip.ipv4.address
        7: support.constant
        8: support.constant
        9: constant.numeric.ip.ipv4.address

  extended_acl_old:
    - match: |
        (?xi)
        ^\s*
        (access-list)\s+(\d{3})\s+
        (?:
          (permit)|
          (deny)
        )\s+
        ({{protocol_target}})
        (?:
          (?:
            (?:
              \s+
              (?:
                (?:({{ip}})\s+({{wildcard_mask}}))|
                (?:(host)\s+({{ip}}))|
                (any)
              )
            )
            (?:\s+({{operators}})\s+({{port_target}}))?
            (\s+established)?
            (?:
              \s+
              (?:
                (?:({{ip}})\s+({{wildcard_mask}}))|
                (?:(host)\s+({{ip}}))|
                (any)
              )
            )
            (?:\s+({{operators}})\s+({{port_target}}))?
            (\s+established)?
          )
        )
      captures:
        1: support.constant
        2: constant.numeric
        3: entity.other.attribute-name
        4: keyword.other
        5: constant.numeric
        6: constant.numeric.target_ip
        7: constant.numeric.network.ipv4.wildcard
        8: constant.language
        9: constant.numeric.ip.ipv4.address
        10: constant.language
        11: support.constant
        12: constant.numeric
        13: support.constant
        14: constant.numeric.target_ip
        15: constant.numeric.network.ipv4.wildcard
        16: constant.language
        17: constant.numeric.ip.ipv4.address
        18: constant.language
        19: support.constant
        20: constant.numeric
        21: support.constant

  extended_acl:
    - match: ^\s*(ip)\s+(access-list)\s+(extended)\s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.acl.extended
        - include: remark_ace
        - include: ogacl
        - include: extended_ace
        - include: pop_on_configure_terminal_context

  remark_ace:
    - match: |
        (?xi)
        ^\s*
        ({{line_number}}\s+)?
        (remark)\s+
        (.*)
      scope: text.network.cisco.acl.extended.ace.remark
      captures:
        1: constant.numeric             # Line number
        2: comment.line                 # remark
        3: comment.line                 # remark text

  ogacl:
    - include: ogacl_permit

  ogacl_permit:
    - include: ogacl_permit_l3_protocol

  # https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/m1/sec-m1-cr-book/sec-cr-p1.html#wp1459792010
  ogacl_permit_l3_protocol:
    - match: |
        (?xi)
        ^\s*
        (permit)\s+
        (?!
          (?:tcp)|
          (?:udp)
        )
        ({{protocol_target}})
        \s+
        (?:
          (?:({{ip}})\s+({{wildcard_mask}}))|
          (any)|
          (?:
            (host)\s+
            (?:
              ({{ip}})|
              (\S+)
            )
          )|
          (?:(object-group)\s+(\S+))
        )
        \s+
        (?:
          (?:({{ip}})\s+({{wildcard_mask}}))|
          (any)|
          (?:
            (host)\s+
            (?:
              ({{ip}})|
              (\S+)
            )
          )|
          (?:(object-group)\s+(\S+))
        )
        (?:
          \s+
          (?:
            (?:(dscp)\s+({{dscp_w_value}}|(?:default)))|
            (?:(precedence)\s+({{tos_precedence}}))|
            (?:(fragments))|
            (?:(option)\s+({{ip_options}}))|
            (?:(reflect)\s+(\S+))|
            (?:(time-range)\s+(\S+))|
            (?:(ttl)\s+({{ttl_match_values}})\s+(\d+)(?:\s+(\d+))?)|
            (?:(tos)\s+({{tos}}))|
            (?:(log)(?:\s+(\S+))?)|
            (?:(log-input)(?:\s+(\S+))?)
          )
        )?
      scope: text.network.cisco.acl.extended.ace.ogacl.permit.l3
      captures:
        1: entity.other.attribute-name                                  # Permit
        2: constant.numeric                                             # Protocol Name
        3: constant.numeric.network.ipv4.network_address                # Source Network
        4: constant.numeric.network.ipv4.wildcard                       # Source Wildcard
        5: support.constant                                             # Source Any
        6: support.constant                                             # Source Host
        7: constant.numeric.ip.ipv4.address                             # Source Host IP
        8: string.unquoted                                              # Source Host Name
        9: support.constant                                             # Source Object-Group
        10: string.unquoted                                             # Source Object-Group Name
        11: constant.numeric.network.ipv4.network_address               # Destination Network
        12: constant.numeric.network.ipv4.wildcard                      # Destination Wildcard
        13: support.constant                                            # Destination Any
        14: support.constant                                            # Destination Host
        15: constant.numeric.ip.ipv4.address                            # Destination Host IP
        16: string.unquoted                                             # Destination Host Name
        17: support.constant                                            # Destination Object-Group
        18: string.unquoted                                             # Destination Object-Group Name
        19: support.constant                                            # dscp
        20: constant.numeric                                            # dscp value
        21: support.constant                                            # precedence
        22: constant.numeric                                            # precedence value
        23: support.constant                                            # fragments
        24: support.constant                                            # option
        25: constant.numeric                                            # option value
        26: support.constant                                            # reflect
        27: string.unquoted                                             # reflect acl_name
        28: support.constant                                            # time-range
        29: string.unquoted                                             # time-range acl_name
        30: support.constant                                            # ttl
        31: support.constant                                            # ttl operator
        32: constant.numeric                                            # ttl ttl-value
        33: constant.numeric                                            # ttl ttl-value ttl-value
        34: support.constant                                            # tos
        35: constant.numeric                                            # tos value
        36: support.constant                                            # log
        37: string.unquoted                                             # log name
        38: support.constant                                            # log-input
        39: string.unquoted                                             # log-input name

  extended_ace:
    - match: |
        (?xi)
        ^\s*
        ({{line_number}}\s+)?
        (?:
          (permit)|
          (deny)
        )
        \s+
        (?:
          (?:
            (?:(object-group)\s+(\S+))
            (?:
              (?:
                (?:
                  \s+
                  (?:
                    (?:({{ip}})\s+({{wildcard_mask}}))|
                    (any)|
                    (?:(host)\s+({{ip}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )
                (?:
                  \s+
                  (?:
                    (?:({{ip}})\s+({{wildcard_mask}}))|
                    (any)|
                    (?:(host)\s+({{ip}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )
              )
            )
          )|
          (?:
            ({{protocol_target}})
            (?:
              (?:
                (?:
                  \s+
                  (?:
                    (?:({{ip}})\s+({{wildcard_mask}}))|
                    (any)|
                    (?:(host)\s+({{ip}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )
                (?:
                  \s+
                  (?:
                    (?:({{operators}})\s+({{port_target}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )?
                (\s+established)?
                (?:
                  \s+
                  (?:
                    (?:({{ip}})\s+({{wildcard_mask}}))|
                    (any)|
                    (?:(host)\s+({{ip}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )
                (?:
                  \s+
                  (?:
                    (?:({{operators}})\s+({{port_target}}))|
                    (?:(object-group)\s+(\S+))
                  )
                )?
                (\s+established)?
              )
            )
          )
        )
      scope: text.network.cisco.acl.extended.ace
      captures:
        1: constant.numeric                         # Line number
        2: entity.other.attribute-name              # Permit
        3: keyword.other                            # Deny
        4: support.constant                         # Service network object-group
        5: string.unquoted.service                  # Service network object-group name
        6: constant.numeric.ip.ipv4.address         # Source IP
        7: constant.numeric.network.ipv4.wildcard   # Source Wildcard mask
        8: constant.language                        # Any
        9: support.constant                         # Source Host
        10: constant.numeric.ip.ipv4.address        # Source Host IP
        11: support.constant                        # Source network object-group
        12: string.unquoted                         # Source network object-group name
        13: constant.numeric.ip.ipv4.address        # Destination IP
        14: constant.numeric.network.ipv4.wildcard  # Destination Wildcard mask
        15: constant.language                       # Any
        16: support.constant                        # Destination Host
        17: constant.numeric.ip.ipv4.address        # Destination Host IP
        18: support.constant                        # Destination network object-group
        19: string.unquoted                         # Destination network object-group name
        20: constant.numeric                        # Protocol Name
        21: constant.numeric.ip.ipv4.address        # Source IP
        22: constant.numeric.network.ipv4.wildcard  # Source Wildcard mask
        23: constant.language                       # Any
        24: support.constant                        # Source Host
        25: constant.numeric.ip.ipv4.address        # Source Host IP
        26: support.constant                        # Source network object-group
        27: string.unquoted                         # Source network object-group name
        28: support.constant                        # Source Operator
        29: constant.numeric                        # Source Port
        30: support.constant                        # Source service object-group
        31: string.unquoted                         # Source service object-group name
        32: support.constant                        # Source Established
        33: constant.numeric.ip.ipv4.address        # Destination IP
        34: constant.numeric.network.ipv4.wildcard  # Destination Wildcard mask
        35: constant.language                       # Any
        36: support.constant                        # Destination Host
        37: constant.numeric.ip.ipv4.address        # Destination Host IP
        38: support.constant                        # Destination network object-group
        39: string.unquoted                         # Destination network object-group name
        40: support.constant                        # Destination Operator
        41: constant.numeric                        # Destination Port
        42: support.constant                        # Destination service object-group
        43: string.unquoted                         # Destination service object-group name
        44: support.constant                        # Destination Established

  route_map:
    - match: '^\s*(route-map)\s+(\S+)\s+(?:(permit)|(deny))\s+(\d+)?'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: string.unquoted
        3: entity.other.attribute-name
        4: keyword.other
        5: constant.numeric
      push:
      - meta_content_scope: text.network.cisco.route_map
      - match: >
          (?xi)
          (?:(match\s+ip\s+address\s+prefix-list)\s+(\S+))|
          (?:(match\s+ip\s+address)\s+(\S+))|
          (?:(set\s+extcommunity\s+rt)\s+({{route_target}})(\s+additive)?)|
          (?:(set\s+local-preference)\s+(\d+)?)
        captures:
          1: support.constant   # match address prefix-list
          2: string.unquoted    # match address prefix-list name
          3: support.constant   # match address
          4: string.unquoted    # match address name
          5: support.constant   # set extcommunity rt
          6: constant.numeric   # set extcommunity rt route_target
          7: support.constant    # set extcommunity rt route_target additive
          8: support.constant   # set local-preference
          9: constant.numeric   # set local-preference number
      - include: pop_on_configure_terminal_context

  login:
    - match: |
        (?xi)
        ^\s*
        (login)\s+
        (?:
          (block-for)\s+
          ({{number_32_bit}})\s+
          (attempts)\s+
          ({{number_32_bit}})\s+
          (within)\s+
          ({{number_32_bit}})
        )
      captures:
        1: support.constant             # login
        2: support.constant             # block-for
        3: constant.numeric             # block-for seconds
        4: support.constant             # block-for attempts
        5: constant.numeric             # block-for attempts seconds
        6: support.constant             # block-for within
        7: constant.numeric             # block-for within seconds

