Multiple vendor config comparison

Hi Thwackers,

I have a Query. First time poster & a beginner using SW so please forgive me if im in the wrong section etc.

ive spent a number of hours reading documents & watching vids on here but havent worked out how to do what i want.

Our Company has 3 clients with thousands of routers/switches (mainly ADSL) across the country from Cisco, Zyxel & Draytek.

ive been tasked with ensuring a number of best practices are present on these nodes such as SSH, TACACS enforced and clear text passwords & telnet access is removed.

this has been done for some but not all nodes in the network so identifying the devices that need the adding/removing of config would be my first task.

is there a way of doing all this via the NCM? if so please help or point me in the right direction.

thanks in advance

Louis

Find more posts tagged with

ncm zyxel

config comparison

network configuration

help me

questions

ncm draytek

questions_and_answers

ncm cisco

Accepted answers

All comments

cvachovecj

Louis,

NCM can help with that and the feature you are looking for are compliance reports.

I recommend looking at the product itself, admin guide, and read related topics here on thwack to get the general idea.

Once you are a little familiar with the feature, feel free to ask specific questions.

Makes sense?

Jiri

cnorborg

If anything can do it, it would be NCM. However, there are probably limitations based on the vendor equipment that you're running.

NCM compliance is built upon verifying the text-based configs that are on the products, usually for those that have a CLI. If its a fully web-based config, then NCM can't touch it. All mainline cisco products have a text based config, so they most certainly will work, but that can be a bit iffy for the Zyxel or DrayTech and such.

Many low-end alternate brands only have web-based GUI's, or if they have a CLI that can be enabled its usually telnet only (ie: insecure) and quite often can only be accessed via the LAN attached to it. Some I've seen are menu-based systems, which NCM can do to some extent, but are a bit harder to work with.

But if anything can do it, NCM can. Just saying that the more brands of equipment you try and bring in, esp. low-end equipment, will make things be a bigger challenge for you, and you might run into some roadblocks you won't be able to get around too...

Good luck! If you have specific questions, be sure to post them!

charityshare

Hi Jiri,

Thanks for pointing me in the way of the compliance reports. i have found a couple of cisco reports within which show some useful alerts however they dont seem to be saving correctly when i edit the reports to show different columns.

im guessing ill have to just create what i want from scratch instead?

Louis

cvachovecj

Can you please share a screenshot? I'm not 100 % what exactly you are talking about.

Jiri

dmartzall

The default ones are a good starting point, however what I had done in the past was make a baseline of certain pieces of the configuration. For example on a Cisco router:

ip flow-export source lo0
ip flow-export version 5
ip flow-export destination x.x.x.x 2055
!
logging x.x.x.x

By adding things that you want to be standard in every config this is a very easy way to do it. Think of it as your "Gold standard" configuration. Then you can have NCM find devices that match your criteria and tell you what the differences are and remediate if you want it to do so. This is a super powerful tool.

cnorborg

I'd go with a big huge "Yes" on whether or not you should customize it.

The included Compliance reports do just that, they check and see if your config's comply to the standards that they are set for. ie: the HIPAA reports check for HIPAA compliance, which may or may not apply to you.

They also check for pretty generic things. Like whether or not a logging host is set and such. They do NOT check for specific things, like whether or not a specific logging host is set, and no others are set.

So building your own to fit your needs is definitely the best option, but they give you the building blocks to do so, and lots of examples...

The structure of Compliance reports is both flexible and a bit confusing if you don't know what is what. I'll try and give a simple overview.

There are 3 main components of Compliance Reports, the "Report", "Policies" and "Rules.

A Report is made up of one or more Policies. A Policy is made up of one or more Rules.

So, the Rule is the most basic component of a report. A Rule can be put in multiple policies (and thus multiple reports). This is the part that actually looks at, or inspects, the config, and if desired, perform an action based on the results of said inspection.

A Policy is where you define what nodes a rule is performed on. So, if you had different compliance reports, maybe one for your routers and one for your switches, you might have the rules common to most TACACS policies in both, but maybe a few custom rules. You could make a Policy that had all the common rules for both, and another one that had specific rules for routers or switches.

Reports are a group of policies. You don't control what devices or what the rules are in reports...

HTH!

charityshare

Hi Guys & thanks for all your replies.

i think i need a 5 day course on SW as nothing seems to look straight forward.

cnorborg your information is particularly helpful and i believe my screen shot labels of rules/policies/reports is correct?

cvachovecj see below, i can remove rules/colums from a particular policy but i cant add a policy to a report.

from this screen there is an "edit report" button

as you can see i have removed "flood prevention" policy & added "security" "security settings" & "services"

not sure what rules are in these policies or if they are default from SW or an old admin set them up.

once i hit submit and then view report again it brings up the same report i had before

what am i doing wrong?

dmartzall where are u creating a baseline config? is it within a rule?

it certainly sounds like what i need for example how would i search all my cisco nodes (as i dont think ill be able to do this with the low end zyxel and Draytek routers weve deployed) for the following config lines:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication enable default group tacacs+ enable

aaa accounting exec default start-stop group tacacs+

aaa session-id common

ip tacacs source-interface Loopback0

tacacs-server host 10.96.2.48

tacacs-server host 10.96.34.48

tacacs-server directed-request

tacacs-server key 7 **************