Package: ciscoconfparse
ciscoconfparseIntroduction: What is ciscoconfparse?Short answer: ciscoconfparse is aPythonlibrary
that helps you quickly answer questions like these about your
Cisco configurations:What interfaces are shutdown?Which interfaces are in trunk mode?What address and subnet mask is assigned to each interface?Which interfaces are missing a critical command?Is this configuration missing a standard config line?It can help you:Audit existing router / switch / firewall / wlc configurationsModify existing configurationsBuild new configurationsSpeaking generally, the library examines an IOS-style config and breaks
it into a set of linked parent / child relationships. You can perform
complex queries about these relationships.Generic UsageThe following code will parse a configuration stored inexampleswitch.confand select interfaces that are shutdown.In this case, the parent is a line containinginterfaceand
the child is a line containing the wordshutdown.fromciscoconfparseimportCiscoConfParseparse=CiscoConfParse('exampleswitch.conf',syntax='ios')forintf_objinparse.find_parent_objects('^interface','^\s+shutdown'):print("Shutdown: "+intf_obj.text)The next example will find the IP address assigned to interfaces.fromciscoconfparseimportCiscoConfParseparse=CiscoConfParse('exampleswitch.conf',syntax='ios')forccp_objinparse.find_objects('^interface'):intf_name=ccp_obj.re_match_typed('^interface\s+(\S.+?)$')# Search children of all interfaces for a regex match and return# the value matched in regex match group 1.  If there is no match,# return a default value: ''intf_ip_addr=ccp_obj.re_match_iter_typed(r'ip\saddress\s(\d+\.\d+\.\d+\.\d+)\s',result_type=str,group=1,default='')print(f"{intf_name}:{intf_ip_addr}")Cisco IOS Factory UsageCiscoConfParse has a special feature that abstracts common IOS / NXOS / ASA / IOSXR fields; at this time, it is only supported on those configuration types. You will see factory parsing in CiscoConfParse code as parsing the configuration withfactory=True.  A fraction of these pre-parsed Cisco IOS fields follows; some variables are not used below, but simply called out for quick reference.fromciscoconfparseimportIPv4Obj,IPv6ObjfromciscoconfparseimportCiscoConfParse############################################################################### Parse an example Cisco IOS HSRP configuration from:#     tests/fixtures/configs/sample_08.ios## !# interface FastEthernet0/0#  ip address 172.16.2.1 255.255.255.0#  ipv6 dhcp server IPV6_2FL_NORTH_LAN#  ipv6 address fd01:ab00::/64 eui-64#  ipv6 address fe80::1 link-local#  ipv6 enable#  ipv6 ospf 11 area 0#  standby 110 ip 172.16.2.254#  standby 110 ipv6 autoconfig#  standby 110 priority 150#  standby 110 preempt delay minimum 15#  standby 110 track Dialer1 75#  standby 110 track FastEthernet 0/1#  standby 110 track FastEthernet1/0 30#  standby 111 ip 172.16.2.253#  standby 111 priority 150#  standby 111 preempt delay minimum 15#  standby 111 track Dialer1 50###############################################################################parse=CiscoConfParse('tests/fixtures/configs/sample_08.ios',syntax='ios',factory=True)forccp_objinparse.find_objects('^interface'):# Skip if there are no HSRPInterfaceGroup() instances...iflen(ccp_obj.hsrp_interfaces)==0:continue# Interface name, such as 'FastEthernet0/0'intf_name=ccp_obj.name# Interface descriptionintf_description=ccp_obj.description# IPv4Objintf_v4obj=ccp_obj.ipv4_addr_object# IPv4 address object: ipaddress.IPv4Address()intf_v4addr=ccp_obj.ipv4_addr_object.ip# IPv4 netmask object: ipaddress.IPv4Address()intf_v4masklength=ccp_obj.ipv4_addr_object.masklength# set() of IPv4 secondary address/prefixlen stringsintf_v4secondary_networks=ccp_obj.ip_secondary_networks# set() of IPv4 secondary address stringsintf_v4secondary_addresses=ccp_obj.ip_secondary_addresses# List of HSRP IPv4 addrs from the ciscoconfpasre/models_cisco.py HSRPInterfaceGroup()intf_hsrp_addresses=[hsrp_grp.ipforhsrp_grpinccp_obj.hsrp_interfaces]# A bool for using HSRP bia mac-address...intf_hsrp_usebia=any([ii.use_biaforiiinccp_obj.hsrp_interfaces])########################################################################### Print a simple interface summary##########################################################################print("----")print(f"Interface{ccp_obj.interface_object.name}:{intf_v4addr}/{intf_v4masklength}")print(f"  Interface{intf_name}description:{intf_description}")########################################################################### Print