...
The compliance condition examples throughout this article are evaluated against the following theoretical configuration snippet. The example snippet represents only a portion of the device configuration; other configuration sections backup. This is a theoretical example containing only the relevant configuration lines; many config lines that would normally appear in a real backup are omitted for brevity.
| Code Block | ||
|---|---|---|
| ||
hostname R1 ! interface Ethernet1 description Uplink ip address 10.0.0.1 255.255.255.0 no shutdown ! interface Ethernet2 description LAN ip address 192.168.1.1 255.255.255.0 no shutdown ! interface Loopback0 description Management Loopback ip address 10.255.255.1 255.255.255.255 ! router ospf router-id 1.1.1.1 network 10.0.0.0 0.0.0.255 area 0 ! |
...
Both lines match in the source, but the description Management Loopback line appears between them. Strict mode requires the matching lines to be consecutive, so the condition fails.
Choosing the right Match mode
...
Requirement
...
Recommended match mode
...
Required lines can appear anywhere and in any order
...
Loose
...
Required lines must appear in a specific order, but may have other lines between them
...
Sequential
...
Required lines must appear in a specific order with no lines between them
...
Strict
Common use cases:
The following are some example scenarios where each match mode is particularly useful:
...
examples illustrate common configuration validation scenarios and the match mode best suited to each.
| Config to validate | Match mode | Rationale | |||
|---|---|---|---|---|---|
| Baseline configuration and security hardening - NTP servers, AAA, logging...DNS servers, syslog host, password encryption, telnet disabled, HTTP disabled | Loose | Requirements are independent lines scattered across the config, only presence matters | |||
| Security hardening - telnet disabled, no SNMPv2, management ACLs... | Loose | Independent requirements with no meaningful ordering relative to each other | |||
| Firewall and ACL rules | Sequential | Rule ordering matters, such as when specific rules must precede broader rules. | |||
| RouteThe required lines are independent of each other and may appear in different parts of the configuration. Only their presence matters. | |||||
| Firewall and ACL rules, route-maps | Sequential | Match and set clauses The required lines must appear in a required sequencespecific order, while other configuration lines may appear between them. | |||
| Multiline MOTD banner, interface configurations | Strict | The required lines form a complete banner configuration block must be present and uninterrupted | Interface config blocks | Strict | Validate that a required set of interface configuration commands appears together as a consecutive blockand must appear consecutively without any other lines between them. |