Original automation module from the submitted project. Lab credentials and the device inventory are not published.
# acl_automation.py
# Security Policy Matrix Injection Engine
# Builds and applies the GUEST_RESTRICTION_ACL, IoT_ISOLATION_ACL, and
# CCTV_RESTRICTION_ACL extended access lists on CORE-SW, enforcing the security
# policy defined in Table 2.2 (VLAN & Access Control Matrix) of the report.
from netmiko import ConnectHandler
from devices import INVENTORY
def provision_acls():
print("[*] Preparing Automated Firewall/ACL Matrix Execution...")
for device in INVENTORY["switches"]:
if device["role"] == "core":
try:
net_connect = ConnectHandler(**{
k: v for k, v in device.items() if k not in ("role", "name", "block")
})
acl_payload = [
# Guest Network Policy Definition
"ip access-list extended GUEST_RESTRICTION_ACL",
"deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255",
"deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255",
"deny ip 192.168.30.0 0.0.0.255 192.168.40.0 0.0.0.255",
"deny ip 192.168.30.0 0.0.0.255 192.168.50.0 0.0.0.255",
"deny ip 192.168.30.0 0.0.0.255 192.168.99.0 0.0.0.255",
"permit ip 192.168.30.0 0.0.0.255 any", # WAN internet route allowed
# IoT Isolation Policy Definition
"ip access-list extended IoT_ISOLATION_ACL",
"deny ip 192.168.40.0 0.0.0.255 192.168.10.0 0.0.0.255",
"deny ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255",
"deny ip 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255",
"deny ip 192.168.40.0 0.0.0.255 192.168.50.0 0.0.0.255",
"deny ip 192.168.40.0 0.0.0.255 192.168.99.0 0.0.0.255",
"permit ip 192.168.40.0 0.0.0.255 any",
# CCTV Restriction Policy Definition - only Server (99) and
# Management (20) may initiate inbound connections to CCTV
"ip access-list extended CCTV_RESTRICTION_ACL",
"permit ip 192.168.99.0 0.0.0.255 192.168.50.0 0.0.0.255",
"permit ip 192.168.20.0 0.0.0.255 192.168.50.0 0.0.0.255",
"deny ip any 192.168.50.0 0.0.0.255",
# SVI Interception Point Mapping Execution
"interface Vlan30",
"ip access-group GUEST_RESTRICTION_ACL in",
"interface Vlan40",
"ip access-group IoT_ISOLATION_ACL in",
"interface Vlan50",
"ip access-group CCTV_RESTRICTION_ACL in"
]
output = net_connect.send_config_set(acl_payload)
print(output)
net_connect.disconnect()
print(f"[SUCCESS] Core Security ACL Matrices applied effectively on {device['name']}.")
except Exception as e:
print(f"[ERROR] Failed ACL configuration on device {device['name']} "
f"({device['host']}): {str(e)}")
if __name__ == "__main__":
provision_acls()