  # https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_01.html#wp8415192690
  aaa_server_radius_dynamic_author:
    - match: '^\s*(aaa)\s+(server\s+radius\s+dynamic-author)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
      push:
        - meta_content_scope: text.network.cisco.ios.aaa.server-radius-dynamic-author
        # https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_0100.html#wp1831441675
        - match: |
            (?xi)
            ^\s*
            (client)\s+
            (?:
              ({{ip}})|
              ({{hostname}})|
              (\S+)
            )
            \s+
            (?:
              (?:
                  (server-key)
                  \s+
                  (?:
                    (?:(0)\s+(\S+))|
                    (?:(6)\s+(\S+))|
                    (?:(7)\s+(\S+))|
                    (?:(\S+)\s+(\S+))
                  )
                  (?:\s+(\S+))?
              )|
              (?:
                (vrf)\s+
                (\S+)
              )|
              (.*)
            )?
          captures:
            1: support.constant
            2: constant.numeric.ip.ipv4.address
            3: constant.language.hostname
            4: invalid.illegal
            5: support.constant
            6: constant.numeric
            7: string.unquoted
            8: constant.numeric
            9: string.unquoted.cisco.password.type.6
            10: constant.numeric
            11: string.unquoted.cisco.password.type.7
            12: invalid.illegal
            13: invalid.illegal
            14: invalid.illegal
            15: support.constant
            16: string.unquoted.vrf
            17: invalid.illegal
        - include: pop_on_configure_terminal_context


  aaa_authorization:
    - match: |
        (?xi)
        ^\s*
        (aaa\s+authorization)\s+
        (?:
          (auth-proxy)|
          (cache)|
          (?:(commands)\s+({{number_range_1_15}}))|
          (config-commands)|
          (configuration)|
          (console)|
          (exec)|
          (ipmobile)|
          (multicast)|
          (network)|
          (policy-if)|
          (prepaid)|
          (radius-proxy)|
          (reverse-access)|
          (subscriber-service)|
          (template)
        )
        \s+
        (?:
          (default)|
          (\S+)
        )
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: entity.other.attribute-name
        4: entity.other.attribute-name
        5: constant.numeric
        6: entity.other.attribute-name
        7: entity.other.attribute-name
        8: entity.other.attribute-name
        9: entity.other.attribute-name
        10: entity.other.attribute-name
        11: entity.other.attribute-name
        12: entity.other.attribute-name
        13: entity.other.attribute-name
        14: entity.other.attribute-name
        15: entity.other.attribute-name
        16: entity.other.attribute-name
        17: entity.other.attribute-name
        18: entity.other.attribute-name
        19: constant.language
        20: string.unquoted
      push:
        - meta_scope: text.cisco.ios.aaa.authorization
        - match: (cache)\s+(\S+)
          captures:
            1: support.constant
            2: string.unquoted
        - match: (if-authenticated)
          captures:
            1: support.constant
        - match: (local)
          captures:
            1: support.constant
        - match: (none)
          captures:
            1: support.constant
        - match: |
            (?xi)
            (group)\s+
            (?:
              (ldap)|
              (radius)|
              (tacacs\+)|
              (\S+)
            )
          captures:
            1: support.constant
            2: constant.language
            3: constant.language
            4: constant.language
            5: string.unquoted
      with_prototype:
        - match: (?=$)
          pop: true

  aaa_accounting:
    - include: aaa_accounting_main

  aaa_accounting_main:
    - match: |
        (?xi)
        ^\s*
        (aaa\s+accounting)\s+
        (?:
          (auth-proxy)|
          (system)|
          (?:(commands)\s+({{number_range_1_15}}))|
          (network)|
          (exec)|
          (connection)|
          (dot1x)
        )
        \s+
        (?:
          (default)|
          (guarantee-first)|
          (\S+)
        )
        (?:\s+(vrf)\s+(\S+))?
        \s+
        (
          (?:start-stop)|
          (?:stop-only)|
          (?:none)
        )
        (\s+broadcast)?
        (?:
          \s+
          (?:
            (radius)|
            (?:(group)\s+(\S+))
          )
        )
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: entity.other.attribute-name
        4: entity.other.attribute-name
        5: constant.numeric
        6: entity.other.attribute-name
        7: entity.other.attribute-name
        8: entity.other.attribute-name
        9: entity.other.attribute-name
        10: constant.language
        11: constant.language
        12: string.unquoted
        13: support.constant
        14: string.unquoted
        15: support.constant
        16: support.constant
        17: support.constant
        18: support.constant
        19: string.unquoted


  aaa_authentication:
    - include: aaa_authentication_login
    - include: aaa_authentication_dot1x

  aaa_authentication_dot1x:
    - match: |
        (?xi)
        ^\s*
        (aaa)\s+(authentication)\s+(dot1x)\s+
        (?:
          (default)|
          (\S+)
        )
        (?:\s+({{authentication_methods_dot1x}}))+
      captures:
        1: support.constant
        2: support.constant
        3: constant.language
        4: support.constant
        5: string.unquoted
        6: constant.language

  aaa_authentication_login:
    - match: |
        (?xi)
        ^\s*
        (?:(aaa\s+authentication)\s+)
        (?:
          (?:
            (login)\s+
            (?:
              (?:(default)|(\S+))
            )
          )
        )
      scope: text.network.cisco.aaa.authentication
      captures:
        1: support.constant             # aaa authentication
        2: support.constant             # login
        3: support.constant             # default
        4: string.unquoted              # group name
      push:
        - match: |
            (?xi)
            (?:
              (?:
                \s+
                (
                  (?:cache)|
                  (?:group)
                )
                \s+(\S+)
              )?
              (
                (
                  \s+
                  (?:
                    (?:{{authentication_methods}})|
                    (?:enable)|
                    (?:group\s+ldap)|
                    (?:group\s+radius)|
                    (?:group\s+tacacs\+)|
                    (?:krb5-telnet)|
                    (?:krb5)|
                    (?:line)|
                    (?:local-case)|
                    (?:local)|
                    (?:none)|
                    (?:passwd-expiry)
                  )
                )+
              )
            )
          pop: true
          captures:
            1: support.constant             # method group type
            2: string.unquoted              # method group name
            3: entity.other.attribute-name  # method

  aaa_group:
    - match: |
        (?xi)
        ^\s*
        (aaa)\s+(group)\s+(server)\s+
        (
          (?:radius)
        )
        \s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: entity.other.attribute-name
        5: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.ios.aaa_group
        - include: aaa_group_settings
        - include: pop_on_configure_terminal_context

  aaa_group_settings:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:
            (server)\s+({{ip}})
            (?:\s+(auth-port)\s+(\d+))?
            (?:\s+(acct-port)\s+(\d+))?
          )
        )
      captures:
        1: support.constant
        2: constant.numeric.ip.ipv4.address
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.numeric

  class_map:
    - match: ^\s*(class-map)\s+(match-(?:(?:all)|(?:any)))\s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: entity.other.attribute-name
        3: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.policy_map
        - include: class_map_settings
        - include: pop_on_configure_terminal_context

  class_map_settings:
    - match: |
        (?xi)
        (?:
          (?:(match\s+ip\s+dscp)\s+({{dscp}}))|
          (?:(match\s+access-group)\s+(\d+))
        )
      captures:
        1: support.constant              # match ip dscp
        2: constant.numeric              # match ip dscp value
        3: support.constant              # bandwidth percent
        4: constant.numeric              # match access-group
        5: support.constant              # match access-group id

  policy_map:
    - match: ^\s*(policy-map)\s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.policy_map
        - include: policy_class_map
        - include: pop_on_configure_terminal_context

  policy_class_map:
    - match: ^\s*(class)\s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.policy_map.policy_class_map
        - include: policy_class_map_settings
        - include: pop_on_policy_map_context

  policy_class_map_settings:
    - match: |
        (?xi)
        (?:
          (?:(priority)\s+(\d+))|
          (?:(bandwidth)\s+(percent)\s+
            (
              (?:1\d{2})|
              (?:\d{2})|
              (?:\d)
            )
          )|
          (?:(police)\s+(cir)\s+(\d+))|
          (?:
            (
              (?:conform-action)|
              (?:exceed-action)|
              (?:violate-action)
            )
            \s+
            (?:
              (transmit)|
              (drop)
            )
          )|
          (?:
            (shape)\s+
            (?:
              (?:(average)\s+(\d+))
            )
          )|
          (?:(service-policy)\s+(\S+))
        )
      captures:
        1: support.constant              # priority
        2: constant.numeric              # priority value
        3: support.constant              # bandwidth
        4: support.constant              # bandwidth percent
        5: constant.numeric              # bandwidth percent value
        6: support.constant              # police
        7: support.constant              # police cir
        8: constant.numeric              # police cir value
        9: support.constant              # action-type
        10: entity.other.attribute-name  # action-type transmit
        11: keyword.other                # action-type drop
        12: support.constant              # shape
        13: support.constant              # shape average
        14: constant.numeric              # shape average value
        15: support.constant              # service-policy
        16: string.unquoted              # service-policy name

  ospf:
    - match: ^\s*(router)\s+(ospf)\s+(\d+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.language
      push:
        - meta_content_scope: text.network.cisco.ospf
        - include: ospf_settings
        - include: pop_on_configure_terminal_context

  ospf_settings:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:(log-adjacency-changes))|
          (?:(auto-cost\s+reference-bandwidth)\s+(\d+))|
          (?:
            (area)\s+(\d+)\s+
            (?:
              (?:(authentication)\s+(message-digest))|
              (?:(nssa))
            )
          )|
          (?:(passive-interface)\s+({{interface_names}})\s*({{interface_numbers}}))|
          (?:(network)\s+({{ip}})\s+({{wildcard_mask}})\s+(area)\s+(\d+))
        )
      captures:
        1: support.constant                          # log-adjacency-changes
        2: support.constant                          # auto-cost reference-bandwidth
        3: constant.numeric                          # auto-cost reference-bandwidth value
        4: support.constant                          # area
        5: constant.numeric                          # area id
        6: support.constant                          # area authentication
        7: support.constant                          # area authentication message-digest
        8: support.constant                          # area nssa
        9: support.constant                          # passive-interface
        10: entity.other.attribute-name              # passive-interface type
        11: constant.numeric                         # passive-interface type number
        12: support.constant                         # network
        13: constant.numeric.ip.ipv4.address         # network ip
        14: constant.numeric.network.ipv4.wildcard   # network ip wildcard
        15: support.constant                         # network ip wildcard area
        16: constant.numeric                         # network ip wildcard area id


