Compliance rules to verify SNMPv3 settings on Cisco devices

cnorborg

This post might get a bit long, but it shows how powerful NCM and compliance rules can be.   However, in order to run a compliance rule, it kind of has to be in the configuration, right?   Well, lets say "yes" and "no"?!

With most Cisco IOS devices, and possibly other devices, they removed the SNMP users from the configuration for some sort of security purposes, this is true of things like certificates also.   We have another application here that uses different SNMP credentials than our network management does, but have been having problems with those credentials being set up incorrectly.   Until I realized that they weren't in the config I was thinking Compliance Rules, but once I realized they weren't there I started going down the roads of trying to figure out how to write scripts and maybe couple them with API programming to do this.   No path looked very easy, so I kept contemplating which might be the best way.

Then all of a sudden I realized that just because it's not in the startup or running configurations doesn't necessarily rule out using Compliance Rules, but it took a bit of setup to prepare for what I wanted to do.   The first step being declaring a brand new configuration type, which I decided to call "CiscoSNMPUser", but you can easily choose your own name.   Why put Cisco in there?   We do use Arista here also, but Arista leaves the SNMP user right in the config, so at least for us, this problem is pretty Cisco-specific.   So, under "Admin" and "NCM Settings" I went to "Config Types".    Was kind of surprised to see 3 types already there, "Startup" and "Running" which I expected, and a third one called "Device State".   But, either way I added my new type here, and once I had it added I went and edited it where I can choose the "Vendor" for the config type.   I added "Cisco" as a vendor, like this:

This is just the first step though, once you have a new config type set up, you need to go tell it how to download the configs.   So, I went in to "Settings" and "Manage Device Templates".  Note that this is in the main part of settings and not the NCM specific settings.   Once there I copied a device template, in my case the "Cisco IOS" template.    I gave it a name which made it easy to see that this was a company specific setting and saved it.    Since this is a pretty simple change, I selected my copy and went to "Edit" and "Using Interactive Wizard".    The first thing you do here is select a node to use as a test for the rest of the setup.   The next setting asks you if you want to "Execute scripts only", "Execute scripts and download config from the device" or "Execute scripts, download config from the device and upload config to the device".   For this to work, you'd have to choose one of the two that allowed you to download the config, I'd recommend the one that allows you to upload also.

The next page is how to access the device you chose in the first step.   If you're editing a template like I was, most things should be filled in for you.   Click on the "Test" button to make sure its working.  Note that this will affect ALL config types for your device, and not just the new one you're setting up.   If the test is successful, go to the next step.   

This is where it might be a bit tricky for you.   The "Download config command" probably has something like "Show ${ConfigType}" with the macro ${ConfigType} relating to the config types defined in the section below.   In my case, the "Running Config File Name" was "running", so the config command gets expanded to "Show running".   In the case of our new configuration type, we want the command to be "show snmp user", so in the 3rd box for "CiscoSNMPUser Config File Name", we need to put in "snmp user".   So, it should look something like this:

Now, below these sections there is a "Download Test" area where you can perform a download test on the device you previously selected to see if it works.  Go ahead and do this.   It should end up with a "CiscoSNMPUser" config downloaded with the contents being your SNMP users that you would get by executing that command.   This particular config has 3 SNMP users defined.

One last step to get the configuration down.  Most configurations are longer than these, so the minimum length of a config command is 11 lines by default.   If you have only a single SNMP user defined, it will be only 6 lines, so I recommend changing this to 6.   You do this under "NCM Settings" again, and under "Config Settings".   You can either slide the slider over, or type 6 in to the box.

You can now go into Configuration Management, select as many devices as you want, and tell it to "Download" where you should see a Custom config type called "CiscoSNMPUser".   This will download what the SNMPv3 user is from all your devices.   You do need to pay attention for an error that says your configuration is too short, if you set it to 6 like I recommended and still get some of these, you probably don't have any SNMP users on the device, or you might need to set it to be shorter.

But, you now have a new configuration type that allows you to check the configuration of your SNMPv3 users!   I'll follow up later with a post to tell you how to write a complaince rule to do some testing on this.  Guessing some of you can write your own...

Guessing this has the potential to be used for other things, does anyone have ideas on what?

cnorborg

Ok, quick basics for everyone who hasn't worked with Compliance Reports before.  There are 3 components, Rules, Policies and Reports.   

A Rule is just that, a rule that describes what an acceptable part of a configuration is.   Rules should be fairly short and concise, the bigger you make one, the more difficult it can be to manage.   You can also choose the severity of the rule here.

