Dec-30-2018, 09:43 PM
Folks,
I am not even sure how to ask the question so I don't really have code to post for what I have tried. I am trying to do some comparisons on some Firewall Services and Firewall Service groups.
- A Firewall Service is like the lines that start with config firewall service custom below and it defines a specific service and its values.
- A Firewall Service Group is group of services and service groups that make up the services allowed. Some Service Groups have nested service groups in them and that is what I am trying to solve.
I have a text file and in the file I have the following lines (example lines. The actual file is hundreds of lines long):
config firewall service group edit "GROUP-1-GRP" set member "svc-name-1" "svc-2" "Serv_3" "GROUP-2-GRP" "TEST1-GRP"
config firewall service group edit "GROUP-2-GRP" set member "svc-name-1" "Serv_3" "SERVICE-4"
config firewall service group edit "TESTING-GRP" set member "SERVICE-7" "SERVICE-6" "SERVICE-5"
config firewall service group edit "TEST1-GRP" set member "svc-name-1" "NESTED-GRP"
config firewall service group edit "NESTED-GRP" set member "SVC-6"
config firewall service custom edit "svc-name-1" set color 1 set udp-portrange 500 4500
config firewall service custom edit "svc-2" set tcp-portrange 5190-5194
config firewall service custom edit "Serv_3" set tcp-portrange 123 set udp-portrange 123
config firewall service custom edit "SERVICE-4" set udp-portrange 26000 27000 27910 27960
config firewall service custom edit "SERVICE-5" set tcp-portrange 3389
config firewall service custom edit "SVC-6" set tcp-portrange 33381
I also have a list of Service Groups and I want to loop through that list and figure out the actual services that are associated to the main service group. This means if it is a service already then I can get those values, but if it is a service group, I have do dig into that group and pull out all services and if there is another nested group then I have to dig into that service group and pull out the services so at the end I can identify which actual services are being used by the base service group.
So for example:
BASE GROUP: GROUP-1-GRP
BASE SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
BASE SERVICE: "svc-2" set tcp-portrange 5190-5194
BASE SERVICE: "Serv_3" set tcp-portrange 123 set udp-portrange 123
NESTED GROUP: "GROUP-2-GRP"
NESTED SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
NESTED NESTED GROUP: "TEST1-GRP"
NESTED NESTED SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
NESTED NESTED NESTED GROUP: NESTED-GRP
NESTED NESTED NESTED SERVICE: "SVC-6" set tcp-portrange 33381
So after going through the services and service groups I would say that the actual services being used in GROUP-1-GRP are:
"svc-name-1" set color 1 set udp-portrange 500 4500
"svc-2" set tcp-portrange 5190-5194
"Serv_3" set tcp-portrange 123 set udp-portrange 123
"SVC-6" set tcp-portrange 33381
The reason I need to get down to the actual services for viewing is because I have a Centralized Firewall Manager (CMS) and on it there are a list of services groups, and when I want to bring in a new firewall to the Centralized Manager, it does a comparison of the CMS and the Firewall and tells me if there is a conflict with Service Groups because if the Firewall has a service group named GROUP-1-GRP it may be the same name but is made up of different services than the . GROUP-1-GRP on the CMS. These configurations are old and they are a nightmare because the engineers did not use a good naming standard and that is what I am trying to accomplish. I am going through the configurations of over 300 Firewalls and trying to bring them in to the CMS and the big stumbling block is names that are the same but have different services.
I just don't know how to recurse back into an object if it is a group and then possibly into another group and be able to pull out those values and associate them with the top level service group. Any pointers or maybe different ways of looking at the data would be appreciated.
Thanks in Advance
Wally
I am not even sure how to ask the question so I don't really have code to post for what I have tried. I am trying to do some comparisons on some Firewall Services and Firewall Service groups.
- A Firewall Service is like the lines that start with config firewall service custom below and it defines a specific service and its values.
- A Firewall Service Group is group of services and service groups that make up the services allowed. Some Service Groups have nested service groups in them and that is what I am trying to solve.
I have a text file and in the file I have the following lines (example lines. The actual file is hundreds of lines long):
config firewall service group edit "GROUP-1-GRP" set member "svc-name-1" "svc-2" "Serv_3" "GROUP-2-GRP" "TEST1-GRP"
config firewall service group edit "GROUP-2-GRP" set member "svc-name-1" "Serv_3" "SERVICE-4"
config firewall service group edit "TESTING-GRP" set member "SERVICE-7" "SERVICE-6" "SERVICE-5"
config firewall service group edit "TEST1-GRP" set member "svc-name-1" "NESTED-GRP"
config firewall service group edit "NESTED-GRP" set member "SVC-6"
config firewall service custom edit "svc-name-1" set color 1 set udp-portrange 500 4500
config firewall service custom edit "svc-2" set tcp-portrange 5190-5194
config firewall service custom edit "Serv_3" set tcp-portrange 123 set udp-portrange 123
config firewall service custom edit "SERVICE-4" set udp-portrange 26000 27000 27910 27960
config firewall service custom edit "SERVICE-5" set tcp-portrange 3389
config firewall service custom edit "SVC-6" set tcp-portrange 33381
I also have a list of Service Groups and I want to loop through that list and figure out the actual services that are associated to the main service group. This means if it is a service already then I can get those values, but if it is a service group, I have do dig into that group and pull out all services and if there is another nested group then I have to dig into that service group and pull out the services so at the end I can identify which actual services are being used by the base service group.
So for example:
BASE GROUP: GROUP-1-GRP
BASE SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
BASE SERVICE: "svc-2" set tcp-portrange 5190-5194
BASE SERVICE: "Serv_3" set tcp-portrange 123 set udp-portrange 123
NESTED GROUP: "GROUP-2-GRP"
NESTED SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
NESTED NESTED GROUP: "TEST1-GRP"
NESTED NESTED SERVICE: "svc-name-1" set color 1 set udp-portrange 500 4500
NESTED NESTED NESTED GROUP: NESTED-GRP
NESTED NESTED NESTED SERVICE: "SVC-6" set tcp-portrange 33381
So after going through the services and service groups I would say that the actual services being used in GROUP-1-GRP are:
"svc-name-1" set color 1 set udp-portrange 500 4500
"svc-2" set tcp-portrange 5190-5194
"Serv_3" set tcp-portrange 123 set udp-portrange 123
"SVC-6" set tcp-portrange 33381
The reason I need to get down to the actual services for viewing is because I have a Centralized Firewall Manager (CMS) and on it there are a list of services groups, and when I want to bring in a new firewall to the Centralized Manager, it does a comparison of the CMS and the Firewall and tells me if there is a conflict with Service Groups because if the Firewall has a service group named GROUP-1-GRP it may be the same name but is made up of different services than the . GROUP-1-GRP on the CMS. These configurations are old and they are a nightmare because the engineers did not use a good naming standard and that is what I am trying to accomplish. I am going through the configurations of over 300 Firewalls and trying to bring them in to the CMS and the big stumbling block is names that are the same but have different services.
I just don't know how to recurse back into an object if it is a group and then possibly into another group and be able to pull out those values and associate them with the top level service group. Any pointers or maybe different ways of looking at the data would be appreciated.
Thanks in Advance
Wally