  bgp:
    - match: ^\s*(router)\s+(bgp)\s+(\d+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.language
      push:
        - meta_content_scope: text.network.cisco.bgp
        - include: ipv4_network
        - include: ipv6_network
        - include: ipv4_neighbor
        - include: ipv6_neighbor
        - include: ipv6_address_family
        - include: ipv4_address_family
        - include: vpnv4_address_family
        - include: bgp_settings
        - include: pop_on_configure_terminal_context

  vpnv4_address_family:
    - match: ^\s*(address-family)\s+(vpnv4)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.bgp.ipv4.address_family
        - match: '({{pop_address_family_ctx}})'
          pop: true
          captures:
            1: comment.line
        - include: ipv4_network
        - include: ipv4_neighbor
        - include: pop_on_bgp_address_family_context

  ipv4_address_family:
    - match: ^\s*(address-family)\s+(ipv4)(?:\s+(vrf)\s+(\S+))?
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.bgp.ipv4.address_family
        - match: '({{pop_address_family_ctx}})'
          pop: true
          captures:
            1: comment.line
        - include: ipv4_network
        - include: ipv4_neighbor
        - include: pop_on_bgp_address_family_context

  ipv6_address_family:
    - match: ^\s*(address-family)\s+(ipv6)\s+(vrf)\s+(\S+)\s*(\s+\S.*)?$
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: string.unquoted
        5: invalid.illegal
      push:
        - meta_content_scope: text.network.cisco.bgp.ipv6.address_family
        - match: '({{pop_address_family_ctx}})'
          pop: true
          captures:
            1: comment.line
        - include: ipv6_network
        - include: ipv6_neighbor
        - include: pop_on_bgp_address_family_context
        # - include: pop_context_on_unknown


  ipv4_neighbor:
    - match: |
        (?xi)
        ^\s*(neighbor)\s+({{ip}})\s+
        (?:
        (activate)|
        (shut(?:down)?)|
        (next-hop-self)|
        (?:(soft-reconfiguration)\s+(inbound|outbound))|
        (?:(password)\s+(5)\s+({{type_5_password}}))|
        (?:(password)\s+(7)\s+({{type_7_password}}))|
        (?:(password)\s+(\d+)\s+(\S{1,25}))|
        (?:(prefix-list|route-map)\s+(\S+)\s+(in|out))|
        (?:(inherit)\s+(peer-policy)\s+(\S+))|
        (send-community(?:\s+(?:(?:both)|(?:extended)))?)|
        (?:(remote-as)\s+(\d+)(\s+shutdown)?)|
        (?:(timers)\s+(\d+)\s+(\d+)(?:\s+(\d+))?)|
        (?:(ttl-security)\s+(hops)\s+(\d+))|
        (?:(description)\s+(.*))|
        (?:(version)\s+(\d+))|
        (?:(transport)\s+(path-mtu-discovery))|
        (?:(ebgp-multihop)\s+(\d+))|
        (?:(update-source)\s+(?:({{interface_names}})\s*({{interface_numbers}})))
        )
      captures:
        1: support.constant                        # Neighbor
        2: constant.numeric.ip.ipv4.address        # IP
        3: entity.other.attribute-name             # Active
        4: keyword.other                           # Shutdown
        5: support.constant                        # Next-hop-self
        6: support.constant                        # Soft reconfiguration inbound
        7: support.constant                        # Soft reconfiguration inbound
        8: support.constant                        # Password
        9: constant.numeric                        # Password Type 5
        10: string.unquoted.cisco.password.type.5  # Password Type 5 Text
        11: support.constant                       # Password
        12: constant.numeric                       # Password Type 7
        13: string.unquoted.cisco.password.type.7  # Password Type 7 Text
        14: support.constant                       # Password
        15: constant.numeric                       # Password
        16: string.unquoted                        # Password
        17: support.constant                       # Prefix list
        18: string.unquoted                        # Prefix list
        19: support.constant                       # Prefix list
        20: support.constant                       # Inherit peer policy
        21: support.constant                       # Inherit peer policy
        22: string.unquoted                        # Inherit peer policy
        23: support.constant                       # Send community
        24: support.constant                       # Remote AS
        25: constant.numeric                       # Remote AS #
        26: keyword.other                          # Remote AS shutdown
        27: support.constant                       # Timers
        28: constant.numeric                       # Timers
        29: constant.numeric                       # Timers
        30: constant.numeric                       # Timers
        31: support.constant                       # TTL security hops
        32: support.constant                       # TTL security hops
        33: constant.numeric                       # TTL security hops
        34: support.constant                       # Description
        35: comment.block.documentation            # Description
        36: support.constant                       # Version
        37: constant.numeric                       # Version
        38: support.constant                       # Path MTU discovery
        39: support.constant                       # Path MTU discovery
        40: support.constant                       # ebgp multihop
        41: constant.numeric                       # ebgp multihop hops
        42: support.constant                       # update-source
        43: entity.other.attribute-name            # update-source interface_type
        44: constant.numeric                       # update-source interface_number

  ipv4_network:
    - match: '^\s+(network)\s+({{ip}})(?:\s+(mask)\s+({{subnet_mask}}))?'
      captures:
        1: support.constant
        2: constant.numeric.ip.ipv4.address
        3: support.constant
        4: constant.numeric.network.ipv4.subnet_mask

  bgp_settings:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:(timers\s+bgp)\s+(\d+)\s+(\d+)(?:\s+(\d+))?)|
          (?:
            (bgp)\s+
            (?:
              (?:(router-id)\s+(\S+))|
              (?:(log-neighbor-changes))
            )
          )
        )
      captures:
        1: support.constant              # Timers
        2: constant.numeric              # Timers
        3: constant.numeric              # Timers
        4: constant.numeric              # Timers
        5: support.constant              # bgp
        6: support.constant              # bgp router-id
        7: constant.numeric              # bgp router-id id
        8: support.constant              # bgp log-neighbor-changes


  ipv6_neighbor:
    - match: |
        (?xi)
        ^\s*(neighbor)\s+({{ipv6}})\s+
        (?:
          (activate)|
          (shut(?:down)?)|
          (next-hop-self)|
          (?:(soft-reconfiguration)\s+(inbound|outbound))|
          (?:(password)\s+(5)\s+({{type_5_password}}))|
          (?:(password)\s+(7)\s+({{type_7_password}}))|
          (?:(password)\s+(\d+)\s+(\S+))|
          (?:(prefix-list|route-map)\s+(\S+)\s+(in|out))|
          (?:(inherit)\s+(peer-policy)\s+(\S+))|
          (send-community(?:\s+(?:(?:both)|(?:extended)))?)|
          (?:(remote-as)\s+(\d+)(\s+shutdown)?)|
          (?:(timers)\s+(\d+)\s+(\d+)(?:\s+(\d+))?)|
          (?:(ttl-security)\s+(hops)\s+(\d+))|
          (?:(description)\s+(.*))|
          (?:(version)\s+(\d+))|
          (?:(transport)\s+(path-mtu-discovery))
        )
      captures:
        1: support.constant                       # Neighbor
        2: constant.numeric.ip.ipv6.address       # IP
        3: entity.other.attribute-name            # Active
        4: keyword.other                          # Shutdown
        5: support.constant                       # Next-hop-self
        6: support.constant                       # Soft reconfiguration inbound
        7: support.constant                       # Soft reconfiguration inbound
        8: support.constant                       # Password
        9: constant.numeric                       # Password
        10: string.unquoted.cisco.password.type.5 # Password
        11: support.constant                      # Password
        12: constant.numeric                      # Password
        13: string.unquoted.cisco.password.type.7 # Password
        14: support.constant                      # Password
        15: constant.numeric                      # Password
        16: string.unquoted                       # Password
        17: support.constant                      # Prefix list
        18: string.unquoted                       # Prefix list
        19: support.constant                      # Prefix list
        20: support.constant                      # Inherit peer policy
        21: support.constant                      # Inherit peer policy
        22: string.unquoted                       # Inherit peer policy
        23: support.constant                      # Send community
        24: support.constant                      # Remote AS
        25: constant.numeric                      # Remote AS
        26: keyword.other                         # Remote AS shutdown
        27: support.constant                      # Timers
        28: constant.numeric                      # Timers
        29: constant.numeric                      # Timers
        30: constant.numeric                      # Timers
        31: support.constant                      # TTL security hops
        32: support.constant                      # TTL security hops
        33: constant.numeric                      # TTL security hops
        34: support.constant                      # Description
        35: comment.block.documentation           # Description
        36: support.constant                      # Version
        37: constant.numeric                      # Version
        38: support.constant                      # Path MTU discovery
        39: support.constant                      # Path MTU discovery

  ipv6_network:
    - match: '^\s*(network)\s+({{ipv6_prefix}})?'
      captures:
        1: support.constant
        2: constant.numeric.ip.ipv6.prefix

  ipv6_unicast_routing:
  - match: ^\s*(ipv6\s+unicast-routing)
    captures:
      1: support.constant

  ip_classless:
  - match: ^\s*(ip\s+classless)
    captures:
      1: support.constant

  ntp:
  - match: |
      (?xi)
        ^\s*
        (ntp)\s+
        (?:
          (?:(source)\s+({{interface_names}})\s*({{interface_numbers}}))|
          (?:(clock-period)\s+(\d+))|
          (?:(server)\s+({{ip}}))
        )
    captures:
      1: support.constant                  # ntp
      2: support.constant                  # ntp source
      3: entity.other.attribute-name       # ntp source interface type
      4: constant.numeric                  # ntp source interface number
      5: support.constant                  # ntp clock-period
      6: constant.numeric                  # ntp clock-period value
      7: support.constant                  # ntp server
      8: constant.numeric.ip.ipv4.address  # ntp server ip

  ip_http:
  - match: ^\s*(ip\s+http\s+server)
    captures:
      1: support.constant

  ip_scp:
  - match: ^\s*(ip\s+scp\s+server)\s+(enable)
    captures:
      1: support.constant
      2: entity.other.attribute-name.

