Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cisco object-group ACLs don't properly render ICMP type and code #298

Open
abates opened this issue Feb 11, 2022 · 0 comments · May be fixed by #300
Open

Cisco object-group ACLs don't properly render ICMP type and code #298

abates opened this issue Feb 11, 2022 · 0 comments · May be fixed by #300

Comments

@abates
Copy link
Contributor

abates commented Feb 11, 2022

Policy terms with an icmp type and code are not correctly rendered when using the Cisco generator and the object-group argument. The rendered lines are missing the icmp-type and code.

For example, using the following policy:

# NETWORK.net
header {
    target:: ciscoxr ICMP_EXAMPLE object-group
}

term PERMIT_ICMP_ECHO_REPLY {
    protocol:: icmp
    action:: accept
    icmp-type:: echo-reply
}

aclgen renders the following:

! $Id:$
! $Date:$
! $Revision:$
no ip access-list extended ICMP_EXAMPLE
ip access-list extended ICMP_EXAMPLE
 remark $Id:$


 remark PERMIT_ICMP_ECHO_REPLY
 permit icmp any any

exit

Note the missing icmp-type following permit icmp any any. The expected output is:

! $Id:$
! $Date:$
! $Revision:$
no ip access-list extended ICMP_EXAMPLE
ip access-list extended ICMP_EXAMPLE
 remark $Id:$


 remark PERMIT_ICMP_ECHO_REPLY
 permit icmp any any 0

exit
@abates abates linked a pull request Mar 4, 2022 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant