Sponsored Content
Full Discussion: ACL Analyzer Script
Top Forums Shell Programming and Scripting ACL Analyzer Script Post 302174305 by Okema on Monday 10th of March 2008 05:31:58 PM
Old 03-10-2008
ACL Analyzer Script

Hello,

I am trying to make a bash script that will analyze and document Cisco (router) ACLs that will output a file with the source, destination, protocol, and ports (ports of the destination only) into a text file. The whole reason why all our current ACLs need to be documented is because we are moving over to state full firewalls (PIX), which means you don't need to state anything that was already established. I would also like to keep the remark lines and add that in output along with everything else, but I could probably do that myself once I get an idea about how to approach this. Assuming I get this script done, I could then just hand the output over to the firewall team and they can take it from there.

Example (IPs changed for confidentiality):
permit tcp host x.x.x.x eq smtp y.y.y.y 0.0.0.31 gt 1023 established
permit tcp host x.x.x.x eq 5308 y.y.y.y 0.0.0.31 gt 1023 established
permit tcp host x.x.x.x eq 6802 y.y.y.y 0.0.0.31 gt 1023 established
permit tcp x.x.x.x 0.0.0.31 eq 2049 y.y.y.y 0.0.0.31
permit tcp host x.x.x.x gt 1023 y.y.y.y 0.0.0.31 eq smtp
permit tcp host x.x.x.x gt 1023 y.y.y.y 0.0.0.31 eq 5308
permit tcp host x.x.x.x gt 1023 y.y.y.y 0.0.0.31 eq 6802
permit tcp x.x.x.x 0.0.0.31 y.y.y.y 0.0.0.31 eq 2049

The first four aren't need while the last four are.

Now that you know what I'm trying to do, I'll explain my problem... I'm not too sure where to start and what is the best method for something like this. There are several different types of ACL lines such as:

permit protocol src mask dest mask
permit protocol any desk mask
permit protocol src mask any
permit protocol any any
permit protocol src mask port dest mask port
permit protocol src mask port dest mask portrange
etc...

Anyone have any ideas about how to start a task like this? Or even the way the looping structure should be or the commands I should use? I've been documenting each ACL I have by hand and I have thousands, so I figured that a script would be the best way to tackle this. I do have experience in BASH scripting, although my knowledge of commands such as awk, grep, and many others I probably don't even know about, is very limited.

What I had in mind was to set the spaces as delimiters and set each token as a variable, but that's all I thought up of and I'm not really sure even how to do that.

So to sum it all up this is what I hope to accomplish:
- To input a text file of (hopefully) all the ACLs in one (as in the show run command on Cisco routers, same output, the whole ACL section pasted in a text file).
- To be able to get rid of the lines that isn't needed when converting from ACL to state full firewall. This might be easier to this part last, although I'll wait and see what comes up before I decide anything.
- To output to a text file to something that's easy to read.

Thank you
 

7 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

multiple website traffic analyzer

Hello everybody, I'm hosting several websites on the same server using apache virtual hosting: ~$ tail /etc/apache2/sites-available/default <VirtualHost *> ServerName website1.mydomain.com DocumentRoot /var/www/website1 </VirtualHost> <VirtualHost *> ServerName... (5 Replies)
Discussion started by: chebarbudo
5 Replies

2. Shell Programming and Scripting

Script to find/apply Solaris 10 ACL's

This may be a question for a different forum, but as I will need a script I thought I would start here. We recently migrated from Solaris 8 to Solaris 10. The file system in question here is ZFS, meaning the method for listing and applying ACL's has changed dramatically. To make a long story... (3 Replies)
Discussion started by: Shoeless_Mike
3 Replies

3. HP-UX

HP UX Syslog Analyzer

Hi everybody I need to analyze syslog file in HP UX Is there any log analayzer for this file? Regards (3 Replies)
Discussion started by: m_arab
3 Replies

4. Solaris

[REQ] tool analyzer for /var/adm/messages

hi all, i am trying to find a tool to analyze the var/adm/messages. is there any? thanks, Mahm. (6 Replies)
Discussion started by: mahm_14
6 Replies

5. Solaris

graphical diskspace analyzer

Hi all, recently I took over the admin task for a solaris 5.10 machine. Being a little bit familiar with debian systems Solaris is up to now a complete mystery to me. The first thing I would like to have is a graphical diskspace analyzer. I mean something like BaoBab under gnome. I there a... (2 Replies)
Discussion started by: sly_dunbar
2 Replies

6. IP Networking

Best iptables log analyzer?

Hello all, i want to view my iptables log on web interface, with chart (in option, and this is not my priority). What is the best program for this? I have Ubuntu server. Thanks ! :) (0 Replies)
Discussion started by: Pacifiste95
0 Replies

7. Infrastructure Monitoring

Centralized linux system log analyzer?!

Hello everyone! I`m searching for linux log parser application. I already find some ways, but the best looks logzilla. Requirements: Web interface for viewing Filtering in web Notifications in web or email Open source Support linux system logs, custom logs and apache logs. I will... (5 Replies)
Discussion started by: jabalv
5 Replies
SCRIPT(1)							   User Commands							 SCRIPT(1)

NAME
script - make typescript of terminal session SYNOPSIS
script [options] [file] DESCRIPTION
script makes a typescript of everything printed on your terminal. It is useful for students who need a hardcopy record of an interactive session as proof of an assignment, as the typescript file can be printed out later with lpr(1). If the argument file is given, script saves all dialogue in file. If no file name is given, the typescript is saved in the file type- script. OPTIONS
-a, --append Append the output to file or typescript, retaining the prior contents. -c, --command command Run the command rather than an interactive shell. This makes it easy for a script to capture the output of a program that behaves differently when its stdout is not a tty. -e, --return Return the exit code of the child process. Uses the same format as bash termination on signal termination exit code is 128+n. -f, --flush Flush output after each write. This is nice for telecooperation: one person does `mkfifo foo; script -f foo', and another can supervise real-time what is being done using `cat foo'. --force Allow the default output destination, i.e. the typescript file, to be a hard or symbolic link. The command will follow a symbolic link. -q, --quiet Be quiet. -t, --timing[=file] Output timing data to standard error, or to file when given. This data contains two fields, separated by a space. The first field indicates how much time elapsed since the previous output. The second field indicates how many characters were output this time. This information can be used to replay typescripts with realistic typing and output delays. -V, --version Output version information and exit. -h, --help Output help and exit. NOTES
The script ends when the forked shell exits (a control-D to exit the Bourne shell (sh(1)), and exit, logout or control-d (if ignoreeof is not set) for the C-shell, csh(1)). Certain interactive commands, such as vi(1), create garbage in the typescript file. Script works best with commands that do not manipulate the screen, the results are meant to emulate a hardcopy terminal. ENVIRONMENT
The following environment variable is utilized by script: SHELL If the variable SHELL exists, the shell forked by script will be that shell. If SHELL is not set, the Bourne shell is assumed. (Most shells set this variable automatically). SEE ALSO
csh(1) (for the history mechanism), scriptreplay(1). HISTORY
The script command appeared in 3.0BSD. BUGS
Script places everything in the log file, including linefeeds and backspaces. This is not what the naive user expects. AVAILABILITY
The script command is part of the util-linux package and is available from Linux Kernel Archive <ftp://ftp.kernel.org/pub/linux/utils/util- linux/>. util-linux September 2011 SCRIPT(1)
All times are GMT -4. The time now is 07:11 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy