|
1 | | -<img src="https://netpicker.io/wp-content/uploads/2024/01/netpicker-logo-276x300.png" width="160"> |
| 1 | +We set out to revolutionize the way you can test the quality, design, compliance and security of your networks. |
2 | 2 |
|
3 | | -# Compliance Examples |
| 3 | +Netpicker allows you to discover all your devices, back up configs and run automated health- and compliance tests, based on community supported (pytest) libraries for CIS hardening, common design validations, CVE checks and many more. |
4 | 4 |
|
5 | | -A set of common Netpicker compliance use-cases. |
| 5 | +## Examples |
6 | 6 |
|
7 | | -<br /> |
8 | | - |
9 | | -## Table of Contents |
10 | | - |
11 | | -1. [Format of the Rules](#format-of-the-rules) |
12 | | -2. [Simple Examples](#simple-examples) |
13 | | -3. [Multiple Lines](#multiple-lines) |
14 | | -4. [Multiple Commands](#multiple-commands) |
15 | | -5. [Using Configuration and Commands](#configuration-commands) |
16 | | -6. [Using device parameters](#device-parameters) |
17 | | -7. [Using TextFSM](#using-textfsm) |
18 | | - |
19 | | -## Format of the Rules |
20 | | - |
21 | | -### Understand the Netpicker Rule Structure |
22 | | -- **Severity Levels**: Decide whether your rule should be low, medium, or high severity, depending on its importance. |
23 | | -- **Rule Naming**: Name your rule starting with `rule_`, followed by a descriptive name that reflects the test's purpose. |
24 | | -- **Platform Specification**: Identify the platforms (e.g., `cisco_ios`, `juniper`) the rule applies to. |
25 | | - |
26 | | -### Write the Netpicker Rule |
27 | | -- **Basic Structure**: Use the Netpicker rule template: |
28 | | - ```python |
29 | | - @low( |
30 | | - name='rule_name', |
31 | | - platform=['platform_name'], |
32 | | - ) |
33 | | - def rule_name(configuration): |
34 | | - assert 'keyword' in configuration |
35 | | - ``` |
36 | | -- **Customize the Rule**: |
37 | | - - Replace `'rule_name'` with your actual rule name. |
38 | | - - Specify the correct platform(s). |
39 | | - - Implement the logic inside the function, using assertions to determine if the device complies with the rule. |
40 | | - |
41 | | -## Simple Examples |
42 | | - |
43 | | -### Example 1: Check for Specific Banner Text |
44 | | -This rule ensures that a Cisco IOS device has the correct banner text configured: |
45 | | - |
46 | | -```python |
47 | | -@low( |
48 | | - name='rule_banner_check', |
49 | | - platform=['cisco_ios'], |
50 | | -) |
51 | | -def rule_banner_check(configuration): |
52 | | - assert 'Authorized access only' in configuration |
53 | | -``` |
54 | | -*This example checks if the banner contains the text "Authorized access only".* |
55 | | - |
56 | | -### Example 2: Ensure NTP is Synchronized |
57 | | -This rule checks the status of NTP synchronization and reports if the device is not in sync: |
58 | | - |
59 | | -```python |
60 | | -@medium( |
61 | | - name='rule_ntp_sync', |
62 | | - platform=['cisco_ios'], |
63 | | - commands=dict(show_ntp_status: 'show ntp status'), |
64 | | -) |
65 | | -def rule_ntp_sync(commands): |
66 | | - assert ' synchronized' in commands.show_ntp_status, "NTP is not synchronized" |
67 | | -``` |
68 | | -*This example executes the show ntp status command and checks if the output contains the word " synchronized." If the NTP status is not synchronized, the rule will fail, indicating that the device is not in sync with the NTP server.ecure manner.* |
69 | | - |
70 | | -## Multiple Lines |
71 | | - |
72 | | -### Example: Ensure Specific Log Servers are Configured |
73 | | -This rule checks that specific log servers are configured in the device: |
74 | | - |
75 | | -```python |
76 | | -@medium( |
77 | | - name='rule_specific_log_servers_configured', |
78 | | - platform=['cisco_ios'], |
79 | | -) |
80 | | -def rule_specific_log_servers_configured(configuration): |
81 | | - assert "logging host 1.2.3.4" in configuration, "Log server 1.2.3.4 is not configured" |
82 | | - assert "logging host 2.3.4.5" in configuration, "Log server 2.3.4.5 is not configured" |
83 | | -``` |
84 | | -*This rule ensures that the device configuration includes the specific log servers 1.2.3.4 and 2.3.4.5. If either line is missing, the rule will fail and report which log server is not configured.* |
| 7 | +- [Netpicker Example rules](https://github.com/netpicker/pytests-for-networking/blob/main/EXAMPLES.md) |
0 commit comments