########
Commands
########

.. Keep this file organized alphabetically or I will cut you.

The default command is :code:`ssh`.

ACS
===
Plugin to interact with Cisco ACS. Allows for ACS device creation, ACS device info
gathering, and ACS device IP address changes directly through NSCLI.

Command
    nscli acs add $coreid

Command
    nscli acs info $coreid
Options
        -c, --config
            produce configuration for target device

Command
    nscli acs changeip $coreid $newip

Command
    nscli acs migrate $coreid $newcoreid

ADX
===
Plugin to interact upload and download ADX certificates and scripts from a Brocade.

Command
    nscli adx $device

Options
        --uploadssl
            upload ssl cert and keypair
        --uploadscript
            upload OpenScript to the ADX
        --listssl
            list all SSL certificates and keys on the ADX

Command
    nscli adx sanitize pull $device
        Pulls a config from a device and returns the sanitized version of it
Options
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli adx sanitize input
        Allows a raw config to be pasted into the terminal and returns the sanitized version of it
Options
    -i INPUT_FILE, --input-file INPUT_FILE
        Input a file instead of pasting to the terminal
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

ASA
===
ASA module is a parent module for ASA related sub-commands. All tools that relate
to the Cisco ASA will fall here.

Command
    nscli asa convert $device             Convert ASA config from pre-to-post 8.3
Options
        -s, --source SOURCE
            Source of config <torq|device>. Default is TORQ
        -v, --version VERSION
            Specify the to version to put into the config and boot
        --force
            Force the process of an unsupported config ASA config. USE WITH CAUTION!
        --noconvert
            Passthough ASA config without attempting to convert it.
        --nobackup
            Do not make a local backup of the config. (default is true)

Command
    nscli asa vpnusers $account          Get all ASA local users on an account

Command
    nscli asa vpnpeers $account          Get all ASA VPN peers on an account

Command
    nscli asa natfix $device             Applies no-proxy-arp and route-lookup to ASA NAT entries

Command
    nscli asa fogen $device              ASA failover config generator

Command
    nscli asa clientvpn $device          ASA Client VPN Generator

Command
    nscli asa codeupload $device         Upload current code standard to ASA.

Command
    nscli asa findnetworks $device       Find remote encrypt domains, print VPN config for peer.

Command
    nscli asa qc-static $dc $device      qc IPS pulled from NAT statics

Command
    nscli asa build $device $ha_device   Build config/image on an ASA.
Options
        -f [FILENAME], --filename [FILENAME]
            Name of .bin file to use in device build
        -m [MD5], --md5 [MD5]
            Md5 checksum of the associated .bin file

Command
    nscli asa shun $device $ip_address   Manage ASA Shuns via NSCLI
Options
        --user USERNAME
            ASA username, if different from ACS.
        --password PASSWORD
            Login password, if different from ACS. Enter '?' to be prompted.
        --enable ENABLE
            Enable secret, if different from ACS. Enter '?' to be prompted
        --searchonly
            Search the firewall for the address(es), but do not shun
        --delete
            delete IP from the ASA's shun table, i.e. "no shun <ip>"
        --ignore_mask NETMASK
            Ignore matches with masks of this length or shorter. For example,
            a value of "255.0.0.0" will cause the config search to ignore all
            /0 through /8 networks that would otherwise match. By default, only
            /0 network are ignored.

Command
    nscli asa recovery $device           Convert an ASA's config to easily paste it into a console connection
Options
        -manual
            Manual (offline) mode

Command nscli asa vpnprep $device       An interactive script to prepare VPN configuration for target device.


Command
    nscli asa version_check
       | Audit OS Code and/or AnyConnect version(s) on given ASA(s) (live or consoled) against FACTS API.
	   | Results are based on what is RUNNING/STORED on device

.. the next section is getting parsed as a definition list, followed by an option list.
   I'm not sure what to do about that, but it looks ok when it renders.  ¯\_(ツ)_/¯

Options
    \-c ``Device:Console:Port [Device:Console:Port ...]``, \-\-console ``Device:Console:Port [Device:Console:Port ...]``
        For cycladed ASAs : Device + Console information : Device:Console:Port,
        Once for each device, for example: 111111:con180\-2.dfw3:7015 111112:con180\-2.dfw3:7016
    \-d dev [111112 ...], \-\-device 111112 [111112 ...]
        Core device number(s)
    \-w, \-\-webvpn_only
        Check only for AnyConnect versions, not for code version.
    \-o, \-\-code_only
        Check only for OS code version, not for AnyConnect versions.
    \-v, \-\-verbose
        Provide step by step details of the tasks being done.
    \-k, \-\-keep_cache
        Keep and Use cached data for functions from previous call (if available).  
        If not specified, cache is wiped with each call. 
        DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 


Command
    nscli asa vpnprep $device           Prepare required commands to built a new IKEv1 L2L vpn on an ASA.

Command
    nscli asa md5 $device               Verify MD5 Checksum without unlocking ZSP
Options
        -file FILE
            Filename to check
        -checksum CHECKSUM
            Checksum to verify against

Command
    nscli asa static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>
        Preps or configures static address translations

Options:
    -m, --manual
        Makes the displayed commands usable in a copy/paste format for manual configuration
    -p, --perform_changes
        Performs the translation configurations on the network device.
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username, --username username
        Specify a different username to log in with. Will prompt for passwords.
    --no_dns, --no_dns_doctoring
        Prep or configure translations without dns doctoring (only works with ASAs)
    --no_qc
        Prep or configure translations, even if they do not pass QC
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli asa qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    -v
        Connects to Environment Manager and Core to return more detailed information about results
    -vv
        Connects to Environment Manager and Core to return more detailed information about results in CSV format
    -t, --timeout
        Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli asa ol <account> <IP>

Options:
    -p, --prefix
        Checks if the IP belongs to an object-group network prefix
    -r, --report
        Shows all configured objects and Object-groups for the specified account

Command
    nscli asa portalcomments -c <current> -n <new>
        Copies customer portal comments from current asa to new asa

Options:
    -c,
        Current ASA Firewall
    -n,
        New ASA Firewall

Command
    nscli asa pt $device $source_ip $destination_ip $destination_port

Options

    --sport SPORT   source port (default is 1024)
    -u, --udp       match UDP (default TCP)
    -D, --detailed  detailed output

Command
    nscli asa sanitize pull $device
        Pulls a config from a device and returns the sanitized version of it
Options
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli asa sanitize input
        Allows a raw config to be pasted into the terminal and returns the sanitized version of it
Options
    -i INPUT_FILE, --input-file INPUT_FILE
        Input a file instead of pasting to the terminal
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)


AWS
===
Generates updated ASA and Juniper objects

Command
    nscli aws aws2obj $object_name
Options
    -a, --asa
        Generate Cisco ASA Object-Group.
    -j, --juno
        Generate Juniper SRX Address-Book.
    -r REGION, --region REGION
        Filter by region. Ex. us-east-1.
    -s SERVICE, --service SERVICE
        Filter by the service. Ex S3.
    -6, --ipv6
        Include IPv6 entries.

Bandwidth
=========
Provides customer billable bandwidth for range provided

Command
    nscli bandwidth $account_number $start_date $end_date
Options
    -b, --bytes
        Display all numbers in Bytes
    -kb, --kilobytes
        Display all numbers in Kilobytes
    -mb, --megabytes
        Display all numbers in Megabytes
    -gb, --gigabytes
        Display all numbers in Gigabytes
    -tb, --terabytes
        Display all numbers in Terabytes
    --month
        Summarize down to months instead of days

Cbast
=====
The cbast command will log you into the customer bastion in that DC using
the VIP, if your key is not present it will exit with a warning.

Command
    nscli cbast $DC

Options
    -1
        Connect to cbast 1 instead of the VIP
    -2
        Connect to cbast 2 instead of the VIP

Certificates
=============
The 'certificates' option will have TLS certificate related sub-commands

Command
    nscli certificates prep
        Parse one or more cert/keys from tickets/attachments or local directory and prepare files to upload to net devices
Options
    -i INPUT_DIR, --input_dir INPUT_DIR
        Local directory where input (cert/key/CA) files are. E.g: ~/Downloads

    -t TICKET [TICKET2 ..], --ticket TICKET [TICKET2 ...]
        One or more ticket numbers (for the account) containing certificate / keys to process.
        PEM formatted data in given ticket comments will be looked at.

    -m, --manual_input
        Cert/Key/CAs to be parsed are provided manually over CLI

    -a, --attachments
        When specified, attachments from given ticket number are processed for certificate / keys.
        Flag will be ignored, if ticket number is not specified.

    -c, --ssltool_chain_fix
        When specified, CA chains for all certs are populated using SSL TOOL API.
        Pre-existing chains from source data will ONLY be looked at of SSL Tool cannot find a matching CA chain.

    -o [pfx], --output_format [pfx]
        By default output file(s) are in PEM format. Alternatively, PFX (with RAX default password) output is supported.
        Other formats may be added in future releases

    -p PASSWORDS, --passwords PASSWORDS
        Local file where passwords for PFX/encrypted files are stored. Put one password per line.

    -s, --ssltool_check_certkey
        When specified, results are re-validated via SSL Tool API.

    -v, --verbose
        Used for collecting debugging information (stroed on NSCLI cache folder)

Cfgstation
==========
The cfgstation option will log you into the config station in that DC.

Command:
    nscli cfgstation $DC

Options:
    -p, --public
        Attempt to connect directly using the public IP instead of the
        private IP.

Cloudflare
===========
Cloudflare module is a parent module for Cloudflare related sub-commands. All tools that relate
to the Rackspace Managed Cloudflare service will fall here.

Command
    nscli cloudflare add_members
        Add members to customer's existing Cloudflare account
Options
    -d 111111 [111111 ...], --device 111111 [111111 ...]
        Cloudflare device ID(s) from accounts for which the users are to be added

    -a ACCOUNT_ID [ACCOUNT_ID ...], --account_id ACCOUNT_ID [ACCOUNT_ID ...]
        Cloudflare account ID(s) under which the users are to be added

    -m, --my_accounts
        Users are to be added to ALL accounts, which you have access to

    --ignore_subscription_id
        DO NOT USE. FOR TESTING ONLY. Ignore 'Default Provider Subscription ID' associated with CF device in CORE. CF account ID must be provided in that case

    -r, --rax_all
        Add All users from RAX demo CF account added to new account

    -s, --rax_some
        Specific list of RACKER email-IDs, to be provided when prompted for

    -c, --customer_ids
        Specific list of CUSTOMER email-IDs, to be provided when prompted for

Command
    nscli cloudflare list_accounts
        List Cloudflare accounts you have access to
Options
    -n, --nsadmin
        List Cloudflare accounts visible to "nsadmin" service account

Command
    nscli cloudflare list_members
        List Cloudflare account members
Options
    -d 111111, --device 111111
        Cloudflare device ID. DO NOT use for multi-account operations.

