Skip to content

Security

ANTA catalog for security tests

Test functions related to the EOS various security settings

VerifyAPIHttpStatus

Bases: AntaTest

Verifies if eAPI HTTP server is disabled globally.

Expected Results
  • success: The test will pass if eAPI HTTP server is disabled globally.
  • failure: The test will fail if eAPI HTTP server is NOT disabled globally.
Source code in anta/tests/security.py 
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
class VerifyAPIHttpStatus(AntaTest):
    """
    Verifies if eAPI HTTP server is disabled globally.

    Expected Results:
        * success: The test will pass if eAPI HTTP server is disabled globally.
        * failure: The test will fail if eAPI HTTP server is NOT disabled globally.
    """

    name = "VerifyAPIHttpStatus"
    description = "Verifies if eAPI HTTP server is disabled globally."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands")]

    @AntaTest.anta_test
    def test(self) -> None:
        """
        Run VerifyAPIHTTPStatus validation.
        """

        command_output = self.instance_commands[0].json_output

        if command_output["enabled"] and not command_output["httpServer"]["running"]:
            self.result.is_success()
        else:
            self.result.is_failure("eAPI HTTP server is enabled globally")

test 

test() -> None

Run VerifyAPIHTTPStatus validation.

Source code in anta/tests/security.py 
180
181
182
183
184
185
186
187
188
189
190
191
@AntaTest.anta_test
def test(self) -> None:
    """
    Run VerifyAPIHTTPStatus validation.
    """

    command_output = self.instance_commands[0].json_output

    if command_output["enabled"] and not command_output["httpServer"]["running"]:
        self.result.is_success()
    else:
        self.result.is_failure("eAPI HTTP server is enabled globally")

VerifyAPIHttpsSSL

Bases: AntaTest

Verifies if eAPI HTTPS server SSL profile is configured and valid.

Expected results
  • success: The test will pass if the eAPI HTTPS server SSL profile is configured and valid.
  • failure: The test will fail if the eAPI HTTPS server SSL profile is NOT configured, misconfigured or invalid.
  • skipped: The test will be skipped if the SSL profile is not provided.
Source code in anta/tests/security.py 
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
class VerifyAPIHttpsSSL(AntaTest):
    """
    Verifies if eAPI HTTPS server SSL profile is configured and valid.

    Expected results:
        * success: The test will pass if the eAPI HTTPS server SSL profile is configured and valid.
        * failure: The test will fail if the eAPI HTTPS server SSL profile is NOT configured, misconfigured or invalid.
        * skipped: The test will be skipped if the SSL profile is not provided.
    """

    name = "VerifyAPIHttpsSSL"
    description = "Verifies if eAPI HTTPS server SSL profile is configured and valid."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands")]

    @AntaTest.anta_test
    def test(self, profile: Optional[str] = None) -> None:
        """
        Run VerifyAPIHttpsSSL validation.

        Args:
            profile: SSL profile to verify.
        """
        if not profile:
            self.result.is_skipped(f"{self.__class__.name} did not run because profile was not supplied")
            return

        command_output = self.instance_commands[0].json_output

        try:
            if command_output["sslProfile"]["name"] == profile and command_output["sslProfile"]["state"] == "valid":
                self.result.is_success()
            else:
                self.result.is_failure(f"eAPI HTTPS server SSL profile ({profile}) is misconfigured or invalid")

        except KeyError:
            self.result.is_failure(f"eAPI HTTPS server SSL profile ({profile}) is not configured")

test 

test(profile: Optional[str] = None) -> None

Run VerifyAPIHttpsSSL validation.

Parameters:

Name Type Description Default
profile Optional[str]

SSL profile to verify.

 None
Source code in anta/tests/security.py 
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
@AntaTest.anta_test
def test(self, profile: Optional[str] = None) -> None:
    """
    Run VerifyAPIHttpsSSL validation.

