Skip to content

Security

ANTA catalog for security tests

Test functions related to the EOS various security settings

VerifyAPIHttpStatus

Bases: AntaTest

Verifies if eAPI HTTP server is disabled globally.

Expected Results
  • success: The test will pass if eAPI HTTP server is disabled globally.
  • failure: The test will fail if eAPI HTTP server is NOT disabled globally.
Source code in anta/tests/security.py 
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
class VerifyAPIHttpStatus(AntaTest):
    """
    Verifies if eAPI HTTP server is disabled globally.

    Expected Results:
        * success: The test will pass if eAPI HTTP server is disabled globally.
        * failure: The test will fail if eAPI HTTP server is NOT disabled globally.
    """

    name = "VerifyAPIHttpStatus"
    description = "Verifies if eAPI HTTP server is disabled globally."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands")]

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        if command_output["enabled"] and not command_output["httpServer"]["running"]:
            self.result.is_success()
        else:
            self.result.is_failure("eAPI HTTP server is enabled globally")

VerifyAPIHttpsSSL

Bases: AntaTest

Verifies if eAPI HTTPS server SSL profile is configured and valid.

Expected results
  • success: The test will pass if the eAPI HTTPS server SSL profile is configured and valid.
  • failure: The test will fail if the eAPI HTTPS server SSL profile is NOT configured, misconfigured or invalid.
Source code in anta/tests/security.py 
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
class VerifyAPIHttpsSSL(AntaTest):
    """
    Verifies if eAPI HTTPS server SSL profile is configured and valid.

    Expected results:
        * success: The test will pass if the eAPI HTTPS server SSL profile is configured and valid.
        * failure: The test will fail if the eAPI HTTPS server SSL profile is NOT configured, misconfigured or invalid.
    """

    name = "VerifyAPIHttpsSSL"
    description = "Verifies if eAPI HTTPS server SSL profile is configured and valid."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands")]

    class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
        profile: str
        """SSL profile to verify"""

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        try:
            if command_output["sslProfile"]["name"] == self.inputs.profile and command_output["sslProfile"]["state"] == "valid":
                self.result.is_success()
            else:
                self.result.is_failure(f"eAPI HTTPS server SSL profile ({self.inputs.profile}) is misconfigured or invalid")

        except KeyError:
            self.result.is_failure(f"eAPI HTTPS server SSL profile ({self.inputs.profile}) is not configured")

Input

Bases: Input

Source code in anta/tests/security.py 
179
180
181
class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
    profile: str
    """SSL profile to verify"""

profile instance-attribute 

profile: str

SSL profile to verify

VerifyAPIIPv4Acl

Bases: AntaTest

Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if eAPI has the provided number of IPv4 ACL(s) in the specified VRF.
  • failure: The test will fail if eAPI has not the right number of IPv4 ACL(s) in the specified VRF.
Source code in anta/tests/security.py 
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
class VerifyAPIIPv4Acl(AntaTest):
    """
    Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if eAPI has the provided number of IPv4 ACL(s) in the specified VRF.
        * failure: The test will fail if eAPI has not the right number of IPv4 ACL(s) in the specified VRF.
    """

    name = "VerifyAPIIPv4Acl"
    description = "Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands ip access-list summary")]

    class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
        number: conint(ge=0)  # type:ignore
        """The number of expected IPv4 ACL(s)"""
        vrf: str = "default"
        """The name of the VRF in which to check for eAPI"""

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        ipv4_acl_list = command_output["ipAclList"]["aclList"]
        ipv4_acl_number = len(ipv4_acl_list)
        not_configured_acl_list = []
        if ipv4_acl_number != self.inputs.number:
            self.result.is_failure(f"Expected {self.inputs.number} eAPI IPv4 ACL(s) in vrf {self.inputs.vrf} but got {ipv4_acl_number}")
            return
        for ipv4_acl in ipv4_acl_list:
            if self.inputs.vrf not in ipv4_acl["configuredVrfs"] or self.inputs.vrf not in ipv4_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv4_acl["name"])
        if not_configured_acl_list:
            self.result.is_failure(f"eAPI IPv4 ACL(s) not configured or active in vrf {self.inputs.vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

Input

Bases: Input

Source code in anta/tests/security.py 
210
211
212
213
214
class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
    number: conint(ge=0)  # type:ignore
    """The number of expected IPv4 ACL(s)"""
    vrf: str = "default"
    """The name of the VRF in which to check for eAPI"""

number instance-attribute 

number: conint(ge=0)

