SEARCH CONFIG FILE/BLOCK --> Find empty blocks

roberto.uriarte

Hello everyone, wondering if someone's been able to trigger when looking for empty extended ACL's.  I've tried doing using a config block start/stop of "ip access-list extended" but not sure what to use for the string match that would look for empty space.

I would like to find ACL-1, empty ACL's that can be deleted from switches.

ip access-list extended ACL-1
ip access-list extended ACL-2

ip access-list extended ACL-3

permit 1

permit 2

ip access-list extended ACL-4

Thank you in advance for any help.

shyde

Couple minor problems I can see here is in knowing what configuration will follow the final access list. If you do a start/stop of "ip access-list extended" the final access-list will not be included in the check since there is no "ip access-list extended" after it. So you will need to know what will come after the last access-list and build in some variability if you want it included. Second issue is not all access-list are extended, if you are only wanting to review extended access-lists this will not be an issue. Neither of these problems are the original question though.

To answer your string match question I would use the settings in the snippet below. Summarized as: string is not found with three 'OR' statements looking for permit or deny or remark. If you don't care about an access-list if it only has remarks and no permit or deny than just remove the remark from the or statements. I tested this and it works fine for detection.