    -a ACCOUNT_ID, --account_id ACCOUNT_ID
        Cloudflare account ID under which the zone needs to be provisioned

    --ignore_subscription_id
        USE WITH CAUTION. Ignore 'Default Provider Subscription ID' associated with CF device in CORE. CF account ID must be provided in that case

    -l, --all_ids
        List ALL users which are members of CF account

    -r, --rax_ids
        List of RACKER email-IDs which are members of CF account

    -c, --customer_ids
        List of NON-RACKER email-IDs which are members of CF account

Command
    nscli cloudflare logs
        Check (default) or enable HTTP logging for Cloudflare account. Logs stored @ Cloudflare.
Options
    -d 111111, --device 111111
        Cloudflare device ID(s) for relevant accounts for logs operation

    -a ACCOUNT_ID, --account_id ACCOUNT_ID
        Cloudflare account ID(s) (NOT CORE act) for logs operation

    -s, --status
        Check the status of HTTP logging for the zones under account/device

    -e, --enable
        Enable HTTP logging for the account/device. Applies to ALL zones under account.

Command
    nscli cloudflare new_account
        Create new customer Cloudflare account
Options
    -d 111111, --device 111111
        Cloudflare device ID

    -s SUFFIX, --suffix SUFFIX
        DO NOT USE. This is for testing only. Suffix to append to new CF account name.

Command
    nscli cloudflare new_zone
        Add new zone under customer's Cloudflare account
Options
        -a ACCOUNT_ID, --account_id ACCOUNT_ID
            Cloudflare account ID under which the zone needs to be provisioned

        -z customer-site.com [customer-site.com ...], --zones customer-site.com [customer-site.com ...]
            Zones to be provisioned

        -d 111111, --device 111111
            Cloudflare device ID

        --ignore_subscription_id
            USE WITH CAUTION. Ignore 'Default Provider Subscription ID' associated with CF device in CORE.
            CF account ID must be provided in that case

Command
    nscli cloudflare read_access
        Command to get read-access to Managed Cloudflare accounts

Options
    -d 111111, --device 111111
        Cloudflare device ID(s) associated with account(s) for which access is needed

    -a ACCOUNT_ID, --account_id ACCOUNT_ID
        Cloudflare account IDs (NOT CORE act) for which access is needed

Command
    nscli cloudflare usage_report
        Get report on parameters that affect Cloudflare billing for given period
Options
        -d 111111 [111111 ...], --devices 111111 [111111 ...]
            Cloudflare device ID(s) to get the data for

        -a a0c58bfb17fb35eb4f964152f532b747 [a0c58bfb17fb35eb4f964152f532b747 ...], --cf_account_ids a0c58bfb17fb35eb4f964152f532b747 [a0c58bfb17fb35eb4f964152f532b747 ...]
            Cloudflare account ID(s) (NOT CORE act) to get data for

        -c 123456 [123456 ...], --core_account_ids 123456 [123456 ...]
            CORE account ID(s) (NOT CORE act) to get data for

        -m MONTH, --month MONTH
            Month number (1 to 12) for billing data (current year ONLY)

        -k, --keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

        -1, --single_thread
            DO NOT USE. For troubleshooting ONLY. Some API calls are made serially instead of in parallel.

Command
    nscli cloudflare zsp <ticket>
        Ticket number with CF devices to unlock. Devices will automatically re-lock if ticket status changes to awaiting feedback or any form of solved, or after 8 hours.


Conkill
=======
Console Killer

Command
    nscli conkill

Options:
    -c, --console
        Console to kill connection too
    -p, --port
        Port on the console to kill

Credentials
===========
NSCLI caches some of your credentials. These commands let you interact with that cache. A return code of 0 means
the credential was successfully gotten, set, or deleted. A return code of 1 means the credential was not gotten, set,
or deleted. This could be because the credential did not exist in the cache, or because the user does not have 
permission to access the cache.

Command
    nscli credentials get <service> <username>

    nscli credentials set <service> <username>

    nscli credentials del <service> <username>

Options:
    service
        The name of the service that the credential applies to, like sso, acs, or core
    username
        Your username for the service, like your sso username or acs username

DCX
===
The DCX nscli option provides command-line interaction to the DCX API service
at api.dcx.rackspace.com.

Commands:
    nscli dcx api $sub_commands     Direct API calls to the DCX API
    nscli dcx batch $sub_commands   Environment Manager batch changes helper

dedos
=====
Dedos releated sub-commands

Command
    nscli dedos [-f] $file [-d] $device
Options
    -d, --device                                 Use live data from the ASA device
    -f, --file                                   Parse the data from a local file (show conn output)


DCX Bridge Services
===================
The DCX Bridge Services will allow the user to List/Create/Delete Bridge Containers and configured vlans

Command
    nscli dcx_bridge add_endpoints $container_id $vlan_id               Removes an endpoint/vlan_id from a given container
Options
    -y
        Automatically confirm vlan/endpoint to be add from container

Command
    nscli dcx_bridge create_container $name $id_num             Creates a container given configured vlan ids.
Options
    -t, --type
        Specify 1 or 2. Type 1 - used by RackConnect, Type 2 - RPIB - used for AggExnet zone bridging

Command
    nscli dcx_bridge create_vlans               Creates a configured vlan given vlan number and either aggr name or zone name
Options
    -z
        zone_name,vlan_num
    -a
        aggr_name,vlan_num

Command
    nscli dcx_bridge delete_container $id_num               Delete container for given container id
Opitons
    -y
        Automatically confirm container to be deleted

Command
    nscli dcx_bridge delete_vlans               Delete a configured vlan given configured vlan id, vlan number and aggr name pair, or vlan number and zone name pair
Options
  -i, --id
        Delete a configured vlan given configured vlan id
  -z, --zone
        Delete a configured vlan given zone and vlan number pair
  -a, --aggr
        Delete a configured vlan given aggr and vlan number pair
  -y
        Automatically confirm configured vlan to be deleted

Command
    nscli dcx_bridge list_container             Show container information for given container id or name
Options
  -i, --id
        Show container information for given container id/s
  -n, --name
        Show container information for given container name
  -vid, --vlan_id
        Show container information for given vlan id
  -e, --expand
        Show vlan information as part of the container

Command
    nscli dcx_bridge list_rpib_aggr             List all aggrs associated with the RPIB (Rapid Provisioning Internal Build) L2Service

Command
    nscli dcx_bridge list_vlans
Options
  -i, --id
        Show vlan information for given configured vlan id/s
  -z, --zone
        Show vlan information for given zone and vlan number pair
  -a, --aggr
        Show vlan information for given aggr and vlan number pair

Command
    nscli dcx_bridge new_bridge $zone_a_side $vlan_a_side $zone_b_side $vlan_b_side $type   Step through process of creating new bridge
Options
  -n, --name
        Name for the bridge/container that will be created
  -y
        Automatically confirm new bridge creation

Command
    nscli dcx_bridge remove_endpoints $container_id $vlan_id        Removes an endpoint/vlan_id from a given container
Options
  -y
        Automatically confirm vlan/endpoint to be removed from container

F5
===
F5 module is a parent module for F5 related sub-commands. All tools that relate
to the F5 product line will fall here.

Command
    nscli afmrulegen              Create AFM rules using NSCLI
Options
    -src, --source
        source ip address(es) for the rule (required for single rule)
    -dst, --destination
        destination ip address(es) for the rule (required for single rule)
    -port, --port
        destination port(s) for the rule (required for single rule)
    -proto, --protocol
        protocol for the rule (tcp, udp, ip, icmp | required for single rule)
    -desc, --description
        description for rule (default decription will contain ACS user/ticket number)
    -rname, --rname
        name of the new rule (default is to do ALLOW-<ticket>-<r_cnt>
    -bi, --bidirectional
        bool arg used to indicate if the rule should be allowed in both directions (single rules only)
    -csv, --csv
        name of the csv file for batch rule creation (required for batch rule)
    -delim, --delim
        delimiter for the csv file, default is tab to allow for copy paste from excel
    -f, --fields
        fields for the csv, default are "Source IP","Destination IP","Port #","Business Justification",
        "Bi-directional","Protocol"
    -r, --refresh
        bool arg, do not use local cache for rule, pull latest config from target device
    -sonly, --sonly
        print only the show security firewall matching rule commands
    -conly, --conly
        print only the create/modify security firewall rule commands
    -t, --ticket
        ticket for rule name/description (required for any rule type)
    -d, --device
        device the rule should be created on (required for any rule type)
    -unittest, --unittest
        used for to test unittest logic

Command
    nscli f5 rcvlan $device          Generate RC VLAN commands (beta)

Command
    nscli f5 certloader $device         Upload cert/key/CABundle to f5 with automated assistance

Options
    -c, --create     Create new SSL Profile with new cert/key pair
    -u, --update     Update existing SSL Profile with new cert/key pair
    -p, --prep_only  Only prep the changes and rollback for user review
Command
    nscli f5 scripts $device         Uploads custom scripts to F5

Command
    nscli f5 haconfig $device        F5 HA Config Generator

Command
    nscli f5 rebuildha $device       Rebuild HA Config on F5s

Command
    nscli f5 md5 $device             Verify MD5 Checksum without unlocking ZSP
Options
        -file FILE
            Filename to check
        -checksum CHECKSUM
            Checksum to verify against
Command
    nscli f5 sip $account $ip        Search IP In Pools a given account


Command
    nscli f5 static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>
        Preps or configures static address translations

Options:
    -m, --manual
        Makes the displayed commands usable in a copy/paste format for manual configuration
    -p, --perform_changes
        Performs the translation configurations on the network device.
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username, --username username
        Specify a different username to log in with. Will prompt for passwords.
    --no_dns, --no_dns_doctoring
        Prep or configure translations without dns doctoring (only works with ASAs)
    --no_qc
        Prep or configure translations, even if they do not pass QC
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli f5 qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    -v
        Connects to Environment Manager and Core to return more detailed information about results
    -vv
        Connects to Environment Manager and Core to return more detailed information about results in CSV format
    -t, --timeout
        Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli f5_ssl_audit [-h] [-v] [-e] [-u] [-j | -c] [-a | -d ]

