Multiple Failing Use Cases in Cisco IOS ACL Template

[tyler-8]

Using this issue to track progress on fixes.

ISSUE TYPE

• Bug Report

TEMPLATE USING

Value Required,Filldown ACL_TYPE (Standard|Extended)
Value Required,Filldown ACL_NAME (\S+)
Value LINE_NUM (\d+)
Value ACTION (permit|deny)
Value PROTOCOL ([a-z]+)
Value SRC_HOST (\d+\.\d+\.\d+\.\d+)
Value SRC_ANY (any)
Value SRC_NETWORK (\d+\.\d+\.\d+\.\d+)
Value SRC_WILDCARD (\d+\.\d+\.\d+\.\d+)
Value SRC_PORT_MATCH (eq|range|lt|gt)
Value SRC_PORT ((?<!range\s)\S+)
Value SRC_PORT_RANGE_START ((?<!range\s)\S+)
Value SRC_PORT_RANGE_END (\S+)
Value DST_HOST (\d+\.\d+\.\d+\.\d+)
Value DST_ANY (any)
Value DST_NETWORK (\d+\.\d+\.\d+\.\d+)
Value DST_WILDCARD (\d+\.\d+\.\d+\.\d+)
Value DST_PORT_MATCH (eq|range|lt|gt)
Value DST_PORT ((?<!range\s)\S+)
Value DST_PORT_RANGE_START ((?<=range\s)\S+)
Value DST_PORT_RANGE_END (\S+)
Value LOG (log-input|log)
Value TIME (\S+)
Value STATE (inactive|active)


Start
  ^(Standard|Extended) -> Continue.Clearall
  ^${ACL_TYPE}\s+IP\s+access\s+list\s+${ACL_NAME}\s* -> Record
  ^\s+${LINE_NUM}\s+${ACTION}\s+${PROTOCOL}\s+(host\s+${SRC_HOST}|${SRC_ANY}|${SRC_NETWORK}\s+${SRC_WILDCARD})(\s+${SRC_PORT_MATCH}\s+|)(${SRC_PORT_RANGE_START}\s+${SRC_PORT_RANGE_END}|${SRC_PORT}|)\s+(host\s+${DST_HOST}|${DST_ANY}|${DST_NETWORK}\s+${DST_WILDCARD})(\s+${DST_PORT_MATCH}\s+(${DST_PORT_RANGE_START}\s+${DST_PORT_RANGE_END}|${DST_PORT}|)|)(\s+${LOG}|)(\s+time-range\s+${TIME}\s+\(${STATE}\)|)\s* -> Record
  ^\s+${LINE_NUM}\s+${ACTION}\s+(${SRC_NETWORK},\s+wildcard\s+bits\s+${SRC_WILDCARD}|${SRC_HOST}|${SRC_ANY})(\s+{LOG}|)(\s+time-range\s+${TIME}\s+\(${STATE}\)|)\s* -> Record
  ^.* -> Error "Could not parse line:"

EOF

SAMPLE COMMAND OUTPUT

310 permit udp any range 16384 32767 10.XXX.XXX.0 0.0.XXX.XXX range 16384 32767
330 permit udp any eq snmp bootpc 10.XXX.0.0 0.XXX.XXX.XXX
430 permit ip 10.XXX.XXX.XXX 0.XXX.XXX.XXX object-group SOME_APP_IPS
10 permit tcp any any established

SUMMARY

The template fails on source port ranges, multiple port entries (up to 10 allowed on IOS), and object-groups.

STEPS TO REPRODUCE

(using netmiko)

device.send_command('show ip access-list MY_ACL', use_textfsm=True)

EXPECTED RESULTS

Structured data returned from template.

ACTUAL RESULTS

TextFSM failed parsing on all 3 2 scenarios.

textfsm.TextFSMError: Error: "Could not parse line:". Rule Line: 32. Input Line:     310 permit udp any range 16384 32767 10.XXX.XXX.0 0.0.XXX.XXX range 16384 32767.
Error: "Could not parse line:". Rule Line: 32. Input Line:     310 permit udp any range 16384 32767 10.XXX.XXX.0 0.0.XXX.XXX range 16384 32767.

POTENTIAL FIXES

• Src Port Range: Value SRC_PORT_RANGE_START ((?<=range\s)\S+) (courtesy @jmcgill298)
• Multiple Ports:

Value SRC_PORT ((?<!range\s)\S+|(\S+(\s\S+){1,9}))
Value DST_PORT ((?<!range\s)\S+|(\S+(\s\S+){1,9}))

• Object groups: TBD
• established line: TBD

[gudgeong]

I have a similar issue.... Should I just post it here or as a new issue ??

textfsm.parser.TextFSMError: Error: "Could not parse line:". Rule Line: 38. Input Line: 10 permit icmp 23.54.66.128 0.0.0.127 any echo-reply.

show_ip_access-list.txt

Sorry not familiar with Git hub and loggin of bugs and issues...

Cheers