google / google/capirca

port group optimization for same src/dst rules

Open
#254 0 comments 0 reactions 1 assignee Claimed by @nero85 View on GitHub
generator: cisco
Dominant language
Python
Stars
857
Forks
213
PR merge metrics
No merged PRs in 30d

Description

Capirca port-group doesn't group ports for same src/dst rules.

e.g. in the default cisco-sample.pol , add this
```
term accept-to-honestdns {
comment:: "Allow name resolution using honestdns."
destination-address:: GOOGLE_DNS
destination-port:: DNS DHCP
protocol:: udp tcp
action:: accept
}
```

Outputs:
```
object-group port 53-53
eq 53
exit
object-group port 67-68
range 67 68
exit
remark Allow name resolution using honestdns.
permit udp any net-group GOOGLE_DNS port-group 53-53
permit tcp any net-group GOOGLE_DNS port-group 53-53
permit udp any net-group GOOGLE_DNS port-group 67-68
permit tcp any net-group GOOGLE_DNS port-group 67-68
```

It would make sense to get something like:

```
object-group port DNS_DHCP
eq 53
range 67 68
exit
remark Allow name resolution using honestdns.
permit udp any net-group GOOGLE_DNS port-group DNS_DHCP
permit tcp any net-group GOOGLE_DNS port-group DNS_DHCP
```

This is specifically helpful when you have a list of ports sharing same src/dst permit statements

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.