Options:
    -v, --virtualservers
        Display VS per profile
    -e, --expired
        Display expired only
    -u, --unused
        Display profiles not applied to VS's only
    -j, --json
        Output as JSON formatted
    -c, --csv
        Output as CSV
    -a, --account
        CORE Account Number
    -d, --device
        CORE Device NUmber

Command
    nscli f5 sanitize pull $device
        Pulls a config from a device and returns the sanitized version of it
Options
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli f5 sanitize input
        Allows a raw config to be pasted into the terminal and returns the sanitized version of it
Options
    -i INPUT_FILE, --input-file INPUT_FILE
        Input a file instead of pasting to the terminal
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli f5 pt $device $source_ip $destination_ip $destination_port

Options
    --sport SPORT   source port (default is 1024)
    -u, --udp       match UDP (default TCP)
    -D, --detailed  detailed output


Facts
=====
NSCLI interface for pulling information from the NetSec Facts API

Command:
    nscli facts version $platform
        Prints the NetSec standard version for the given platform (asa/ftd/f5/adx/srx/netscaler)

Options:
    -m, --model
        Filters the platform standards to only a specific model

Command
    nscli facts version $device
        Prints the NetSec standard for the specific platform model of the device provided


Finder
======
NSCLI implementation of Hozers Finder tool

Command:
    nscli finder $search_string

Options:
    -s, --seniority
        View the finder seniority report
    -l, --locations
        Employee count by location


Fleet Tools
===========
NSCLI tools for acting/reporting on large chunks of the fleet.

Command:
    nscli fleet_tools naas
        Execute arbitrary commands against an arbitrary list of Netsec devices.

Options:
    -t, --threads
        Number of threads to use for this task.
    --device_type
        choices: "cisco_asa", "f5_tmsh"
        Device type, ASA by default.
    -s, --send_config
        Use the NAAS ``/send_config`` method to deliver configuration changes to a device
    --save_changes
        If applying config (via --send_config) also save these changes
    -c, --commands
        Command(s) you wish to send, separated by a semi colon ";" and enclosed in single quotes ''.
    --command_file
        File with commands/configuration to pass to devices, separated by new line
    -d, --devices
        1 (or more) Device Number(s), space separated, must all be same device type.
    -device_file
        File with Device Numbers, separated by new line, must all be same device type
    -o, --output_file
        File to output results to, if none output is to STDOUT
    --custom_credentials
        Provide custom credentials for access to these devices (uses your TACACS credentials by default).

Command:
    nscli fleet_tools mac
        View MAC executed maintenances against devices.

Options:
    -m, --maint
        View a requested Maintenance
    -q, --qc
        View a requested Qc
    -r, --run
        View a requested Run
    -i, --id
        Id value of Mac execution.



FTD
===
| FTD module is a parent module for FTD related sub-commands. All tools that relate to the FTD product line will fall 
 here. YAML files can be generated by torq-firekick with the templates that start with _FTD. Most likely, one would 
 create an SSH tunnel to bounce the https connection through a bastion to the FTD we are managing. Sample command:
| nscli ftd nat -c nat.yaml -a 127.0.0.1 -u admin -p mypassword --port 8443

Command
    nscli ftd flexconfig

    nscli ftd nat

    nscli ftd networking

    nscli ftd objects

    nscli ftd platform

    nscli ftd secpol

Options
    -a, --address
        address (management ip) of the FTD we are managing
    -c, --config_file
        config file in YAML format
    -p, --password
        password
    -P, --port
        use this port for the API calls to the FTD
    -u, --username
        username to run the API commands against
    -v, --verifytls
        verify the FTD's TLS certificate authenticity and validity


Goast
=====
Perform Goast checks on a device.  Goast (formerly ROAST) is a QC tool that runs through
Rackspace stadard configuration items, and validates config compliance.

Command:
    nscli goast $device

History
=======
Lists tickets for the specified user within the last month

Command
    nscli history

Options
    -u  [user] Specify a user to pull ticket history for.

IDS
===
Alert Logic IDS related sub-commands

Command
    nscli ids cert_list $account
        Gather SSL Certificates installed on the CORE account provided
Options
    -a, --al_account                            Account provided is an Alert Logic account #, NOT CORE
    -f, --filter                                Filter returned certs matching a select word or phrase
    -s, --ssl_tool                              Provide additional details from SSLTool for each cert. ONLY LEGACY. NOT MDR.

Command
    nscli ids cert_uploader $device $directory  upload a local pfx to the associated Alert Logic account
                                                of an Alert Logic IDS.
Options
    -r, --recursive                             Upload all PFX SSL Certificates found in the provided directory
    -a, --al_account                            Account provided is an Alert Logic account #, NOT CORE
    -p, --password                              Prompt for password to use for all certs

Imperva
=======
Imperva related sub-commands

Command
    nscli imperva mx_update $device                      Gather gateways and update DB for Imperva MX device
    nscli imperva snmp_check $mx_device(s)               Process gateways on each MX to check the snmp status

Info
====
The info command is a set of utilities that will pull device information
from core, port status from switch api, and configuration using the switch
libraries.

Supported identifiers:
    - <CORE Ticket>, example: 170117-07799
    - <CORE ID>, example: 349763
    - <IP Address valid in CORE>, example: 50.56.20.10
    - DP-<Mydatapipe DeviceID>, example: DP-86926
    - DP-<IP Address valid in mydatapipe>, example: DP-206.55.127.120

Command
    nscli info $identifier [$identifier...]

Options
    -s, --simple
        Simple information print out, this will only include the device number,
        primary ip, and switch port information.

    -p, --portinfo
        Display the device information and port status using Switch API.

    -m, --macinfo
        Diplays the device information, port status and mac address information
        from Switch API.

    -c, --config
        NSCLI will attempt to gather the configuration for each device port, by
        logging into the switches.

    -n, --nat
        Inlcude the nat comments for each device. This will be a list of public
        and private IPs.

    -e, --edge
        Attempts to identify the edge device by using Switch API.

    --portcompare
        Runs bulk port comparisons against each other.
    
    -t, --table
        Represents tabular information when used after identifier(s) or shows a 'summary table' when used after any of -p/-pp/-pe/-pd options

    -ip, --ip
        Display ip assignments from env manager in tabular format
    
    -D, --ip_vlan_details
        Display detailed result of ip assignments and switch port-vlan info in tabular format

    -sv, --sw_port_vlan
        Display only switch port-vlan info in tabular format

ip
====
| nscli ip can run ping, traceroute, public aggr and route checks.
| aggr and routes functions are designed for use with Rackspace IPs.
| ping and trace functions can be used with external IPs too.

| the -c (ping count) and -t (ticket) flags are for the ping function only.
| routes takes device numbers only.

Commands
    nscli ip ping $core_device $ip $ip_block $ticket
        Pings IP addresses.

Options
    -c, --count
        Works with the ping command. Lets you specify ping count.

    -t, --ticket
        Works with the ping command. Lets you ping devices on a ticket.

    -l, --long
        Works with the ping command. Show de response times.

    -s, --store
        saves the run state

    -m, --compare
        compare save state with the actual run

    nscli ip aggr $core_device $ip $ip_block
        Displays a table showing the current aggr.

    nscli ip trace $core_device $ip $ip_block
        Displays a traceroute for each IP.

    nscli ip routes $core_device
        Displays IP blocks routed to a device on the A and B aggr and pings each IP.

Options
    -e, --em_blocks
        Get routed block info directly from environment manager.

Juniper
=======
Juniper module is a parent module for Juniper related sub-commands. All tools that relate
to the Juniper product line will fall here.

Command
    nscli juniper junospw     Decode Junos encypted '$9$' strings.

Options
    -e, --encrypted-string
        Non-interactive mode. nscli juniper junospw -e '$encrypted_string'
        Note: Bash can sometimes attempt to interpret 'special' characters as commands.
        It is highly likely your string will contain these characters. Ensure your encrypted
        string is wrapped in single quotes (see above example), to avoid this happening.


Command
    nscli juniper pt $device $source_ip $destination_ip $destination_port

Options
    -s SPORT, --sport SPORT
                          source port (default is 1024)
    -u, --udp             match udp (default tcp)
    -c, --command         prints the juno match policy command only
    -P, --public          Connect via Public IP.
    -U USER, --user USER  Specify the user.

Command
    nscli juniper sanitize pull $device
        Pulls a config from a device and returns the sanitized version of it
Options
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli juniper sanitize input
        Allows a raw config to be pasted into the terminal and returns the sanitized version of it
Options
    -i INPUT_FILE, --input-file INPUT_FILE
        Input a file instead of pasting to the terminal
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli juniper static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>
        Preps or configures static address translations

Options:
    -m, --manual
        Makes the displayed commands usable in a copy/paste format for manual configuration
    -p, --perform_changes
        Performs the translation configurations on the network device.
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username, --username username
        Specify a different username to log in with. Will prompt for passwords.
    --no_dns, --no_dns_doctoring
        Prep or configure translations without dns doctoring (only works with ASAs)
    --no_qc
        Prep or configure translations, even if they do not pass QC
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli juniper qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    -v
        Connects to Environment Manager and Core to return more detailed information about results
    -vv
        Connects to Environment Manager and Core to return more detailed information about results in CSV format
    -t, --timeout
        Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Luno_ng
=======

    Tool to utilise the Luno API. Some input checking is provided but engineers are responsible for their inputs
    
    See LUNO wiki for details of commands in the LUNO NG client section or use -h.

    https://raxglobal.sharepoint.com/sites/OneWiki-NetworkSecurity/SitePages/LUNO%20(Lazy%20Upgrade%20of%20Network%20Operating%20System)%20-%20F5%20Edition.aspx

Command
    luno_ng f5_relicense -d <required>
        Relicense using F5s external licensing server.

Command
    luno_ng f5_upgrade_part1 -d <required>
        Carries out upload and install of code, boot variable is not changed, includes validation.
        
        Staging only (no reboot)
        
Command
    luno_ng f5_upgrade_part2 -d <required>
        Carries out reboot into new code with VIP checks, includes license check and validation.
        
        Upgrade (includes reboot)

Command
    luno_ng f5_upgrade_full -d <required>
        Carries out install of already loaded code, includes VIP check, validation and re-license.

Command
    luno_ng f5_clean_up -d <required>
        Removes volumes except, live, target code, last two volumes installed.