A Policy is a collection of multiple rules.   The most important things to remember about a policy beyond that is that it defines what configuration type it applies to AND is where you select what nodes it applies to.  So here is where you will select the CiscoSNMPUser config type we created.

A Report is a collection of multiple policies.   Not much more is defined here, although you can pick to have a "Report Summary" and whether or not you want to "Show Rules without violation".   While debugging reports I recommend always showing rules without violation.   You can change either of these two values and NOT have to regenerate a report.   If you modify a policy or a rule, you have to regenerate the entire report.

So, lets say you wanted to have one report that showed whether SNMP users were configured for both Cisco and Arista devices.   Since Arista stores SNMP users in their normal config, and Cisco doesn't, you'll need rule(s) for each.   You would also need 2 policies, one for Arista that chose Arista devices AND used a running-config, while the Cisco one used Cisco devices AND used a CiscoSNMPUser config-type.   However, both of these policies could be in the same report and would show up side-by-side.

In this posting, I'm going to focus on Cisco devices using the CiscoSNMPUser device type.   So, I'll start by creating a rule by going to "My Dashboards", "Network Configuraiton", "Compliance".  Once there I'll click on "Manage Policy Reports" and click on the "Manage Rules" tab.   Here I'll add a new rule.  This rule will be fairly simple and just check to see if the SNMP user exists.   At a minimum we'll need to set a Rule Name, which will show on each report, and put something in the rule.  In this case its fairly simple string matching.   You will note I tend to use Regular Expressions instead of a simple find string.  Why?   Using simple strings you can't be sure you're getting what you asked for.   ie:  If I set this to "Find String" and put in "Username: SNMPUser1", it would find "SNMPUser1" like I wanted.  However, if that user didn't exist, but "SNMPUser10" did, or "SNMPUser1098293", it would also show up ok.   Even if someone put in an Interface Description on a switch "SNMPUser 1", it would match.  Simple string matches quite simply match anywhere.   With regular expressions.I can anchor it.   So in this case the carat (^) anchors it to the beginning of a line, preventing it finding it in an interface description.   The "\s" matches any white space, like a blank.    Quite often in regex's you will use a "$" to anchor it to the end of a line, but I learned quite some time ago in this forum that using that only works in some cases.   Using a [\r\n] matches either a newline (\n) or a carriage-return (\r), which tends to work in any case.   So, rather than matching on anything that contains "Username: SNMPUser1", I am now guaranteed to get what I was looking for.    You'll note that it looks for when this user is not found and will raise an informational warning if it doesn't find it.  You can copy this rule to work for multiple SNMP Users if you want.

Next, I'll need to create a policy and add this rule to it.   So, I'll go to the "Manage Policies" tab after saving this and add a new policy.    In the case below, I'm matching any device that matches a "Machine Type" of simply "Cisco", modify this as you wish.   You can see the config type is "CiscoSNMPUser" as we mentioned before, and in the policy rules I selected what rules I wanted in my report in the left column and clicked on "Add" which duplicated them in the right column.

Next I would need to put this policy in a report, so I go to the "Manage Reports" tab after saving, add a new report,   I need to at least put in a report name and once again select the policy in the left column, and click add to duplicate it in the right column.

At this point you're ready to generate the report.  You can either do this from the main "Compliance" page, or from the "Manage Policy Reports" page with the "Manage Reports" selected.  In either case, select the report you want generated and click on "Update Selected".   I don't recommend clicking on "Update All" as every built-in report that you haven't disabled will regenerate and take some time.   If you select your report and just update that it will go much quicker.

Your report should look similar to below, with one line for each device in your selection.   Here I was testing for 3 different users to see if they were in the configuration.   You can see that two of them were by the green checkmarks.  The one in blue was not in the config, so its raising an informational error, which we defined in the rule.

Pretty simple, right?  This is a very basic rule but when you have thousands of configurations to go through can save you a ton of time.  In the rule you can also define a Remediation Script which is simply a set of commands to execute to fix a rule that was violated.   The same as what you would type in to the device.

So, this rule tests for users that you want to be in the configuration.   How would you go about finding "extra" users that shouldn't be in configurations?   If there is enough interest I'll post that.   Hint: There was a discussion on this years ago in Thwack where someone figured out how to do this using regular expressions, you'd just need to adapt it to this use.

Also, now that you have the SNMP users configuraiton, is there a way to check and make sure that the user is using the correct Authentication Protocol?   How about the right Privacy Protocol?   What about the right password for each one of these?   Post your results or express your interest if you want me to show you.