Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #82306 > unrolled thread

Python Script to convert firewall rules

Started byKashif Rana <kashifrana84@gmail.com>
First post2014-12-10 10:51 -0800
Last post2014-12-14 22:07 -0700
Articles 8 — 2 participants

Back to article view | Back to comp.lang.python

Contents

  Python Script to convert firewall rules Kashif Rana <kashifrana84@gmail.com> - 2014-12-10 10:51 -0800
    Re: Python Script to convert firewall rules Jason Friedman <jsf80238@gmail.com> - 2014-12-11 18:44 -0700
      Re: Python Script to convert firewall rules Kashif Rana <kashifrana84@gmail.com> - 2014-12-11 23:54 -0800
        Re: Python Script to convert firewall rules Jason Friedman <jsf80238@gmail.com> - 2014-12-12 19:31 -0700
          Re: Python Script to convert firewall rules Kashif Rana <kashifrana84@gmail.com> - 2014-12-13 09:41 -0800
            Re: Python Script to convert firewall rules Jason Friedman <jsf80238@gmail.com> - 2014-12-13 18:35 -0700
            Re: Python Script to convert firewall rules Kashif Rana <kashifrana84@gmail.com> - 2014-12-14 10:51 +0400
            Re: Python Script to convert firewall rules Jason Friedman <jsf80238@gmail.com> - 2014-12-14 22:07 -0700

#82306 — Python Script to convert firewall rules

FromKashif Rana <kashifrana84@gmail.com>
Date2014-12-10 10:51 -0800
SubjectPython Script to convert firewall rules
Message-ID<b23872cc-7b5c-4e38-96c1-ac907b6df7f1@googlegroups.com>
Hello Experts

I am network engineer and not expert in programming. I would like to make one python script to convert juniper netscreen firewall configuration into juniper SRX firewall configuration. Sample is below. I would appreciate if anybody can give me the high level steps to start with.

Juniper Netscreen
--------------------
set interface ethernet0/0 ip 194.1.1.1/24
set interface ethernet0/0 route
set interface "ethernet0/0" zone "Untrust"


set interface ethernet2/5 ip 10.17.10.1/24
set interface ethernet2/5 route
set interface "ethernet2/5" zone "Mail DMZ"

 

set interface "ethernet0/0" mip 194.1.1.10 host 10.17.10.10 netmask 255.255.255.255 vr "trust-vr"
set interface "ethernet0/0" mip 194.1.1.20 host 10.17.10.20 netmask 255.255.255.255 vr "trust-vr"

set address "Mail DMZ" "mx1.union.com" 10.17.10.10 255.255.255.255
set address "Mail DMZ" "mx2.union.com" 10.17.10.20 255.255.255.255

set policy id 100 name "CR4444567" from "Untrust" to "DMZ"  "Any" "MIP(194.1.1.10)" "SMTP" permit log
set policy id 100
set dst-address "MIP(194.1.1.20)"
set log session-init
exit

Juniper SRX
----------
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address 194.1.1.1/24;
            }
        }
    }
    ge-2/0/5 {
        unit 0 {
            family inet {
                address 10.17.10.1/24;
            }
        }
    }
}
security {
    nat {
        static {
            rule-set static-nat-"Untrust" {
                from zone "Untrust";
                rule rule-1 {
                    match {
                        destination-address 194.1.1.10/32;
                    }
                    then {
                        static-nat prefix 10.17.10.10/32;
                    }
                }
		rule rule-2 {
                    match {
                        destination-address 194.1.1.20/32;
                    }
                    then {
                        static-nat prefix 10.17.10.20/32;
                    }
                }
            }
        }
        proxy-arp {
            interface ge-0/0/0.0 {
                address {
                    194.1.1.10/32;
		    194.1.1.20/32;
                }
            }
        }
    }
    zones {
        security-zone Untrust {
            interfaces {
                ge-0/0/0.0;
            }
        }
        security-zone DMZ {
            address-book {
                address mx1.union.com  10.17.10.10/32;
                address mx2.union.com  10.17.10.20/32;
            }
            interfaces {
                ge-2/0/5.0;
            }
        }
    }
    policies {
        from-zone Untrust to-zone DMZ {
            /* "CR4444567" */
            policy 100 {
                match {
                    source-address any;
                    destination-address [ mx1.union.com mx2.union.com ];
                    application junos-smtp;
                }
                then {
                    permit;
                    log {
                        session-init;
                    }
                }
            }
        }
    }
}