  ip_ssh:
    - match: |
        (?xi)
        ^\s*
        (?:
          (ip)\s+(ssh)\s+(?:
            (?:(source-interface)\s+({{interface_names}})\s+({{interface_numbers}}))|
            (?:(version)\s+([12]))|
            (?:(authentication-retries)\s+(\d+))|
          )
        )
      captures:
        1: support.constant             # ip
        2: support.constant             # ssh
        3: support.constant             # source-interface
        4: entity.other.attribute-name  # source-interface name
        5: constant.numeric             # source-interface name number
        6: support.constant             # version
        7: constant.numeric             # version number
        8: support.constant             # authentication-retries
        9: constant.numeric             # authentication-retries number

  vtp:
    - match: |
        (?xi)
        ^\s*
        (?:
          (vtp)\s+(?:
            (?:(mode)\s+(?:(off)|(server)|(client)|(transparent)))|
            (?:(domain)\s+(\S+))|
            (?:(password)\s+(\S+))|
            (?:(version)\s+(\d+))
          )
        )
      captures:
        1: support.constant             # vtp
        2: support.constant             # vtp mode
        3: keyword.other                # vtp mode off
        4: entity.other.attribute-name  # vtp mode server
        5: entity.other.attribute-name  # vtp mode client
        6: entity.other.attribute-name  # vtp mode transparent
        7: support.constant             # domain
        8: string.unquoted              # domain name
        9: support.constant             # password
        10: string.unquoted             # password string
        11: support.constant            # version
        12: constant.numeric            # version number

  spanning_tree:
    - match: |
        (?xi)
        ^\s*
        (?:
          (spanning-tree)\s+(?:
            (?:(mode)\s+
              (?:
                (rapid-pvst)|
                (pvst)|
                (mst)
              )
            )
          )
        )
      captures:
        1: support.constant             # spanning-tree
        2: support.constant             # mode
        3: entity.other.attribute-name  # mode rapid-pvst
        4: entity.other.attribute-name  # mode pvst
        5: entity.other.attribute-name  # mode mst

  crypto:
    - include: crypto_key

  crypto_key:
    - match: |
        (?xi)
        ^\s*
        (?:
          (crypto)\s+(key)\s+(?:
            (?:(zeroize)\s+({{pkey_types}})\s+(noconfirm)?)|
            (?:(generate)\s+({{pkey_types}})(?:\s+(general-keys))?\s+(modulus)\s+(\d+)\s+(noconfirm)?)
          )
        )
      captures:
        1: support.constant             # crypto
        2: support.constant             # crypto key
        3: support.constant             # zeroize
        4: entity.other.attribute-name  # zeroize pkey_type
        5: support.constant             # zeroize pkey_type noconfirm
        6: support.constant             # generate
        7: entity.other.attribute-name  # generate pkey_type
        8: support.constant             # generate pkey_type general-keys
        9: support.constant             # generate pkey_type general-keys modulus
        10: constant.numeric            # generate pkey_type general-keys modulus bits
        11: support.constant            # generate pkey_type general-keys modulus bits noconfirm

  ip_subnet_zero:
  - match: ^\s*(ip\s+subnet-zero)
    captures:
      1: support.constant

  ip_cef:
  - match: ^\s*(ip\s+cef)
    captures:
      1: support.constant

  aaa_session_id:
    - match: |
        (?xi)
        ^\s*
        (aaa\s+session-id)\s+
        (
          (?:common)|
          (?:unique)
        )
      captures:
        1: support.constant
        2: support.constant

  terminal_info_current_configuration:
    - match: '(Current configuration : \d+ bytes)'
      captures:
        1: comment.line

  terminal_info_boot_marker:
    - match: '(boot-(?:(?:start)|(?:end))-marker)'
      captures:
        1: comment.line


  ip_route:
    - include: ipv4_route
    - include: ipv6_route

  ipv4_route:
    - match: |
        (?xi)
        ^\s*
        (?:
          (ip)\s+(route)\s+
          (?:(vrf)\s+(\S+)\s+)?
          ({{ip}})\s+
          ({{subnet_mask}})
          (?:
            \s+
            (?:
              (?:(Null)\s*(\d+))|
              (?:({{interface_names}})\s*({{interface_numbers}}))
            )
          )?
          (?:
            \s+
            ({{ip}})
            (?:
              (?:\s+(name)\s+(\S+))?
              (?:\s+(permanent))?
              (?:\s+(track)\s+(\S+))?
              (?:\s+(tag)\s+(\S+))?
            )?
          )?
        )
      captures:
        1: support.constant                           # ip
        2: support.constant                           # route
        3: support.constant                           # vrf
        4: string.unquoted                            # vrf name
        5: constant.numeric.ip.ipv4.address           # ip
        6: constant.numeric.network.ipv4.subnet_mask  # subnet mask
        7: entity.other.attribute-name                # next hop interface
        8: constant.numeric                           # next hop interface id
        9: entity.other.attribute-name                # next hop null
        10: constant.numeric                          # next hop null id
        11: constant.numeric.ip.ipv4.address          # next hop ip
        12: support.constant                          # name
        13: string.unquoted                           # name
        14: support.constant                          # perminate
        15: support.constant                          # track
        16: constant.numeric                          # track id
        17: support.constant                          # tag
        18: constant.numeric                          # tag id

  ipv6_route:
    - match: |
        (?xi)
        ^\s*
        (ipv6)\s+(route)\s+
        (?:(vrf)\s+(\S+)\s+)?
        ({{ipv6_prefix}})
        \s+
        (?:
          (?:
            (?:(Null)\s*(\d+))|
            (?:({{interface_names}})\s*({{interface_numbers}}))
          )
          \s+
        )?
        ({{ipv6}})
        (?:
          \s+
          (?:\s+(name)\s+(\S+))?
          (?:\s+(permanent))?
          (?:\s+(track)\s+(\S+))?
          (?:\s+(tag)\s+(\S+))?
        )?
      captures:
        1: support.constant                                  # ip
        2: support.constant                                  # route
        3: support.constant                                  # vrf
        4: string.unquoted                                   # vrf name
        5: constant.numeric.ip.ipv6.prefix                   # ip
        6: entity.other.attribute-name                       # next hop null
        7: constant.numeric                                  # next hop null id
        8: entity.other.attribute-name                       # next hop interface
        9: constant.numeric                                  # next hop interface id
        10: constant.numeric.ip.ipv6.address                 # next hop ip
        11: support.constant                                 # name
        12: string.unquoted                                  # name
        13: support.constant                                 # perminate
        14: support.constant                                 # track
        15: constant.numeric                                 # track id
        16: support.constant                                 # tag
        17: constant.numeric                                 # tag id

  ip_sla:
    - include: ip_sla_schedule
    - match: |
        (?xi)
        ^\s*(ip)\s+(sla)\s+(\d+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.numeric
      push:
        - include: ip_sla_icmp_echo
        - include: ip_sla_vrf
        - include: ip_sla_tag
        - include: ip_sla_timeout
        - include: ip_sla_tos
        - include: ip_sla_threshold
        - include: ip_sla_frequency
        - include: udp_jitter
        - include: pop_on_configure_terminal_context

  udp_jitter:
    - match: |
        (?xi)
        (udp-jitter)\s+
        (?:
          ({{ip}})|
          ({{ipv6}})|
          ({{hostname}})
        )
        \s+
        ({{number_16_bit}})
        (?:
          \s+
          (endpoint-list)\s+(\S+)
        )?
        (\s+ssm)?
        (?:
          \s+(source-ip)\s+
          (?:
            ({{ip}})|
            ({{ipv6}})|
            ({{hostname}})
          )
        )?
        (?:\s+(source-port)\s+({{number_16_bit}}))?
        (?:
          \s+(control)\s+
          (?:
            (enable)|
            (disable)
          )
        )?
        (?:\s+(num-packets)\s+(\d+))?
        (?:\s+(interval)\s+(\d+))?

      captures:
        1: support.constant
        2: constant.numeric.ip.ipv4.address
        3: constant.numeric.ip.ipv6.address
        4: constant.language.hostname
        5: constant.numeric
        6: support.constant
        7: string.unquoted
        8: support.constant
        9: support.constant
        10: constant.numeric.ip.ipv4.address
        11: constant.numeric.ip.ipv6.address
        12: constant.language.hostname
        13: support.constant
        14: constant.numeric
        15: support.constant
        16: entity.other.attribute-name
        17: keyword.other
        18: support.constant
        19: constant.numeric
        20: support.constant
        21: constant.numeric

  ip_sla_schedule:
    - match: |
        (?xi)
        ^\s*(ip)\s+(sla)\s+(schedule)\s+(\d+)
        (?:
          \s+
          (life)\s+
          (?:
            (forever)|
            (\d+)
          )
        )?
        (?:
          \s+
          (start-time)\s+
          (?:
            (?:
              ([0-2]?\d:[0-5]?\d(?::[0-5]?\d)?+)\s+
              (?:
                (?:
                  (?:({{month_name}})|({{month_short_name}}))\s+({{number_range_1_31}})|
                  (?:({{number_range_1_31}}\s+({{month_name}})|({{month_short_name}})))
                )
              )
            )|
            (pending)|
            (now)|
            (?:(after)\s+([0-2]?\d:[0-5]?\d(?::[0-5]?\d)?+))
          )
        )?
        (?:\s+(ageout)\s+(\d+))?
        (?:\s+(recurring))?
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.language
        7: constant.numeric
        8: support.constant
        9: constant.numeric
        10: constant.language
        11: constant.language
        12: constant.numeric
        13: constant.language
        14: constant.language
        15: constant.numeric
        16: constant.language
        17: constant.language
        18: support.constant
        19: constant.numeric
        20: support.constant
        21: constant.numeric
        22: support.constant

  ip_sla_tos:
    - match: |
        (?xi)
        ^\s*(tos)\s+({{number_range_0_255}})
      captures:
        1: support.constant
        2: constant.numeric

  ip_sla_threshold:
    - match: |
        (?xi)
        ^\s*(threshold)\s+({{number_range_0_60000}})
      captures:
        1: support.constant
        2: constant.numeric

  ip_sla_frequency:
    - match: |
        (?xi)
        ^\s*(frequency)\s+(\d+)
      captures:
        1: support.constant
        2: constant.numeric

  ip_sla_tag:
    - match: |
        (?xi)
        ^\s*(tag)\s+((?:{{ascii_character}}){0,16})
      comment: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipsla/command/sla-cr-book/sla_s2.html#wp3793668867
      captures:
        1: support.constant
        2: string.unquoted

  ip_sla_timeout:
    - match: |
        (?xi)
        ^\s*(timeout)\s+({{number_range_0_604800000}})
      comment: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipsla/command/sla-cr-book/sla_s2.html#wp3793668867
      captures:
        1: support.constant
        2: constant.numeric

  ip_sla_vrf:
    - match: |
        (?xi)
        ^\s*(vrf)\s+(\S+)
      captures:
        1: support.constant
        2: string.unquoted

