google / google/capirca

established not added when using object-groups on cisco or ciscoxr

Open
#174 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
857
Forks
213
PR merge metrics
No merged PRs in 30d

Description

When using object-groups as part of the target:: ciscoxr parameters the output doesn't include the established keyword.

### With object-group keyword
example .pol
```
header {
target:: ciscoxr INBOUND_INTERNET_V4 object-group
}

term accept-tcp-replies {
comment:: "Allow tcp replies to internal hosts."
destination-address:: INTERNAL
protocol:: tcp
option:: established
action:: accept
}

term permit-offices {
comment:: "Allow Remote Offices"
destination-address:: REMOTE_OFFICES
action:: accept
}

term permit-login-queue {
comment:: "Allow Login Queue Servers"
destination-address:: LQ_SERVERS
protocol:: tcp
destination-port:: LOGINQUEUE
action:: accept
logging:: true
}

term default-permit {
comment:: "Allow what's left."
action:: deny
}
```
### Output
```
object-group network ipv4 INTERNAL
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
exit

object-group port 1024-65535
range 1024 65535
exit

object-group network ipv4 REMOTE_OFFICES
200.1.0.0/19
200.2.1.0/24
200.5.1.0/24
exit

object-group network ipv6 REMOTE_OFFICES
2620:0:10a1::/48
exit

object-group network ipv4 LQ_SERVERS
10.0.0.64/29
exit

object-group port 80-80
eq 80
exit

object-group port 443-443
eq 443
exit

! $Id:$
! $Date:$
! $Revision:$
no ipv4 access-list INBOUND_INTERNET_V4
ipv4 access-list INBOUND_INTERNET_V4
remark $Id:$

remark accept-tcp-replies
remark Allow tcp replies to internal hosts.
permit tcp any net-group INTERNAL port-group 1024-65535

remark permit-offices
remark Allow Remote Offices
permit ip any net-group REMOTE_OFFICES

remark permit-login-queue
remark Allow Login Queue Servers
permit tcp any net-group LQ_SERVERS port-group 80-80
permit tcp any net-group LQ_SERVERS port-group 443-443

remark default-permit
remark Allow what's left.
deny ip any any
```

### Without object-group keyword

```
header {
target:: ciscoxr INBOUND_INTERNET_V4
}

term accept-tcp-replies {
comment:: "Allow tcp replies to internal hosts."
destination-address:: INTERNAL
protocol:: tcp
option:: established
action:: accept
}

term permit-offices {
comment:: "Allow Remote Offices"
destination-address:: REMOTE_OFFICES
action:: accept
}

term permit-login-queue {
comment:: "Allow Login Queue Servers"
destination-address:: LQ_SERVERS
protocol:: tcp
destination-port:: LOGINQUEUE
action:: accept
logging:: true
}

term default-permit {
comment:: "Allow what's left."
action:: deny
}
```
### Output
```
! $Id:$
! $Date:$
! $Revision:$
no ipv4 access-list INBOUND_INTERNET_V4
ipv4 access-list INBOUND_INTERNET_V4
remark $Id:$

remark accept-tcp-replies
remark Allow tcp replies to internal hosts.
permit tcp any 10.0.0.0 0.255.255.255 range 1024 65535 established
permit tcp any 172.16.0.0 0.15.255.255 range 1024 65535 established
permit tcp any 192.168.0.0 0.0.255.255 range 1024 65535 established

remark permit-offices
remark Allow Remote Offices
permit ipv4 any 200.1.0.0 0.0.31.255
permit ipv4 any 200.2.1.0 0.0.0.255
permit ipv4 any 200.5.1.0 0.0.0.255

remark permit-login-queue
remark Allow Login Queue Servers
permit tcp any 10.0.0.64/29 0.0.0.7 eq 80 log
permit tcp any 10.0.0.64/29 0.0.0.7 eq 443 log

remark default-permit
remark Allow what's left.
deny ipv4 any any

exit
```

Similar behavior also occurs when adding the logging:: option. As shown on permit-login-queue term. When using object-groups, the "log" keyword is not added.

I can open a different issue for the log but seems to be related.

thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.