1. fw_Oper.acl User documentation!

1.1. Cisco Firewall Access-Lists - How To ?

Use the acl module of fw_oper package to get the necessary changes for the ACL on Cisco Firewall.


Build your own script in order to get the change delta script generated using this package.

High-level steps:

  1. Make a firewall change request excel, csv sheet. read it thru Pandas or other package.

  2. Read thru each add/del request.

  3. Convert request to dictionary format as required by this package.

  4. Execute appropriate request on eligible ACL.

  5. At last get the delta changes.

See Also: Sample Execution Steps!

1.2. High-level Overview

  1. Define inputs

  2. Import package, modules

  3. select firewall, acls, acl Objects

  4. Operate and View acl

1.3. Detailed How To

  1. Define inputs:

    file = 'running-config log captuerd file for fw.log'    # fw log
    new_entry_to_add = {            # acl detail to add
            'acl_type': 'extended',
            'action': 'permit',
            'protocol': 'tcp',
            'source': '',
            'destination': 'host',
            'ports': 'eq 2222',
            'log_warning': True,
            'remark': 'Remark if any',
    old_entry_to_del = {    # acl detail to del
            'action': 'permit',
            'protocol': 'tcp',
            'source': '',
            'destination': 'host',
            'ports': 'eq ssh',
  2. Import necessary package/modules:

    import fwOper as fw
  3. Create Firewall Object:

    with open(file, 'r') as f:
            flst = f.readlines()
    insts = fw.get_object(fw.Instances, conf_list=flst)
    print(insts)                    # set of instances
  4. Refereance to Instance Access-lists (set of ALCs)

    acls = insts['instance_name'].acls
    acls = insts.instance_name.acls
    print(acls)                     # set of acls

    instance_name can be accepted in either bracket or dotted format. Use of bracket format is must if space/special characters involved in instance_name.

  5. Select an ACL from set of ACLS

    acl = acls['acl_name']
    acl = acls.acl_name

    acl_name can be accepted in either bracket or dotted format. Use of bracket format is must if space/special characters involved in acl_name.

  6. Set ACL Numbering enable/disable on given acl:

    acl.sequence = True     # set sequence numbering enabled (default=disable)
  7. Operations on ACL

    1. acl views, properties:

      print(acl)                      # full acl
      print(acl[8:13])                # get range of acl lines
      print(acl.min, acl.max)         # least & maximm acl sequence number.
    2. add:

      acl1 = acl + new_entry_to_add   # append new entry, create a new ACL
      acl += new_entry_to_add         # append new entry, same acl
      print(acl.append(new))          # same as above.
    3. delete:

      acl1 = acl - old_entry_to_del   # create a new ACL by deleting an old entry.
      acl -= old_entry_to_del         # delete an old entry from existing ACL.
      print(acl.delete(old_entry_to_del))  # same as above
      acl1 = acl - 10                 #  delete acl sequence number `10`
      print(acl.delete(10))           # same as above
      del(acl[210:212])               # delete range of lines from acl.
      print(acl.delete(200, 210, 2))  # delete range of lines from acl, with jump step.
      print(acl.removals)             # verify, get - deleted entries
    4. insert:

      print(acl.insert(10, new))      # insert new entry at position (10)
    5. verifications:

      print(old_entry_to_del in acl)  # bool: entry found in acl
      print(acl.contains(old_entry_to_del))# set: of line numbers containing attributes (sparse matche).
      print(acl.exact(old) )          # set: of line numbers matching attributes (exact matches)
    6. comparisions:

      acl1 = acls.another_acl_name    # select another ACL
      print(acl > acl1)               # acl1 entries missing in acl, diff in two acls
      print(acl < acl1)               # acl entries missing in acl1, diff in two acls
      print( acl == acl1 )            # bool: compare two acls / (exact match)
      print(acl.difference(acl1))     # differences: from acl to acl1
      print(acl1.same_elements(acl))  # bool: compare two acl elements == (sparse match)
    7. get delta:

      print(acls.changes("adds"))     # get additions for all ACLs after apply changes
      print(acls.changes("removals")) # get removals for all ACLs after apply changes


Be extra careful on implementatin steps if sequence numbering used.

1.4. Extra Nuggets

  • In delta modification dictionary, source and destinations accepts all three variants of addressing format. And no-mask will consider it as host entry.

    2. host


  • Multiple source and/or destinations can be supplied in sets, as below.
    • ‘source’: {‘’, ‘’, ‘’, ‘’}

    • ‘destination’: {‘’, ‘’, ‘’, ‘’},