netspoc - network security policy compiler
netspoc [options] input-dir [output-dir]
netspoc [options] input-file [output-dir]
The network security compiler takes a policy description
recursively from all files in input-dir and places one file for
each managed device into output-dir.
Alternatively input may be read from a single input-file; this
is mainly used for small examples or testing.
Input is read from STDIN if input-file is equal to -
.
If output-dir is missing, all output is written to STDOUT.
The following options are recognized. Some can be negated (prefixed with ``no'') which is specially useful when the default is ``true''.
Controls whether netspoc shows output about different compiler phases and statistics on standard error.
Add a comment line before each generated ACL entry. Comments use names of network objects as defined in the topology.
Add a comment line before each generated routing entry. Comments use names of network objects as defined in the topology.
Handling of unused groups and service groups.
Controls behavior for rules with no managed device on the path from source to destination.
Allow subnets only if the enclosing network is declared as 'route_hint' or if the subnet is declared as 'subnet_of'. If set to 'warn', netspoc only warns about undeclared subnet relations.
Optimize the number of routing entries per router:
For each router find the hop, where the largest number of routing entries points to and replace them with a single default route. This is only applicable for internal networks which have no default route to the internet.
A regular expression matching filenames which are ignored when reading directories.
View runtime of compilation steps. Adds time stamps in seconds when printing compilation steps in verbose mode.
CVS and RCS directories
CVS working files
directory raw for prolog & epilog files
Editor backup files: emacs: *~
Abort after this many errors.
Heinz Knutzen <heinzknutzen@users.berlios.de>