The number of expected IPv4 ACL(s)

vrf class-attribute instance-attribute 

vrf: str = 'default'

The name of the VRF in which to check for eAPI

VerifyAPIIPv6Acl

Bases: AntaTest

Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if eAPI has the provided number of IPv6 ACL(s) in the specified VRF.
  • failure: The test will fail if eAPI has not the right number of IPv6 ACL(s) in the specified VRF.
  • skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
Source code in anta/tests/security.py 
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
class VerifyAPIIPv6Acl(AntaTest):
    """
    Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if eAPI has the provided number of IPv6 ACL(s) in the specified VRF.
        * failure: The test will fail if eAPI has not the right number of IPv6 ACL(s) in the specified VRF.
        * skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
    """

    name = "VerifyAPIIPv6Acl"
    description = "Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands ipv6 access-list summary")]

    class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
        number: conint(ge=0)  # type:ignore
        """The number of expected IPv6 ACL(s)"""
        vrf: str = "default"
        """The name of the VRF in which to check for eAPI"""

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
        ipv6_acl_number = len(ipv6_acl_list)
        not_configured_acl_list = []
        if ipv6_acl_number != self.inputs.number:
            self.result.is_failure(f"Expected {self.inputs.number} eAPI IPv6 ACL(s) in vrf {self.inputs.vrf} but got {ipv6_acl_number}")
            return
        for ipv6_acl in ipv6_acl_list:
            if self.inputs.vrf not in ipv6_acl["configuredVrfs"] or self.inputs.vrf not in ipv6_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv6_acl["name"])
        if not_configured_acl_list:
            self.result.is_failure(f"eAPI IPv6 ACL(s) not configured or active in vrf {self.inputs.vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

Input

Bases: Input

Source code in anta/tests/security.py 
249
250
251
252
253
class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
    number: conint(ge=0)  # type:ignore
    """The number of expected IPv6 ACL(s)"""
    vrf: str = "default"
    """The name of the VRF in which to check for eAPI"""

number instance-attribute 

number: conint(ge=0)

The number of expected IPv6 ACL(s)

vrf class-attribute instance-attribute 

vrf: str = 'default'

The name of the VRF in which to check for eAPI

VerifySSHIPv4Acl

Bases: AntaTest

Verifies if the SSHD agent has the right number IPv4 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if the SSHD agent has the provided number of IPv4 ACL(s) in the specified VRF.
  • failure: The test will fail if the SSHD agent has not the right number of IPv4 ACL(s) in the specified VRF.
Source code in anta/tests/security.py 
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
class VerifySSHIPv4Acl(AntaTest):
    """
    Verifies if the SSHD agent has the right number IPv4 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if the SSHD agent has the provided number of IPv4 ACL(s) in the specified VRF.
        * failure: The test will fail if the SSHD agent has not the right number of IPv4 ACL(s) in the specified VRF.
    """

    name = "VerifySSHIPv4Acl"
    description = "Verifies if the SSHD agent has IPv4 ACL(s) configured."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh ip access-list summary")]

    class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
        number: conint(ge=0)  # type:ignore
        """The number of expected IPv4 ACL(s)"""
        vrf: str = "default"
        """The name of the VRF in which to check for the SSHD agent"""

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        ipv4_acl_list = command_output["ipAclList"]["aclList"]
        ipv4_acl_number = len(ipv4_acl_list)
        not_configured_acl_list = []
        if ipv4_acl_number != self.inputs.number:
            self.result.is_failure(f"Expected {self.inputs.number} SSH IPv4 ACL(s) in vrf {self.inputs.vrf} but got {ipv4_acl_number}")
            return
        for ipv4_acl in ipv4_acl_list:
            if self.inputs.vrf not in ipv4_acl["configuredVrfs"] or self.inputs.vrf not in ipv4_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv4_acl["name"])
        if not_configured_acl_list:
            self.result.is_failure(f"SSH IPv4 ACL(s) not configured or active in vrf {self.inputs.vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

Input

Bases: Input

Source code in anta/tests/security.py 
57
58
59
60
61
class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
    number: conint(ge=0)  # type:ignore
    """The number of expected IPv4 ACL(s)"""
    vrf: str = "default"
    """The name of the VRF in which to check for the SSHD agent"""

number instance-attribute 

number: conint(ge=0)