    Args:
        profile: SSL profile to verify.
    """
    if not profile:
        self.result.is_skipped(f"{self.__class__.name} did not run because profile was not supplied")
        return

    command_output = self.instance_commands[0].json_output

    try:
        if command_output["sslProfile"]["name"] == profile and command_output["sslProfile"]["state"] == "valid":
            self.result.is_success()
        else:
            self.result.is_failure(f"eAPI HTTPS server SSL profile ({profile}) is misconfigured or invalid")

    except KeyError:
        self.result.is_failure(f"eAPI HTTPS server SSL profile ({profile}) is not configured")

VerifyAPIIPv4Acl

Bases: AntaTest

Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if eAPI has the provided number of IPv4 ACL(s) in the specified VRF.
  • failure: The test will fail if eAPI has not the right number of IPv4 ACL(s) in the specified VRF.
  • skipped: The test will be skipped if the number of IPv4 ACL(s) or VRF parameter is not provided.
Source code in anta/tests/security.py 
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
class VerifyAPIIPv4Acl(AntaTest):
    """
    Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if eAPI has the provided number of IPv4 ACL(s) in the specified VRF.
        * failure: The test will fail if eAPI has not the right number of IPv4 ACL(s) in the specified VRF.
        * skipped: The test will be skipped if the number of IPv4 ACL(s) or VRF parameter is not provided.
    """

    name = "VerifyAPIIPv4Acl"
    description = "Verifies if eAPI has the right number IPv4 ACL(s) configured for a specified VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands ip access-list summary")]

    @AntaTest.anta_test
    def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
        """
        Run VerifyAPIIPv4Acl validation.

        Args:
            number: The number of expected IPv4 ACL(s).
            vrf: The name of the VRF in which to check for eAPI. Defaults to 'default'.
        """
        if not number or not vrf:
            self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
            return

        command_output = self.instance_commands[0].json_output

        ipv4_acl_list = command_output["ipAclList"]["aclList"]
        ipv4_acl_number = len(ipv4_acl_list)
        not_configured_acl_list = []

        if ipv4_acl_number != number:
            self.result.is_failure(f"Expected {number} eAPI IPv4 ACL(s) in vrf {vrf} but got {ipv4_acl_number}")
            return

        for ipv4_acl in ipv4_acl_list:
            if vrf not in ipv4_acl["configuredVrfs"] or vrf not in ipv4_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv4_acl["name"])

        if not_configured_acl_list:
            self.result.is_failure(f"eAPI IPv4 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

test 

test(number: Optional[int] = None, vrf: str = 'default') -> None

Run VerifyAPIIPv4Acl validation.

Parameters:

Name Type Description Default
number Optional[int]

The number of expected IPv4 ACL(s).

 None
vrf str

The name of the VRF in which to check for eAPI. Defaults to ‘default’.

 'default'
Source code in anta/tests/security.py 
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
@AntaTest.anta_test
def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
    """
    Run VerifyAPIIPv4Acl validation.

    Args:
        number: The number of expected IPv4 ACL(s).
        vrf: The name of the VRF in which to check for eAPI. Defaults to 'default'.
    """
    if not number or not vrf:
        self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
        return

    command_output = self.instance_commands[0].json_output

    ipv4_acl_list = command_output["ipAclList"]["aclList"]
    ipv4_acl_number = len(ipv4_acl_list)
    not_configured_acl_list = []

    if ipv4_acl_number != number:
        self.result.is_failure(f"Expected {number} eAPI IPv4 ACL(s) in vrf {vrf} but got {ipv4_acl_number}")
        return

    for ipv4_acl in ipv4_acl_list:
        if vrf not in ipv4_acl["configuredVrfs"] or vrf not in ipv4_acl["activeVrfs"]:
            not_configured_acl_list.append(ipv4_acl["name"])

    if not_configured_acl_list:
        self.result.is_failure(f"eAPI IPv4 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
    else:
        self.result.is_success()

VerifyAPIIPv6Acl

Bases: AntaTest

Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if eAPI has the provided number of IPv6 ACL(s) in the specified VRF.
  • failure: The test will fail if eAPI has not the right number of IPv6 ACL(s) in the specified VRF.
  • skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
Source code in anta/tests/security.py 
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
class VerifyAPIIPv6Acl(AntaTest):
    """
    Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if eAPI has the provided number of IPv6 ACL(s) in the specified VRF.
        * failure: The test will fail if eAPI has not the right number of IPv6 ACL(s) in the specified VRF.
        * skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
    """

    name = "VerifyAPIIPv6Acl"
    description = "Verifies if eAPI has the right number IPv6 ACL(s) configured for a specified VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management api http-commands ipv6 access-list summary")]

    @AntaTest.anta_test
    def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
        """
        Run VerifyAPIIPv6Acl validation.

