Your first policy

This tutorial takes one rule from an empty editor to a compliance result. The rule checks that an IOS-XE running config has no lab or test interfaces left in it. You need rConfig 8.0.2 or later and at least one IOS-XE device with a stored show running-config backup.

---

The rule

A policy definition is a plain text file made of blocks. Each block has three parts, one per line:

1. A description line starting with //. rConfig shows this text in the results.
2. The method, in square brackets after a hash: #[method_name].
3. The body: the config text the method checks. One line is a string; several lines are a list.

Here is the rule for this tutorial:

// No lab or test interfaces in the running configuration
#[wildcard_must_not_match_single_string]
interface *test*

wildcard_must_not_match_single_string passes when the pattern is not found. In the pattern, * stands for any run of characters, so interface *test* matches any line where interface is followed later on the same line by test. The match is case-sensitive.

Caution

Keep the description and method lines next to each other, with no blank line between them or between the method and the body. rConfig rejects a definition that has a blank line in either place.

Step 1: Create the definition

1. Navigate to Compliance → Definitions and click New Policy Definition.
2. Give it a name such as IOS-XE-Baseline-Draft and a short description, then click Create.
3. Paste the rule into the editor and click Save.

Step 2: Test it against a stored config

Testing reads the stored backup. It does not connect to the device.

1. Open a backed-up config for one of your IOS-XE devices.
2. Click Test Policy Definition above the config view and choose IOS-XE-Baseline-Draft.
3. Read the result for the rule.

The two configs below show what to expect. The first passes:

interface GigabitEthernet0/0/1
 description Production-Server-Link
 ip address 192.0.2.1 255.255.255.0
 no shutdown
interface GigabitEthernet0/0/2
 description Production-Client-Link
 ip address 198.51.100.1 255.255.255.0
 no shutdown
interface Loopback0
 description Management-Interface
 ip address 203.0.113.1 255.255.255.255

The second fails, because interface test-lab-connection matches the pattern:

interface GigabitEthernet0/0/1
 description Production-Server-Link
 ip address 192.0.2.1 255.255.255.0
 no shutdown
interface test-lab-connection
 description Temporary-Test-Interface
 ip address 203.0.113.100 255.255.255.0
 shutdown
interface GigabitEthernet0/0/2
 description Production-Client-Link
 ip address 198.51.100.1 255.255.255.0
 no shutdown

Config	Rule result	Overall result
First config	pass	PASS
Second config	fail	FAIL

Test against one config you expect to pass and one you expect to fail. A rule that passes everything is as broken as one that fails everything.

Step 3: Assign it

1. Navigate to Compliance → Assignments and click New Policy Assignment.
2. Name the assignment, then set the Scope: a single device is the safest start.
3. Set Command to the command whose output holds the config, here show running-config.
4. Set Policy Definition to IOS-XE-Baseline-Draft.
5. Leave it Enabled and click Save.

The Policy Assignments page covers the other scope types and the Run on backup option.

Step 4: Run it

On the Policy Assignments page, open the actions menu for your assignment and click Run now. The run uses the latest stored backup for the chosen command.

Step 5: Read the results

Navigate to Compliance → Reports and open the details for your assignment, then the results for your device. Policy Method Results lists each rule with its description and result. The overall result is PASS only when every rule in the definition passes. One failing rule makes the device fail.

Policy Compliance Results explains the report screens and the full result output.

---

Next steps

This rule is also on the IOS-XE baseline hardening page, where you can add more rules to the same definition. Before you write rules of your own, read avoiding false positives.