HSRP Group interface tracking information##########################################################################print("")print(f"  HSRP tracking for{set([ii.interface_nameforiiinccp_obj.hsrp_interfaces])}")forhsrp_intf_groupinccp_obj.hsrp_interfaces:group=hsrp_intf_group.hsrp_group# hsrp_intf_group.interface_tracking is a list of dictionariesiflen(hsrp_intf_group.interface_tracking)>0:print(f"  --- HSRP Group{group}---")fortrack_intfinhsrp_intf_group.interface_tracking:print(f"    --- Tracking{track_intf.interface}---")print(f"    Tracking interface:{track_intf.interface}")print(f"    Tracking decrement:{track_intf.decrement}")print(f"    Tracking weighting:{track_intf.weighting}")########################################################################### Break out inidividual interface name components#   Example: 'Serial3/4/5.6:7 multipoint'########################################################################### The base ciscoconfparse/ccp_util.py CiscoInterface() instanceintf_cisco_interface=ccp_obj.interface_object# The ciscoconfparse/ccp_util.py CiscoInterface() name, 'Serial3/4/5.6:7 multipoint'intf_name=ccp_obj.interface_object.name# The ciscoconfparse/ccp_util.py CiscoInterface() prefix, 'Serial'intf_prefix=ccp_obj.interface_object.prefix# The ciscoconfparse/ccp_util.py CiscoInterface() digit separator, '/'digit_separator=ccp_obj.interface_object.digit_separatoror""# The ciscoconfparse/ccp_util.py CiscoInterface() slot, 3intf_slot=ccp_obj.interface_object.slotor""# The ciscoconfparse/ccp_util.py CiscoInterface() card, 4intf_card=ccp_obj.interface_object.cardor""# The ciscoconfparse/ccp_util.py CiscoInterface() card, 5intf_port=ccp_obj.interface_object.port# The ciscoconfparse/ccp_util.py CiscoInterface() subinterface, 6intf_subinterface=ccp_obj.interface_object.subinterfaceor""# The ciscoconfparse/ccp_util.py CiscoInterface() channel, 7intf_channel=ccp_obj.interface_object.channelor""# The ciscoconfparse/ccp_util.py CiscoInterface() interface_class, 'multipoint'intf_class=ccp_obj.interface_object.interface_classor""########################################################################### Extract all IPv4Obj() with re_match_iter_typed()##########################################################################_default=Nonefor_objinccp_obj.children:# Get a dict() from re_match_iter_typed() by caling it with 'groupdict'intf_dict=_obj.re_match_iter_typed(# Add a regex match-group called 'v4addr'r"ip\s+address\s+(?P<v4addr>\S.+?\d)\s*(?P<secondary>secondary)*$",# Cast the v4addr regex match group as an IPv4Obj() typegroupdict={"v4addr":IPv4Obj,"secondary":str},# Default to None if there is no regex matchdefault=_default,)intf_ipv4obj=intf_dict["v4addr"]########################################################################### Extract all IPv6Obj() with re_match_iter_typed()##########################################################################_default=Nonefor_objinccp_obj.children:# Get a dict() from re_match_iter_typed() by caling it with 'groupdict'intf_dict=_obj.re_match_iter_typed(# Add regex match-groups called 'v6addr' and an optional 'ipv6type'r"ipv6\s+address\s+(?P<v6addr>\S.+?\d)\s*(?P<v6type>eui.64|link.local)*$",# Cast the v6addr regex match group as an IPv6Obj() typegroupdict={"v6addr":IPv6Obj,"v6type":str},# Default to None if there is no regex matchdefault=_default,)intf_ipv6obj=intf_dict["v6addr"]intf_ipv6type=intf_dict["v6type"]# Skip this object if it has no IPv6 addressifintf_ipv6objis_default:continueWhen that is run, you will see information similar to this...----
Interface FastEthernet0/0: 172.16.2.1/24
  Interface FastEthernet0/0 description: [IPv4 and IPv6 desktop / laptop hosts on 2nd-floor North LAN]

  HSRP Group tracking for {'FastEthernet0/0'}
  --- HSRP Group 110 ---
    --- Tracking Dialer1 ---
    Tracking interface: Dialer1
    Tracking decrement: 75
    Tracking weighting: None
    --- Tracking FastEthernet 0/1 ---
    Tracking interface: FastEthernet 0/1
    Tracking decrement: 10
    Tracking weighting: None
    --- Tracking FastEthernet1/0 ---
    Tracking interface: FastEthernet1/0
    Tracking decrement: 30
    Tracking weighting: None
  --- HSRP Group 111 ---
    --- Tracking Dialer1 ---
    Tracking interface: Dialer1
    Tracking decrement: 50
    Tracking weighting: None
GRP {'addr': <IPv6Obj fd01:ab00::/64>}
RESULT <IOSIntfLine # 231 'FastEthernet0/0' primary_ipv4: '172.16.2.1/24'> <IPv6Obj fd01:ab00::/64>Are there private copies of CiscoConfParse()?Yes.Cisco Systemsmaintains their own copy ofCiscoConfParse(). The terms of the GPLv3
