...
Use case | Recommended mode |
|---|---|
Verify several independent configuration lines exist in the source | Loose |
Verify the presence and order of configuration commands in the source | Sequential |
Verify an exact configuration block | Strict |
Practical Examples:
Required security commands
Requirement:
Every device must have SSH version 2, password encryption, and a configured NTP server.
Recommended: Loose
The commands are independent requirements; their order is not important.
Interface configuration structure
Requirement:
An interface declaration must be followed somewhere later in the same configuration section by its IP address.
Recommended: Sequential
The order matters, but other interface configuration may appear between the two matches.
Approved configuration template
Requirement:
An interface must contain an exact three-line configuration block with no additional commands between the required lines.
Recommended: Strict
The exact structure is part of the requirement.
Multiple approved alternatives
Requirement:
Devices must use either TACACS+ or RADIUS authentication.
Recommended: Multiple conditions with OR
Each authentication method is represented by a separate condition, and the rule succeeds if either condition matches.
Complete security baseline
Requirement:
Devices must have SSH version 2, a configured TACACS+ server, and HTTP disabled.
Recommended: Multiple conditions with AND
Each individual requirement is evaluated separately, and the rule succeeds only when all requirements are satisfied.