Command
    luno_ng f5_validate -d <required>
        Carries out all validation checks covering upgrade caveats.

Command
    luno_ng f5_status -d <required> -i <required>
        Retrieves current or completed job status for jobs that are still in the DB for F5s, based on given job ID.

Command
    luno_ng f5_volume_id -d <required>
        Display volume name required by luno.


Options

    -d, --device
        Core device ID
    -i, --id
        Luno status ID (use only in f5_status at this time)

Example

    luno_ng f5_upgrade_part1 -d 784223

MACAddress
==========
Returns the device number and switchport associated to the MAC address if it can be found. The MAC address can be entered in any format.

Command
    nscli macaddress <macaddress>

Options:
    --silent              Disables printed messages during execution


Maint
=====
Maintenance related plugins

Command
    nscli maint asa
        Script to automate migrating ASA platforms

	*Options*

		\-c CURRENT_DEVICE, \--current_device CURRENT_DEVICE
			Current active/standby or single device
		\-n NEW_DEVICE, \--new_device NEW_DEVICE
			New primary or single device
		\--manual
			Manual (offline) mode
		\-f FAILOVER_INTERFACE, \--failover_interface FAILOVER_INTERFACE
			Interface name for non-standard failover interface (e.g. GigabitEthernet1/6)
		\-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 
Command
    nscli maint asa_to_afm [DEVICE]
        Convert ASA ACL's to AFM

    positional arguments:

		device
			ASA device number

Command
    nscli maint cabling-audit [DEVICE] -t [TICKET]
		| Perform cabling audit to establish how device NICs connect to switch-ports.
		| CAUTION: use for breand new devices ONLY
		| DO NOT use on live/online devices as interfaces/switch ports associated will be WIPED / SHUT DOWN

	*Options*

	    -t TICKET, \--ticket TICKET
			Core ticket number

	    -c Device:Console:Port [Device:Console:Port ...], \--console Device:Console:Port [Device:Console:Port ...]
	    	| Device:Console:Port, once for each device, Example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016.
			| This ONLY applies for ASA/FP.
			| F5s need DRAC for code interaction.

		\--rcg
			Treat RackConnect port as ExNet port. Should be used when RackConnect Global port is on the FW.

Command
    nscli maint cyclade_asa_upgrade
        | Checks if software upgrade for ASAs on cyclade (console)  is needed
        | and attempts to do change prep for upgrade by using KIR VLAN / DHCP.
        | By default, also checks for both code and anyconnect files versions on device

	*Options*

		\-c Device:Console:Port [Device:Console:Port ...], \--console Device:Console:Port [Device:Console:Port ...]
			| Console information for EACH device, in format 'Device:Console:Port' (space separated).
			| For example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number

		\-k, \--keep_cache 
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

		\-w, \--webvpn_only 
			Check only for AnyConnect versions, not for code version.

		\-o, \--code_only
			Check only for OS code version, not for AnyConnect versions.

		\-v, \--verbose
			Verbose output for more step-by-step updates and feedback

Command
    nscli maint decomm
        | Plugin to assist with cleanup of decommissioning automation tickets with failures.
        | DOES NOT apply to general decomm. work

	*Options*

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number (REQUIRED)

		\-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

Command
    nscli maint escalation
		Escalates ticket (may be depricated soon)

Command
    nscli maint failover [DEVICE]
		Generate failover testing plan (ASA, F5, ADX and PaloAlto)

Command
    nscli maint freeze [DEVICE]
		Add configuration freeze to network devices

	positional arguments:

		device
			Device number (Active or Standby)

    *Options*

		\-r
			Remove config freeze sku

		\-priv
			Use private comments

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number (which will get 'freeze' updates)

Command
    nscli maint ftd diff_asa
		Diff FTD vs ASA config for migration prep / QC

    *Options*

		\-a '/Users/asa.txt', \--asa_config '/Users/asa.txt'
			REQUIRED. Local file with source ASA configuration (show run) for comparison

		\-f '/Users/ftd.txt', \--ftd_config '/Users/ftd.txt'
			REQUIRED. Local file with converted FTD configuration (show run) for comparison

Command
    nscli maint fw_convert
		Convert firewall rules between ASA and F5 platforms

    *Options*

        \-c CURRENT_DEVICE, \--current_device CURRENT_DEVICE
            Current device to convert

        \-d DESTINATION_DEVICE, \--destination_device DESTINATION_DEVICE
            Target device you want to convert to

        \-f FILE, \--file FILE
            Location of source config file

        \--manual
            Manual (offline) mode

Command
    nscli maint f5_license [DEVICE]
		Generates maintenance steps in order to apply utilitu License

	positional arguments:
		device
			Device number

    *Options*

		\-g, \--gtm
			Provision GTM

		\-f, \--afm
			Provision AFM in ADC mode

		\-a, \--avr
			Provision AVR

Command
    nscli maint lb_convert
		Convert load-balancer configurations from Brocade ADX to BigIP-LTM or Citrix ADC.

    *Options*

        -d 123456, --device 123456
        	Source device number. Cannot be specified along with '-f'. MUST be ADX (at this time)

        -f '/Users/config.txt', --input_file '/Users/config.txt'
            Local file with source device configuration. Cannot be specified along with '-d'.
            MUST be ADX (at this time)

        -o (adc or ltm), --out_platform (adc or ltm)
            Target LB platform. F5 LTM (ltm) or Citrix ADC (adc) (previously NetScalar)

        \--ns_dont_force_snat
            Applies to Citrix NS/ADC conversion ONLY. For ADC configuration, SNAT will be 'enforced'
            as default configuration for ALL VIPS.
            If you need to stick to the settings in source configuration, pass this argument.

        -k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

        -v, \--verbose
            Verbose output for more step-by-step updates and feedback

Command
	nscli maint luno
		Template for LUNO maintenances

Command
    nscli maint migrate-ucs
		Migrates configuration from current device to target device

	*Options*

		\-c C
			Current F5 device

		\-n N
			New F5 device

		\--no_acs_add
			DO NOT add device to ACS. Plugin will try to ADD given new F5 to the ACS.
			Use this flag to skip this step, if device has been previouly added

		\-k, \--keep_cache
			Keep and Use cached data for functions from previous call (if available).
			If not specified, cache is wiped with each call

Command
    nscli maint minor
        minor code upgrade prep for one of the following platforms: 
        ASA, PaloAlto FW, F5, ADX, Citrix ADC (Netscaler)
        
        Either -d or -o is required

    *Options*

        -d DEVICE_NO
            Either active/standby device or single device
        
        -o [palo], \--offline [palo]
            Only available for PaloAlto devices at this time. Offline mode to print generic steps.

        -t TICKET_NO, \--ticket TICKET_NO
            Ticket number (to refer in maintenance plan). Does not work with ASA / ADX device type.
        
        -b, \--brief
            Only applicable for PaloAlto devices. Print upgrade path ONLY and no prep / plan output
    
        -u, \--user
            Login to devices using custom credentials in case it does not allow TACACS auth.

        -k, \--keep_cache
            | Keep and Use cached data for functions from previous call (if available). 
            | DO NOT USE, unless you have a specific issue like timeouts / API failures. 
            | Does not work with ASA / ADX device type. If not specified, cache is wiped with each call

Command
    nscli maint nd_auto_parallel
		| Streamlines parallel migration process (ASA code only).
		| Process has following high-level steps:
		| 	cabling audit (run or parse results) -> ASA config. conversion -> ASA code upgrade (if needed)
		| 	-> switch changes > ASA config. apply -> parallel migration plan.

	*Options*

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number

		\-c Device:Console:Port [Device:Console:Port ...], \--console Device:Console:Port [Device:Console:Port ...]
			| Console information for EACH device, in format 'Device:Console:Port' (space separated).
			| For example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016

		\-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

		\-s, \--skip_ticket_update
			Skips calls to external modules : OwnPrep, Freeze. This avoids duplicate updates while testing and repeat calls due to any issues with first run

		\-u, \--skip_upgrade_check
			Skips Code and Anyconnect version check step. This avoids duplicate checks while testing and repeat calls due to any issues with first run

		\-v, \--verbose
			Verbose output for more step-by-step updates and feedback

		\-x, \--no_execute
			Skips 'auto-push' over console and switch changes

		\-p <dfw or ord or..>, \--proxy_bast_dc <dfw or ord or..>
			Netbast DC location to proxy out for Console connection, if device DC cannot be used

		\--unipede_timeout
			| Set timeout value (in seconds, default = 300) for Unipede API calls, which NSCLI uses to get switch configuration data. 
            | Use in case you see errors/timeouts during switch data processing phase.

Command
    nscli maint palo base_config
        Generate Base Palo Alto configuration to be used ASA to Palo Alto Migration
        
        usage: nscli maint palo base_config [-h] (-m | -b) -n NEW_DEVICE_NO -t TICKET_NO [-S] [-A] [-k] [-c CURRENT_DEVICE_NO] 
        [--testing]

	*Options*

        \-m, \--migration
            Indicates that this is an ASA -> PA migration

        \-n, \--newbuild
            Indicates that this is an brand-new PA build

		\-c CURRENT_DEVICE_NO, \--current_fw CURRENT_DEVICE_NO
			Current FW core device number. REQUIRED IF it's a migration

		\-n NEW_DEVICE_NO, \--new_fw NEW_DEVICE_NO
			REQUIRED. New Palo Alto core device number(s)

		\-t TICKET_NO, \--ticket TICKET_NO
			Core ticket number

        \-S, \--skip_code_upgrade
            Skip code upgrade check / steps generation ('maint minor' call)

        \-A, \--skip_aggr_check
            Skip Aggr / MAC ID discovery for automatic HA group determination. 
            Needed if PAs don't connect to normal RXT aggr topology / colo switches etc.

		\-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

        \--testing
			DO NOT USE. Skips some validations / calls to allow faster testing

Command
    nscli maint palo parse_asa 
		| Prepare ASA configuration to be fed into Expedition tool for migration. 
        | It removes RAX kick and adds some ACL changes to facilitate migration
        | Also may create some Palo configuration commands (for NAT etc) based on ASA configuration.
    
        usage: nscli maint palo parse_asa [-h] (-s ASA_DEVICE_NO | -o) [-v] [-k]

	*Options*

        \-s ASA_DEVICE_NO, \--source_asa ASA_DEVICE_NO
            Source ASA core device number(s)

        \-o, \--offline
            Offline mode. ASA configuration is gathered from local files.

