[rancid] cisco-xr ASR9K and numbered ACL's

[Jos]

Thanks Alan and all those offering help with this. Your suggestion Alan of
using “($_ =~ /^\s+(\d+) (\w+) (.*\s)(.*)/)” has worked for me, I have
extra line breaks between ACL entries, but the ACL’s hold all the key data
they should now so I’m happy.
In my 3.1 install I had to adjust /home/rancid/lib/rancid/iosxr.pm as
noted.
Not sure if this is a bug or not, should the ACLSORT=NO disable this
feature entirely?

Cheers, Jos


On 16/10/14 10:14, "Alan McKinnon" <alan.mckinnon at gmail.com> wrote:

>On 15/10/2014 09:59, Jos wrote:
>> Hi Guys
>> 
>> Thanks to you both for the replies. I should have mentioned I’ve tried
>>the
>> ACL-SORT option being disabled/enabled in config without seeing any
>> success, I had this line in rancid.conf:
>> 
>> # if ACLSORT is NO, access-lists will NOT be sorted.
>> ACLSORT=NO; export ACLSORT
>> #
>> 
>> I have tried removing “export ACLSORT” with no luck either.
>> 
>> 
>> I have 4 or 5 ASR9K’s running 4.3.x and all do the same thing. Perhaps a
>> better example is this one:
>> 
>> Rancid backs up this:
>> ipv4 access-list name
>>  permit ipv4 any 166
>>  remark the below subnet is currently not in use
>>  permit ipv4 any 166
>> 
>> What we have configured is:
>> ipv4 access-list name
>>  10 permit ipv4 any 166.1xx.xx.xx/28
>>  20 remark the below subnet is currently not in use
>>  30 permit ipv4 any 166.1xx.xx.xxx/28
>> 
>> 
>>  - so the rancid backup leaves a bit to be desired here I think.
>
>
>The truncated address is due to this code in WriteTerm():
>
>if (/^ipv(4|6) access-list (\S+)\s*$/) {
>    ...
>    while (<INPUT>) {
>       ...
>       ($seq, $cmd, $misc, $ip) = ($_ =~ /^\s+(\d+) (\w+) (.*\s)(\w+)/);
>                if ($cmd =~ /(permit|deny)/) {
>                    ProcessHistory("ACL $nlri $key $cmd",
>"$aclsort","$ip", " $cmd $misc$ip\n");
>                ...
>    }
>}
>
>
>That final (\w+) stops at the first dot.
>
>I'm no Cisco guru and don't know all the permutations of how XR lists
>access-lists, but I imagine the address must be everything after
>"ipv(4|6) any ", so the regex should probably become:
>
>
>($_ =~ /^\s+(\d+) (\w+) (.*\s)(.*)/)
>
>
>This is for 2.3.8 (I don't have a 3.x install to hand to check)
>
>> 
>> I have:
>> expect version 5.44.1.15
>> This is on centos 6.5, I had the packaged version of rancid installed,
>>an
>> old 2.3.8 or something but then grabbed 3.1 and compiled it and have
>> removed the package.
>> 
>> 
>> Thanks for all your help with this, I can share more config if you let
>>me
>> know what exactly.
>> 
>> Cheers, Jos
>> 
>> 
>> On 15/10/14 18:27, "heasley" <heas at shrubbery.net> wrote:
>> 
>>> Wed, Oct 15, 2014 at 07:22:23AM +0200, Alan McKinnon:
>>>>> Rancid collected config:
>>>>> ipv4 access-list no-rfc1918
>>>>>  remark Deny traffic to RFC 1918
>>>>>  deny ipv4 10.0.0.0/8 any
>>>>>  deny ipv4 any 10
>>>>>  deny ipv4 172.16.0.0/12 any
>>>>>  deny ipv4 any 172
>>>>>  deny ipv4 192.168.0.0/16 any
>>>>>  deny ipv4 any 192
>>>>>  permit ipv4 any any
>>>>>
>>>>>
>>>>> A minor problem where the ACL is obvious as above, but this is the
>>>>> exception.
>>>>> Can someone suggest a good fix or workaround for this please
>>>> (preferably
>>>>> without changing the ASR9K config), I trust it affects others with
>>>> this
>>>>> sort of config?
>>>>> I can see earlier posts mention xrrancid but can’t find that in our
>>>> 3.1
>>>>> install.
>>>>
>>>> This appears to be rancid's acl renumbering, which is the designed
>>>> behaviour for good reasons.
>>>
>>> I dont think so; yes its removing the line numbers, but its botching
>>>every
>>> other line.
>>> _______________________________________________
>>> Rancid-discuss mailing list
>>> Rancid-discuss at shrubbery.net
>>> http://www.shrubbery.net/mailman/listinfo/rancid-discuss
>> 
>> 
>
>
>-- 
>Alan McKinnon
>alan.mckinnon at gmail.com
>
>_______________________________________________
>Rancid-discuss mailing list
>Rancid-discuss at shrubbery.net
>http://www.shrubbery.net/mailman/listinfo/rancid-discuss