  ip_sla_icmp_echo:
    - match: |
        (?xi)
        ^\s*(icmp-echo)\s+
        (?:
          ({{ip}})|
          ({{ipv6}})|
          ({{hostname}})
        )
        (?:
          \s+
          (?:
            (?:
              (source-ip)\s+
              (?:
                ({{ip}})|
                ({{ipv6}})|
                ({{hostname}})
              )
            )|
            (?:
              (source-interface)\s+({{interface_names}})\s*({{interface_numbers}})
            )
          )
        )?
      captures:
        1: support.constant
        2: constant.numeric.ip.ipv4.address
        3: constant.numeric.ip.ipv6.address
        4: constant.language
        5: support.constant
        6: constant.numeric.ip.ipv4.address
        7: constant.numeric.ip.ipv6.address
        8: constant.language
        9: support.constant
        10: entity.other.attribute-name
        11: constant.numeric

  prefix_list:
    - include: ipv4_prefix_list
    - include: ipv6_prefix_list

  ipv4_prefix_list:
    - match: |
        (?xi)
        ^\s*(ip)\s+(prefix-list)\s+(\S+)\s+
        (?:(seq)\s+(\d+)\s+)?
        (?:(permit)|(deny))\s+
        ({{ip_prefix}})
        (?:
          \s+({{operators}})\s+({{ipv4_prefix_length}})
          (?:\s+({{operators}})\s+({{ipv4_prefix_length}}))?
        )?
      captures:
        1: support.constant                             # IP
        2: support.constant                             # Prefix list
        3: string.unquoted                              # Name
        4: support.constant                             # sequence
        5: constant.numeric                             # sequence number
        6: entity.other.attribute-name                  # permit
        7: keyword.other                                # deny
        8: constant.numeric.ip.ipv4.prefix              # prefix
        9: support.constant                             # operator
        10: constant.numeric.network.ipv4.prefix_length # prefix
        11: support.constant                            # operator
        12: constant.numeric.network.ipv4.prefix_length # prefix

  ipv6_prefix_list:
    - match: |
        (?xi)
        ^\s*(ipv6)\s+(prefix-list)\s+(\S+)\s+
        (?:(seq)\s+(\d+)\s+)?
        (?:(permit)|(deny))\s+
        ({{ipv6_prefix}})
        (?:
          \s+({{operators}})\s+({{ipv6_prefix_length}})
          (?:\s+({{operators}})\s+({{ipv6_prefix_length}}))?
        )?
      captures:
        1: support.constant                              # IP
        2: support.constant                              # Prefix list
        3: string.unquoted                               # Name
        4: support.constant                              # sequence
        5: constant.numeric                              # sequence number
        6: entity.other.attribute-name                   # permit
        7: keyword.other                                 # deny
        8: constant.numeric.ip.ipv6.prefix               # prefix
        9: support.constant                              # operator
        10: constant.numeric.network.ipv6.prefix_length  # prefix
        11: support.constant                             # operator
        12: constant.numeric.network.ipv6.prefix_length  # prefix

  service:
    - match: |
        (?xi)
        (service)\s+
        (?:
          (?:(password-encryption))|
          (?:(nagle))|
          (?:(sequence-numbers))|
          (?:(tcp-keepalives-in))|
          (?:(tcp-keepalives-out))|
          (?:(timestamps)
            (
              \s+
              (?:
                (?:debug)|
                (?:log)
              )
            )?
            (?:
              \s+
              (?:
                (uptime)|
                (?:
                  (datetime)(\s+msec)?
                )
              )
            )?
            (\s+localtime)?
            (\s+show-timezone)?
            (\s+year)?
          )
        )
      captures:
        1: support.constant               # service
        2: support.constant               # password-encryption
        3: support.constant               # nagle
        4: support.constant               # sequence-numbers
        5: support.constant               # tcp-keepalives-in
        6: support.constant               # tcp-keepalives-out
        7: support.constant               # timestamps
        8: support.constant               # timestamps debug | log
        9: support.constant               # timestamps uptime
        10: support.constant              # timestamps datetime
        11: support.constant              # timestamps datetime msec
        12: support.constant              # timestamps localtime show-timezone
        13: support.constant              # timestamps show-timezone
        14: support.constant              # timestamps year

  clock:
    - match: |
        (?xi)
        (clock)\s+
        (?:
          (?:
            (timezone)\s+
            ({{timezones}})\s+
            ({{utc_offset_hour}})
            (?:\s+({{utc_offset_minute}}))?
          )|
          (?:
            (summer-time)\s+
            ({{timezones}})\s+
            (?:
              (?:
                (date\s+)
                (
                  (?:
                    (?:3[01])|
                    (?:[0-2]?\d)
                  )
                  \s+
                )
                ({{month_names}}\s+)
                (
                  (?:
                    (?:199[3-9])|
                    (?:20[0-2]\d)|
                    (?:203[0-5])
                  )
                  \s+
                )
                ({{military_clock_hour_minute}}\s+)
                (
                  (?:
                    (?:3[01])|
                    (?:[0-2]?\d)
                  )
                  \s+
                )
                ({{month_names}}\s+)
                (
                  (?:
                    (?:199[3-9])|
                    (?:20[0-2]\d)|
                    (?:203[0-5])
                  )
                  \s+
                )
                ({{military_clock_hour_minute}})
                (\s+[0-6]?\d)?
              )|
              (?:
                (date\s+)
                ({{month_names}}\s+)
                (
                  (?:
                    (?:3[01])|
                    (?:[0-2]?\d)
                  )
                  \s+
                )
                (
                  (?:
                    (?:199[3-9])|
                    (?:20[0-2]\d)|
                    (?:203[0-5])
                  )
                  \s+
                )
                ({{military_clock_hour_minute}}\s+)
                ({{month_names}}\s+)
                (
                  (?:
                    (?:3[01])|
                    (?:[0-2]?\d)
                  )
                  \s+
                )
                (
                  (?:
                    (?:199[3-9])|
                    (?:20[0-2]\d)|
                    (?:203[0-5])
                  )
                  \s+
                )
                ({{military_clock_hour_minute}})
                (\s+[0-6]?\d)?
              )|
              (?:
                (recurring)
                (?:
                  \s+
                  (?:
                    (?:
                      (?:
                        ([1-5])|
                        (last)
                      )
                      \s+
                    )
                    ({{day_of_week_names}}\s+)
                    ({{month_names}}\s+)
                    ({{military_clock_hour_minute}}\s+)
                    (?:
                      (?:
                        ([1-5])|
                        (last)
                      )
                      \s+
                    )
                    ({{day_of_week_names}}\s+)
                    ({{month_names}}\s+)
                    ({{military_clock_hour_minute}})
                    (\s+[0-6]?\d)?
                  )
                )?
              )
            )
          )
        )
      captures:
        1: support.constant               # clock
        2: support.constant               # clock timezone
        3: entity.other.attribute-name    # clock timezone name
        4: constant.numeric               # clock timezone hour offset
        5: constant.numeric               # clock timezone minute offset
        6: support.constant               # clock summer-time
        7: entity.other.attribute-name    # clock summer-time timezone-name

        # date month year hh:mm date month year hh:mm [offset]
        8: support.constant               # clock date
        9: constant.numeric               # clock date day
        10: entity.other.attribute-name    # clock date month
        11: constant.numeric               # clock date year
        12: constant.numeric               # clock date time
        13: constant.numeric               # clock date day
        14: entity.other.attribute-name    # clock date month
        15: constant.numeric               # clock date year
        16: constant.numeric               # clock date time
        17: constant.numeric               # clock date minute offset

        # month date year hh:mm month date year hh:mm [offset]
        18: support.constant               # clock date
        19: entity.other.attribute-name    # clock date month
        20: constant.numeric               # clock date day
        21: constant.numeric               # clock date year
        22: constant.numeric               # clock date time
        23: entity.other.attribute-name    # clock date month
        24: constant.numeric               # clock date day
        25: constant.numeric               # clock date year
        26: constant.numeric               # clock date time
        27: constant.numeric               # clock date minute offset

        28: support.constant               # clock summer-time recurring
        29: constant.numeric               # clock summer-time recurring week
        30: support.constant               # clock summer-time recurring last week
        31: entity.other.attribute-name   # clock summer-time recurring day
        32: entity.other.attribute-name   # clock summer-time recurring month
        33: constant.numeric              # clock summer-time recurring time
        34: constant.numeric               # clock summer-time recurring week
        35: support.constant               # clock summer-time recurring last week
        36: entity.other.attribute-name   # clock summer-time recurring day
        37: entity.other.attribute-name   # clock summer-time recurring month
        38: constant.numeric              # clock summer-time recurring time
        39: constant.numeric              # clock summer-time recurring minute offset

  vlan:
    - match: '^\s*(vlan)\s+({{vlan_id}})'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: constant.numeric.vlan.id
      push:
      - meta_content_scope: text.network.cisco.vlan
      - match: ^\s*(name)\s+(\S+)
        captures:
          1: support.constant
          2: string.unquoted
      - include: pop_on_configure_terminal_context

