iCC Help >> Typical Applications >> Advanced Configuration Check Examples

Advanced Configuration Check Examples

Configuration Procedures

1. Select the Service tab, click the Compliance Center in the navigation tree to enter the Compliance Policy page.
2. Click the Add.
3. Click the Add Rule button.
4. Select Advanced from the Standard list.
5. Configure the following key parameters for an advanced rule:
   • Operation: Operation to be performed: Check or Check and Get. Check indicates only checking whether the configurations match the rule. Check and Get indicates checking the configurations, abstracting some configurations, and displaying them in the report. If you select Check and Get, Included is forcibly selected for Match Mode, and Match Mode is not displayed on the page.
   • Rule Relation: Relation between the added content and the existing contents: and or or. The system determines the final logical relation by computing rules one by one. Suppose Included is selected for Match Mode. If you configure rules A, B, and C in the sequence "A and B and C", you mean that the three rules must be included. If you configure "A and B or C", you mean that rules A and B must be included, or C is included. If you configure "A or B and C", you mean that at least one of rules A and B must be included, and C must be included. If you configure "A or B or C", you mean that at least one of the three rules must be included.
   • Rule Configuration: Includes Included and Excluded. Included indicates that device configurations that contain the rule contents meet the rule requirements. Excluded indicates that device configurations that exclude the rule contents meet the rule requirements.
   • Match Mode: You can configure multiple strings or regular expressions. The relation between the strings or regular expressions depends on the rule relation.

Configuration Examples

1. Check

• Rule content

This rule indicates that a match contains both "traffic classifier + any characters" and "traffic behavior + any characters", or does not contain "interface GigabitEthernet X/X/X", where "X" indicates a number.

• Configuration segment 1:
  #
  traffic classifier lsy-c operator and if-match dscp 6
  #
  traffic behavior lsy-b
  car cir 64 cbs 4000 ebs 4000 green pass red discard yellow pass
  #
  interface NULL0
  #
  This segment includes both "traffic classifier + lsy-c operator and if-match dscp 6" and "traffic behavior + lsy-b", although it does not include "interface GigabitEthernet". The segment meets the rule requirements.
• Configuration segment 2:
  #
  traffic classifier lsy-c operator and if-match dscp 6
  #
  interface NULL0
  #
  qos apply policy sunxuefeng outbound
  #
  This segment does not contain "interface GigabitEthernet", although it contains "traffic classifier + lsy-c operator and if-match dscp 6" but does not contain "traffic behavior". The segment meets the rule requirements.
• Configuration segment 3:
  #
  traffic classifier lsy-c operator and if-match dscp 6
  #
  interface NULL0
  #
  interface GigabitEthernet2/0/1
  qos apply policy sunxuefeng outbound
  #
  This segment contains "interface GigabitEthernet2/0/1", and contains "traffic classifier + lsy-c operator and if-match dscp 6", but does not contain "traffic behavior". The segment does not meet the rule requirements.

2. Check

• Match patterns
  acl number (?<ACL Number>[0-9]{4})
  In a regular expression, a pair of parentheses introduces a sub-expression (that is, a group), and the ?<> combination that follows the left parenthesis defines the group name, which can contain only A-Z or a-z or 0-9 or blank letters. If you specify no group name for a group, the system will assign one for the group.
  In this example, <ACL Number>[0-9]{4} is the only group, and ACL Number is the name of the group. [0-9]{4} indicates that four digits should be abstracted. The whole expression indicates that the system gets the four digits following ACL Number, and displays ACL Number as the group name.
• Configuration segment
  #
  telnet server enable
  #
  acl number 2001
  rule 0 permit
  #
  acl number 2000
  rule 0 permit source 5000::6/96
  #
  domain system
  access-limit disable
  idle-cut disable
  self-service-url disable
  #
  This segment contains "acl number 2001" and "acl number 2000" which meet the rule requirements.

Related Topics

• Basic Configuration Check Examples