NAPALM get_firewall_policies support

[Architect333]

Hi Team!

Not really sure if this is the right way to start :)

Working on a network automation project with Juniper vSRX firewalls. One of the tasks I'm working on is to get firewall policies.

As per https://napalm.readthedocs.io/en/latest/support/, looks like this is a pending item for all platforms..

Just came up with a very simple version 0.1 extending JunOSDriver as follows:

### junos.py ###
from napalm.junos.junos import JunOSDriver

class CustomJunOSDriver(JunOSDriver):
    
    """EXTENDING NAPALM JunOS HANDLER TO PARSE FIREWALL POLICIES"""
    
    def get_firewall_policies(self):
        commands = ['show security policies']
        output = self.cli(commands)

        return_vars = {}
        policy_index = 1
        
        for line in output['show security policies'].splitlines():

            if 'From zone' in line:
                from_zone = line.split(",")[0].split(": ")[1].strip()
                to_zone = line.split(",")[1].split(": ")[1].strip()
            elif 'Policy' in line:
                policy = line.split(",")[0].split(": ")[1].strip()
            elif 'Source addresses' in line:
                source = line.split(":")[1].strip()
            elif 'Destination addresses' in line:
                destination = line.split(":")[1].strip()
            elif 'Applications' in line:
                application = line.split(":")[1].strip()
            elif 'Action' in line:
                if 'log' in line:
                    action = line.split(":")[1].split(",")[0].strip()
                    log = 'Yes'
                else:
                    action = line.split(":")[1].strip()
                    log = 'No'
                
                return_vars[policy_index] = {
                    'From Zone': from_zone,
                    'To Zone': to_zone,
                    'Policy Name': policy,
                    'Source': source,
                    'Destination': destination,
                    'Applications': application,
                    'Action': action,
                    'Log Enabled': log
                    }
                policy_index += 1
    
        return return_vars

To launch:

### ibnrisen_nr.py ###
from nornir import InitNornir
from nornir_napalm.plugins.tasks import napalm_get
from nornir_utils.plugins.functions import print_result

nr = InitNornir(config_file="nr_config.yaml")

def get_firewall_policies():
    policies_xls = nr.run(task=napalm_get, getters=['firewall_policies'])
    print_result(policies_xls)

if __name__ == '__main__':
    get_firewall_policies()

Sample output:

architect@architect-Virtual-Machine:~/Documents/ibnraisen_nr$ /bin/python3 /home/architect/Documents/ibnraisen_nr/ibnrisen_nr.py napalm_get**********************************************************************

• vSRX-Firewall ** changed : False ********************************************* vvvv napalm_get ** changed : False vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv INFO { 'firewall_policies': { 1: { 'Action': 'permit', 'Applications': 'any', 'Destination': 'any', 'From Zone': 'trust', 'Log Enabled': 'No', 'Policy Name': 'default-permit', 'Source': 'any', 'To Zone': 'trust'}, 2: { 'Action': 'permit', 'Applications': 'any', 'Destination': 'any', 'From Zone': 'trust', 'Log Enabled': 'No', 'Policy Name': 'default-permit', 'Source': 'any', 'To Zone': 'untrust'}, 3: { 'Action': 'deny', 'Applications': 'any', 'Destination': 'any', 'From Zone': 'ABC', 'Log Enabled': 'Yes', 'Policy Name': 'P1', 'Source': 'any', 'To Zone': 'XYZ'}, 4: { 'Action': 'deny', 'Applications': 'any', 'Destination': 'any', 'From Zone': 'CDF', 'Log Enabled': 'Yes', 'Policy Name': 'P2', 'Source': 'any', 'To Zone': 'JKH'}, 5: { 'Action': 'deny', 'Applications': 'APP1, APP22', 'Destination': 'D1', 'From Zone': 'ABC', 'Log Enabled': 'Yes', 'Policy Name': 'NAME1', 'Source': 'S1', 'To Zone': 'JKH'}}} ^^^^ END napalm_get ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ """

Any of this makes sense to you as a potential contribution??

Thanks!

Agustin

AGUSTIN CICILIANI Network Solutions Consultant CCIE #52116 | DevNet | Data Center | Python Email: [email protected] Mobile: +54 9 11 4969 3761