ciscoconfparse2

Introduction: What is ciscoconfparse2?

Summary

ciscoconfparse2 is the next generation of ciscoconfparse, which was the primary development package from 2007 until 2023.

ciscoconfparse2 is similar to an advanced grep and diff that handles multi-vendor network configuration files (such as those from Arista, Cisco, F5, Juniper, Palo Alto, etc).

Use ciscoconfparse2 to find configuration values without needing to ssh and use show commands.
Use ciscoconfparse2 to build new configuration files.

Example - Find shutdown interfaces

Assume you have a bunch of interfaces in a configuration. How do you find which ones are shutdown?

One way is manually reading the whole Cisco IOS-XE configuration. Another option is ciscoconfparse2

>>> from ciscoconfparse2 import CiscoConfParse
>>>
>>> parse = CiscoConfParse("/path/to/config/file")
>>> intf_cmds = parse.find_parent_objects(["interface", "shutdown"])
>>>
>>> shut_intf_names = [" ".join(cmd.split()[1:]) for cmd in intf_cmds]
>>>
>>> shut_intf_names
['GigabitEthernet1/5', 'TenGigabitEthernet2/2', 'TenGigabitEthernet2/3']
>>>

Example - Find EBGP peer addresses and AS Numbers

Assume you have this IOS-XR bgp configuration:

router bgp 65534
  bgp router-id 10.0.0.100
  address-family ipv4 unicast
  !
  neighbor 10.0.0.37
    remote-as 64000
    route-policy EBGP_IN in
    route-policy EBGP_OUT out
  !
  neighbor 10.0.0.1
    remote-as 65534
    update-source Loopback0
    route-policy MANGLE_IN in
    route-policy MANGLE_OUT out
      next-hop-self
  !
  neighbor 10.0.0.34
    remote-as 64000
    route-policy EBGP_IN in
    route-policy EBGP_OUT out

You can generate the list of EBGP peers pretty quickly with this script:

from ciscoconfparse2 import CiscoConfParse

parse = CiscoConfParse(
    "/path/to/config/file"
)  # Or read directly from a list of strings

# Get all neighbor configuration branches
branches = parse.find_object_branches(("router bgp", "neighbor", "remote-as"))

# Get the local BGP ASN
bgp_cmd = branches[0][0]
local_asn = bgp_cmd.split()[-1]

# Find EBGP neighbors for any number of peers...
for branch in branches:

    # Extract individual instances for each BGP neighbor "branch"
    neighbor_obj = branch[1]
    remote_asn_obj = branch[2]

    # Use the BaseCfgLine().split() method to get the peer address and ASN
    neighbor_addr = neighbor_obj.split()[-1]
    remote_asn = remote_asn_obj.split()[-1]

    # Only grab EBGP neighbors...
    if local_asn != remote_asn:
        print(f"EBGP NEIGHBOR {neighbor_addr}, ASN {remote_asn}")

When you run that, you'll see:

$ python example.py
EBGP NEIGHBOR 10.0.0.37, ASN 64000
EBGP NEIGHBOR 10.0.0.34, ASN 64000
$

Tutorial

Many things are possible; see the tutorial.

CLI Tool

ciscoconfparse2 distributes a CLI tool that will diff and grep various network configuration or text files.

API Examples

The API examples are documented on the web

Why

ciscoconfparse2 is a Python library that helps you quickly search for questions like these in your router / switch / firewall / load-balancer / wireless text configurations:

What interfaces are shutdown?
Which interfaces are in trunk mode?
What address and subnet mask is assigned to each interface?
Which interfaces are missing a critical command?
Is this configuration missing a standard config line?

It can help you:

Audit existing router / switch / firewall / wlc configurations
Modify existing configurations
Build new configurations

Speaking generally, the library examines a text network config and breaks it into a set of linked parent / child relationships. You can perform complex queries about these relationships.

What changed in ciscoconfparse2?

In late 2023, I started a rewrite because ciscoconfparse is too large and has some defaults that I wish it didn't have. I froze ciscoconfparse PYPI releases at version 1.9.52; there will be no more ciscoconfparse PYPI releases.

I recommend that you upgrade to ciscoconfparse2.

Here's why, it:

Streamlines the API towards a simpler user interface.
Removes legacy and flawed methods from the original (this could be a breaking change for old scripts).
Can search for parents and children using an arbitrary list of ancestors
Is better at handling multiple-child-level configurations (such as IOS XR and JunOS)
Adds string methods to BaseCfgLine() objects
Defaults ignore_blank_lines=False (this could be a breaking change for old scripts).
Includes a CLI command (which can grep for mac addresses and IPv4 / IPv6 subnets in text files)
Adds the concept of change commits; this is a config-modification performance feature that ciscoconfparse lacks
Adds an auto_commit keyword, which defaults True
Documents much more of the API
Intentionally requires a different import statement to minimize confusion between the original and ciscoconfparse2
Vastly improves Cisco IOS diffs

Cisco and Other Vendor-Specific factory parsers

Years ago, I introduced a beta-quality feature called factory, where I built vendor-specific syntax parsers to extract values from Cisco and other vendor configs.

