Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

running config vs. baseline config mismatch

Hello,

On some of my routers I'm getting running config mismatches on items that I believe I should be able to configure to turn off. These are mainly with crypto keys. I believe I read somewhere that I can configure the system to not flag these as conflicts, as they seem to be stored differently in running config vs. startup configs, but I can't find the setting. Can anyone let me know where I can find that setting?

Find more posts tagged with

Accepted answers

All comments

rschroeder

You can configure NCM to ignore differences in crypto lines when you do config change reports. Just start NCM's admin console on its host server, then go to File > Settings, scroll down to Configs, and choose Comparison Criteria.

I use a pattern there named "Ignoring crypto lines". I don't recall if I built this, or if it came with NCM, or if Support sent it to me, but if you already see it present, and it isn't enabled, click the box to put a check in it and enable it.

I recall having to stop & start NCM to make it read this file again and apply the changes--a minor inconvenience.

Now select two configs from the same device, which you know are identical except for the crypto keys, and run a Configuration comparison on them. If your comparison no longer shows they're different, the criteria item fixed it.

But let's say you don't have this pattern in your Comparison Criteria area. Here's how to build it:

1. Click Add Pattern

2. Give it a Title (e.g.: Ignoring crypto lines)

3. In the RegEx Pattern, copy and past this:

^[ \t\r\n\v\f]*crypto.*certificate

4. In comment area, put in your explanation for what this pattern is expected to do

5. At the top of the window put a check in the "Enable this RegEx Pattern during Config Compares"

6. Tell it OK, and OK again.

7. Restart the NCM application.

8. Test by selecting two configs from the same box, that previously showed a difference in the crypto / certificate area, and running the config comparison on them.

I have added many config ignore lines to my Comparison Critera area. One similar one, for ignoring certificate differences, is this pattern:

^[ \t\r\n\v\f]*certificate[ \t\r\n\v\f]*self-signed

You can use that to build another pattern, with a slightly different name, if you need to ignore certificates.

Or just build one with the word

certificate

in the pattern to match.

Make sure your new patterns are enabled before stopping/starting NCM and testing the comparisons.

Good luck!