Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Network Change & Configuration Management

Reply

XML Policy advice using device attributes and a list

[ Edited ]
Adviser
Posts: 9
2761     0

HI all,

I am looking to create an xml policy that compares the running IOS to a list of approved software.

 

I know i can use the list search but i'm not sure how to format the xml appropriately.   I keep getting the following error-

'{http://www.infoblox.com/NetworkAutomation/1.0/ScriptXml}ListSearch': This element is not expected. Expected is ( {http://www.infoblox.com/NetworkAutomation/1.0/ScriptXml}Then ).

 

The basic goal is to get the device model, find the model in the list and return the approved software version and compare that the software version netmri says is running.

 

Latest non working policy-

<PolicyRuleLogic xmlns="http://www.infoblox.com/NetworkAutomation/1.0/ScriptXml" editor="raw-xml">
  <If>
    <Expr field="DeviceModel"/>
    <Then>
      <If>
        <Expr op="and"/>
        <ListSearch list-name="ApprovedSoftware" result-columns="netmri-version" search-columns="model">
          <Expr variable="_match_1"/>
        </ListSearch>
        <Expr op="=">
          <Expr field="Device Version"/>
          <Expr variable="netmri-version"/>
        </Expr>
        <Then>
          <PolicyRulePass/>
        </Then>
        <Else>
          <PolicyRuleFail/>
        </Else>
      </If>
    </Then>
  </If>
</PolicyRuleLogic>

List-

approvedsoftware-list.png

 

Thanks.

Daniel

Re: XML Policy advice using device attributes and a list

Adviser
Posts: 9
2761     0

Solved my own issue and came up with this small xml policy.

 

<PolicyRuleLogic editor="raw-xml" xmlns='http://www.infoblox.com/NetworkAutomation/1.0/ScriptXml'>
  <ListSearch list-name='ApprovedSoftware' result-columns='netmri-version' search-columns='model'>
    <Expr field='model'/>
  </ListSearch>
  <If>
    <Expr op='=='>
      <Expr field='version'/>
      <Expr variable='netmri-version'/>
    </Expr>
    <Then>
      <PolicyRulePass/>
    </Then>
    <Else>
      <PolicyRuleFail>
        <Expr op='concat'>
          <Expr>Software Check Failed.  Please Upgrade/Downgrade to:</Expr>
          <Expr variable='netmri-version'/>
        </Expr>
      </PolicyRuleFail>
    </Else>
  </If>
</PolicyRuleLogic>

Re: XML Policy advice using device attributes and a list

Expert
Posts: 69
2762     0

Thanks for sharing your working solution.

For anyone who has only a few device models to validate, a non-policy method is to create a child device group with membership based on $Version not like "xxxxx".

 

Showing results for 
Search instead for 
Did you mean: 

Recommended for You