[toc] | [next] | [standalone]

#82400

FromJason Friedman <jsf80238@gmail.com>
Date2014-12-11 18:44 -0700
Message-ID<mailman.16883.1418348704.18130.python-list@python.org>
In reply to#82306

[Multipart message — attachments visible in raw view] — view raw

> I am network engineer and not expert in programming. I would like to make
> one python script to convert juniper netscreen firewall configuration into
> juniper SRX firewall configuration.
>

Looks pretty tricky, do you have a specification for each format containing
all the possible keywords/values?

If you could describe the logic in English then writing the equivalent in
Python would be straightforward for many people on this list.

[toc] | [prev] | [next] | [standalone]

#82420

FromKashif Rana <kashifrana84@gmail.com>
Date2014-12-11 23:54 -0800
Message-ID<e0d8dd24-2256-4b89-972e-c1ebe82f72a9@googlegroups.com>
In reply to#82400
Hi Jason

Thanks for the reply. Yes I can make the all possible keywords/values for both formate. But after that what gonna be the logic to convert one format to other format. Like to convert one line below are the keywords:

set interface ethernet2/5 ip 10.17.10.1/24 (format 1)
set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24 (format 2)

(set, interface, ip) = (set, interfaces, family inet address)

But some values are variable and should ask the user to convert manually like ethernet2/5 equal to ge-0/0/0 or ge-0/0/1 or ge-0/0/2

And some values keep as it is like 10.17.10.1/24 

Also then format 2 can be converted int o format 3 (as below) for more readability of format 2. This is just optional. 

interfaces {  
    ge-2/0/5 { 
        unit 0 { 
            family inet { 
                address 10.17.10.1/24; 
            } 
        } 
    } 
}

On Friday, December 12, 2014 5:45:20 AM UTC+4, Jason Friedman wrote:
> I am network engineer and not expert in programming. I would like to make one python script to convert juniper netscreen firewall configuration into juniper SRX firewall configuration.
> 
> 
> 
> Looks pretty tricky, do you have a specification for each format containing all the possible keywords/values?
> 
> 
> If you could describe the logic in English then writing the equivalent in Python would be straightforward for many people on this list.

[toc] | [prev] | [next] | [standalone]

#82471

FromJason Friedman <jsf80238@gmail.com>
Date2014-12-12 19:31 -0700
Message-ID<mailman.16931.1418437882.18130.python-list@python.org>
In reply to#82420

[Multipart message — attachments visible in raw view] — view raw

>
>
> Thanks for the reply. Yes I can make the all possible keywords/values for
> both formate. But after that what gonna be the logic to convert one format
> to other format. Like to convert one line below are the keywords:
>
> set interface ethernet2/5 ip 10.17.10.1/24 (format 1)
> set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24 (format
> 2)
>
> (set, interface, ip) = (set, interfaces, family inet address)
>
> But some values are variable and should ask the user to convert manually
> like ethernet2/5 equal to ge-0/0/0 or ge-0/0/1 or ge-0/0/2
>
> And some values keep as it is like 10.17.10.1/24
>
> Also then format 2 can be converted int o format 3 (as below) for more
> readability of format 2. This is just optional.
>
> interfaces {
>     ge-2/0/5 {
>         unit 0 {
>             family inet {
>                 address 10.17.10.1/24;
>             }
>         }
>     }
> }
>
>
Note that the practice on this list is to put your response after the
(edited) portion of the previous posts.