  interface:
    - include: interface_default
    - include: interface_block

  interface_block:
    - match: >
        (?xi)
        ^\s*
        (?:
          (interface)\s+
          (?:
            (?:(range)\s+({{interface_names}})\s*({{interface_number_ranged}}))|
            ({{interface_names}})\s*({{interface_numbers}})
          )
        )
      captures:
        0: cisco.scope.interface
        1: variable.parameter               # interface
        2: support.constant               # range
        3: entity.other.attribute-name    # interface name
        4: constant.numeric               # interface number
        5: entity.other.attribute-name    # interface name
        6: constant.numeric               # interface number
      push:
      - meta_content_scope: text.network.cisco.interface
      - include: standby
      - include: switchport
      - include: load_interval
      - include: interface_ipv6_link_local
      - include: ip_dhcp_snooping
      - include: storm_control
      - include: interface_speed
      - include: interface_snmp
      - include: interface_service_policy
      - include: interface_trust_device
      - include: interface_auto_qos
      - match: |
          (?xi)
          ^\s*
          (?:
            (?:(description.*))|
            (?:((?:ip\s+)?vrf\s+forwarding)\s+(\S*))|
            (port-channel\s+standalone-disable)|
            (?:(encapsulation\s+dot1q)\s+({{vlan_id}}))|
            (?:(ip\s+helper-address)\s+({{ip}}))|
            (?:(ip\s+access-group)\s+(\S+)\s+(in|out))|
            (?:(ip\s+proxy-arp))|
            (?:(ip(?:v6)?\s+redirects))|
            (?:(ipv6\s+address\s+general-prefix)\s+({{ipv6_prefix}}))(\s+eui-64)?|
            (?:(ipv6\s+nd\s+prefix)\s+({{ipv6_prefix}}))|
            (?:(ipv6\s+address)\s+(\S+)\s+({{ipv6_prefix}}))(\s+eui-64)?|
            (?:(ip\s+address)\s+({{ip}})\s+({{subnet_mask}})(\s+secondary)?)|
            (shut(?:down)?)|
            (ipv6\s+enable)|
            (?:(channel-group)\s+(\d+)\s+(mode)\s+
              (
                (?:active)|
                (?:on)
              )
            )|
            (?:(ip\s+nat)\s+((?:inside)|(?:outside)))|
            (?:(duplex)\s+((?:auto)|(?:half)|(?:auto)))|
            (?:
              (ip)\s+
              (?:
                (flow\s+ingress)|
                (?:(igmp\s+query-interval)\s+(\d+))
              )
            )|
            (?:(mtu)\s+(\d+))|
            (?:(bandwidth)\s+(\d+))|
            (?:(speed)\s+(\d+))|
            (?:(full-duplex))|
            (?:(half-duplex))|
            (?:(ip\s+pim)\s+((?:(?:sparse)|(?:dense))-mode))|
            (?:(ip\s+ospf)\s+
              (?:
                (?:(message-digest-key)\s+(\d+)\s+({{hashing_algorithms}})\s+
                  (?:
                    (?:(7)\s+(\S+))|
                    (?:(\d+)\s+(\S+))
                  )
                )|
                (?:(cost)\s+(\d+))
              )
            )|
            (?:
              (spanning-tree)\s+
              (?:
                (portfast)
                (?:
                  \s+
                  (
                    (?:edge)|
                    (?:trunk)
                  )
                )?
              )|(?:
                (port\s+type)\s+
                (?:
                  (edge)\s+
                )
              )|(?:
                (bpduguard)\s+(?:(enable)|(disable))
              )
            )|
            (?:
              (service-policy)\s+
              (
                (?:input)|
                (?:output)
              )
              \s+(\S+)
            )|
            (?:
              (logging\s+event)\s+
              (?:
                (link-status)|
                (trunk-status)
              )
            )|
            (?:(vpc)\s+(\d+))
          )
        captures:
          1: comment.line                                  # Description
          2: support.constant                              # ip vrf forwarding
          3: string.unquoted                               # vrf name
          4: support.constant                              # port-channel standalone-disable
          5: support.constant                              # encapsulation dot1q
          6: constant.numeric.vlan.id                      # dot1q id
          7: support.constant                              # ip helper-address
          8: constant.numeric.ip.ipv4.address              # dhcp-ip
          9: support.constant                              # ip access-group
          10: string.unquoted                              # acl name
          11: support.constant                             # in / out
          12: support.constant                             # proxy-arp
          13: support.constant                             # ip redirects
          14: support.constant                             # ipv6 address general-prefix
          15: constant.numeric.ip.ipv6.prefix              # ipv6 prefix
          16: support.constant                             # eui-64
          17: support.constant                             # ipv6 nd prefix
          18: constant.numeric.ip.ipv6.prefix              # ipv6 nd prefix IP
          19: support.constant                             # ipv6 address
          20: string.unquoted                              # ipv6 address PREFIX_NAME
          21: constant.numeric.ip.ipv6.prefix              # ipv6 address PREFIX_NAME address
          22: support.constant                             # ipv6 address PREFIX_NAME address eui64
          23: support.constant                             # ip address
          24: constant.numeric.ip.ipv4.address             # ip address ipv4 address
          25: constant.numeric.network.ipv4.subnet_mask    # ip address ipv4 subnet mask
          26: support.constant.secondary                   # ip address secondary
          27: keyword.other                                # shutdown
          28: support.constant                             # ipv6 enable
          29: support.constant                             # channel-group
          30: constant.numeric                             # channel-group id
          31: support.constant                             # channel-group mode
          32: support.constant                             # channel-group mode active
          33: support.constant                             # ip nat
          34: support.constant                             # ip nat inside / outside
          35: support.constant                             # duplex
          36: support.constant                             # duplex auto / full / half
          37: support.constant                             # ip
          38: support.constant                             # ip flow ingress
          39: support.constant                             # ip igmp query-interval
          40: constant.numeric                             # ip igmp query-interval value
          41: support.constant                             # mtu
          42: constant.numeric                             # mtu value
          43: support.constant                             # bandwidth
          44: constant.numeric                             # bandwidth value
          45: support.constant                             # speed
          46: constant.numeric                             # speed value
          47: support.constant                             # full-duplex
          48: support.constant                             # half-duplex
          49: support.constant                             # ip pim
          50: entity.other.attribute-name                  # ip pim mode
          51: support.constant                             # ip ospf
          52: support.constant                             # ip ospf message-digest-key
          53: constant.numeric                             # ip ospf message-digest-key id
          54: entity.other.attribute-name                  # ip ospf message-digest-key hash
          55: constant.numeric                             # ip ospf message-digest-key password type 7
          56: string.unquoted.cisco.password.type.7        # ip ospf message-digest-key 7 password
          57: constant.numeric                             # ip ospf message-digest-key password type
          58: string.unquoted                              # ip ospf message-digest-key password
          59: support.constant                             # ip ospf cost
          60: constant.numeric                             # ip ospf cost value
          61: support.constant                             # spanning-tree
          62: support.constant                             # spanning-tree portfast
          63: support.constant                             # spanning-tree portfast edge
          64: support.constant                             # spanning-tree bpduguard
          65: entity.other.attribute-name                  # spanning-tree bpduguard enable
          66: keyword.other                                # spanning-tree bpduguard disable
          67: support.constant                             # service-policy
          68: support.constant                             # service-policy input/output
          69: string.unquoted                              # service-policy input/output name
          70: support.constant                             # logging event
          71: support.constant                             # logging event link-status
          72: support.constant                             # logging event trunk-status
          73: support.constant                             # vpc
          74: constant.numeric                             # vpc id
      - include: pop_on_configure_terminal_context

  interface_speed:
    - match: |
        (?xi)
        ^\s*(speed)\s+
        (?:
          (10{1,3})|
          (?:
            (auto)
            (
              (?:\s+10(?!\d))?
              (?:\s+100(?!\d))?
              (?:\s+1000(?!\d))?
            )?
          )|
          (nonegotiate)
        )
      captures:
        1: support.constant
        2: constant.numeric
        3: constant.language
        4: support.constant
        5: constant.language

  interface_trust_device:
    - match: |
        (?xi)
        ^\s*(trust\s+device)\s+
        (
          (?:cisco-phone)|
          (?:cts)|
          (?:ip-camera)|
          (?:media-player)
        )
      captures:
        1: support.constant
        2: constant.language

  interface_service_policy:
    - match: |
        (?xi)
        ^\s*(service-policy)\s+
        (
          (?:input)|
          (?:output)
        )\s+
        (\S+)
      captures:
        1: support.constant
        2: support.constant
        3: string.unquoted

  interface_auto_qos:
    - include: interface_auto_qos_voip

  interface_auto_qos_voip:
    - match: |
        (?xi)
        ^\s*(auto\s+qos\s+voip)\s+
        (
          (?:cisco-phone)|
          (?:cisco-softphone)|
          (?:trust)
        )
      captures:
        1: support.constant
        2: constant.language

  interface_ipv6_link_local:
    - match: |
        (?xi)
        ^\s*(ipv6)\s+(address)\s+({{ipv6_prefix}})\s+(link-local)(\s+cga)?
      captures:
        1: support.constant
        2: support.constant
        3: constant.numeric.ip.ipv6.prefix
        4: support.constant
        5: support.constant

  standby:
    - match: |
        (?xi)
        ^\s*
        (?:
          (standby)\s+(?:(\d+)|(?:(version)\s+([1-2])))\s+
          (?:
            (?:(ip)\s+({{ip}}))|
            (?:(preempt)\s+(delay)\s+(reload)\s+(\d+))|
            (?:(preempt)(?:\s+(delay\s+minimum)\s+(\d+)(?:\s+(reload)\s+(\d+))?)?)|
            (?:(track)\s+(\d+)\s+(decrement)\s+(\d+))|
            (?:(priority)\s+(\d+))|
            (?:(ipv6)\s+(?:
               (?:(autoconfig))|
               (?:({{ipv6_prefix}}))
              )
            )
          )?
        )
      captures:
        1: support.constant                       # standby
        2: constant.numeric                       # standby id
        3: support.constant                       # version
        4: constant.numeric                       # version number
        5: support.constant                       # ip
        6: constant.numeric.ip.ipv4.address       # ip address
        7: support.constant                       # preempt
        8: support.constant                       # preempt delay
        9: support.constant                       # preempt delay reload
        10: constant.numeric                       # preempt delay reload
        11: support.constant                       # preempt
        12: support.constant                       # delay minimum
        13: constant.numeric                       # delay time
        14: support.constant                      # reload
        15: constant.numeric                      # reload time
        16: support.constant                      # track
        17: constant.numeric                      # track number
        18: support.constant                      # track decrement
        19: constant.numeric                      # track decrement number
        20: support.constant                      # priority
        21: constant.numeric                      # priority number
        22: support.constant                      # ipv6
        23: support.constant                      # ipv6 autoconfig
        24: constant.numeric.ip.ipv6.prefix       # ipv6 ip

  banner:
    - match: |
        (?xi)
        ^\s*
        (banner)\s+(login)\s+
        (\^?\S)([^\3]*)
      captures:
        1: support.constant
        2: support.constant
        3: constant.language
        4: string.unquoted
        5: constant.language
      embed: 'mutliline_text'
      escape: (\3)
      escape_captures:
        1: constant.language

  mutliline_text:
    - meta_scope: multiline-text
    - match: (.*)
      captures:
        1: string.unquoted

  errdisable:
    - include: errdisable_recovery_cause
    - include: errdisable_detect_cause

  errdisable_recovery_cause:
    - match: |
        (?xi)
        ^\s*
        (errdisable\s+recovery\s+cause)\s+
        (
          (?:all)|
          (?:arp-inspection)|
          (?:bpduguard)|
          (?:channel-misconfig)|
          (?:dhcp-rate-limit)|
          (?:dtp-flap)|
          (?:gbic-invalid)|
          (?:inline-power)|
          (?:link-flap)|
          (?:loopback)|
          (?:mac-limit)|
          (?:pagp-flap)|
          (?:port-mode-failure)|
          (?:pppoe-ia-rate-limit)|
          (?:psecure-violation)|
          (?:psp)|
          (?:security-violation)|
          (?:sfp-config-mismatch)|
          (?:storm-control)|
          (?:udld)|
          (?:vmp)
        )
        \s*$
      captures:
        1: support.constant
        2: entity.other.attribute-name