        Args:
            number: The number of expected IPv6 ACL(s).
            vrf: The name of the VRF in which to check for eAPI. Defaults to 'default'.
        """
        if not number or not vrf:
            self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
            return

        command_output = self.instance_commands[0].json_output

        ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
        ipv6_acl_number = len(ipv6_acl_list)
        not_configured_acl_list = []

        if ipv6_acl_number != number:
            self.result.is_failure(f"Expected {number} eAPI IPv6 ACL(s) in vrf {vrf} but got {ipv6_acl_number}")
            return

        for ipv6_acl in ipv6_acl_list:
            if vrf not in ipv6_acl["configuredVrfs"] or vrf not in ipv6_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv6_acl["name"])

        if not_configured_acl_list:
            self.result.is_failure(f"eAPI IPv6 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

test 

test(number: Optional[int] = None, vrf: str = 'default') -> None

Run VerifyAPIIPv6Acl validation.

Parameters:

Name Type Description Default
number Optional[int]

The number of expected IPv6 ACL(s).

 None
vrf str

The name of the VRF in which to check for eAPI. Defaults to ‘default’.

 'default'
Source code in anta/tests/security.py 
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
@AntaTest.anta_test
def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
    """
    Run VerifyAPIIPv6Acl validation.

    Args:
        number: The number of expected IPv6 ACL(s).
        vrf: The name of the VRF in which to check for eAPI. Defaults to 'default'.
    """
    if not number or not vrf:
        self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
        return

    command_output = self.instance_commands[0].json_output

    ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
    ipv6_acl_number = len(ipv6_acl_list)
    not_configured_acl_list = []

    if ipv6_acl_number != number:
        self.result.is_failure(f"Expected {number} eAPI IPv6 ACL(s) in vrf {vrf} but got {ipv6_acl_number}")
        return

    for ipv6_acl in ipv6_acl_list:
        if vrf not in ipv6_acl["configuredVrfs"] or vrf not in ipv6_acl["activeVrfs"]:
            not_configured_acl_list.append(ipv6_acl["name"])

    if not_configured_acl_list:
        self.result.is_failure(f"eAPI IPv6 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
    else:
        self.result.is_success()

VerifySSHIPv4Acl

Bases: AntaTest

Verifies if the SSHD agent has the right number IPv4 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if the SSHD agent has the provided number of IPv4 ACL(s) in the specified VRF.
  • failure: The test will fail if the SSHD agent has not the right number of IPv4 ACL(s) in the specified VRF.
  • skipped: The test will be skipped if the number of IPv4 ACL(s) or VRF parameter is not provided.
Source code in anta/tests/security.py 
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
class VerifySSHIPv4Acl(AntaTest):
    """
    Verifies if the SSHD agent has the right number IPv4 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if the SSHD agent has the provided number of IPv4 ACL(s) in the specified VRF.
        * failure: The test will fail if the SSHD agent has not the right number of IPv4 ACL(s) in the specified VRF.
        * skipped: The test will be skipped if the number of IPv4 ACL(s) or VRF parameter is not provided.
    """

    name = "VerifySSHIPv4Acl"
    description = "Verifies if the SSHD agent has IPv4 ACL(s) configured."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh ip access-list summary")]

    @AntaTest.anta_test
    def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
        """
        Run VerifySSHIPv4Acl validation.

        Args:
            number: The number of expected IPv4 ACL(s).
            vrf: The name of the VRF in which to check for the SSHD agent. Defaults to 'default'.
        """
        if not number or not vrf:
            self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
            return

        command_output = self.instance_commands[0].json_output

        ipv4_acl_list = command_output["ipAclList"]["aclList"]
        ipv4_acl_number = len(ipv4_acl_list)
        not_configured_acl_list = []

        if ipv4_acl_number != number:
            self.result.is_failure(f"Expected {number} SSH IPv4 ACL(s) in vrf {vrf} but got {ipv4_acl_number}")
            return

        for ipv4_acl in ipv4_acl_list:
            if vrf not in ipv4_acl["configuredVrfs"] or vrf not in ipv4_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv4_acl["name"])

        if not_configured_acl_list:
            self.result.is_failure(f"SSH IPv4 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

test 

test(number: Optional[int] = None, vrf: str = 'default') -> None

Run VerifySSHIPv4Acl validation.