        \-v, \--verbose
            Provide step by step details of the tasks being done.

        \-u, \--user
            Login to devices using custom credentials in case it does not allow TACACS auth.

        \-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

Command
    nscli maint palo post_exp
        Fix up configuration given by Expedition migration tool to apply on PA

	*Options*

		\-f LOCAL_FILE_PATH, \--file LOCAL_FILE_PATH
			REQUIRED. File with configuration (set commands) given by Expedition migration tool

		\-v, \--verbose
			Provide step by step details of the tasks being done.

		\-k, \--keep_cache
			Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

Command
    nscli maint parallel
		Maintenance generator for Parallel migrations v2

	*Options*
	  \-c
	  		Current network device
	  \-n
	  		New network device
	  \-t
	  		Ticket Number

Command
    nscli maint port-audit
		Port audit for ticket or list of devices

	*Required Options (choose 1)*

		-t , \--ticket
			Ticket number to gather the device list from
		-d , \--device
			Space delimited device list
		-u , \--update-switch
			Force Unipede to update for a single switch/aggr and then ends

	*Additional Options*

		-f, \--force
			Force Unipede to refresh all switch and aggr data

        -y  [ ...], --porttype  [ ...]
            Include ONLY specified port type(s) in results, exclude ones not specified. e.g drac public

        -l, \--logs
            Pull the switch-port logs for ports involved

		\--full
			Full table including Speed/Duplex

		-v, \--verbose
			Verbose output for more step-by-step updates and feedback

		-nc, \--nocompact
			Adds blank lines to the table output for easier reading

		-all, \--downstream
			Includes downstream switches in the table output

		-noenv, \--noenvironmentcheck
			Skips the ENV check from the DCX API

		-pt, \--print-to-ticket
			Print output to ticket private comment instead of terminal
        
        -k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

Command
    nscli maint port-migrate
		Assists in switch-port configuration for migrations (copy port settings from one device to another)

    *Options*

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number (REQUIRED)

		\-r, \--replicate_ports
			New device(s) ports set up 'same as' current reference device.
			Required co-arguments specified below.

		\-m, \--migration_ports
			Existing device moving to new location (cab migration, migration ports in core).
			Required co-arguments specified below.

		\-u, \--user_mapping
			Provide port mapping manually. Core migration port designation is ignored.

		\-s, \--self_review
			Print summary comparison table for SELF QC/review by person who 'prepped' the changes.
			This ONLY applies if data from previous run (where prep was done)
			is in 'cache' folder. ONLY needs -t, and ignore other arguments.

		\-q, \--qc_table
			Print switch port mapping and configuration comparison table for QC/review.
			No CHANGE PREP is done with this option. TO BE USED WITH '-r or -m' (with
			appropriate co-arguments). Will be IGNORED with -s

		\--qc_with_cache
			Only valid with -q/\--qc_table option. In case switch info. gathering calls are FAILING,
			use this option to enable 'caching' for attempting to reduce API/ Switch login issues

		\-a, \--allow_up_ports
			Allow target 'switch ports' to be 'UP' during initial checks

		\-e, \--enable_ports
			Enable target 'switch ports' post changes. They are left in disabled state by default.

		\-k, \--keep_cache
            Keep and Use cached data for functions from previous call (if available).  
            If not specified, cache is wiped with each call. 
            DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

		\--no_drac
			Exclude DRAC ports for the prep. DRAC ports are included in changes by default. Has same effect as: --exclude drac

		\--exclude service_1 [service_2 ...]
			List of 'port types' or 'services' to exclude from mapping / configuration. Like drac, rackconnect etc.
			Matches service names that contain keywords from exclude list.   

		\--port_description {none | maint}
			By default, server name will be used as port description on target ports.
			You can choose 'none' for no description or 'maint' for description as 'MAINT-<TKT NO>.

		\--speed_duplex
			You will be prompted for speed/duplex settings for each switch port TYPE

		\--vlan_mapping
			You will be prompted for VLAN mapping. To be used for 'zone-migrations'

		\-x, \--no_execute
			Skips 'auto-push' for switch changes

		\-v, \--verbose
			Verbose output for more step-by-step updates and feedback


		-r/\--replicate_ports expects following arguments:

			\-c 111111, \--current_device 111111
					Current device (Source of switch configuration)

			\-n 222222 [222222 ...], \--new_device 222222 [222222 ...]
					New device(s) (Target(s) of switch configuration)


		-m/\--migration_ports expects following arguments:

			\-d 123456 [123456 ...], \--devices 123456 [123456 ...]
					Devices with migration ports

			\-p, \--ports
					Optional. Designate migration ports manually, if they are not marked in CORE.

Command
    nscli maint port-migrate-old
		Print commands to configure migration ports including trunking, vlandb etc.

    *Options*

		\-h, \--help
			show this help message and exit

		\-d [DEVICES ...], \--devices [DEVICES ...]
			Input device numbers that have migration ports(ex. device device etc)

		\-t 123456-78900, \--ticket 123456-78900
			Ticket number

		\-m, \--manual
			Manual Port mapping for Migration

		\-n, \--notes
			Add sections for notes in the prep

		\-p, \--para
			Prep ports in shutdown for staging parallel otherwise 'no shutdown' is assumed

		\-g, \--gig
			Override speed with 1000MBPS

		\--auto
			Override speed/duplex with auto/auto

		\--diff
			Only return config changes for interfaces that aren't identical

		\--diff-ignore-speed-duplex
			Only return config changes for interfaces that aren't identical, excluding speed/duplex from the diff

		\--dc DC
			Specify DC (only for \--manual)

		\-i, \--info
			Only return port-mapping

		\-q, \--quick
			Don't force a config refresh in unipede

		\--ignore-up
			CAREFUL This ignores up interfaces

		\--vlan-map
			Allows for vlan map if vlans are changing

		\--bugs
			List known issues with the script

Command
    nscli maint prep
		Prints a generic maintenance prep template

Command
    nscli maint protected_ips
		Prints pool members that should be added as protected ips on a WAF

Command
    nscli maint qc asa
		Assists in QC for ASA to ASA migrations

	*Options*

		\-single
			Print asa single to single parallel migration qc template

		\-single-ha
			Print asa single to ha parallel migration qc template

		\-ha-ha
			Print ha to ha parallel migration qc template

		\-directswap_single
			1 for 1 direct swap for single device

		\-directswap_ha
			1 for 1 direct swap for ha devices

		\-t Ticket, \--ticket Ticket
			Auto-QC for asa parallel migrations

		\-u acs | custom | rax, \--user acs | custom | rax
			By default, RAX default credentials ('rax') will be used to log-in to FW on console.
			You can choose 'acs' to use YOUR ACS credentials OR 'custom' to get prompted for credentials instead, if needed.

		\-c Device:Console:Port [Device:Console:Port ...], \--console Device:Console:Port [Device:Console:Port ...]
			Device:Console:Port, for example: 111111:con180-2.dfw3:7015.
			This ONLY applies for ASA code QC.
			Provide for PRIMARY FW ONLY. NO need for HA pair details.

		\-k, \--keep_cache
			Keep and Use cached data for functions from previous call (if available).
			If not specified, cache is wiped with each call

Command
    nscli maint qc f5
		QC steps for F5 parallel migrations

	*Options*

		\-h, \--help
			show this help message and exit

		\--single
			QC steps for F5 single to single parallel migration

		\--single-ha
			QC steps for F5 single to ha parallel migration

		\--ha-ha
			QC steps for F5 ha to ha parallel migration

		\--afm_single
			QC steps for F5 afm single to single parallel migration

		\--afm_ha
			QC steps for F5 afm ha to ha parallel migration

		\-u, \--user
			By default, ACS/TACACS credentils will be used to log-in to the F5.
			If you need to use different login, use -u flag. You will be prompted to provide user-id / password. 

		\-t Ticket, \--ticket Ticket
			Auto qc for f5 parallel migrations 

		\-k, \--keep_cache
			Keep and Use cached data for functions from previous call (if available).
			If not specified, cache is wiped with each call 
        
		\-c current_device, \--current_device current_device
			Current Device Number

		\-n new_device, \--new_device new_device
			New Device Number

Command
    nscli maint rcv3
		Maintenance templates for Rackconnectv3

	*Positional arguments*

	  device
	  	RCv2 connected device of the environment

	*Additional Options*

		-v2, \--version2
			Template for RCv2 to RCv3 maintenances

		\-cleanacl
			Provide commmands to cleanup outside ACL after v2 to v3 upgrade

Command
    nscli maint qc generic
		Prints generic qc steps

Command
    nscli maint qc para
		Prints qc steps for parallel migrations

Command
    nscli maint sweep
		Allows Ping sweeping IPs behind an edge device. Uses NAT's (if possible) else Routed IP blocks are used

	*Options*
		-n, \--add-nats
			Also print the NAT (if available)
		-t TICKET_NUMBER, \--print-to-ticket TICKET_NUMBER
			Also output the table to a ticket
		-s, \--store
			Store results for later comparison
		-c, \--compare
			Compare live results against stored results
		-b, \--blocks_only
			Skip NAT evaluation, use Routed IP blocks for scanning

Command
    nscli maint sw
		SwitchRunner API

	*Options*
		status
			List/Enable/Disable switch ports

		*Option arguments*
			-l, \--list
				list switch port status
			-m [enable|disable], \--modify [enable|disable]
				modify switch port status.
			-t TICKET, \--ticket TICKET
				Core ticket number
			-d DEVICE, \--device DEVICE
				Core device number
			-sw SWITCH, \--switch SWITCH
				switch
			-i [INTERFACE [INTERFACE ...]], \--interface [INTERFACE [INTERFACE ...]]
				interfaces separated by space. Example gi0/8 gi/09

Command
    nscli maint times
		Print standard maintenance times

Command
    nscli maint updates
        Generates prefabs used for maintenance process

	*Options*
	  -mrt             Prefab for waiting on prep
	  -mrt_v2_3        MRT for v2 to v3 upgrades
	  -mrt_afm         MRT for AFM related maintenances
	  -waitprep        Prefab for waiting on prep
	  -waitqc          Prefab for waiting qc
	  -ownprep         Prefab for owning Prep
	  -ownqc           Prefab for owning qc
	  -sched           scheduling prefab
	  -qcsched         Prefab for owning qc + scheduling
	  -waitqcsched     Prefab for waiting qc + scheduling
	  -qcpass          Update ticket with official NetSec QC Pass
	  -escalate        Escalate ticket
	  --ticket TICKET  Update ticket with prefab: usage --ticket <ticket_num>
	  -nd              Updated ticket with network defense signature
	  -priv            Update ticket privately


Migrations
==========
Migrations sub-commands are quick scripts, audits, and actions that pertain to data-center migrations.

