Automation

With much help and support from Mattia I have created a slax commit script to build firewall policers on demand when they are referenced on an interface and also apply it inbound if it has been added outbound.  The final part of this script is to remove the inbound policer when the output policer gets deleted.  It is this final part that is giving me problems, here is the behaviour I see:

The commit script runs and commits but reports the error: could not set input.  This error seems to come from the <change> delete statement for the input policer statement as I dont get it when I comment this out.  What am I doing wrong that triggers this  error? 

{master}[edit]
T4000# show | display set | match n1234567k_rate_limiter_150m                                   
set interfaces xe-7/1/11 unit 0 family inet policer input n1234567k_rate_limiter_150m
set interfaces xe-7/1/11 unit 0 family inet policer output n1234567k_rate_limiter_150m
set firewall policer n1234567k_rate_limiter_150m if-exceeding bandwidth-limit 150m
set firewall policer n1234567k_rate_limiter_150m if-exceeding burst-size-limit 32767
set firewall policer n1234567k_rate_limiter_150m then discard

{master}[edit]
T4000# delete interfaces xe-7/1/11 unit 0 family inet policer output n1234567k_rate_limiter_150m 

{master}[edit]
T4000# show | compare 
[edit interfaces xe-7/1/11 unit 0 family inet policer]
-       output n1234567k_rate_limiter_150m;

{master}[edit]
T4000# commit 
warning: n1234567k_rate_limiter_150m
error: could not set input
configuration check succeeds
re0: 
commit complete
re1: 
commit complete

{master}[edit]
T4000# show | compare    

{master}[edit]
T4000# commit 
re1: 
commit complete

{master}[edit]
T4000# show | display set | match n1234567k_rate_limiter_150m                                       
set firewall policer n1234567k_rate_limiter_150m if-exceeding bandwidth-limit 150m
set firewall policer n1234567k_rate_limiter_150m if-exceeding burst-size-limit 32767
set firewall policer n1234567k_rate_limiter_150m then discard

I have attached my script, hopefully that helps.

Attachment(s)

test7.txt   4 KB 1 version

Hello, I'm glad I helped you to proceed with your work 🙂

Regarding the error, maybe it's related to the specification of the input policer name that's not needed while deleting it (since only one input policer can be applied on a interface).

If you write the change element as follows, it should work fine:

                                        <change> { 
                                    
                                        <interfaces> 
                                        { <interface> 
                                        	{ <name> ../../../name; 
                                        		<unit> { <name> ../../name; 
                                        			<family> { <inet> 
                                        					{ <policer>
                                        						{ <input delete="delete">; }
                                        					 	
                                        					}
                                        				}
                                        			}
                                        	}
                                        }
                                        
                                        }

I'm not sure this is useful, but you may also want to change the if condition, just to check that the input policer you are deleting is related to the missing output policer:

   if  ( (jcs:empty(./policer[output==$in_pol]))  )

 I hope this helps!

Mattia

Thanks for your help, the suggested change works perfectly.