NAME

netspoc - network security policy compiler


SYNOPSIS

netspoc [options] input-dir [output-dir]

netspoc [options] input-file [output-dir]


DESCRIPTION

The network security compiler takes a policy description recursively from all files in input-dir and places one file for each managed device into output-dir. Alternatively input may be read from a single input-file; this is mainly used for small examples or testing. Input is read from STDIN if input-file is equal to -. If output-dir is missing, all output is written to STDOUT.


OPTIONS

The following options are recognized. Some can be negated (prefixed with ``no'') which is specially useful when the default is ``true''.

--verbose, --quiet
Controls whether netspoc shows output about different compiler phases and statistics on standard error.

--[no]comment_acls
Add a comment line before each generated ACL entry. Comments use names of network objects as defined in the topology.

--[no]comment_routes
Add a comment line before each generated routing entry. Comments use names of network objects as defined in the topology.

--allow_unused_groups yes|no|warn
Handling of unused groups and service groups.

--check_unenforceable_rules yes|no|warn
Controls behavior for rules with no managed device on the path from source to destination.

--strict_subnets yes|no|warn
Allow subnets only if the enclosing network is declared as 'route_hint' or if the subnet is declared as 'subnet_of'. If set to 'warn', netspoc only warns about undeclared subnet relations.

--[no]auto_default_route
Optimize the number of routing entries per router:

For each router find the hop, where the largest number of routing entries points to and replace them with a single default route. This is only applicable for internal networks which have no default route to the internet.

--ignore_files regex (default: ^CVS$|^RCS$|^.#|^raw$|~$)
A regular expression matching filenames which are ignored when reading directories. Default value matches these files:
--max_errors number
Abort after this many errors.


AUTHOR

Heinz Knutzen <heinzknutzen@users.berlios.de>


SEE ALSO

http://netspoc.berlios.de