Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Comparing firewall configs (PIX, ASA)

When comparing firewall (Startup, running) configs in NCM, it always reports conflicts between the configs. Is their a way to ignore these lines when running reports, I am sure it can be done with regex, comparison data, but have not yet managed it yet.

Does anyone has a fix for this ?

Startup Config

: Written by name at time date

: End

Running config

has not got these lines

Thanks

NCM version 5.5.2

001	: Saved	001	: Saved
002	: Written by hugh.walsh at 06:11:28.847 utc Thu Apr 1 2010	002	:

001	: Saved	001	: Saved
002	: Written by hugh.walsh at 06:11:28.847 utc Thu Apr 1 2010	002	:

Find more posts tagged with

disa_stig

Compliance

Accepted answers

cvachovecj

Hi,

It shows "changes". We have a feature request to handle this properly: http://thwack.solarwinds.com/ideas/1322.

Regards,

Jiri

All comments

christineb

Hi Hugh - have you tried Config Change Report ->Edit Comparison Criteria?

--C

Ciag

Hi Hugh,

I've run into this issue too this week. I look to have found a Reg Ex that looks to instruct the comparison creteria to ignore the 'Written by' live.

NOTE: I am not a Regex Expert in any way at all. I coped parts this line from other Reg Ex formula in the comparison criteria. But for my testing it it was completely successful and doesn't impact any other comparisons on different devices.

^[ \t\r\n\v\f]*: Written by[ \t\r\n\v\f]*

I'm sure this statement is inefficiant and and probably needlessly long but like I said I'm no expert in Reg Ex.

Does anyone know a Reg Ex formula that will tell the comparison criteria to ignore 14 blank spaces? I'm experiencing a similar problem on other firewalls where it thinks it's found a difference on lines that contain nothing but blank spaces.

HTH

Cheers

Hugh

Hi guys,

Thanks for the feedback, yes I have used the comparison criteria and it works well with the 3 pix firewalls we have. But the ASA, still showing up stuff that the pix does not, I am not sure why as the ASA/PIX configs are just text files it compares and if the criteria works for the pix then I am not sure why it does not do the same for ASSA configs.

A compare shows the following in the ASA configs

A pix comparison, works fine

My comparison criteria

HWA - Remove lines starting with : ^[ \t\r\n\v\f]*:[ \t\r\n\v\f]*

I had to add the above for the pix, and I have tried numerous versions of writtwn by, but if you compare the Pix & ASA : written line it kind of makes no sense, or am i overseeing something.

If it works for the PIX, then is should also work for the ASA ? (We plan to upgrade all firewalls to ASA in the next months, and not looking forward to having false reports

Ciag

Hey Hugh,

I am unable to see your example comparison but I have also run into another similar issue with our Cisco Fwsm contexts. I have opened a topic of my own explaining what I am seeing, you can find it here:

Is this what you are experiencing?

regards

Ciag

I see the images now thanks.

I have ASA's here that compare as expected ever since I added the rule

^[ \t\r\n\v\f]*: Written by[ \t\r\n\v\f]*

I have checked to see if I have any other rules that might be helping the comparison, but the above rules is the only one that applies to the ASA's.

The only difference I can see from the information you have provided is that I'm running a newer version, 8.0(3) on our boxes. I do not have any boxes running 7.0(6) so I can't run a comparrison to check.

christineb

Hi Hugh - could you open a support ticket on this one?

--Christine

Hugh

One other problem which I have with the ASA with configuration comparisons is that it reports I have deleted the routes and added them back (or the line count/break are different between a startup & running config). I know there has nothing been changed, but it is annoying especially when mails are sent out once a week reporting thses changes.

oiram

do not compare different types of configs, they usually have slightly different format, i.e. order of commands

bit_herder

So, how does the NCM compare Running to Startup (graphs on summary page) if it isn't aware of these differences?

cvachovecj

Hi,

It shows "changes". We have a feature request to handle this properly: http://thwack.solarwinds.com/ideas/1322.

Regards,

Jiri