Command
    nscli migrations validate **$collection** **$devices**         Validate source dest switchport configs
Options
  -a AGE, --age AGE  Unipede age. default: 86400 sec
  --no-errors        Only print config issues and not errors to screen

Command
    nscli migrations finalize_migration **$device**     Finalize migration switchport configs
Options
  -C, --switchport-copy      Run switchport copy after finalize

Command
    nscli migrations finalize_current **$device**  Finalize current switchport configs

Command
    nscli migrations startup **$device**         Prep NetDevice startup config for DC migration shutdowns
Options
  -b, --no-backup       Do not run a TORQ backup prior to executing
  -t, --test            Only print payload, do not run
  --management-ip  Pass different management IP address

Command
    nscli migrations update_waf **$device**     Re-IP ServiceNet for Imperva WAF's using migration IPs
Options
  -t, --test            only print payload, do not run

Command
    nscli migrations f5_trust          Rebuild device trust between two F5s (prompts for devices)
Options
  -t, --test      only print payload, do not run
  -p, --password  specify a unique local admin password to attempt

Command
    nscli migrations info **$collection** **$device**             Pull information from the MigrationDB

Command
    nscli migrations reserve_ip **$device** **$ip_address**      Reserve a migration IP address (marks reserve flag in Commander)

Command
    nscli migrations refresh **$collection** **$source**        Refresh data in the Migrations Database
Options
  -D, --device  Refresh a device
  -A, --account  Refresh an account

Command
    nscli migrations status **$device**          Get port status and reachability for a device
Options
  -p, --no-ping  don't run aggr ping and just return ports

Command
    nscli migrations mirror_ports **$device**      Gather span-sessions for a given device/account/move-group
Options
  -D, --device
                        Gather for a device
  -A, --account
                        Gather for an account
  -M, --move-group
                        Gather for a move-group
  -a, --age      Unipede age. default: 86400 sec

Command
    nscli migrations zones             Zone lookup of all migration up-links

Command
    nscli migrations auto_discover  **$environment**   True-up Environment Manager device+vlan / port+segment associations
Options
  -M, --make-changes  make production changes, this WILL make changes in EM

Command
    nscli migrations audit **type**           Run audits against migrations data

Command
    nscli migrations vlans **$env_or_device**           Pull DCX Vlan and relationship information


mirror
======
Mirror related sub-commands

Command
    nscli mirror login      Logs you into the NetSec code mirror (requires access to the NetSec DevOps PasswordSafe)

Command
    nscli mirror search $filename      Searches the NetSec code mirror for a specific filename(s)

monitoring
==========
Plugin that allows to obtain checks, alarms and suppression information given a device. Moreover, plugin provides the 
option to copy alarms from one device to another device (parallel migrations)

Command:
    nscli monitoring $device

Options:

    -d, --display-alarms
        Display device alarms

    -c, --copy-alarms
        Copy alarms from existing device to new device

    -t TARGET_DEVICE, --target-device TARGET_DEVICE
        Target device

Example
    nscli monitoring 689684 -c -t 689680

Ndapi
=====
This is an example of the device api we are building to support our current
and future automation efforts.  Given the platform, device number and a full
command the api will attempt to run it if it's a valid parser and return you
the output in json format.

Command
    nscli ndapi $platform -d $device_number -r $command

Example
    nscli ndapi asa -d 550883 -r show version

Netbast
=======
The netbast option will log you into the netbastion, NSCLI will use your
tacacs password if your key is not on the bastion.

Command
    nscli netbast $DC

Options:
    -1, --net1
        Force connection to 1st Netbast in Datacenter.

    -2, --net2
        Force connection to 2nd Netbast in Datacenter.

    -3, --net3
        Force connection to 3rd Netbast in Datacenter.

Netscaler
=========
Netscaler module is a parent module for netscaler related sub-commands. All tools that relate
to the Citrix Netscaler will fall here.

Command
    nscli netscaler sanitize pull $device
        Pulls a config from a device and returns the sanitized version of it
Options
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

Command
    nscli netscaler sanitize input
        Allows a raw config to be pasted into the terminal and returns the sanitized version of it
Options
    -i INPUT_FILE, --input-file INPUT_FILE
        Input a file instead of pasting to the terminal
    -o OUTPUT_PATH, --output-path OUTPUT_PATH
        Path to folder where to save the file instead of printing to the terminal
    -d, --desktop
        Save file to ~/Desktop instead of printing to the terminal
        (Saves to nscli cache directory if Desktop does not exist)

NLA
===
The NLA (Network Level Authentication) option will allow you to interact with the Rackspace
cut-through proxies to either login, logout, or view status per datacenter.

Command
    nscli nscli status $dc

Command
    nscli nscli login $dc

Command
    nscli nscli logout $dc

PA
===
PA module is a parent module for Palo alto related sub-commands. All tools that relate
to the PA product line will fall here.

Command
    nscli pa group get
         Get HA-GroupId information from FACTS PA HGID application
    
    *Options*

        -d DEVICE, --device DEVICE
            Device number to get HA-GroupId entry for
        -a, --all             
            Get a CSV file for ALL entries in the PaloAlto HA GroupID database.
        -s, --search          
            Find entries in the PaloAlto HA GroupID database.
        -D DC_NAME, --datacenter DC_NAME
            Must be used with '-s/--search' to find entries for given DC in the PaloAlto HA GroupID database.
        -A ACCOUNT_NUMBER, --account ACCOUNT_NUMBER
            Must be used with '-s/--search' to find entries for given account number in the PaloAlto HA GroupID database.
        -G AGGR_NAME, --aggr AGGR_NAME
            Must be used with '-s/--search' to find entries for given AGGR in the PaloAlto HA GroupID database.
        -V VLAN_ID, --vlan VLAN_ID
            Must be used with '-s/--search' to find entries for given VLAN ID in the PaloAlto HA GroupID database.
        -e ENV_TYPE, --env ENV_TYPE
            (For testing purpose only). Choose env to get data from; local | staging | prod
        -f TOKENFILE, --tokenfile TOKENFILE
            (For non prod environment only) File path to read the custom identity token
        -u URL, --url URL
            (For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command
    nscli pa group create
         Create HA-GroupId entry in from FACTS PA HGID application

    *Options*

        -d DEVICE, --device DEVICE
            Device to create HA-GroupId entry for
        -D, --discovery
            If provided, turns discovery OFF. Then, Aggr & VLAN has to be provided to create HA-GroupId entry.
        -a AGGR, --aggr AGGR
            Aggr for the HA-GroupId entry when discover option is False
        -v VLAN, --vlan VLAN
            Vlan for the HA-GroupId entry when discover option is False
        -g GID, --gid GID
            GroupID for the HA-GroupId entry when discover option is False
        -e ENV_TYPE, --env ENV_TYPE
            (For testing purpose only) Choose env to get data from; local | staging | prod
        -f TOKENFILE, --tokenfile TOKENFILE
            (For non prod environment only) File path to read the custom identity token
        -u URL, --url URL
            (For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command
    nscli pa group update
        Update HA-GroupId entry in from FACTS PA HGID application
    
    This command is a placeholder and cannot be run in this current NSCLI version. 
    

Command
    nscli pa group delete
        Delete HA-GroupId entry from from FACTS PA HGID application
    
    This command is a placeholder and cannot be run in this current NSCLI version. 


Command
    nscli pa group status <job_id>
        Check the status/results of a group-id request with given job-id

    *Options*

        -e ENV_TYPE, --env ENV_TYPE
            Choose env to get data from; local | staging | prod
        -f TOKENFILE, --tokenfile TOKENFILE
            (For non prod environment only) File path to read the custom identity token
        -u URL, --url URL
            (For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command
    nscli pa qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    -v
        Connects to Environment Manager and Core to return more detailed information about results
    -vv
        Connects to Environment Manager and Core to return more detailed information about results in CSV format
    -t, --timeout
        Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

PassGen
=======
Passgen tool is a command-line quick-tool that will provide a random password within NSCLI.
Default behavior will generate a 30 character password with uppercase, lowercase, numbers,
special character types.

Command
    nscli passgen

Options:
    -c, --length LENGTH
        Length of password to generate (Default: 30)
    -a, --add ADD
        Add characters to the generator
    -l, --no_lower
        Remove lowercase letters from passgen.
    -u, --no_upper
        Remove uppercase letters from passgen.
    -s, --no_special
        Remove special characters from passgen.

Permissions
===========
Permissions tool is a command-line quick-tool that queries customer permissions

Command
    nscli permissions

Options:
    -t TICKET, --ticket <TICKET>
        user permissions of devices attached to ticket
    -d, --device <DEVICE [DEVICE...]>
        user permissions give a list of devices


Projects
============
Lists projects for a team (defaults to Maintenance Team)

Command

Options:
    -t
        Show projects for a specific team
    -a
        Shows all tickets for given team including Unassigned
    -1, --single_threaded
        Runs 1 core call at a time. By default, core calls are made in parallel (for ticket batches) for faster processing.
    -s, --support_tiers
        Tier information from wiki will be used in output:
        https://raxglobal.sharepoint.com/sites/Onewiki-support/SitePages/GTS%20Queues%20and%20Views%20-%20Tier%20Change%20Requests.aspx
        By default, Tier information from 'Encore' is used otherwise.
    -m, --am_names
        RUNS SLOWER. Adds account manager's + AM's manager's name in the output.
    -c, --core_data
        RUNS SLOWER. DO NOT USE YET. Adds core lookups for data like 'is_us' or 'NetSec Team' for account.
    -k, --keep_cache
        Keep and Use cached data for functions from previous call (if available).  
        If not specified, cache is wiped with each call. 
        DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting. 

