NAME

netspoc - network security policy compiler


SYNOPSIS

netspoc [options] input-dir [output-dir]

netspoc [options] input-file [output-dir]


DESCRIPTION

The network security compiler takes a policy description recursively from all files in input-dir and places one file for each managed device into output-dir. Alternatively input may be read from a single input-file; this is mainly used for small examples or testing. Input is read from STDIN if input-file is equal to -. If output-dir is missing, all output is written to STDOUT.


OPTIONS

The following options are recognized. Some can be negated (prefixed with ``no'') which is specially useful when the default is ``true''.

--verbose, --quiet

Controls whether netspoc shows output about different compiler phases and statistics on standard error.

--[no]comment_acls

Add a comment line before each generated ACL entry. Comments use names of network objects as defined in the topology.

--[no]comment_routes

Add a comment line before each generated routing entry. Comments use names of network objects as defined in the topology.

--allow_unused_groups yes|no|warn

Handling of unused groups and service groups.

--check_unenforceable_rules yes|no|warn

Controls behavior for rules with no managed device on the path from source to destination.

--strict_subnets yes|no|warn

Allow subnets only if the enclosing network is declared as 'route_hint' or if the subnet is declared as 'subnet_of'. If set to 'warn', netspoc only warns about undeclared subnet relations.

--[no]auto_default_route

Optimize the number of routing entries per router:

For each router find the hop, where the largest number of routing entries points to and replace them with a single default route. This is only applicable for internal networks which have no default route to the internet.

--ignore_files regex (default: ^CVS$|^RCS$|^.#|^raw$|~$)

A regular expression matching filenames which are ignored when reading directories.

--time_stamps

View runtime of compilation steps. Adds time stamps in seconds when printing compilation steps in verbose mode.

--max_errors number

Abort after this many errors.


AUTHOR

Heinz Knutzen <heinzknutzen@users.berlios.de>


SEE ALSO

http://netspoc.berlios.de