Note: This feature is currently in beta and is available only to early adopters.

All  Compliance Condition types support three match modes:

• Loose

• Sequential

• Strict

Match mode determines how the order and consecutiveness of input lines in the source affect condition evaluation.

Reference Source:

The examples throughout this article use the following device configuration:

hostname R1
 
interface Ethernet1
 description Uplink
 ip address 10.0.0.1/24
 
interface Ethernet2
 description LAN
 ip address 192.168.1.1/24
 
router ospf
 network 10.0.0.0/24 area 0

Note: The Compliance engine can validate MCP automation outputs in addition to device configurations. To validate an automation output, select Source → Mass Config Push Result. The same condition types and matching principles described in this article apply when evaluating automation output.

Text matching condition types:

Loose Mode

Loose mode verifies that all input lines exist somewhere in the source. Their order is ignored, and any content may appear between matching lines in the source.

Example Input 1:

 description LAN
hostname R1

Result: Condition successful

Although the order of the input lines differs from the source, both lines are present.

Example Input 2:

hostname R1
 description WAN

Result: Condition failed

The line description WAN does not exist in the source.

Sequential Mode

Sequential mode requires all input lines to appear in the source in the same order as entered. Additional text/lines may appear between them.

Example Input 1:

interface Ethernet1
 ip address 10.0.0.1/24

Result: Condition successful

Both input lines appear in the source in the correct order. The "description Uplink" line between them is ignored.

Example Input 2:

 ip address 10.0.0.1/24
interface Ethernet1

Result: Condition failed

The input lines appear in the source in reverse order.

Strict Mode

Strict mode requires input lines to appear consecutively in the source. No additional text/lines may exist between the matching lines in the source.

Example Input 1:

interface Ethernet1
 description Uplink
 ip address 10.0.0.1/24

Result: Condition successful

All three lines appear consecutively in the source.

Example Input 2:

interface Ethernet1
 ip address 10.0.0.1/24

Result: Condition failed

The source contains the line "description Uplink" between the two input lines. Strict mode therefore fails.

Regex matching condition types:

The same three match modes apply when using regex matching condition types. Each regular expression in the input is evaluated against lines in the source, and the match mode governs whether the matches must occur in order and whether intervening unmatched lines are permitted.

Choosing the Right Match Mode

Common use cases:

 Required security commands

Requirement:

Every device must have SSH version 2, password encryption, and a configured NTP server.

Recommended: Loose

The commands are independent requirements; their order is not important.

 Interface configuration structure

Requirement:

An interface declaration must be followed somewhere later in the same configuration section by its IP address.

Recommended: Sequential

The order matters, but other interface configuration may appear between the two matches.

 Approved configuration template

Requirement:

An interface must contain an exact three-line configuration block with no additional commands between the required lines.

Recommended: Strict

The exact structure is part of the requirement.

 Multiple approved alternatives

Requirement:

Devices must use either TACACS+ or RADIUS authentication.

Recommended: Multiple conditions with OR

Each authentication method is represented by a separate condition, and the rule succeeds if either condition matches.

 Complete security baseline

Requirement:

Devices must have SSH version 2, a configured TACACS+ server, and HTTP disabled.

Recommended: Multiple conditions with AND

Each individual requirement is evaluated separately, and the rule succeeds only when all requirements are satisfied.