license allow this as long as they don't distribute their modified private copy in
binary form.  Also refer to thisGPLv3 License primer / GPLv3 101.  Officially,modified
copies of CiscoConfParse source-code must also be licensed as GPLv3.DearCisco Systems: please consider porting your improvements back into
thegithub ciscoconfparse repo.Are you releasing licensing besides GPLv3?I will not; however, you can take the solution Cisco does above as long as you comply with the GPLv3 terms.  If it's truly a problem for your company, there are commercial solutions available (to include purchasing the project, or hiring me).What if we don't use Cisco IOS?Don't let that stop you.As of CiscoConfParse 1.2.4, you can parsebrace-delimited configurationsinto a Cisco IOS style (seeGithub Issue #17), which means that CiscoConfParse can parse these configurations:Juniper Networks JunosPalo Alto Networks Firewall configurationsF5 Networks configurationsCiscoConfParse also handles anything that has a Cisco IOS style of configuration, which includes:Cisco IOS, Cisco Nexus, Cisco IOS-XR, Cisco IOS-XE, Aironet OS, Cisco ASA, Cisco CatOSArista EOSBrocadeHP SwitchesForce 10 SwitchesDell PowerConnect SwitchesExtreme NetworksEnterasysScreenosDocsBlogsKirk Byers publisheda ciscoconfparse blog pieceHenry Ölsner publisheda ciscoconfparse blog pieceThe latest copy of the docs arearchived on the webThere is also aCiscoConfParse TutorialInstallation and DownloadsUsepoetryfor Python3.x... :python -m pip install ciscoconfparseIf you're interested in the source, you can always pull from thegithub repo:Download fromthe github repo: :git clone git://github.com/mpenning/ciscoconfparse
  cd ciscoconfparse/
  python -m pip install .Github Star HistoryWhat is the pythonic way of handling script credentials?Never hard-code credentialsUsepython-dotenvIs this a tool, or is it artwork?That depends on who you ask.  Many companies use CiscoConfParse as part of their
network engineering toolbox; others regard it as a form of artwork.Pre-requisitesThe ciscoconfparse python packagerequires Python versions 3.7+ (note: Python version 3.7.0 has a bug - refGithub issue #117, but version 3.7.1 works); the OS should not matter.Other ResourcesDive into Python3is a good way to learn PythonTeam CYMRUhas aSecure IOS Template, which is especially useful for external-facing routers / switchesCisco's Guide to hardening IOS devicesCenter for Internet Security Benchmarks(An email address, cookies, and javascript are required)Bug Tracker and SupportPlease report any suggestions, bug reports, or annoyances with agithub bug report.If you're having problems with general python issues, consider searching for a solution onStack Overflow.  If you can't find a solution for your problem or need more help, you canask on Stack Overfloworreddit/r/Python.If you're having problems with your Cisco devices, you can contact:Cisco TACreddit/r/Ciscoreddit/r/networkingNetworkEngineering.seDependenciesPython 3passlibtomldnspythonlogurudeprecatedUnit-Tests and DevelopmentWe are manually disabling someSonarCloudalerts with:#pragma warning disable S1313#pragma warning restore S1313WhereS1313is a False-positive thatSonarCloudflags inCiscoConfParse.Those#pragma warninglines should be carefully-fenced to ensure that we don't disable aSonarCloudalert that is useful.Semantic Versioning and Conventional CommitsAt this point,CiscoConfParsedoes NOT adhere toSemantic VersioningAlthough we addedcommitizenas a dev dependency, we are NOT enforcing commit rules (such asConventional Commits) yet.Execute Unit testsThe project'stest workflowchecks ciscoconfparse on Python versions 3.7 and higher, as well as apypy JITexecutable.If you already git cloned the repo and want to manually run tests either run withmake testfrom the base directory, or manually run withpytestin a unix-like system...$cdtests
$pytest-vvs./test_*py
...Execute Miss ReportIf you already have havepytestandpytest-covinstalled, run a test line miss report as shown below.$cdtests
$pytest--cov-report=term-missing--cov=ciscoconfparse./
