Using NCM for my Cisco devices to find IP HTTP Servers

Question

Is there a way for me to use NCM search or create a report to make sure that all my devices have the "no ip http server" configuration in place.   If I run this search it tells me what devices have the config but not what device don't have the config.  I can't really do the search with "ip http server' because the no's get lumped into it.

justinhandrickson · Answer

Certainly! To specifically identify devices lacking the "no ip http server" configuration, you can try using a negative search with "ip http server" to filter out devices with this configuration. For instance: sqlCopy codeNCM search: "ip http server" -"no ip http server"This way, you're excluding devices that already have the "no ip http server" configuration, giving you a list of devices where this configuration is missing. It should help you pinpoint devices that need attention public investment. If you encounter any issues or need further assistance, feel free to ask!

joye760 · Answer

[quote userid="304041" url="~/product-forums/network-configuration-manager-ncm/f/forum/100366/using-ncm-for-my-cisco-devices-to-find-ip-http-servers"]Is there a way for me to use NCM search or create a report to make sure that all my devices have the "no ip http server" configuration in place.   If I run this search it tells me what devices have the config but not what device don't have the config.  I can't really do the search with "ip http server' because the no's get lumped into it. [/quote]Using Network Configuration Manager (NCM) to verify specific configurations across multiple devices, like ensuring all devices have the "no ip http server" command configured, can be a bit tricky. Here are steps based on personal experience and best practices on Edgar Haircut:

* Inventory and Baseline Configuration: First, ensure that you have an updated inventory of all network devices. This will serve as your reference point. Make sure you have a baseline configuration for what you expect in your network devices.

* Using NCM to Search for Configurations:

* In NCM, you can use the configuration search feature to look for specific strings in the configurations of your devices.
* Search for "no ip http server" to find all devices that explicitly have this command in their configuration.
* This search, however, won't directly show you devices that lack this configuration. It only shows devices that match the search criteria.

* Creating a Compliance Report:

* A more effective approach is to use NCM’s compliance reporting feature.
* Create a compliance rule that checks for the presence of "no ip http server".
* Apply this rule to a compliance policy, and then assign this policy to the relevant devices or groups of devices in your network.
* Run the compliance report. This will not only show you devices that comply (i.e., have the "no ip http server" command) but also those that are non-compliant (lacking the command).

* Dealing with Ambiguities in Search:

* When you search for "ip http server", you're correct that it includes both configurations with and without the "no" prefix. This is where compliance reports are more effective.

* Regular Audits and Reports:

* Schedule regular compliance reports to continuously monitor and ensure that the desired configuration ("no ip http server") is maintained across all devices.
* This proactive approach helps in maintaining the security and configuration standards of the network.

* Documentation and Change Management:

* Keep a record of all compliance reports and any actions taken to rectify non-compliance.
* Incorporate this process into your change management and network operation protocols to ensure consistency and accountability.

* Automation and Alerts:

* If possible, automate the compliance report generation and set up alerts for any non-compliance issues. This can help in quickly addressing any deviations from the desired configuration.

maciej.sandecki · Answer

This is how we configured it: