Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Need assistance with NCM compliance policy logic

We have a requirement to ensure that all the switches and routers in the network must have at least 2 out of the 3 possible NTP servers listed. The goal is for the rule to call out any configuration that either does not have the IPs listed or has additional IPs listed besides the authorized 3. The order in which the IPs are listed does not matter but the expected IPs should be present and no other IP is allowed.

In other words, say the list of ntp servers is:

ntp server 1.2.3.4

ntp server 5.6.7.8

ntp server 9.10.11.12

we want to verify that 2 of the above are on each switch.

But if a switch has the following config it should fail since it has the IPs we are looking for PLUS others we don't want:

ntp server 1.2.3.4

ntp server 5.6.7.8

ntp server 9.10.11.12

ntp server 13.14.15.16

ntp server 10.25.41.254

We tried the following rule (see attached) but it does not complain when additional IPs are present. Any idea on how we can be more restrictive to make this rule work?

ntp rule.jpg

Find more posts tagged with

Accepted answers

sgtp

I'm no regex guy, but this one worked for me in my lab.

Screen Shot 2016-08-06 at 12.19.03.png

All comments

christopher.a.thornton

I would maybe do something like this.

The first line should match any of your approved NTP servers and will pass 2 or more of them are found. The second line checks for any NTP servers that are not one of the approved 3 and it will fail if it finds one of them. You may have to adjust the regex a bit to tailor your exact setup but that should get you in the right direction.

jckristin

Thanks a lot, Chris T. I will give that a shot.

sgtp

I'm no regex guy, but this one worked for me in my lab.

Screen Shot 2016-08-06 at 12.19.03.png

jckristin

Thank you so much, sgtp. Your suggestion worked!!! Parenthesis can be powerful.

sgtp

I actually would have thought that Chris's would have been mo better.

after looking at mine, it would allow any combination of each octet.. meaning... 1.2.3.4 would work, but so would 5.2.3.4 as well as 1.10.11.4 and so on ( i think).

You might be ok using mine, depending on your IP structure, for instance, most people have /24s or smaller, and mine might work. but if you have a crazy IP allocation it might cause you some issues.

Tony

jckristin

You are correct sgtp. Your solution worked for me because our NTP server IPs only differ in the 2nd octet. The first, third and fourth octets are all the same.