Parameters:

Name Type Description Default
number Optional[int]

The number of expected IPv4 ACL(s).

 None
vrf str

The name of the VRF in which to check for the SSHD agent. Defaults to ‘default’.

 'default'
Source code in anta/tests/security.py 
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
@AntaTest.anta_test
def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
    """
    Run VerifySSHIPv4Acl validation.

    Args:
        number: The number of expected IPv4 ACL(s).
        vrf: The name of the VRF in which to check for the SSHD agent. Defaults to 'default'.
    """
    if not number or not vrf:
        self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
        return

    command_output = self.instance_commands[0].json_output

    ipv4_acl_list = command_output["ipAclList"]["aclList"]
    ipv4_acl_number = len(ipv4_acl_list)
    not_configured_acl_list = []

    if ipv4_acl_number != number:
        self.result.is_failure(f"Expected {number} SSH IPv4 ACL(s) in vrf {vrf} but got {ipv4_acl_number}")
        return

    for ipv4_acl in ipv4_acl_list:
        if vrf not in ipv4_acl["configuredVrfs"] or vrf not in ipv4_acl["activeVrfs"]:
            not_configured_acl_list.append(ipv4_acl["name"])

    if not_configured_acl_list:
        self.result.is_failure(f"SSH IPv4 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
    else:
        self.result.is_success()

VerifySSHIPv6Acl

Bases: AntaTest

Verifies if the SSHD agent has the right number IPv6 ACL(s) configured for a specified VRF.

Expected results
  • success: The test will pass if the SSHD agent has the provided number of IPv6 ACL(s) in the specified VRF.
  • failure: The test will fail if the SSHD agent has not the right number of IPv6 ACL(s) in the specified VRF.
  • skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
Source code in anta/tests/security.py 
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
class VerifySSHIPv6Acl(AntaTest):
    """
    Verifies if the SSHD agent has the right number IPv6 ACL(s) configured for a specified VRF.

    Expected results:
        * success: The test will pass if the SSHD agent has the provided number of IPv6 ACL(s) in the specified VRF.
        * failure: The test will fail if the SSHD agent has not the right number of IPv6 ACL(s) in the specified VRF.
        * skipped: The test will be skipped if the number of IPv6 ACL(s) or VRF parameter is not provided.
    """

    name = "VerifySSHIPv6Acl"
    description = "Verifies if the SSHD agent has IPv6 ACL(s) configured."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh ipv6 access-list summary")]

    @AntaTest.anta_test
    def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
        """
        Run VerifySSHIPv6Acl validation.

        Args:
            number: The number of expected IPv6 ACL(s).
            vrf: The name of the VRF in which to check for the SSHD agent. Defaults to 'default'.
        """
        if not number or not vrf:
            self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
            return

        command_output = self.instance_commands[0].json_output

        ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
        ipv6_acl_number = len(ipv6_acl_list)
        not_configured_acl_list = []

        if ipv6_acl_number != number:
            self.result.is_failure(f"Expected {number} SSH IPv6 ACL(s) in vrf {vrf} but got {ipv6_acl_number}")
            return

        for ipv6_acl in ipv6_acl_list:
            if vrf not in ipv6_acl["configuredVrfs"] or vrf not in ipv6_acl["activeVrfs"]:
                not_configured_acl_list.append(ipv6_acl["name"])

        if not_configured_acl_list:
            self.result.is_failure(f"SSH IPv6 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
        else:
            self.result.is_success()

test 

test(number: Optional[int] = None, vrf: str = 'default') -> None

Run VerifySSHIPv6Acl validation.

Parameters:

Name Type Description Default
number Optional[int]

The number of expected IPv6 ACL(s).

 None
vrf str

The name of the VRF in which to check for the SSHD agent. Defaults to ‘default’.

 'default'
Source code in anta/tests/security.py 
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
@AntaTest.anta_test
def test(self, number: Optional[int] = None, vrf: str = "default") -> None:
    """
    Run VerifySSHIPv6Acl validation.

