...
| Code Block | ||
|---|---|---|
| ||
hostname R1 ! interface Ethernet1 description Uplink ip address 10.0.0.1/24 no shutdown ! interface Ethernet2 description LAN ip address 192.168.1.1/24 no shutdown ! interface Loopback0 description Management Loopback ip address 10.255.255.1 255.255.255.255 ! router ospf router-id 1.1.1.1 network 10.0.0.0/24 area 0 ! |
Note: The Compliance engine can validate MCP automation outputs in addition to device configurations. To validate an automation output, select Source → Mass Config Push Result. The same condition types and matching principles described in this article apply when evaluating automation output.
...
The same three match modes apply when using regex matching condition types. Each regular expression in the input is evaluated against lines in the source, and the match mode governs whether the matches must occur in order and whether intervening unmatched lines are permitted.
...
Loose Mode
...
| Code Block |
|---|
...
Recommended mode
...
Verify several independent configuration lines exist in the source
...
Loose
...
Verify the presence and order of configuration commands in the source
...
Sequential
...
Verify an exact configuration block
...
Strict
Common use cases:
Required security commands
Requirement:
Every device must have SSH version 2, password encryption, and a configured NTP server.
Recommended: Loose
The commands are independent requirements; their order is not important.
Interface configuration structure
Requirement:
An interface declaration must be followed somewhere later in the same configuration section by its IP address.
Recommended: Sequential
The order matters, but other interface configuration may appear between the two matches.
Approved configuration template
Requirement:
An interface must contain an exact three-line configuration block with no additional commands between the required lines.
Recommended: Strict
The exact structure is part of the requirement.
Multiple approved alternatives
Requirement:
Devices must use either TACACS+ or RADIUS authentication.
Recommended: Multiple conditions with OR
Each authentication method is represented by a separate condition, and the rule succeeds if either condition matches.
Complete security baseline
Requirement:
Devices must have SSH version 2, a configured TACACS+ server, and HTTP disabled.
Recommended: Multiple conditions with AND
...
| ||
(?m)^router ospf$
(?m)^hostname R[0-9]+$ |
This verifies that the device follows the R<number> hostname convention and has OSPF enabled. The two matches are independent, so their order does not matter.
Sequential Mode
| Code Block | ||
|---|---|---|
| ||
(?m)^router ospf$
(?m)^ network [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/([0-9]+) area [0-9]+$ |
This verifies that an OSPF configuration section is followed by an OSPF network statement. Other OSPF configuration, such as a router-id, may appear between the matches.
Strict Mode
| Code Block | ||
|---|---|---|
| ||
(?m)^interface Loopback[0-9]+$
(?m)^ description Management Loopback$
(?m)^ ip address 10\.255\.255\.[0-9]+ 255\.255\.255\.255$ |
This verifies that a Loopback interface with a variable interface number has the required "Management Loopback" description and uses a /32 address from the 10.255.255.0/24 management subnet.
Choosing the Right Match Mode
Use case | Recommended mode |
|---|---|
Verify several independent configuration lines exist in the source | Loose |
Verify the presence and order of configuration commands in the source | Sequential |
Verify the presence of a configuration block | Strict |