
关于
路由器和交换机配置的部署前检查,包括危险命令、重复地址、子网重叠、过期引用、管理面风险和 IOS 风格安全规范。
name: network-config-validation description: 路由器和交换机配置的部署前检查,包括危险命令、重复地址、子网重叠、过期引用、管理平面风险和 IOS 风格安全检查。 origin: community
网络配置验证
使用此技能在变更窗口之前或自动化运行接触生产设备之前审查网络配置。
适用场景
- 部署前审查 Cisco IOS 或 IOS-XE 风格的配置片段。
- 审计脚本或模板生成的配置。
- 查找危险命令、重复 IP 地址或子网重叠。
- 检查 ACL、route-map、prefix-list 或 line 策略是否被引用但未定义。
- 为网络自动化构建轻量级预检脚本。
工作原理
将配置验证视为分层证据,而非完整解析器。正则检查对预检警告有用,但最终批准仍需网络工程师审查意图、平台语法和回滚步骤。
按以下顺序验证:
- 破坏性命令。
- 凭证和管理平面暴露。
- 重复地址和重叠子网。
- ACL、route-map、prefix-list 和接口的过期引用。
- 操作规范如 NTP、时间戳、远程日志和横幅。
危险命令检测
import re
DANGEROUS_PATTERNS: list[tuple[re.Pattern[str], str]] = [
(re.compile(r"\breload\b", re.I), "reload causes downtime"),
(re.compile(r"\berase\s+(startup|nvram|flash)", re.I), "erases persistent storage"),
(re.compile(r"\bformat\b", re.I), "formats a device filesystem"),
(re.compile(r"\bno\s+router\s+(bgp|ospf|eigrp)\b", re.I), "removes a routing process"),
(re.compile(r"\bno\s+interface\s+\S+", re.I), "removes interface configuration"),
(re.compile(r"\baaa\s+new-model\b", re.I), "changes authentication behavior"),
(re.compile(r"\bcrypto\s+key\s+(zeroize|generate)\b", re.I), "changes device SSH keys"),
]
def find_dangerous_commands(lines: list[str]) -> list[dict[str, str | int]]:
findings = []
for line_number, line in enumerate(lines, start=1):
stripped = line.strip()
for pattern, reason in DANGEROUS_PATTERNS:
if pattern.search(stripped):
findings.append({
"line": line_number,
"command": stripped,
"reason": reason,
})
return findings
重复 IP 和子网重叠
import ipaddress
import re
from collections import Counter
IP_ADDRESS_RE = re.compile(
r"^\s*ip address\s+"
r"(?P<ip>\d{1,3}(?:\.\d{1,3}){3})\s+"
r"(?P<mask>\d{1,3}(?:\.\d{1,3}){3})\b",
re.I | re.M,
)
def extract_interfaces(config: str) -> list[dict[str, str]]:
results = []
current = None
for line in config.splitlines():
if line.startswith("interface "):
current = line.split(maxsplit=1)[1]
continue
match = IP_ADDRESS_RE.match(line)
if current and match:
ip = match.group("ip")
mask = match.group("mask")
network = ipaddress.ip_interface(f"{ip}/{mask}").network
results.append({"interface": current, "ip": ip, "network": str(network)})
return results
def find_duplicate_ips(config: str) -> list[str]:
ips = [entry["ip"] for entry in extract_interfaces(config)]
counts = Counter(ips)
return sorted(ip for ip, count in counts.items() if count > 1)
def find_subnet_overlaps(config: str) -> list[tuple[str, str]]:
networks = [ipaddress.ip_network(entry["network"]) for entry in extract_interfaces(config)]
overlaps = []
for index, left in enumerate(networks):
for right in networks[index + 1:]:
if left.overlaps(right):
overlaps.append((str(left), str(right)))
return overlaps
管理平面检查
按区段解析 VTY 块,使 access-class 检查不会溢出到无关行。
import re
def iter_blocks(config: str, starts_with: str) -> list[str]:
blocks = []
current: list[str] = []
for line in config.splitlines():
if line.startswith(starts_with):
if current:
blocks.append("\n".join(current))
current = [line]
continue
if current:
if line and not line.startswith(" "):
blocks.append("\n".join(current))
current = []
else:
current.append(line)
if current:
blocks.append("\n".join(current))
return blocks
def check_vty_blocks(config: str) -> list[str]:
issues = []
for block in iter_blocks(config, "line vty"):
if re.search(r"transport\s+input\s+.*telnet", block, re.I):
issues.append("VTY 允许 Telnet;应仅要求 SSH。")
if not re.search(r"\baccess-class\s+\S+\s+in\b", block, re.I):
issues.append("VTY 缺少入站 access-class。")
return issues
兼容工具
Claude CodeCursor
标签
运维部署