This feature turned out to be a bad design decision; however, it's also much more popular than I imagined.

Going forward I strongly discourage people from using factory features. There will be no further development on vendor-specific factory parsers (such as models_cisco.py).

I truly apologize for any disappointment.

Docs, Installation, and Dependencies

The latest copy of the docs are archived on the web

Installation and Downloads

Use pip for Python3.x... :
```
python -m pip install ciscoconfparse2
```

Dependencies

Pre-requisites

The ciscoconfparse2 python package requires Python versions 3.10+.

What is the pythonic way of handling script credentials?

Never hard-code credentials
Use python-dotenv

Other Resources

Dive into Python3 is a good way to learn Python
Team CYMRU has a Secure IOS Template, which is especially useful for external-facing routers / switches
Cisco's Guide to hardening IOS devices
Center for Internet Security Benchmarks (An email address, cookies, and javascript are required)

Are you releasing licensing besides GPLv3?

I will not. however, if it's truly a problem for your company, there are commercial solutions available (to include purchasing the project, or hiring me).

Bug Tracker and Support

Please report any suggestions, bug reports, or annoyances with a github bug report.
If you're having problems with general python issues, consider searching for a solution on Stack Overflow. If you can't find a solution for your problem or need more help, you can ask on Stack Overflow or reddit/r/Python.
If you're having problems with your Cisco devices, you can contact:

License and Copyright

ciscoconfparse2 is licensed GPLv3

The word "Cisco" is a registered trademark of Cisco Systems.

Author

ciscoconfparse2 was written by David Michael Pennington and other contributors.

Metadata

Release files for ciscoconfparse2 0.9.18

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for ciscoconfparse2 0.9.18
File	Size	Uploaded
ciscoconfparse2-0.9.18.tar.gz	1.3 MB	May 17, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for ciscoconfparse2 0.9.18
File	Interpreter	ABI	Platform	Reset
ciscoconfparse2-0.9.18-py3-none-any.whl 423.5 kB May 17, 2026	Python 3	none	any	Details

Total release size: 1.8 MB

Release files / ciscoconfparse2-0.9.18.tar.gz

Download URL	ciscoconfparse2-0.9.18.tar.gz
Size	1.3 MB
Tags	Source
SHA-256 checksum How to use checksums	`a28d4117907664b0231c2d3c5702ede9fdc3c7d78f9336fcb857b3d5bb983dc7`
BLAKE2b-256 checksum How to use checksums	`561e1680e8d0d13f493380aa80459c95ee74b0c5601da4150df1a7ea3104dc01`
Upload date	May 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/6.1.0 CPython/3.13.13`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/mpenning/ciscoconfparse2
Publishing commit: github.com/mpenning/ciscoconfparse2/tree/b50af0de89d7236f18ecbaa84fe13db07f6e4b6d

Workflow

Publishing configuration: github.com/mpenning/ciscoconfparse2/blob/b50af0de89d7236f18ecbaa84fe13db07f6e4b6d/.github/workflows/cicd-publish.yml
Publishing logs: github.com/mpenning/ciscoconfparse2/actions/runs/25993616759/attempts/1

Artifact

Subject: ciscoconfparse2-0.9.18.tar.gz
SHA-256 checksum: a28d4117907664b0231c2d3c5702ede9fdc3c7d78f9336fcb857b3d5bb983dc7 Verifying attestations

Release files / ciscoconfparse2-0.9.18-py3-none-any.whl

Download URL	ciscoconfparse2-0.9.18-py3-none-any.whl
Size	423.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`cb18dc7cd9e218855a38d6a9638462c23409bb1f4f25000a9e8f0dd64e91c73a`
BLAKE2b-256 checksum How to use checksums	`76bcc8f6922f7bf88790791c629c99458daba752ca4f1895d8bc0a481bdbae1c`
Upload date	May 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/6.1.0 CPython/3.13.13`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/mpenning/ciscoconfparse2
Publishing commit: github.com/mpenning/ciscoconfparse2/tree/b50af0de89d7236f18ecbaa84fe13db07f6e4b6d

Workflow

Publishing configuration: github.com/mpenning/ciscoconfparse2/blob/b50af0de89d7236f18ecbaa84fe13db07f6e4b6d/.github/workflows/cicd-publish.yml
Publishing logs: github.com/mpenning/ciscoconfparse2/actions/runs/25993616759/attempts/1

Artifact

Subject: ciscoconfparse2-0.9.18-py3-none-any.whl
SHA-256 checksum: cb18dc7cd9e218855a38d6a9638462c23409bb1f4f25000a9e8f0dd64e91c73a Verifying attestations