    Args:
        number: The number of expected IPv6 ACL(s).
        vrf: The name of the VRF in which to check for the SSHD agent. Defaults to 'default'.
    """
    if not number or not vrf:
        self.result.is_skipped(f"{self.__class__.name} did not run because number or vrf was not supplied")
        return

    command_output = self.instance_commands[0].json_output

    ipv6_acl_list = command_output["ipv6AclList"]["aclList"]
    ipv6_acl_number = len(ipv6_acl_list)
    not_configured_acl_list = []

    if ipv6_acl_number != number:
        self.result.is_failure(f"Expected {number} SSH IPv6 ACL(s) in vrf {vrf} but got {ipv6_acl_number}")
        return

    for ipv6_acl in ipv6_acl_list:
        if vrf not in ipv6_acl["configuredVrfs"] or vrf not in ipv6_acl["activeVrfs"]:
            not_configured_acl_list.append(ipv6_acl["name"])

    if not_configured_acl_list:
        self.result.is_failure(f"SSH IPv6 ACL(s) not configured or active in vrf {vrf}: {not_configured_acl_list}")
    else:
        self.result.is_success()

VerifySSHStatus

Bases: AntaTest

Verifies if the SSHD agent is disabled in the default VRF.

Expected Results
  • success: The test will pass if the SSHD agent is disabled in the default VRF.
  • failure: The test will fail if the SSHD agent is NOT disabled in the default VRF.
Source code in anta/tests/security.py 
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
class VerifySSHStatus(AntaTest):
    """
    Verifies if the SSHD agent is disabled in the default VRF.

    Expected Results:
        * success: The test will pass if the SSHD agent is disabled in the default VRF.
        * failure: The test will fail if the SSHD agent is NOT disabled in the default VRF.
    """

    name = "VerifySSHStatus"
    description = "Verifies if the SSHD agent is disabled in the default VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management ssh", ofmt="text")]

    @AntaTest.anta_test
    def test(self) -> None:
        """
        Run VerifySSHStatus validation.
        """

        command_output = self.instance_commands[0].text_output

        line = [line for line in command_output.split("\n") if line.startswith("SSHD status")][0]
        status = line.split("is ")[1]

        if status == "disabled":
            self.result.is_success()
        else:
            self.result.is_failure(line)

test 

test() -> None

Run VerifySSHStatus validation.

Source code in anta/tests/security.py 
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
@AntaTest.anta_test
def test(self) -> None:
    """
    Run VerifySSHStatus validation.
    """

    command_output = self.instance_commands[0].text_output

    line = [line for line in command_output.split("\n") if line.startswith("SSHD status")][0]
    status = line.split("is ")[1]

    if status == "disabled":
        self.result.is_success()
    else:
        self.result.is_failure(line)

VerifyTelnetStatus

Bases: AntaTest

Verifies if Telnet is disabled in the default VRF.

Expected Results
  • success: The test will pass if Telnet is disabled in the default VRF.
  • failure: The test will fail if Telnet is NOT disabled in the default VRF.
Source code in anta/tests/security.py 
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
class VerifyTelnetStatus(AntaTest):
    """
    Verifies if Telnet is disabled in the default VRF.

    Expected Results:
        * success: The test will pass if Telnet is disabled in the default VRF.
        * failure: The test will fail if Telnet is NOT disabled in the default VRF.
    """

    name = "VerifyTelnetStatus"
    description = "Verifies if Telnet is disabled in the default VRF."
    categories = ["security"]
    commands = [AntaCommand(command="show management telnet")]

    @AntaTest.anta_test
    def test(self) -> None:
        """
        Run VerifyTelnetStatus validation.
        """

        command_output = self.instance_commands[0].json_output

        if command_output["serverState"] == "disabled":
            self.result.is_success()
        else:
            self.result.is_failure("Telnet status for Default VRF is enabled")

test 

test() -> None

Run VerifyTelnetStatus validation.

Source code in anta/tests/security.py 
152
153
154
155
156
157
158
159
160
161
162
163
@AntaTest.anta_test
def test(self) -> None:
    """
    Run VerifyTelnetStatus validation.
    """

    command_output = self.instance_commands[0].json_output

    if command_output["serverState"] == "disabled":
        self.result.is_success()
    else:
        self.result.is_failure("Telnet status for Default VRF is enabled")
Last update: July 19, 2023