4

Is there a way to make a Cisco Nexus 7k to reject a CLI command?

Everyone knows about the impact, when you want to add a VLAN to a trunk, and if you forget the keyword aadd.

If you do this with a VPC N7k pair on a VPC port-channel dot1q trunk, the VLANs will go to suspended as long as they're not allowed on both VPC trunks.

Is there a way to make the cli reject the command if you forget the add in:

int po[X]

switchport trunk allowed vlan add [Y]

EDIT: In ios this could be achieved with something like

event cli pattern [regex] skip yes

  • 5
    In our environment, we use Cisco ISE as TACACS, you can specifically specify each command allowed for each user or user group. I just checked and it is possible to reject the command switchport trunk allowed vlan. Here you can also allow the command if it has the add after. But i guess you are thinking about a way to block it directly via CLI? – user36472 Oct 27 '17 at 10:34
  • 2
    In a larger sense, it's not possible to idiot proof systems like data center switches. A better approach is to use change management and test environments and maintenance windows to mitigate the likelihood and impact of configuration errors. – Todd Wilcox Oct 27 '17 at 12:08
  • @Cown thats interesting, probably we'd need to change many things as you probably can't just replace your tacacs server with an ISE. I was looking for a way to block it directly via cli, without having to implement additional services. – Rene Oct 27 '17 at 15:01
  • @Todd Wilcox It could be quite expensive to roll those configurations out via change management. A task which could be done in minutes by one person can turn to one which lasts hours or days with many people involved. If that mistake happens 0.01 times during those configurations, it is questionable if there is a benefit. – Rene Oct 27 '17 at 15:16
  • In the cisco catalyst series (6000') you had the event manager, and shell scripting in ios. So you were able to create my asked behavior via script. – Rene Oct 27 '17 at 15:29
2

I think, it can be done by this:

config t
event manager applet protectmefromdoingstupid
description "goes here"
event cli match "switchport trunk allowed vlan [0-9]+.*"
action 1.0 put "There was no 'add' in that statement! If you know what you are doing, run 'terminal event-manager bypass' and 'no terminal event-manager bypass', when you are done."

from: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/system-management/guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide_chapter_010010.html

Following note from cisco is critical here :)

If you want to allow the triggered event to process any default actions, you must configure the EEM policy to allow the default action. For example, if you match a CLI command in a match statement, you must add the event-default action statement to the EEM policy or EEM will not allow the CLI command to execute. You can use the terminal event-manager bypass command to allow all EEM policies with CLI matches to execute the CLI command.

I'll test this and report back.

EDIT: Improved the regex (.* instead $), thanks to @Ron Maupin for the hint.

Something about regex interpretation on a nx7k can be found here:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_0/nx-os/fundamentals/configuration/guide2/fun_nx-os_book/fun_3about_cli.html#wp1237003

EDIT AFTER TESTING:

it doesn't work like I suggested, there are some weird behaviors and it seems many commands in the cisco documentation doesn't exist (neither on a N7K with nxos 6*(<- I know its old) nor on a n9k with nxos 7*)

I tested a workaround and it works like I wanted to:

conf t
event manager applet protect1
event cli match "conf t ; int * ; switchport trunk allowed vlan 1*"
event manager applet protect2
event cli match "conf t ; int * ; switchport trunk allowed vlan 2*"
event manager applet protect3
event cli match "conf t ; int * ; switchport trunk allowed vlan 3*"
event manager applet protect4
event cli match "conf t ; int * ; switchport trunk allowed vlan 4*"
event manager applet protect5
event cli match "conf t ; int * ; switchport trunk allowed vlan 5*"
event manager applet protect6
event cli match "conf t ; int * ; switchport trunk allowed vlan 6*"
event manager applet protect7
event cli match "conf t ; int * ; switchport trunk allowed vlan 7*"
event manager applet protect8
event cli match "conf t ; int * ; switchport trunk allowed vlan 8*"
event manager applet protect9
event cli match "conf t ; int * ; switchport trunk allowed vlan 9*"
end
terminal no event manager bypass

Some explanation:

According to the documentation, it should interpret this as cli regex. But it don't. Maybe it is because you need to give the absolut path in the event definition. Mandatory are as well the spaces around the semicolons.

I am not very happy with this (happy that it works but its somehow ugly) - tested improvements are very appreciated!

| improve this answer | |
  • 1
    What happens in the case of a list of VLANs? switchport trunk allowed vlan 5,7,9-11 That would still replace the current allowed VLANs instead of adding to them. – Ron Maupin Oct 28 '17 at 17:42
  • That '$' should match anything else after. – Rene Oct 28 '17 at 17:44
  • No, the $ matches the end of the string. You are only matching numbers on the command. – Ron Maupin Oct 28 '17 at 18:14
  • Oh, it was intended to do this. I wanted to have something like .* instead of the $ . – Rene Oct 28 '17 at 18:20
  • @RonMaupin , just realized that I probably don't need anything else after the [0-9]+ . If I'd want to have a whole line match I'd need to put ^ at the beginning and $ to the end, right? – Rene Oct 29 '17 at 5:09
1

If you insist on using EEM on Nexus, you can try with the following two applets. I have tested them out and they work as expected.

event manager applet TrunkAdd
  event cli match "conf t ; int * ; switchport trunk allowed vlan add *"
  action 1.0 event-default

event manager applet TrunkBlock
  event cli match "conf t ; int * ; switchport trunk allowed vlan *"
  • 1st applet is to allow the command switchport trunk allowed vlan add ... as we have event-defaultaction.
  • 2nd applet is to deny the command switchport trunk allowed vlan without add

Test results:

#show run int Ethernet4/1    

interface Ethernet4/1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,30,40,60
  no shutdown

#conf t
(config)# interface Ethernet4/1
(config-if)#switchport trunk allowed vlan 20
% Command blocked by event manager policy
(config-if)#switchport trunk allowed vlan add 20
(config-if)#end

#show run int Ethernet4/1

interface Ethernet4/1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30,40,60
  no shutdown

Be aware that, with EEM on Nexus, in regular command expressions, only the asterisk (*) symbol can be used for replace the arguments (Cisco doc here). We cannot use other characters (such as ^, $, ., [ ], *, ... ) as we normally use for regular expressions. That is why I think we cannot use one applet in this case.

I hope it is helpful.

| improve this answer | |
  • I still have a hard time wrapping my head around allowing people in a data center to make changes without a proper review and approval of the proposed changes. – Ron Maupin Oct 30 '17 at 17:20
  • @RonMaupin I totally agree that we should have a CRB (Change Review Board) within Network and IT teams to review and approve all changes (with all steps and commands clearly documented). And change owner should follow exactly what are written and approved. – Hung Tran Oct 30 '17 at 17:27
  • I liked my solution more because it will allow commands like "switchport trunk allowed vlan none" or "switchport trunk allowed vlan remove" and only denies what I wanted to. Both provided answers here are of course similar and both are functional. – Rene Mar 22 '18 at 0:20
  • @Rene That is okay :) And bear in mind that, the solution here was based on your problem description, as there were no things like "...vlan none" and "....vlan remove" in our question :). If you need those commands, just follow my example to create "TrunkRemove" and "TrunkNone" applet scripts (like "TrunkAdd") before "TrunkBlock". – Hung Tran Mar 22 '18 at 7:38
1

I did the same think using RBAC locally on our Nexus 7010:

role name Soporte-2
  rule 55 permit command configure terminal ; interface * ; switchport trunk allowed vlan add *
  rule 50 deny command configure terminal ; interface * ; switchport trunk allowed vlan *
  rule 5 permit read-write 

Hope this help.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.