Skip to content

IOS-XE baseline hardening

Baseline rules catch configuration that should never reach production. This page has one rule so far. More will be added as the rConfig test suite covers them.


Interfaces created for lab work or temporary testing tend to outlive the test. They carry addresses nobody monitors and often sit outside the normal ACL and description standards. This rule fails if any line contains interface followed later on the same line by test. The match is case-sensitive, so the rule only works if your naming standard uses lowercase test.

// No lab or test interfaces in the running configuration
#[wildcard_must_not_match_single_string]
interface *test*
interface GigabitEthernet0/0/1
description Production-Server-Link
ip address 192.0.2.1 255.255.255.0
no shutdown
interface GigabitEthernet0/0/2
description Production-Client-Link
ip address 198.51.100.1 255.255.255.0
no shutdown
interface Loopback0
description Management-Interface
ip address 203.0.113.1 255.255.255.255
interface GigabitEthernet0/0/1
description Production-Server-Link
ip address 192.0.2.1 255.255.255.0
no shutdown
interface test-lab-connection
description Temporary-Test-Interface
ip address 203.0.113.100 255.255.255.0
shutdown
interface GigabitEthernet0/0/2
description Production-Client-Link
ip address 198.51.100.1 255.255.255.0
no shutdown
ConfigRule resultOverall result
Passing configpassPASS
Failing configfail (matched interface test-lab-connection)FAIL
FrameworkReference
Not yet mappedSee Frameworks
ItemDetail
Tested OS versionNone. The configs were written for the test in IOS-XE syntax, not captured from a device. The failing interface name is a placeholder.
Minimum rConfig version8.0.2 (wildcard_must_not_match_single_string)
EditionsPro, Vector, Enterprise
SourcePolicyMethodsTest::test_wildcard_must_not_match_single_string_pattern_not_found and test_wildcard_must_not_match_single_string_pattern_found