Advanced automation using NCM and other Orion tools.

Question

Wanted to reach out to the community to see if anyone has taken the tools provided in Orion and developed any functional automation off of them? I understand that the compliance tool is there and can check the stored running configuration but the logic it has is limited and does not seem to lend itself toward easy automation and remediation of issues.

For example, we want to audit X variable in our configuration that is a standard in our organization. However between the various platforms in our network IOS, IOS-XE, NXOS and others the configuration is not going to appear the same in each "running-config". To match this example you would need to check the device type and software then match the proper config to that device once the variables are matched and execute remediation. I understand you can build groups to sort devices into and then run compliance reports against each group, however, this requires a ton of manual work to identify the unique charactierstics of each group to match with the compliance report being built. In many ways having to sort into groups to match the report being built truly defeats the goal of automating these task as so much manual work would have to be done for each possible combination.

If anyone has any insight or example of how they've done this in their own organization that they would like to share that would be great.

mesverrum · Accepted Answer

I will say that ncm is not going to have the full range of capabilities that you would be able to leverage from something like hand crafted scripts and ansible playbooks. Like you mentioned, you primarily have to work with the existing saved configs so you can't just pick a series of if statements and run different cli depending on the output of some show commands and their outputs. The work around I've seen is to create additional config types for each of those show commands. The problem is that you aren't really working in real time, you run a stack of "config backups" that are actually the show commands you want, then after all of them are collected you can cook up some logic to piece them all together and determine which scripts you want to run or what policies need to be applied. Ultimately something like this tends to get pretty complex in ncm and if you are already geared up to do it in ansible then doing it in NCM will probably seem clunky by comparison.

With that said, I did have a client who had leveraged ncm to build his routers by pulling a bunch of ncm data out to powershell, did his logic all there to build the necessary configs, then just piped that into the ncm verbs to run whatever lines of config his powershell had assembled. He could have probably just bypassed ncm completely for the remediation stuff really but he liked to use the reporting there and he liked having ncm available for more basic things his junior techs needed to be able to do in the gui.