/usr/share/fwbuilder-5.1.0.3599/configlets/ios/safety_net_acl is in fwbuilder-common 5.1.0-4.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 | ## -*- mode: shell-script; -*-
##
## To be able to make changes to the part of configuration created
## from this configlet you need to copy this file to the directory
## fwbuilder/configlets/ios/ in your home directory and modify it.
## Double "##" comments are removed during processing but single "#"
## comments are be retained and appear in the generated script. Empty
## lines are removed as well.
##
## Configlets support simple macro language with these constructs:
## {{$var}} is variable expansion
## {{if var}} is conditional operator.
##
! temporary access list for "safety net install"
{{if ipv4}}
no ip access-list extended tmp_acl
ip access-list extended tmp_acl
permit ip {{$management_addr}} {{$management_netm}} any
deny ip any any
exit
interface {{$management_interface}}
no ip access-group in
no ip access-group out
ip access-group tmp_acl in
exit
{{endif}}
{{if ipv6}}
no ipv6 access-list tmp_acl
ipv6 access-list tmp_acl
{{if slash_notation}}
permit ipv6 {{$management_addr}} any
{{endif}}
{{if host_addr}}
permit ipv6 host {{$management_addr}} any
{{endif}}
permit icmp any any
deny ipv6 any any
exit
interface {{$management_interface}}
no ipv6 traffic-filter in
no ipv6 traffic-filter out
ipv6 traffic-filter tmp_acl in
exit
{{endif}}
|