iCC Help >> Operation Guide >> Compliance Policy Check >> Compliance Policy >> Add/Modify Compliance Policy >> Add/Modify Rule

Add/Modify Rule

Perform this task to add or modify rules for a compliance policy.

Operation Procedure

1. Select the Service tab, click the Compliance Center in the navigation tree to enter the Compliance Policy page.
2. Click the Add button, or click the Modify link of the target compliance policy in the policy list.
3. Click the Add Rule button, or click the Modify link of the target rule in the rule list.
4. Type the name and select the severity level for the rule.
5. Select the check type for the rule as needed. The following takes the Link check type as an example.
6. Set the start identifier and the end identifier.
7. Select the check target as needed. The following takes the Command Execution Result option as an example.
8. Type the command in the text box, or click Select and then select a command from the command fragment.
9. Select the device vendor.
10. Click Select, select the device series from the dialogue box that appears, and click OK.
11. Type the rule description.
12. Add the rule content and set the rule relation.

    a. Select the rule type. Options include Basic and Advanced. The following takes the Advanced option as an example.

    b. Select the operation. Options include Check and Check and Get. The following takes the Check and Get option as an example.

    c. Type the rule content, select the value comparison type, and input the compared value.

    d. Click Add.

    e. To add multiple rule contents, select the rule relation.

    f. To delete the content of a specific rule, click the Delete link of the rule content on the list.

13. Confirm the configuration and click OK.

Parameters

• Violation level: Indicates the rule violation severity. Options include Info, Minor, Major, Critical, and Emergency. Info: Information related with good practices, which are useful for preventing unauthorized access. Minor: Low risk. Unauthorized users may be able to collect sensitive information about the device, such as software version and interfaces supported, and use such information to get higher-level vulnerabilities. Major: Medium risk. Unauthorized users may be able to control the device, such as enabling a port and configuring wrong settings, resulting in partial network failures. Critical: High risk. Unauthorized users can gain control of the device, and access sensitive information such as device configuration, and user passwords. Emergency: Very high risk. Unauthorized users can gain control of the device resulting in compromising network and device operations.
• Check type: Options include Device, Interface, Link, Aggregate Link, Configuration Segment, Jython Script, and Component Extension. Device: This type checks the configuration file of the device. Interface/Configuration segment: These types check the content between the start identifier and the end identifier in the configuration file of the device. Link/Aggregate link: These types check the content between the start identifier plus the interface description and the end identifier in the configuration file of the device. Jython script: This type uses an uploaded Jython script to define the check result of the device. Component extension: This type uses a Jython script to check components for violation.
• Start identifier/end identifier: They show the rule the content to be checked with the start and end positions.The start identifier and the end identifier cannot specify the same position. If an identifier contains a special character (for example, *.?\+$[]) that needs escaping and exact match, you can add a escape character (\) before the character. For example, when you input \*, * can be exactly matched.
• Check target: Indicates the target that the rule checks. Options include Latest backup running configuration, Latest backup startup configuration, and Display command output.
• Vendor: Indicates the vendor of the device whose rules are to be checked.
• Device series: Indicates the series of the device whose rules are to be checked.
• Description: Describes the rule.
• Renew command: This is the command to be used for renewing the device if the device violates the rule.
• Jython script: This option is the path where the Jython script of the rule is stored.
• Category: Options include Basic and Advanced. The basic category checks strings only, but does not support the special characters in regular expressions. The advanced category supports regular expressions.
• Match mode: Indicates how the device configuration file is matched. When the basic rule type is selected, the rule configuration options include Loose Match, Negative Loose Match, Strict Match, and Negative Strict Match. In strict match, character strings of a rule are strictly matched against the device configuration, whereas the loose match mode does not. The device configuration complies with a rule if certain character strings are contained in loose or strict match mode, or if certain character strings are not contained in negative match modes. When the advanced category is selected, the rule configuration options include Contain and Not Contain. The Contain option means that a match contains the specified contents, whereas the Not Contain option means the opposite.
• Rule relation: Relation between the two or more rule contents: and or or. This option is available for the advanced rule category.
• Execution method: Options include Check and Check and Get. The Check option only checks whether the device configuration matches the rule. The Check and Get option checks the device configuration, gets the configuration, and displays the configuration in reports.
• Value comparison type: This option appears when Link or Aggregate Link is selected as the check type, Advanced is selected as the category, and Check and Get is selected as the execution method. This option defines how the values obtained from two interfaces are compared. Options include All equal to, All not equal to, One of them equals to, One of them not equal to, and All identical.
• Compared value: This option specifies the value with which the value obtained from the device is to be compared.
• Content rule: This option specifies the content that is used to be compared with the check target.

For you to better understand the rule configuration parameters, see the configuration examples in Basic configuration check configuration example and Advanced configuration check configuration example.

Precautions

• The rules of the component extension type only exist in the pre-defined compliance policies. When you add or modify a compliance policy by importing a rule of the component extension type, the check type of the rule changes to the Jython script type.
• If you select Interface, Link, Aggregate Link, or Configuration Segment as the check type, you must set the start and end identifiers. The Interface and Configuration Segment check types check the contents between the start and end identifiers in the configuration file, whereas the Link or Aggregate Link check types check the contents between the start identifier plus the interface description and the end identifier in the configuration file.
• If you select Command Execution Result as the check target, you must set the command for the target by entering a command in the text box, or by clicking Select Command and selecting a command from the command segment.
• When the vendor changes, the device series is cleared, indicating that all device series of the vendor.
• To set the renew command, make sure you select Device, Interface, or Configuration Segment as the check type.
• When the rule category or execution method changes, all the rules you configured in the basic or advanced category will be removed.
• The rule contents are case-insensitive.
• Strict match: Matches device configurations that contain specified strings in the specified order. To check the configuration backup, make sure that the rule contents are taken from a configuration file backed up by the system. To check the command execution result, make sure that the rule contents are taken through telnet or displayed on an SSH device.
• Negative strict match: Matches device configurations that do not contain specified strings in the specified order. To check the configuration backup, make sure that the rule contents are taken from a configuration file backed up by the system. To check the command execution result, make sure that the rule contents are taken through telnet or displayed on an SSH device.
• When the check type is configuration segment, the start and end identifiers must be the characters at the start position of configuration lines.

Related Topics

• Import Rule
• View Rule
• Test Rule
• Delete Rule