1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
.\"
.\" Argus-5.0 Software
.\" Copyright (c) 2000-2024 QoSient, LLC
.\" All rights reserved.
.\"
.\"
.TH RAPOLICY 1 "09 July 2023" "rapolicy 5.0.3"
.SH NAME
\fBrapolicy\fP \- compare a \fBargus(8)\fP data file/stream against a Cisco Access Control List.
.SH SYNOPSIS
.B rapolicy
.B -r
.I argus-file [\fBraoptions\fP] [\fB--\fP \fIfilter-expression\fP]
.SH DESCRIPTION
.IX "rapolicy command" "" "\fLrapolicy\fP \(em argus data"
.LP
.B Rapolicy
reads
.BR argus
data from an \fIargus-file\fP list, and tests the argus data
stream against a Cisco access control list configuration file
.B Rapolicy
can do many things as defined by its configuration file. The configuration
file in not optional and the example below is well commented. The ACL file is
specified in the configuration file.
.SH OPTIONS
\fBRapolicy\fP, like all \fBra\fP based clients, supports a large
number of options. Options that have specific meaning to \fBrapolicy\fP
are:
.nf
-f <rapolicy configuration file> defines the actions of the client.
-D 3 Print the output of the state event machine.
See \fBra(1)\fP for a complete description of \fBra options\fP.
.SH EXAMPLE INVOCATION
.B rapolicy
-f rapolicy.conf
-r argus.file
.nf
.SH CISCO ACL SYNTAX
\fBRapolicy\fP handles both standard and extended, numbered and named
Cisco Access Control Lists
.SH EXAMPLE CONFIGURATION
This example is provided as an example only.
.nf
#
# Argus Software
# Copyright (c) 2000-2024 QoSient, LLC
# All rights reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
#
# Example rapolicy.conf
#
# Rapolicy, like most ra* programs, can read a program specific
# configuration file. This is an example configuration for rapolicy()
# that provides the opportunity to modify the default behavior of
# parsing a Cisco ACL definition, and reporting on flows that match
# aspects of the policy defined by the ACL.
#
# This file is read by rapolicy() from the command line using the
# " -f rapolicy.conf " option.
#
# RA_POLICY_DUMP_POLICY is a debugging aid. If it is set to yes, then rapolicy() will read
# and parse the ACL file and output an English language description of the actions associated
# with each ACL entry. After outputting the explaination, rapolicy will exit.
RA_POLICY_DUMP_POLICY="yes"
# The rapolicy client parses a Cisco IOS ACL and constructs a filter which is used
# to permit or deny flows. Under normal circumstances the packets meeting the
# criteria for a permit rule are output by the client. There are circumstances where
# it is useful to see the flows that are dropped. RA_POLICY_SHOW_WHICH can be set
# to a value of "deny" in these cases.
RA_POLICY_SHOW_WHICH="permit"
# Under normal operating conditions, only the flow records that match a permit
# or a deny rule (depending on the value of RA_POLICY_SHOW_WHICH) are output. In
# some instance like baselining the actions of an ACL, the goal is to have a fully
# labeled set of flows regardless of the ACL's permit or deny determination. In these
# instances, a value of yes for RA_POLICY_JUST_LABEL will allow the full processing of
# the flows and will label them according to the settings of the label flags but all of
# the flows handled by the ACL will be output
RA_POLICY_JUST_LABEL="no"
# A Cisco IP ACL normally has no impact on non-IP traffic eg: ARP, DDCMP, Slotted-Aloha
# RA_POLICY_PERMIT_OTHERS can be set to "yes" for the normal behavior or "no" to block
# non-IP traffic
RA_POLICY_PERMIT_OTHERS="yes"
# The rapolicy client can add a label to a flow indicating the action (permit, deny,
# or implictDeny), the ACL name or number) and the line within the ACL that caused the
# action.
#
# if RA_POLICY_LABEL_LOG is set to "yes" labels will be added to flows matching ACL
# entries that have a log qualifier.
RA_POLICY_LABEL_LOG="no"
# If RA_POLICY_LABEL_ALL is set to "yes" regardless of the value of RA_POLICY_LABEL_LOG,
# any flow that matches an ACL entry will be labeled
RA_POLICY_LABEL_ALL="no"
# Every Cisos IOS ACL has an implicit deny as its last entry. Flows that do not match any
# ACL entry are usually dropped silently. RA_POLICY_LABEL_IMPLICIT will label flows that
# are dropped by the implicit deny rule. Under normal circumstances, these flows are not
# labeled. The values of RA_POLICY_LABEL_ALL and RA_POLICY_LABEL_LOG do not govern the
# labeling of these flows.
RA_POLICY_LABEL_IMPLICIT="no"
# The ACL is contained in a standard ASCII text file which is identified by the value of
# RA_POLICY_ACL_FILE Since rapolicy is not designed to be a syntax checker, it is a
# good idea to create the ACL on a Cisco device and take the output of show running
# (or the appropriate equivalent command) as the input ACL for rapolicy()
# The policy file should be defined as the last item in the rapolicy.conf file
# or there may be unexpected side effects
RA_POLICY_ACL_FILE="/tmp/ACL03.txt"
.fi
.SH COPYRIGHT
Copyright (c) 2000-2024 QoSient. All rights reserved.
.SH AUTHORS
.nf
Carter Bullard (carter@qosient.com).
David Edelman (dwedelman@acm.org)
.fi
.SH SEE ALSO
.BR ra (1),
.BR rarc (5),
.BR argus (8)
|
