Monitor and audit switch port configs

khoapham

Is there a way  that can help me monitor switch port configs against a baseline?

For example, our baseline config for network port can be seen below. If a software can send us an alert email if someone else change any of that.

int g1/0/1

switchport mode access

switchport nonegotiate

spanning-tree portfast

spanning-tree guard root

switchport port-security

switchport port-security maximum 5

switchport port-security aging time 1

switchport port-security violation shutdown

spanning-tree bpduguard enable

no speed

no duplex

Thank you.

netlogix

I just started working on this myself, so far, I have a "Rule" setup that does a similar thing.

Open NCM Policy Reporter

Create a report i.e. "Switch Config Audit"

under that, create a Policy i.e. "End user Switch"

Assign Switches to that (i.e. selection criteria where Name contains "IDF")

Create rule like - Check off Advanced - change to config block - Start "interface .*Ethernet.*:" end "!"

(Config must contain:

  switchport mode access

  switchport access vlan

  port-control auto

  spanning-tree portfast

) or ( must contain

switchport mode drunk

switchport trunk allowed vlan

description

and not contain spanning-tree portfast

) or shutdown

This might not be the best way, but is what I found so far, let me know if you find anything else useful