0

We have an automation, that logs into our firewalls and lists all NAT pools and the allocated connections using the show nat pool command. We want to limit the output, if possible to only show 2 or maybe 3 digit+ in the show command.

I was wondering if this is possible?

Example output from show nat pool:

TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.22(xx.xx.xx.157), range 1024-65535, allocated 100
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.24(xx.xx.xx.188), range 1-1023, allocated 0
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.24(xx.xx.xx.188), range 1024-65535, allocated 1
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.23(xx.xx.xx.93), range 1-1023, allocated 21908
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.23(xx.xx.xx.93), range 1024-65535, allocated 2
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.22(xx.xx.xx.119), range 1-1023, allocated 0
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.22(xx.xx.xx.119), range 1024-65535, allocated 8
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.21(xx.xx.xx.19), range 1-1023, allocated 0
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.21(xx.xx.xx.19), range 1024-65535, allocated 3

I managed to remove all allocated ending on 0 like this:

show nat pool | grep -v .*allocated.0

Result:

TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.22(xx.xx.xx.157), range 1024-65535, allocated 100
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.24(xx.xx.xx.188), range 1024-65535, allocated 1
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.23(xx.xx.xx.93), range 1-1023, allocated 21908
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.23(xx.xx.xx.93), range 1024-65535, allocated 2
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.22(xx.xx.xx.119), range 1024-65535, allocated 8
TCP PAT pool xx-xxx-isp-transit, address xx.xx.xx.21(xx.xx.xx.19), range 1024-65535, allocated 3

I then wanted to remove those ending on 1, 2, 3 as well, but I cannot get it to work:

> show nat pool | grep -v .*allocated.[0-3]
ERROR: Invalid input command arguments

show nat pool | grep -v .*allocated.(0|1|2)

Gives no result.

> show version
-------------------[ XXX ]-------------------
Model                     : Cisco Firepower 4110 Threat Defense (76) Version 7.0.4 (Build 55)
UUID                      : cb5fxx...
Rules update version      : 2022-11-30-001-vrt
VDB version               : 361
----------------------------------------------------
7
  • Have you tried including what you want? show nat pool | grep .*allocated.[0-9]{3}
    – Zac67
    Dec 7, 2022 at 8:51
  • @Zac67 Hey Zac, long time no see, I just tried: > show nat pool | grep .*allocated.[0-9]{3} and result: ERROR: Invalid input command arguments
    – Cow
    Dec 7, 2022 at 8:56
  • Hmm - regex variants vary greatly... Does show nat pool | grep .*allocated.[0-9]+ work? Or show nat pool | grep .*allocated.[0-9][0-9][0-9]?
    – Zac67
    Dec 7, 2022 at 8:58
  • @Zac67 They all give ERROR: Invalid input command arguments. I don't think it likes the brackets for some reason.
    – Cow
    Dec 7, 2022 at 9:00
  • @Zac67 If you come to chat I can show you the output there if you want to. :)
    – Cow
    Dec 7, 2022 at 9:05

1 Answer 1

2

As it seems, you cannot use classes [0-9] or repetitions {3} with that poor regex implementation - pretty much the only thing you've got left is to match for the wanted number of any characters behind allocated:

show nat pool | grep allocated....

A leading .* isn't really required.

1
  • Thanks again, you are a lifesaver!
    – Cow
    Dec 7, 2022 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.