Provisioning
============
These are the collection of utilities to perform various provisioning related tasks

Command
    nscli provisioning add devices <environment number> <list of devices>
        Adds device(s) to the specified environment

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning add environment <list of devices>
        Creates a new environment based on devices listed

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning add gateways <list of devices>
        Modifies and adds the listed devices as gateways in an enviroment

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning add svi <ENV or ZN>
        Documents and configures a shared or dedicated SVI. ENV denotes dedicated, ZN denotes shared

Options:
    -n, --network_address
        Specifies a network address for identifying a public block to use
    -p, --prefix_length
        Specifies a cidr notation required for the public block, default 29 for dedicated, 27 for shared
    -v, --vlan_number
        Specifies a certain VLAN to use for the SVI
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning add vlan <environment number> <vlan name>
        Adds a VLAN to an enviroment

Options:
    -v, --vlan_number <1-4094>
        Specify a specific VLAN Number
    -b, --private_ip_block <172.24.16.0/22>
        Specifiy an Optional private IP block CIDR to create and associate to the VLAN
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning assign ip ['interactive']|[<type> <device ID> <ip|block|auto> [role] [ip|block|vlan] [role] [SVI]]
        Assigns IP(s) to a device or devices

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning assign vlan <vlan number> <list of devices>
        Assigns a VLAN to a list of devices' switchports, or just the devices if they are virtual

Options:
    -m, --match <1E, 2E>
        Only adds the VLAN to switchports with a switch contains this match field
    -p, --port
        Only assigns the VLAN(s) to switch and port specified. Requires switch to be specified.
    -s, --switch
        Only assigns the VLAN(s) to switch and port specified. Requires port to be specified.
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning batch get_ip <env_number>
        Generates a CSV in the Batch IP format based on the existing environment data

Options:
    -f, --file <file_name>
        Outputs to a file instead of the console
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning batch get_vlan <env_number>
        Generates a CSV in the Batch VLAN format based on the existing environment data

Options:
    -f, --file <file_name>
        Outputs to a file instead of the console
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning batch ip <list of devices>
        Creates Environment Manager Batch CSV to add public and/or private IPs devices and assigns their roles

Options:
    -n, --public_ips <any, 1.2.3.4/29, 1.1.1.1, list_of_IPs>
        Specifies the requested public block(s). Use "any" to specific that a public block is needed but to use any available public IP in the environment. More than one public block can be specified, separated by a space.
    -p, --private_ips <172.24.16.0/22, 10.0.0.1, list_of_IPs>
        Specifies the requested private IP(s) or block. You can specify more than one IP or block
    -l, --label <gateway, primary, reserved_gateway, drac>
        Defines the IP address as a primary, DRAC, gateway, or reserved gateway address. Default label is "none"
    -f, --use_first_available
        Finds the first available private IP by default when a block is specified
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning configure nats <network device> <List of individual IPs, pairs of IPs, or device numbers>
        Preps or configures static address translations

Options:
    -m, --manual
        Makes the displayed commands usable in a copy/paste format for manual configuration
    -p, --perform_changes
        Performs the translation configurations on the network device.
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username, --username username
        Specify a different username to log in with. Will prompt for passwords.
    --no_dns, --no_dns_doctoring
        Prep or configure translations without dns doctoring (only works with ASAs)
    --no_qc
        Prep or configure translations, even if they do not pass QC
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning info devices <list of devices>
        Gathers basic information about devices

Options:
  --staging
        This will force the use of staging APIs instead of production APIs
  -f, --filter
        Only show network information about the specified filter
  -v
        Returns basic device information plus network information
  -vv
        Returns basic device information plus detailed network information
  --csv
        Returns the output information in csv format
  --silent
        Disables printed messages during execution

Command
    nscli provisioning info kir_validate <list of devices>
        Checkes devices for KIR validation errors

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning info switch_prep <list of devices>
        Displays organized switchport information for devices

Options:
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning info ndpqc <network device>

Options:
    -f, --fails_only
        This will only output checks that fail
    -t, --ticket
        Post the network device QC results to the specified ticket
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning info qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:
    -s, --srm
        Adds disabled interfaces to the known routes to better identify segments for SRM environments
    -u username, --user username
        Specify a different username to log in with. Will prompt for password.
    -v
        Connects to Environment Manager and Core to return more detailed information about results
    -vv
        Connects to Environment Manager and Core to return more detailed information about results in CSV format
    -t, --timeout
        Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.
    --silent
        Disables printed messages during execution
    --staging
        This will force the use of staging APIs instead of production APIs

Command
    nscli provisioning remove devices <list of devices>
        Removes devices from an enviroment

Options:
    --staging  This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning remove gateways <list of devices>
        Modifies and removes the listed devices as gateways in an enviroment

Options:
    --staging  This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Command
    nscli provisioning unassign vlans <vlan numbers> <list of devices>
        Unassigns VLAN(s) from a list of devices

Options:
    --staging
        This will force the use of staging APIs instead of production APIs
    --silent
        Disables printed messages during execution

Qcip
====
***DEPRECATED.***
Will qc an IP address based on a list of comma seperated public, private IPs
or a ticket number.  This requires you to sepecify the edge device and
only supports ASA. This will only check connected networks and will warn if
it is not local.

Command
    nscli qcip $fw_number $publicip,privateip ...
    nscli qcip $fw_number $device ...
    nscli qcip $fw_number $ticket

RC
===
RackConnect related sub-commands

Command
    nscli rc report  $account
        Show RackConnect instances for the dedicated Account
Options
    -s, --summary
        Show summarized information only
    -j, --json
        Output as JSON
    -f, --file
        Save the output in the specified filename


Command
    nscli rc finder $account $string
        Search for the specified keyword in the following fields: Public/Private IP, instance name and API_ID


RCG
===
Rackconnect Global related sub-commands

Command
    nscli rcg info a $account
        Show instances with Rackconnect Global Sku the dedicated Account
Options
  -h, --help
      show this help message and exit
  -d, --detail
      print detailed output
  -s SKU, --sku SKU
      filter server in an account based on SKU numbers

Command
    nscli rcg info t $ticket_number
        Lists the instances with RackConnect Global SKU that are attached to ticket.
Options
  -h, --help    show this help message and exit
  -d, --detail  print detailed output

Command
    nscli rcg nets
        Extract network from show route connected/static output
Options
  -h, --help
      show this help message and exit
  --paste
      Paste the output of show route connected and static
  --filename FILENAME
      Filename with output

Reset
=====
This will delete any cached secrets, tokens, session data, or infrastructure config, and also delete your ``sso_user`` 
and ``acs_user`` settings from your settings file. NSCLI will re-prompt you for these credentials the next time it 
needs them.

rlookup
=======
Runbook Lookup related sub-commands

Command
    nscli rlookup [-a] $account_number [-b]
Options
    -a, --account
        Enter Core Account Number
    -b, --browser
        Boolean argument to open runbook in browser, default False


runner
=======
The runner option will allow you to run one or more commands in a periodic/repetitive way against net devices.
Currently supported devices are Palo Alto, ASA, F5 and Netscaler. 
You can specify either number of times command will be executed or total duration of command execution. 
If not specified any value, command(s) will be executed only once.

Command:

    nscli runner DEVICE_NUMBER [-h] [-t TICKET_NUMBER] [-i INTERVAL] [-r REPEAT | -a AGE] (-c COMMAND [COMMAND ...] | -f LOCAL_FILE_PATH | -m)

Positional arguments:  
    DEVICE_NUMBER
        Device Number

Options:

    -t, \--ticket [TICKET_NUMBER]
        Ticket Number
  
    -i, \--interval [INTERVAL]
        Time Interval in seconds. Must be greater than 3. You must specify -a or -r along with -i
  
    -r, \--repeat [REPEAT]
        Number of times command needs to be executed/repeated. If not specified, command(s) will be executed only once
  
    -a, \--age [AGE]
        Total duration of time (seconds) for script execution. If not specified, command(s) will be executed only once
  
    -c, \--command [COMMAND ...]
        Commands to be executed
  
    -f, \--file LOCAL_FILE_PATH
        Location of the file that contains commands
  
    -m, \--manual
        User interactive, it will prompt for commands to be executed while Runner plugin is in action

Settings
========
This will open NSCLI's ``settings.ini`` file in your default text editor application.

Options

    -u, --update
        Set your settings back to defaults

    -db, --db_update
        Force refresh of config db

    -g, --gateway
        Set balabit gateway

    -d, --dc
        Set proxy DC

    -e EMAIL, --email EMAIL
        Set Rackspace email ID

    -s, --sso
        Set sso username

    -t, --tacacs
        Set tacacs username

    \--bash
        Print a bash completion script

    \--zsh
        Print a zsh completion script

    -c, --cacerts
        Installs Rackspace CA certificates

    \--details
        Print details/comments of what setting file fields do.
        
SSH
===
The SSH option will attempt to connect to a device based on the core
information by using the customer bastion to proxy the conneciton.

Supported Platforms: ADX, ASA, F5, SRX, RSA, WAF

Supported identifiers:
    - <CORE ID>, example: 349763
    - <IP Address valid in CORE>, example: 50.56.20.10
    - DP-<Mydatapipe DeviceID>, example: DP-86926
    - DP-<IP Address valid in mydatapipe>, example: DP-206.55.127.120

Command
    nscli ssh $identifier

Options
    -d, --drac
        Connect to the device using the DRAC address. This is the default
        aciton for ADX and F5.

    -p, --public
        Connect to the device using the Public address. This is the default
        aciton for ASA, CSS, SRX, RSA, WAF

    -n, --number_of_device
        Display number of network devices connected and connect it through SSH

    -e, --edge            
        SSH to the edge device

    -u, --user
        Prompt for the username and passwords to log into the device.

    -g, --gui
        Open up the GUI for the device. This only supports F5.
        For opening multiple sessions (tabs) at once, this module is compatible with Ghost Browser on Mac. Simply download the application and place it in your Applications folder.

    -s, --scp
        Interactive prompt allowing scp of files to and from a remote net device. Requests user to specify file transfer direction and source/destination filename and location.

    -w, --waf
        Use the WAF Password Safe information to log into the device.

    -r, --rsa
        Use the RSA Password Safe information to log into the device.

    -f, --failover
        login to the failover mate

    --scp_method
         Specify the scp method 1 = local to remote, 2 = remote to local (Used with -s, --scp)

    --src_file
         Specify the source file name (Used with -s, --scp)

    --dest_file
         Specify the destination file name (Used with -s, --scp)

    -a, --attemptssh
        attempt ssh connection to unknown device type. Requires use of -p or -d flags.

Swip
====
The swip command allows you to view and create/modify/remove ARIN information for IP blocks.