Are you willing to learn some Python, if someone gets you started?
Would it be helpful if someone provided Python code to convert this:

set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24

to this:

interfaces {
    ge-2/0/5 {
        unit 0 {
            family inet {
                address 10.17.10.1/24;
            }
        }
    }
}

?

[toc] | [prev] | [next] | [standalone]

#82486

FromKashif Rana <kashifrana84@gmail.com>
Date2014-12-13 09:41 -0800
Message-ID<c89c75f8-190d-4678-b575-b92db5c38983@googlegroups.com>
In reply to#82471
On Saturday, December 13, 2014 6:31:34 AM UTC+4, Jason Friedman wrote:
> Thanks for the reply. Yes I can make the all possible keywords/values for both formate. But after that what gonna be the logic to convert one format to other format. Like to convert one line below are the keywords:
> 
> 
> 
> set interface ethernet2/5 ip 10.17.10.1/24 (format 1)
> 
> set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24 (format 2)
> 
> 
> 
> (set, interface, ip) = (set, interfaces, family inet address)
> 
> 
> 
> But some values are variable and should ask the user to convert manually like ethernet2/5 equal to ge-0/0/0 or ge-0/0/1 or ge-0/0/2
> 
> 
> 
> And some values keep as it is like 10.17.10.1/24
> 
> 
> 
> Also then format 2 can be converted int o format 3 (as below) for more readability of format 2. This is just optional.
> 
> 
> 
> interfaces {
> 
>     ge-2/0/5 {
> 
>         unit 0 {
> 
>             family inet {
> 
>                 address 10.17.10.1/24;
> 
>             }
> 
>         }
> 
>     }
> 
> }
> 
> 
> 
> 
> Note that the practice on this list is to put your response after the (edited) portion of the previous posts.
> 
> 
> Are you willing to learn some Python, if someone gets you started?
> 
> Would it be helpful if someone provided Python code to convert this:
> 
> set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24
> 
> 
> to this:
> 
> 
> interfaces {
> 
>     ge-2/0/5 {
> 
>         unit 0 {
> 
>             family inet {
> 
>                 address 10.17.10.1/24;
> 
>             }
> 
>         }
> 
>     }
> 
> }
> 
> 
> ?

Hello

Thanks for the reply. I am learning python using CBT nuggets for python. But If you can refer me some good course, that should be practical then it would be great. 

For my requirement, if you can give me the best approach to start with or high level steps or give me some sample cod, I really appreciate that.

Regards,

Kashif

[toc] | [prev] | [next] | [standalone]

#82492

FromJason Friedman <jsf80238@gmail.com>
Date2014-12-13 18:35 -0700
Message-ID<mailman.16939.1418520955.18130.python-list@python.org>
In reply to#82486
> Thanks for the reply. I am learning python using CBT nuggets for python. But If you can refer me some good course, that should be practical then it would be great.
>
> For my requirement, if you can give me the best approach to start with or high level steps or give me some sample cod, I really appreciate that.
>
Good, some other sources for learning:
https://docs.python.org/3/tutorial/
http://learnpythonthehardway.org/

Here's some code to get you started  (version 3.4.0):

"""
convert

set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24

to

interfaces {
    ge-2/0/5 {
        unit 0 {
            family inet {
                address 10.17.10.1/24;
            }
        }
    }
}
"""

class interface():
    attribute_name_list = ("ge", "unit", "family", "address")
    def __init__(self, ge, unit, family, address):
        self.ge = ge
        self.unit = unit
        self.family = family
        self.address = address

def convert(interface_list, indent=4):
    indentation = 0
    return_list = list()
    return_list.append(" " * indentation + "interfaces {")
    for interface in interface_list:
        for attribute_name in interface.attribute_name_list:
            indentation += indent
            text = "%s %s {" % (attribute_name, getattr(interface,
attribute_name))
            return_list.append(" " * indentation + text)
        while indentation > indent:
            indentation -= indent
            return_list.append(" " * indentation + "}")
        indentation -= indent
    return_list.append("}")
    return "\n".join(return_list)

if __name__ == "__main__":
    interface1 = interface("0/0/0", "0", "inet", "10.17.10.1/24")
    interface2 = interface("2/0/5", "0", "inet", "11.18.10.1/24")
    print(convert((interface1, interface2, )))

