Last active
February 6, 2024 20:13
-
-
Save consentfactory/85872fc83453d1735b15aed3e47a9763 to your computer and use it in GitHub Desktop.
TTP ASA Template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## TTP ASA Template | |
| ## Published 2021.10.12 | |
| ## Jimmy Taylor | |
| ## | |
| ## Template for Cisco ASA configurations that organizes objects, object-groups, and ACLs | |
| ## for JSON using TTP Project | |
| ## | |
| ## TTP Project: https://github.com/dmulyalin/ttp | |
| ## | |
| ## THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
| ## "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
| ## LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
| ## A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
| ## OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
| ## SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
| ## LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
| ## DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
| ## THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
| ## (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
| ## OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| ## | |
| ## This software consists of voluntary contributions made by many individuals | |
| ## and is licensed under the MIT license. For more information, see | |
| ## <http://www.doctrine-project.org>. | |
| ## TTP variables used below | |
| <vars> | |
| SVC_PORTS = "tcp-udp|tcp|udp" | |
| RANGE = "range" | |
| OBJECT = "object" | |
| OBJECT_EXCLUDE = "[A-Za-z]" | |
| IGNORE_INACTIVE = "inactive" | |
| RE_IPV4 = "((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" | |
| ACL_SVC = "tcp|udp|icmp|ip" | |
| ACL_ACTION = "permit|deny" | |
| ACL_INLINE_SVC = "DM_INLINE_(TCP|UDP|PROTOCOL)_\d{1,3}" | |
| ACL_ANY = "any|any4|any6" | |
| ACL_DEFAULT = { | |
| "log_debug": False | |
| } | |
| </vars> | |
| ## Getting FW name | |
| <group name="firewall_info"> | |
| hostname {{ hostname | re(".+") }} | |
| </group> | |
| ## ASA Objects | |
| <group name="objects"> | |
| <group name="{{ object_type }}-objects.{{ object_name }}**"> | |
| object {{ object_type }} {{ object_name | _start_ }} | |
| description {{ description | re(".*") }} | |
| service {{protocol | re("SVC_PORTS") }} destination eq {{port}} | |
| service {{protocol | re("SVC_PORTS") }} destination range {{port_begin}} {{port_end}} | |
| description {{ description | re(".*") }} | |
| range {{ begin_ip | IP }} {{ end_ip }} | |
| fqdn v4 {{fqdn}} | |
| host {{ip | IP}} | |
| host {{host | WORD}} | |
| subnet {{ ip | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| subnet {{ipv6 | PREFIXV6 }} | |
| </group> | |
| </group> | |
| ## end objects | |
| ## ASA Object Groups | |
| <group name="object-groups"> | |
| <group name="object-{{ object_type }}-groups**.{{ object_name }}**"> | |
| object-group {{ object_type }} {{ object_name | _start_ }} | |
| object-group {{ object_type }} {{ object_name | _start_ }} {{ protocol | re("SVC_PORTS")}} | |
| description {{ description | re(".*") }} | |
| <group name="network-objects" method="table"> | |
| <group name="networks" itemize="obj_name" method="table"> | |
| network-object {{ obj_name | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| </group> | |
| <group name="objects" itemize="obj_name" method="table"> | |
| network-object object {{ obj_name | WORD }} | |
| </group> | |
| <group name="hosts" itemize="obj_name" method="table"> | |
| network-object host {{ obj_name | IP }} | |
| </group> | |
| </group> | |
| <group name="group-objects" itemize="obj_name" method="table"> | |
| group-object {{ obj_name }} | |
| </group> | |
| <group name="group-objects" itemize="obj_name" method="table"> | |
| service-object object {{ obj_name }} | |
| service-object {{ obj_name }} | |
| </group> | |
| <group name="service-object-ports*"> | |
| service-object {{ protocol | re("SVC_PORTS") }} destination eq {{port}} | |
| </group> | |
| <group name="service-object-port-ranges*"> | |
| service-object {{ protocol | re("SVC_PORTS") }} destination range {{port_begin}} {{port_end}} | |
| </group> | |
| <group name="service-port-objects" itemize="port_obj"> | |
| port-object eq {{ port_obj }} | |
| </group> | |
| <group name="service-port-object-ranges*"> | |
| port-object range {{port_begin}} {{port_end}} | |
| </group> | |
| <group name="protocol-objects" itemize="protocol_obj"> | |
| protocol-object {{ protocol_obj }} | |
| </group> | |
| </group> | |
| ## end object-{{ object_type }}-groups** | |
| </group> | |
| ## end object-groups | |
| ## ASA ACLs | |
| ## Note: there are many variations of ASA ACLs; this is an extensive list but may not include all | |
| <group name="access-lists**.{{acl_name}}" method="table"> | |
| access-list {{acl_name}} extended remark {{ ignore }} | |
| ## ACLs to/from ANY objects | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} host {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} | |
| ## ACLs starting with services | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service | DIGIT}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} host {{dst_object}} object-group {{dst_service}} | |
| ## ACLs starting with object because why not? | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} object-group {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} host {{src_object}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| ## ACLs starting with object-groups | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} host {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} host {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} object-group {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} object {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} eq {{dst_service}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} object-group {{dst_service}} | |
| ## LOGGING ITEMS | |
| ## ACLs to/from ANY objects | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} object {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | re("ACL_ANY")}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} host {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object | re("ACL_ANY")}} {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | re("ACL_ANY")}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| ## ACLs starting with services | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} host {{src_object}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} object-group {{dst_object}} {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service | DIGIT}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object-group {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} object {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} object-group {{src_object}} host {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| ## ACLs starting with object because why not? | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} object-group {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} host {{src_object}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| ## ACLs starting with object-groups | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} {{src_object}} host {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} host {{src_object}} {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object-group {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} object-group {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} object {{dst_object}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{dst_service}} object {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} object {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object-group {{src_object}} {{dst_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} object {{src_object}} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} eq {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} object-group {{service}} {{src_object | PHRASE | contains_re('RE_IPV4') | exclude_re('OBJECT_EXCLUDE') | to_ip | with_prefixlen }} object-group {{dst_object}} object-group {{dst_service}} {{ log_debug | PHRASE | equal("log debugging") | let(true)}} | |
| ## Catches entries that are inactive | |
| access-list {{acl_name}} extended {{ inactive | _line_ | joinmatches | contains('inactive')}} | |
| ## Catch-all for all entries that don't match | |
| access-list {{acl_name}} extended {{ remaining_config | _line_ | joinmatches | exclude('inactive')}} | |
| </group> | |
| ## end access-lists |
Can you move this to a repo? I'd love to give feedback and pull-requests.
Today I got bit by this one:
access-list {{acl_name}} extended {{action | re("ACL_ACTION")}} {{service | re("ACL_SVC")}} {{src_object | re("ACL_ANY")}} host {{dst_object}} eq {{dst_service}}
I added the above rule to otherwise some of my rules were being omitted from the output.
Next up, I'm going to build a quick validator to make sure every rule has been matched in the template, so this doesn't happen to me again.
As I mentioned on Twitter I really like the work you did on this! Awesome job.
Let me know if you make a repo, I'll submit some PRs if any more come up.
Here you go! Sorry about the delay.
https://github.com/consentfactory/ttp-cisco-asa-template
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Should have probably made this a git repo to better track changes.
Reconfigured lines 76-85. Moved the networks group above the hosts and objects groups because I discovered an issue where I think
exclude_re('OBJECT_EXCLUDE')in the networks group was causing the hosts and objects groups to be excluded from the lists.