  errdisable_detect_cause:
    - match: |
        (?xi)
        ^\s*
        (errdisable\s+detect\s+cause)\s+
        (
          (?:all)|
          (?:arp-inspection)|
          (?:bpduguard\s+shutdown\s+vlan)|
          (?:dhcp-rate-limit)|
          (?:dtp-flap)|
          (?:gbic-invalid)|
          (?:inline-power)|
          (?:link-flap)|
          (?:loopback)|
          (?:pagp-flap)|
          (?:pppoe-ia-rate-limit)|
          (?:psp\s+shutdown\s+vlan)|
          (?:security-violation\s+shutdown\s+vlan)|
          (?:sfp-config-mismatch)
        )
        \s*$
      captures:
        1: support.constant
        2: entity.other.attribute-name

  storm_control:
    - match: |
        (?xi)
        ^\s*
        (storm-control)\s+(
          (?:broadcast)|
          (?:multicast)|
          (?:unknown-unicast)
        )\s+
        (?:
          (?:
            (pps)\s+({{number_range_1_160000}})
          )|
          (?:
            (kbps)\s+({{number_range_64_1280000}})
          )
        )
        \s*$
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.numeric
    - match: |
        (?xi)
        ^\s*
        (storm-control)\s+(action)\s+
        (?:
          (shutdown)|
          (trap)
        )
        \s*$
      captures:
        1: support.constant
        2: support.constant
        3: keyword.other
        4: entity.other.attribute-name


  configure_terminal_ip_dhcp_snooping:
    - match: |
        (?xi)
        ^\s*
        (ip\s+dhcp\s+snooping\s+vlan)\s+({{vlan_id}})
        \s*$
      captures:
        1: support.constant
        2: constant.numeric
    - match: ^\s*(ip\s+dhcp\s+snooping)
      captures:
        1: support.constant

  ip_dhcp_snooping:
    - include: ip_dhcp_snooping_trust

  ip_dhcp_snooping_trust:
    - match: ^\s*(ip\s+dhcp\s+snooping\s+trust)
      captures:
        1: support.constant


  switchport:
    - match: '^\s*(switchport\s+mode\s+(?:trunk|access|capture))'
      captures:
        1: support.constant
    - include: interface_switchport_port_security
    - include: switchport_trunk
    - include: switchport_access
    - include: switchport_voice
    - include: switchport_nonegotiate
    - match: '^\s*(switchport)'
      captures:
        1: support.constant

  interface_switchport_port_security:
    - include: interface_switchport_port_security_aging
    - include: interface_switchport_port_security_maximum
    - include: interface_switchport_port_security_mac_address
    - include: interface_switchport_port_security_violation
    - match: |
        (?xi)
        ^\s*
        (switchport)\s+(port-security)
        \s*$
      captures:
        1: support.constant
        2: support.constant

  interface_switchport_port_security_aging:
    - match: |
        (?xi)
        ^\s*
        (switchport)\s+(port-security)\s+(aging)\s+
        (?:
          (?:(static))|
          (?:(time)\s+({{number_range_1_1440}}))|
          (?:(type)\s+
            (
              (?:absolute)|
              (?:inactivity)
            )
          )
        )
        \s*$
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: support.constant
        5: support.constant
        6: constant.numeric
        7: support.constant
        8: constant.language

  interface_switchport_port_security_mac_address:
    - match: |
        (?xi)
        ^\s*
        (switchport)\s+(port-security)\s+(mac-address)\s+
        (?:
          ({{number_range_1_1024}})|
          (?:(sticky)(\s+{{mac_address}})?)|
          (?:(vlan)\s+
            (?:
              (?:({{vlan_id}})(?:\s+(voice))?)|
              (?:
                (?:
                  (?:({{vlan_id}}))(?:(-)({{vlan_id}}))?
                  (,)
                )*
                ({{vlan_id}})(?:(-)({{vlan_id}}))?
              )
            )

          )|
          (?:({{mac_address}})\s+(vlan)\s+(voice))
        )
        \s*$
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.numeric.mac
        7: support.constant
        8: constant.numeric.vlan
        9: support.constant
        10: constant.numeric.vlan
        11: comment
        12: constant.numeric.vlan
        13: comment
        14: constant.numeric.vlan
        15: comment
        16: constant.numeric.vlan
        17: constant.numeric.mac
        18: support.constant
        19: support.constant

  interface_switchport_port_security_maximum:
    - match: |
        (?xi)
        ^\s*
        (switchport)\s+(port-security)\s+(maximum)\s+({{number_range_1_4097}})
        (?:
          \s+(vlan)\s+
          (?:
            (?:
              (?:({{vlan_id}}))(?:(-)({{vlan_id}}))?
              (,)
            )*
            ({{vlan_id}})(?:(-)({{vlan_id}}))?
          )
        )?
        \s*$
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.numeric
        5: support.constant
        6: constant.numeric.vlan
        7: comment
        8: constant.numeric.vlan
        9: comment
        10: constant.numeric.vlan
        11: comment
        12: constant.numeric.vlan

  interface_switchport_port_security_violation:
    - match: |
        (?xi)
        ^\s*
        (switchport)\s+(port-security)\s+(violation)\s+
        (
          (?:shutdown)|
          (?:restrict)|
          (?:protect)
        )
        \s*$
      captures:
        1: support.constant
        2: support.constant
        3: support.constant
        4: constant.language

  switchport_voice:
    - match: ^\s*(switchport\s+voice\s+vlan)\s+({{vlan_id}})
      captures:
        1: support.constant
        2: constant.numeric.vlan.id

  switchport_nonegotiate:
    - match: ^\s*(switchport\s+nonegotiate)
      captures:
        1: support.constant

  load_interval:
    - match: |
        (?xi)
        ^\s*(load-interval)\s+(
          (?:300)|
          (?:270)|
          (?:240)|
          (?:210)|
          (?:180)|
          (?:150)|
          (?:120)|
          (?:90)|
          (?:60)|
          (?:30)
        )
      captures:
        1: support.constant
        2: constant.numeric

  switchport_access:
    - match: ^\s*(switchport\s+access\s+vlan)\s+({{vlan_id}})
      captures:
        1: support.constant
        2: constant.numeric

  switchport_trunk:
    - match: |
        (?xi)
        ^\s*
        (?:
          (switchport\s+trunk)\s+
          (?:
            (encapsulation\s+dot1q)|
            (allowed\s+vlan)\s+
            (?:(?:(add)|(remove))\s+)?({{vlan_range}})
          )
        )
      captures:
        1: support.constant               # switchport trunk
        2: support.constant               # mode trunk
        3: support.constant               # encapsulation dot1q
        4: entity.other.attribute-name    # add
        5: keyword.other                  # remove
        6: constant.numeric               # vlan


  interface_default:
    - match: |
        (?xi)
        ^\s*
        (?:
          (default)\s+
          (interface)\s+
          ({{interface_names}})\s*
          ({{interface_numbers}})
        )
      captures:
        1: support.constant               # default
        2: support.constant               # interface
        3: entity.other.attribute-name    # interface name
        4: constant.numeric               # interface number

  description:
    - match: '^\s*(description.*)'
      captures:
        1: comment.line

  object_group:
    - include: object_group_network
    - include: object_group_security
    - include: object_group_service

  object_group_group_object:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:(group-object)\s+(\S+))
        )
      captures:
        1: support.constant     # group-object
        2: string.unquoted      # group-object name

  object_group_any:
    - match: |
        (?xi)
        ^\s*
        (?:
          (any)
        )
      captures:
        1: support.constant     # group-object

  object_group_network:
    - match: '^\s*(object-group)\s+(network)\s+(\S+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.ios.object_group.network
        - include: description
        - include: object_group_any
        - include: object_group_group_object
        - match: |
            (?xi)
            ^\s*
            (?:
                (?:(host)\s+({{ip}}))|
                (?:(host)\s+(\S+))|
                (?:({{ip}})\s+({{subnet_mask}}))|
                (?:(range)\s+({{ip}})\s+({{subnet_mask}}))
            )
          captures:
            1: support.constant                               # host
            2: constant.numeric.ip.ipv4.address               # ip
            3: support.constant                               # host
            4: string.unquoted                                # hostname
            5: constant.numeric                               # network
            6: constant.numeric.network.ipv4.subnet_mask      # subnet mask
            7: constant.numeric.network.ipv4.network_address  # range
            8: constant.numeric.network.ipv4.network_address  # network
            9: constant.numeric.network.ipv4.subnet_mask      # subnet mask
        - include: pop_on_configure_terminal_context

  object_group_service:
    - match: '^\s*(object-group)\s+(service)\s+(\S+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.ios.object_group.service
        - include: description
        - include: object_group_any
        - include: object_group_group_object
        - match: |
            (?xi)
            ^\s*
            (?:
               (?:(tcp)\s+({{number_32_bit}}))|
               (?:(udp)\s+({{number_32_bit}}))|
               (?:(tcp-udp)\s+({{number_32_bit}}))|
               (?:(ip)\s*$)
            )
          captures:
            1: support.constant                               # tcp
            2: constant.numeric                               # tcp number
            3: support.constant                               # udp
            4: constant.numeric                               # udp number
            5: support.constant                               # tcp-udp
            6: constant.numeric                               # tcp-udp number
            7: support.constant                               # ip
        - include: pop_on_configure_terminal_context

  object_group_security:
    - match: '^\s*(object-group)\s+(security)\s+(\S+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: string.unquoted
      push:
        - meta_content_scope: text.network.cisco.ios.object_group.security
        - include: description
        - include: object_group_any
        - include: object_group_group_object
        - match: |
            (?xi)
            ^\s*
            (?:
                (?:(security-group)\s+(tag-id)\s+({{security_tag_id}}))
            )
          captures:
            1: support.constant   # security-group
            2: support.constant   # security-group tag-id
            3: constant.numeric   # security-group tag-id id
        - include: pop_on_configure_terminal_context


  vty:
    - match: '^\s*(line)\s+(vty)\s+(\d+)\s+(\d+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.numeric
        4: constant.numeric
      push:
      - meta_content_scope: text.network.cisco.vty
      - include: line_settings
      - include: pop_on_configure_terminal_context