The number of expected IPv4 ACL(s)

vrf class-attribute instance-attribute 

vrf: str = 'default'

The name of the VRF in which to check for the SSHD agent

VerifySSHIPv6Acl

Bases: AntaTest

Verifies if the SSHD agent has the right number IPv6 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if the SSHD agent has the provided number of IPv6 ACL(s) in the specified VRF.
  • failure: The test will fail if the SSHD agent has not the right number of IPv6 ACL(s) in the specified VRF.
Source code in anta/tests/security.py 
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
class VerifySSHIPv6Acl(AntaTest):
    """
    Verifies if the SSHD agent has the right number IPv6 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if the SSHD agent has the provided number of IPv6 ACL(s) in the specified VRF.
        * failure: The test will fail if the SSHD agent has not the right number of IPv6 ACL(s) in the specified VRF.
    """

    name = "VerifySSHIPv6Acl"
    description = "Verifies if the SSHD agent has IPv6 ACL(s) configured."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh ipv6 access-list summary")]

    class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
        number: conint(ge=0)  # type:ignore
        """The number of expected IPv6 ACL(s)"""
        vrf: str = "default"
        """The name of the VRF in which to check for the SSHD agent"""

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
        ipv6_acl_number = len(ipv6_acl_list)
        not_configured_acl_list = []
        if ipv6_acl_number != self.inputs.number:
            self.result.is_failure(f"Expected {self.inputs.number} SSH IPv6 ACL(s) in vrf {self.inputs.vrf} but got {ipv6_acl_number}")
            return
        for ipv6_acl in ipv6_acl_list:
            if self.inputs.vrf not in ipv6_acl["configuredVrfs"] or self.inputs.vrf not in ipv6_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv6_acl["name"])
        if not_configured_acl_list:
            self.result.is_failure(f"SSH IPv6 ACL(s) not configured or active in vrf {self.inputs.vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

Input

Bases: Input

Source code in anta/tests/security.py 
95
96
97
98
99
class Input(AntaTest.Input):  # pylint: disable=missing-class-docstring
    number: conint(ge=0)  # type:ignore
    """The number of expected IPv6 ACL(s)"""
    vrf: str = "default"
    """The name of the VRF in which to check for the SSHD agent"""

number instance-attribute 

number: conint(ge=0)

The number of expected IPv6 ACL(s)

vrf class-attribute instance-attribute 

vrf: str = 'default'

The name of the VRF in which to check for the SSHD agent

VerifySSHStatus

Bases: AntaTest

Verifies if the SSHD agent is disabled in the default VRF.

Expected Results
  • success: The test will pass if the SSHD agent is disabled in the default VRF.
  • failure: The test will fail if the SSHD agent is NOT disabled in the default VRF.
Source code in anta/tests/security.py 
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
class VerifySSHStatus(AntaTest):
    """
    Verifies if the SSHD agent is disabled in the default VRF.

    Expected Results:
        * success: The test will pass if the SSHD agent is disabled in the default VRF.
        * failure: The test will fail if the SSHD agent is NOT disabled in the default VRF.
    """

    name = "VerifySSHStatus"
    description = "Verifies if the SSHD agent is disabled in the default VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh", ofmt="text")]

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].text_output

        line = [line for line in command_output.split("\n") if line.startswith("SSHD status")][0]
        status = line.split("is ")[1]

        if status == "disabled":
            self.result.is_success()
        else:
            self.result.is_failure(line)

VerifyTelnetStatus

Bases: AntaTest

Verifies if Telnet is disabled in the default VRF.

Expected Results
  • success: The test will pass if Telnet is disabled in the default VRF.
  • failure: The test will fail if Telnet is NOT disabled in the default VRF.
Source code in anta/tests/security.py 
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
class VerifyTelnetStatus(AntaTest):
    """
    Verifies if Telnet is disabled in the default VRF.

    Expected Results:
        * success: The test will pass if Telnet is disabled in the default VRF.
        * failure: The test will fail if Telnet is NOT disabled in the default VRF.
    """

    name = "VerifyTelnetStatus"
    description = "Verifies if Telnet is disabled in the default VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management telnet")]

    @AntaTest.anta_test
    def test(self) -> None:
        command_output = self.instance_commands[0].json_output
        if command_output["serverState"] == "disabled":
            self.result.is_success()
        else:
            self.result.is_failure("Telnet status for Default VRF is enabled")