Format
    nscli swip

Command
    nscli swip (standalone will prompt for info)
    nscli swip -r x.x.x.x/29 y.y.y.y/29 (remove swip information)
    nscli swip --simple

Options
    -m, --modify <IP/CIDR>
        Quick switch to tell the prompted version you want to modify the current swip information

    -n, --new <IP/CIDR>
        Quick switch to tell the prompted version you want to create a new swip entry

    -r, --remove <IP/CIDR> (supports multiple blocks)
        Quick switch to tell the prompted version you want to delete the swip information
        for the provided subnets

    -s, --simple (supports multiple forms all at once)
        Allows user to paste in one or more arin simple forms to mass update arin information

    -l, --lookup
        Returns whois information for requested IP's. This hits the arin whois 
        server for information and NOT the API

    --netname
        Allows the user to override the autogenerated netname used when
        creating a new ARIN entry

    --api-key
        Returns the current API key the script is using to update ARIN

Switch
======
The switch command allows you to connect to a switch and has various other
switch audits and utilities.

Format
    Switch_Name.dc (case insensitive)

Command
    nscli switch switch_name.dc

    Example: nscli switch F9-19-1.DFW1

Options
    -i, --info
        Returns all switch port from core, this should include type,
        account, device number and device name

    -p
        Takes a list of space seperated numbers and only returns the
        information for those ports, this can be used with the -i flag or by
        itself.

    -v
        Given a list of space seperated vlans NSCLI will attempt to the log
        into the switch and indentify all ports where the vlan is active by
        spanning tree and log on to any neighbor switches.  The result will
        include any Core information or interface number where the vlan is
        being used.

    -r
        This option allows you to run a single command on the switch and
        exit, the command can be space seperated or if you want to
        use the | option on the switch the command should be in quotes.

    -V
        VPC audit, you can request 'all' or a give NSCLI a list of space
        seperated port-channel numbers.  The 'all' option will return all
        the ports that are in a bad state, individual numbers will return
        the correct or error depending on the port-channel state.

Ticket
======
The ticket info will retrieve device information from a list of tickets.

Command
    nscli ticket $ticket_number $ticket_number ...

-s, --simple
    Simple information print out, this will only include the device number,
    primary ip, and switch port information.

-p, --portinfo
    Display the device information and port status using Switch API.

-m, --macinfo
    Diplays the device information, port status, and mac address information
    from Switch API.

-c, --config
    NSCLI will attempt to gather the configuration for each device port by
    logging into the switches.

-n, --nat
    Inlcude the nat comments for each device. This will be a list of public
    and private IPs.

-e, --edge
    Attempts to identify the edge device by using Switch API.

--addenv
    Attaches all devices from an environment to the ticket.

--listonly
    Only lists the devices instead of attaching to the ticket. Use with --addenv.

TLS
===
Graphical plugin for creating TLS cipher configurations for F5's, ADX's, and ASAs.
Supports all common device code versions.

Command:
    nscli tls

tshoot_access
=============

Troubleshoot access to network devices from NSI automation. Currently works with ASAs only.

Command
    nscli tshoot_access $device

Torq
====
Use the Torq API to download net device backups, register new devices to Torq, or cause Torq to refresh its device info.

Command
    nscli torq get-file <device_id> <filename> [--metadata]

    device_id
        The CORE device number

    filename
        The name of the file to download, e.g. running-config or version

    --metadata
        Display file metadata followed by file contents. Default: contents only

Command
    nscli torq list-files $device_id

    device_id
        The CORE device number

Command
    nscli torq backup $device_id

    device_id
        The CORE device number

Command
    nscli torq add-device $device_id

    device_id
        The CORE device number

Command
    nscli torq refresh-device $device_id

    device_id
        The CORE device number

Tokens
======
Use the TOKENS plugin to print or set your identity or core token 

Command
    nscli tokens [-h] [--core] [--identity]

.. the next section is getting parsed as a definition list, followed by an option list.
   I'm not sure what to do about that, but it looks ok when it renders.  ¯\_(ツ)_/¯

Options
    -c, \--core
        Print core token
    -i, \--identity
        Print identity token
    -cf, \--cloudflare
        Print Cloudflare API key value from NSCLI token
    -imp AccountNumber, \--impersonation_token AccountNumber
        Print customer impersonation token
    -m, \--managed_cloud_pass
        Print password for 3rd party, managed cloud net devices
    -s \--set_tokens
        Set core or identity token

Trunking
========
Use the TRUNKING plugin to assist in trunking down vlans

Command
    nscli trunking autotrunk [-h] [--v] switchport vlan vlan_name

Options
    --v         Verbose mode.  Can be used multiple times to increase logging level.

    switchport  The switchport to trunk down the Vlan to.  i.e. d13-3-1e.ord1[5]
                Can also support multiple switchports seperated by a comma.
                Example: d13-3-1e.ord1[5],d13-4-1e.ord1[5]

    vlan        The vlan to trunk down.  i.e. 1000
                Supports multiple vlans separated by commas if the port or ports
                are access ports.
                Example: 1,2,3,4,5,6,7,8,9

    vlan_name   The name of the vlan you are trunking down.  i.e. "VLAN_NAME"
                If multiple vlans are specified, you are required to specify a
                name for each vlan.
                Example: "VLAN_NAME_1,VLAN_NAME_2,VLAN_NAME_3"


Virt
====

Virtualization subsection of nscli

Command
    nscli virt port-audit   Same as 'nscli maint port-audit just makes it easier for virt to find

Command
    nscli virt cdp-update  Generate RPCV dns entries for Public and CDNS
Options
    -t, --ticket
        Ticket used for device list
    -d, --device
        List of devices to enable cdp on
    --disable
        Return the disable commands instead of the enable commands

Command
    nscli virt gendns  Generate RPCV dns entries for Public and CDNS
Options
    -t, --ticket
        Ticket used for device list
    -d, --device
        List of devices to generate dns entries for

Command
    nscli virt genmon  Generate RPCV monitoring as well as updates guidelines if necessary
Options
    -t, --ticket
        Ticket used for device list
    -d, --device
        List of devices to generate dns entries for
    -c, --check
        Only checks the account guidelines and monitoring to see if the checks exist
    -u, --user
        Override the default impersonation user

Command
    nscli virt port-check  Checks Hyp ports for cabling and vlan configuration
Options
    -t, --ticket
        Ticket used for device list
    -d, --device
        List of devices to generate dns entries for
    -p, --public
        Uses the public IP of the Hyps for the check. This is used for RPC-V Builds
    -f, --force
        Forces latest information from unipede
    -o, --oneline
        prints output of vlans on oneline

Command
    nscli virt rpcv-acl  Generate ACL's required for RPC-V
Options
    -t, --ticket
        Ticket number
    -d, --device
        List of devices to check
    --no-verify
        Ignore IP validation
    -v, --verbose
        Add verbose information
    --v2
        Switches logic back to the old v2 logic
    --asa
        Tells the script to generate the configuration for an ASA
    --f5
        Tells the script to generate the configuration for an Edge F5
    --palo
        Tells the script to generate the configuration a Palo on the Edge

Command
    nscli virt trunking  device_id  -> audit or generate trunking commands to all hypervisors in cluster
        device_id - this can be one or multiple devices separated by space.

Options
      -m, --manual  specify hypervisor(s), vlans to trunk or audit
      -t, --trunk   Provides commands to trunk vlans, Vcenter API is called to get all hyps in cluster
      -a, --audit   check for missing vlans in cluster; Vcenter API is called to get all hypervisors, and vlans

Voyage
======
Interface for Voyage (bulk ARIC task execution)

Command 
    voyage migrations  
        Lists all the current migration with their id and name
    voyage milestones list $migration_id  
        Lists the milestones of a migration, with their order, name, id and device count
    sync $migration_name  
        Tells Voyage to update it's database from the data in the NS DB.

WAF
===
Imperva WAF related sub-commands

Command
    nscli waf cert_uploader $device $directory  upload a local pfx to the associated server groups 
                                                of an Imperva WAF on an MX
Options
    -r, --recursive                             Upload all PFX SSL Certificates found in the provided directory
    -c, --choose                                Choose which Server Group to upload certificate(s) to
    -p, --password                              Prompt for password to use for all certs
Command
    nscli waf protected_ips $device $address    Determine if IP is part of WAF protected IPs
Options
    -s, --show                                  Show IPs from each server group
Command
    nscli waf info $device                      Provide hardware and Securesphere configuration

Command
    nscli waf cert_list $device                 Gather installed SSL Certificates from an Imperva WAF
Options
    -s, --simple                                Don't provide certs in a tree view. Return a simple list.
    -d, --detailed                              Return detailed information about each cert

Command
    nscli waf violations $device                 Gather installed SSL Certificates from an Imperva WAF
Options
  -d DAYS, \--days DAYS
  	Number of days back to search. Default of 1 day if not defined.
  -l LIMIT, \--limit LIMIT
  	Limit results to a defined number. Note this is PER SERVER GROUP
  -i SOURCE_IP, \--source_ip SOURCE_IP
  	Filter for a specific source IP
  -a ALERT_NUM, \--alert_num ALERT_NUM
  	Filter for a specific Alert number
  -e EVENT_ID, \--event_id EVENT_ID
    Filter for a specific Event ID
  -s [informative, low, medium, high], \--severity [informative, low, medium, high]
    Filter for severity
  -o OUTPUT_DIRECTORY, \--output_directory OUTPUT_DIRECTORY
	Output to csv file at specified directory. Ex: \~/Downloads. A file named 'violations.csv' will be created.
  -u URL, \--url URL
  	Filter URL EQUALS. Must be full path. ex: /html/public/index.php


zenoss-download
===============

Download graphs from Zenoss and make a PDF.

    -h, --help
        shows help
    -r, --reset
        Reset configuration
    -d, --device
        Enter device list separated by comma
    -t, --ticket
        Enter Ticket Number
    -a, --account
        Enter Core Account Number
    -v, --version
        Show version
    -D, --debug
        Debug
    -stime, --start-time
        Enter date/time when you want graph to start, Format 2017-10-10,15:00 YYYY/MM/DD (UTC)
    -etime, --end-time
        Enter date/time when you want graph to end, Format 2017-10-10,18:00 YYYY/MM/DD (UTC)

PT
===
Generic Packet Tracer Plugin Wrapper.

Command
    nscli pt $source_ip $destination_ip $destination_port

Options
    -d, --device          CORE device number
    -a, --account         CORE account number
    --sport SPORT         source port (default is 1024)
    -u, --udp             match UDP (default TCP)
    -D, --detailed        detailed output
    -P, --public          Connect via Public IP.
    -U USER, --user USER  Specify the user.