[toc] | [prev] | [next] | [standalone]

#82493

FromKashif Rana <kashifrana84@gmail.com>
Date2014-12-14 10:51 +0400
Message-ID<mailman.16940.1418539876.18130.python-list@python.org>
In reply to#82486

[Multipart message — attachments visible in raw view] — view raw

Hi Jason

Thank you very much. Appreciated ! But the first requirement was to convert
format1 to format2 as below:

set interface ethernet2/5 ip 10.17.10.1/24 (format 1)
set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24 (format 2)
(set, interface, ip) = (set, interfaces, family inet address)
But some values are variable and should ask the user to convert manually
like ethernet2/5 equal to ge-0/0/0 or ge-0/0/1 or ge-0/0/2
And some values keep as it is like 10.17.10.1/24

Thanks and Regards,

Kashif
On Sun, Dec 14, 2014 at 5:35 AM, Jason Friedman <jsf80238@gmail.com> wrote:
>
> > Thanks for the reply. I am learning python using CBT nuggets for python.
> But If you can refer me some good course, that should be practical then it
> would be great.
> >
> > For my requirement, if you can give me the best approach to start with
> or high level steps or give me some sample cod, I really appreciate that.
> >
> Good, some other sources for learning:
> https://docs.python.org/3/tutorial/
> http://learnpythonthehardway.org/
>
> Here's some code to get you started  (version 3.4.0):
>
> """
> convert
>
> set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24
>
> to
>
> interfaces {
>     ge-2/0/5 {
>         unit 0 {
>             family inet {
>                 address 10.17.10.1/24;
>             }
>         }
>     }
> }
> """
>
> class interface():
>     attribute_name_list = ("ge", "unit", "family", "address")
>     def __init__(self, ge, unit, family, address):
>         self.ge = ge
>         self.unit = unit
>         self.family = family
>         self.address = address
>
> def convert(interface_list, indent=4):
>     indentation = 0
>     return_list = list()
>     return_list.append(" " * indentation + "interfaces {")
>     for interface in interface_list:
>         for attribute_name in interface.attribute_name_list:
>             indentation += indent
>             text = "%s %s {" % (attribute_name, getattr(interface,
> attribute_name))
>             return_list.append(" " * indentation + text)
>         while indentation > indent:
>             indentation -= indent
>             return_list.append(" " * indentation + "}")
>         indentation -= indent
>     return_list.append("}")
>     return "\n".join(return_list)
>
> if __name__ == "__main__":
>     interface1 = interface("0/0/0", "0", "inet", "10.17.10.1/24")
>     interface2 = interface("2/0/5", "0", "inet", "11.18.10.1/24")
>     print(convert((interface1, interface2, )))
>

[toc] | [prev] | [next] | [standalone]

#82545

FromJason Friedman <jsf80238@gmail.com>
Date2014-12-14 22:07 -0700
Message-ID<mailman.16968.1418620081.18130.python-list@python.org>
In reply to#82486
> Thank you very much. Appreciated ! But the first requirement was to convert
> format1 to format2 as below:
>
> set interface ethernet2/5 ip 10.17.10.1/24 (format 1)
> set interfaces ge-0/0/0 unit 0 family inet address 10.17.10.1/24 (format 2)
> (set, interface, ip) = (set, interfaces, family inet address)
> But some values are variable and should ask the user to convert manually
> like ethernet2/5 equal to ge-0/0/0 or ge-0/0/1 or ge-0/0/2
> And some values keep as it is like 10.17.10.1/24

Kashif, perhaps you should contact me off list, this subject is
becoming very particular and maybe not of interest to the general
audience.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.python

csiph-web