...Editing the PackageThis uses the example of editing the package on a git branch calleddevelop...git clone https://github.com/mpenning/ciscoconfparsecd ciscoconfparsegit branch developgit checkout developAdd / modify / delete on thedevelopbranchmake testIf tests run clean,git commitall the pending changes on thedevelopbranchIf you plan to publish this as an official version rev, edit the version number inpyproject.toml.  In the future, we want to integratecommitizento manage versioning.git checkout maingit merge developmake testgit push origin mainmake pypiSphinx DocumentationBuilding the ciscoconfparse documentation tarball comes down to this one wierd trick:cd sphinx-doc/pip install -r ./requirements.txt;  # install Sphinx dependenciespip install -r ../requirements.txt; # install ccp dependenciesmake htmlLicense and Copyrightciscoconfparseis licensedGPLv3Copyright (C) 2022-2023 David Michael PenningtonCopyright (C) 2022 David Michael Pennington at WellSkyCopyright (C) 2022 David Michael PenningtonCopyright (C) 2019-2021 David Michael Pennington at Cisco Systems / ThousandEyesCopyright (C) 2012-2019 David Michael Pennington at Samsung Data ServicesCopyright (C) 2011-2012 David Michael Pennington at Dell Computer CorpCopyright (C) 2007-2011 David Michael PenningtonThe word "Cisco" is a registered trademark ofCisco Systems.Authorciscoconfparsewas written byDavid Michael Pennington(mike [~at~] pennington [.dot.] net).Interesting Users (and some downstream projects)The following are featuredCiscoConfParseusers / projects:saltsuzieq:  SuzieQ collects, normalizes, and stores timestamped data that is otherwise only available to engineers by logging into each device, providing a rich data lake that can be queried and leveraged for next generation monitoring and alertingnetwalk: Python library to discover, parse, analyze and change Cisco switched networksnetlintcisco_switchport_auditor: Parses Cisco switch configuration into Switch & Interface objects to access configuration details of the aforementioned in a programatic manner. Works with SSH, RESTCONF, or with running/start-up config files.nipper-ng: a network security analyzerpynipper-ng: a network security analyzerbuild_fabric: Build a declarative Cisco NXOS leaf and spine fabric using Ansiblejunos-ansiblefaddrNetOpsNorniradala: Extract useful information about your Cisco networkxlina:organize_acls.py: Extract and organize access-list configurations and organizes associated objects and object-groups.organize_anyconnect.py: Extract and organize Anyconnect profiles and associated group policies, auth servers, access-lists, etcorganize_static_nats.py: Extract and organize static nat configurations and associated objects and object-groupsorganize_auto_nat.py: Extract and organize auto nat configurations with associated objectsorganize_crypto_maps.py: Extract and organize crypto map configurations and associated access-lists, transform-sets, tunnel-groups, etcCatalyst_2_Meraki_Config_Checker: Check the Cisco Catalyst configuration text file and verify if they are supported by the Meraki MS platform.parse_nxos_config: Generates an Excel file with the information gathered from running-config file from Cisco NXOSNornir3_CDP_map: Set interface descriptions by looking at the hostname of its CDP neighbordevicebanner: Update the banner message of the day on network devicesiosconfigslicer: Simple script to slice Cisco configuration file, and replicate sections of the config via SSH to another deviceciscocfg: a simple RPCd for ciscoconfparseconfParser: SSH with paramiko, and dump information about your configs into sqllite3 / Excelparse_config: Dump information about your Vlans / VRFs to excelFinally,Cisco SystemsProduct Engineering and Advanced ServicesOther Useful Network Management Projectsnetbox: NetBox is the source of truth for everything on your network, from physical components like power systems and cabling to virtual assets like IP addresses and VLANsntc-netbox-plugin-onboarding: A plugin for NetBox to easily onboard new devices.nautobot: Network Source of Truth & Network Automation Platform.nornir: Network Automation via Plugins - A pluggable multi-threaded framework with inventory management to help operate collections of devicesnetwork-importer: The network importer is a tool/library to analyze and/or synchronize an existing network with a Network Source of Truth (SOT), it's designed to be idempotent and by default it's only showing the difference between the running network and the remote SOT.nuts: NUTS defines a desired network state and checks it against a real network using pytest and nornir.jerikan:nettowel: Collection of useful network automation functionsnapalm-panosTacquito: A go TACACS+ implementationassessment-cmds: Useful show commands to check your Cisco router's healthlearn-to-cloud: Primer for Cloud-computing fundamentals