I am trying to get data out of a Cisco DMVPN hub on the spokes via NHRP database. Specifically the ARIN addresses and if the spoke has a firewall or other NAT.
I was modelling off of this NQE question and it works...except for the 2nd pattern is not detecting the child line.
The above question had a parent line that was always present if the new child was present and NHRP has the new child only if there is a NAT in the path while the parent line is always present.
The line in question is the “(Claimed NBMA address: <IP address>)” line at the bottom of the 2nd example - it is indented 1 space from the line above ‘NBMA address’ which is always present.
I tried both the NHRP data in the data model as well as a custom command ‘show ip nhrp’ with identical results.
//NHRP Database output
//Command: show ip nhrp
//10.100.12.5/32 via 10.100.12.5
// Tunnel1 created 1d18h, expire 01:56:31
// Type: dynamic, Flags: unique registered nhop
// NBMA address: 12.12.31.74
//10.100.12.6/32 via 10.100.12.6
// Tunnel1 created 2w2d, expire 01:53:05
// Type: dynamic, Flags: unique registered nhop
// NBMA address: 48.22.12.199
// (Claimed NBMA address: 192.168.64.24)
The NQE I can get results on all the tunnels but the
NHRPnoFWpattern =
```
{IPandPrefix:string} via {VPNpeer: ipv4Address}
{tunnelnum: string} created
NBMA address: {TunPublic: ipv4Address}
```;
NHRPwithNATpattern =
```
{IPandPrefix:string} via {VPNpeer: ipv4Address}
{tunnelnum: string} created
NBMA address: {TunPublic: ipv4Address}
Claimed NBMA address: {NoNATtunPublic: ipv4Address}
```;
foreach device in network.devices
foreach command in device.outputs.commands
where device.name == "<DMVPN_headend_routername>"
// where command.commandType == CommandType.NHRP_STATE
where command.commandText == "show ip nhrp"
foreach x in =1]
let ParsedResponse = parseConfigBlocks(OS.UNKNOWN, command.response)
foreach r in blockMatches(ParsedResponse, NHRPnoFWpattern)
let rPlus = max(foreach match in blockMatches(ParsedResponse, NHRPwithNATpattern)
where match.data.IPandPrefix == r.data.IPandPrefix
select match)
select {
Prefix: r.data.IPandPrefix,
IP: r.data.VPNpeer,
ARIN: r.data.TunPublic,
LAN: rPlus?.data?.NoNATtunPublic
}