Static routing table does not match across cluster members-checkpoint-gaia

Static routing table does not match across cluster members-checkpoint-gaia
0

Static routing table does not match across cluster members-checkpoint-gaia

Vendor: checkpoint

OS: gaia

Description:
Indeni will identify when two devices are part of a cluster and alert if their static routing tables are different.

Remediation Steps:
Ensure the static routing table matches across devices in a cluster.

chkp-gaia-os-routes-novsx

name: chkp-gaia-os-routes-novsx
description: Check if configured routes in GAIA configuration are the same as set
    in the kernel, as well as record static and connected routes.
type: monitoring
monitoring_interval: 10 minute
requires:
    vendor: checkpoint
    os.name: gaia
    or:
    -   vsx:
            neq: 'true'
    -   mds: 'true'
    asg:
        neq: 'true'
comments:
    routes-missing-kernel:
        why: |
            If a static route is configured via Clish or WebUI, there is no guarantee that those routes will be successfully propagated the Linux kernel routing table. To ensure that all routes are applied correctly it is recommended to compare the actual routes with the configured ones.
        how: |
            Actual routes are retrieved using the built-in "netstat" command, and the configured routes from the gaia configuration database /config/active. The two are then compared to make sure they are the same.
        without-indeni: |
            An administrator could login and manually list routes from both commands, and then compare the output. However, often there are a lot of routes configured; combine this with the difference in output (for example subnet), and comparison can be a cumbersome task.
        can-with-snmp: false
        can-with-syslog: false
        vendor-provided-management: |
            Listing routes from kernel is only available from the command line interface. Listing configured routes is also available from the WebUI.
    static-routing-table:
        skip-documentation: true
    connected-networks-table:
        skip-documentation: true
steps:
-   run:
        type: SSH
        command: ${nice-path} -n 15 grep "route" /config/active ; ${nice-path} -n
            15 netstat -rn; ${nice-path} -n 15 ifconfig -a
    parse:
        type: AWK
        file: gaia-routes-novsx.parser.1.awk

static_routing_table_comparison_non_vsx

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.crossvendor

import com.indeni.server.common.data.conditions.{Equals => DataEquals}
import com.indeni.server.rules.RuleContext
import com.indeni.server.rules.library.templates.SnapshotComparisonTemplateRule
import com.indeni.server.rules.RemediationStepCondition

/**
  *
  */
case class static_routing_table_comparison_non_vsx() extends SnapshotComparisonTemplateRule(
  ruleName = "static_routing_table_comparison_non_vsx",
  ruleFriendlyName = "Clustered Devices (Non-VS): Static routing table does not match across cluster members",
  ruleDescription = "Indeni will identify when two devices are part of a cluster and alert if their static routing tables are different.",
  metricName = "static-routing-table",
  isArray = true,
  metaCondition = !DataEquals("vsx", "true"),
  baseRemediationText = "Ensure the static routing table matches across devices in a cluster.",
  alertDescription = "Devices that are part of a cluster must have the same static routing tables. Review the differences below.\n\nThis alert was added per the request of <a target=\"_blank\" href=\"http://il.linkedin.com/pub/itzik-assaraf/2/870/1b5\">Itzik Assaraf</a> (Leumi Card)."
  )(
  RemediationStepCondition.VENDOR_CP -> "Use the \"show configuration\" command in clish to compare the calls to \"set static-route\".",
  RemediationStepCondition.VENDOR_CISCO ->
    """|
      |1. Execute the "show ip route static" command to display the current contents of the  static routes installed to the routing table.
      |2. Compare the static route config between the peer switches with the show run | i "ip route" command
      |NOTE: The static routes configured between the peer switches may be different in case of orphan devices without need of redundancy between the vPC peer switches
      |3. For more information please review the next Cisco configuration guide:
      |https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/unicast/configuration/guide/l3_cli_nxos/l3_route.html
    """.stripMargin
)
{override def deviceCondition(context: RuleContext) = generateDevicePassiveAndPassiveLinkStateCondition(context.tsDao)}