  line_settings:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:
            (transport)\s+
            (
              (?:preferred)|
              (?:input)|
              (?:output)
            )
            (
              (?:
                \s+
                (?:
                  (?:none)|
                  (?:ssh)|
                  (?:telnet)|
                  (?:all)
                )
              )+
            )
          )|
          (?:(password)\s+(\S+))|
          (?:(access-class)\s+(?:(\d+)|(\S+))\s+(in)(?:\s+(vrf-also))?)|
          (?:(modem\s+enable))|
          (?:(exec-timeout)\s+(\d+)\s+(\d+))|
          (logging\s+synchronous)|
          (?:(stopbits)\s+(\d+))|
          (?:(history)\s+(size)\s+(\d+))|
          (?:(exec)\s+(prompt)\s+(timestamp))|
          (?:(login)\s+((?:tacacs)|(?:local))?)
        )
      captures:
        1: support.constant                 # transport
        2: support.constant                 # transport preferred|input|output
        3: constant.numeric                 # transport protocol
        4: support.constant
        5: string.unquoted
        6: support.constant
        7: constant.numeric
        8: string.unquoted
        9: support.constant
        10: support.constant
        11: support.constant
        12: support.constant
        13: constant.numeric
        14: constant.numeric
        15: support.constant
        16: support.constant                # stopbits
        17: constant.numeric                # stopbits value
        18: support.constant                # history
        19: support.constant                # history size
        20: constant.numeric                # history size value
        21: support.constant                # exec
        22: support.constant                # exec prompt
        23: support.constant                # exec prompt timestamp
        24: support.constant                # login
        25: support.constant                # login local | tacacs

  line_con:
    - match: '^\s*(line)\s+(con(?:sole)?)\s+(0)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.numeric
      push:
      - meta_content_scope: text.network.cisco.ios.console
      - include: line_settings
      - include: pop_on_configure_terminal_context

  line_aux:
    - match: '^\s*(line)\s+(aux)\s+(\d+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: constant.numeric
      push:
      - meta_content_scope: text.network.cisco.ios.aux
      - include: line_settings
      - include: pop_on_configure_terminal_context

  ip_dhcp_pool:
    - match: |
        (?xi)
        ^\s*
        (ip)\s+(dhcp)\s+(pool)\s+(\S+)
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: support.constant
        4: string.unquoted
      push:
      - meta_content_scope: text.network.cisco.ios.ip_dhcp_pool
      - include: ip_dhcp_pool_settings
      - include: pop_on_configure_terminal_context

  ip_dhcp_pool_settings:
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:(network)\s+({{ip}})\s+({{subnet_mask}}))|
          (?:(default-router)\s+({{ip}}))
        )
      captures:
        1: support.constant
        2: constant.numeric.network.ipv4.network_address
        3: constant.numeric.network.ipv4.subnet_mask
        4: support.constant
        5: constant.numeric.ip.ipv4.address

  vrf:
    - include: new_vrf_syntax
    - include: old_vrf_syntax

  old_vrf_syntax:
    - match: '^\s*(ip)\s+(vrf)\s+(\S+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: string.unquoted
      push:
      - meta_content_scope: text.network.cisco.vrf
      - include: vrf_address_family
      - include: vrf_settings
      - include: pop_on_configure_terminal_context

  new_vrf_syntax:
    - match: '^\s*(vrf)\s+(definition)\s+(\S+)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
        3: string.unquoted
      push:
      - meta_content_scope: text.network.cisco.vrf
      - include: vrf_address_family
      - include: vrf_settings
      - include: pop_on_configure_terminal_context

  vrf_settings:
    - include: vrf_settings_export_map
    - match: |
        (?xi)
        ^\s*
        (?:
          (?:(description.*))|
          (?:(rd)\s+([0-9\.:]+))|
          (?:(route-target)\s+(import|export|both)\s+([0-9\.:]+))
        )
      captures:
        1: comment.line                   # description
        2: support.constant               # rd
        3: constant.numeric               # rd id
        4: support.constant               # route-target
        5: entity.other.attribute-name    # route-target import/export/both
        6: constant.numeric               # route-target id


  vrf_settings_export_map:
      - match: |
          (?xi)
          ^\s*
          (export)\s+(map)\s+(\S+)
        captures:
          1: support.constant
          2: support.constant
          3: string.unquoted


  vrf_address_family:
    - include: vrf_ipv4_address_family
    - include: vrf_ipv6_address_family

  vrf_ipv4_address_family:
    - match: '^\s*(address-family)\s+(ipv4)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
      push:
      - meta_content_scope: text.network.cisco.vrf.ipv4_address_family
      - match: '({{pop_address_family_ctx}})'
        pop: true
        captures:
          1: comment.line
      - match: >
          (?xi)
          \s*
          (?:(export\s+map)\s+(\S+))
        captures:
          1: support.constant        # export map
          2: string.unquoted         # export map name
      - include: pop_on_vrf_definition_context

  vrf_ipv6_address_family:
    - match: '^\s*(address-family)\s+(ipv6)'
      captures:
        0: cisco.scope
        1: variable.parameter
        2: support.constant
      push:
      - meta_content_scope: text.network.cisco.vrf.ipv6_address_family
      - match: '({{pop_address_family_ctx}})'
        pop: true
        captures:
          1: comment.line
      - match: >
          (?xi)
          ^\s*
          (?:
            (?:(export\s+map)\s+(\S+))
          )
        captures:
          1: support.constant        # export map
          2: string.unquoted         # export map name
      - include: pop_on_vrf_definition_context

  do_show:
    - match: '^\s*(do)(?=\s)'
      captures:
          1: support.constant
      push:
        - match: '$'
          pop: true
        - include: show

  show:
    - include: show_vlan
    - include: show_interface
    - include: show_run_interface
    - include: show_bgp
    - include: show_standby
    - include: show_ip_interface_brief
    - include: show_route

  show_vlan:
    - match: '\s*(show\s+vlan)(\s+(id)\s+({{vlan_id}}))?'
      captures:
        1: support.constant
        2: constant.numeric
        3: support.constant
        4: constant.numeric

  show_interface:
    - match: '\s*(show\s+interface)(?:(\s+{{interface_names}})\s*({{interface_numbers}}))?'
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: constant.numeric
        4: support.constant

  show_run_interface:
    - match: '\s*(show\s+run\s+interface)(?:(\s+{{interface_names}})\s*({{interface_numbers}}))?'
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: constant.numeric
        4: support.constant


  show_bgp:
    - match: |
        (?xi)
        (show\s+ip\s+bgp)
        (?:
          (?:
            (?:\s+(vpnv6)\s+
              (unicast)(?:
                (?:\s+(vrf)\s+(\S+)
                  (?:\s+
                    (?:
                      ({{ipv6_prefix}})|
                      ({{ipv6}})
                    )
                  )?
                )
              )?
            )|
            (?:\s+(vpnv4)\s+
              (unicast)(?:
                (?:\s+(vrf)\s+(\S+)
                  (?:\s+
                    (?:
                      ({{ip_prefix}})|
                      ({{ip}})
                    )
                  )?
                )
              )?
            )
          )
        )?
      captures:
        1: support.constant                 # show ip bgp
        2: support.constant                 # vpnv6
        3: support.constant                 # vpnv6 unicast
        4: support.constant                 # vpnv6 unicast vrf
        5: string.unquoted                  # vpnv6 unicast vrf name
        6: constant.numeric.ip.ipv4.prefix                 # vpnv6 unicast vrf name prefix
        7: constant.numeric.ip.ipv4.address                 # vpnv6 unicast vrf name prefix
        8: support.constant                 # vpnv4
        9: support.constant                 # vpnv4 unicast
        10: support.constant                 # vpnv4 unicast vrf
        11: string.unquoted                 # vpnv4 unicast vrf name
        12: constant.numeric.ip.ipv4.prefix                # vpnv4 unicast vrf name prefix
        13: constant.numeric.ip.ipv4.address                # vpnv4 unicast vrf name prefix
        14: entity.other.attribute-name
        15: constant.numeric
        16: support.constant

  show_standby:
    - match: '\s*(show\s+standby)(?:\s+({{interface_names}})\s*({{interface_numbers}}))?(\s+brief)?'
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: constant.numeric
        4: support.constant

  show_ip_interface_brief:
    - match: '\s*(show\s+ip\s+interface\s+brief)(?:\s+({{interface_names}})\s*({{interface_numbers}}))?'
      captures:
        1: support.constant
        2: entity.other.attribute-name
        3: constant.numeric

  show_route:
    - match: |
        (?xi)
        \s*(show)\s+
        (?:
          (?:
            (ipv6\s+route)
            (?:\s+(vrf)\s+(\S+))?
            (\s+{{ipv6}})?
          )
          |
          (?:
            (ip\s+route)
            (?:\s+(vrf)\s+(\S+))?
            (\s+{{ip}})?
          )

        )
      captures:
        1: support.constant                 # show
        2: support.constant                 # ipv6 route
        3: support.constant                 # ipv6 vrf
        4: string.unquoted                  # ipv6 vrf name
        5: constant.numeric.ip.ipv6.address # ipv6 prefix
        6: support.constant                 # ip route
        7: support.constant                 # ip vrf
        8: string.unquoted                  # ip vrf name
        9: constant.numeric.ip.ipv4.address # ip prefix

  locations:
    - include: location_local
    - include: location_remote

  location_remote:
    - match: ((?:t?ftp)|scp)(://)({{ip}})(\/\S*)?
      captures:
        1: entity.other.attribute-name
        2: support.constant
        3: constant.numeric.ip.ipv4.address
        4: support.constant

  location_local:
    - match: ({{drives}}|(?:running|startup)-config)
      captures:
        1: support.constant

  write:
    - match: '^\s*(write)\s*'
      captures:
        1: support.constant

  logout:
    - match: '^\s*(logout)\s*'
      captures:
        1: support.constant

  copy:
    - match: '^\s*(copy)\s*'
      set: copy_location_source
      captures:
        1: support.constant

  copy_location_source:
    - match: \s
      set: copy_location_destination
    - include: locations

  copy_location_destination:
    - match: (?:\s|{{comment}}|$)
      pop: true
    - include: locations

  pipe:
    - match: (?<=\s)(\|)
      scope: text.network.cisco.pipe
      captures:
        1: keyword.other
      push:
        - meta_content_scope: text.network.cisco.pipe
        - match: '(?=(?:{{comment}})|$)'
          pop: true
        - match: >
            (?xi)
            \s+
            (?:
              (include)|
              (exclude)
            )
            \s+
            ([^{{comment}}]*)
          captures:
            1: entity.other.attribute-name
            2: keyword.other
            3: string.unquoted
  show_drives:
    - match: '\s*(show)\s+({{drives}})'
      captures:
        1: support.constant
        2: support.constant