Implementing Changes Once you have your network policies defined, see the prior posts Part 1 and Part 2 , then implemented in a configuration policy check, you need a way to correct any non-compliant configurations. An obvious choice for remediation is to simply login to the offending device and type...

In the prior post, I explained why configuration policies are needed. Now it is time to discuss how to build policies. I like to start with the written policies, because that tells me what was intended. An example is: "All network devices will be configured to send syslog messages to the syslog...

I'm building configuration policy checks for a customer and realized that it would be beneficial to share the design choices and implementation details that I encountered. The tool that I used is NetMRI's Configuration Policy, but the same thing would work for other tools that have similar configuration...

I did a Packet Pushers Podcast recently with Greg Ferro and Josh O'Brien , talking about the common network problems that we see in operational networks. The list of topics comes from a poster, The Top 25 Network Problems and Their Business Impact that I developed while at Netcordia (now Infoblox...

Networks use the same devices in many different roles, so configuration validation based on device type isn't sufficient. There are some configuration things that can be checked across all the devices of a certain type in your network, such as checking the syslog and NTP configuration, or verifying...

My previous post talked about the basics of verifying a configuration prior to deployment as a way to minimize the number of incorrect configurations that are fielded. The second topic, which is closer to the original NANOG posting comments, is with respect to auditing existing configurations to make...

The North American Network Operators Group (NANOG) email list just had an interesting exchange about configuration management. Someone asked: For auditing, is there any Cisco Router/Switch configuration analysis tool? Someone else replied: Depends on your goal. Trying to identify and fix configuration...

I'm working on a network that requires configuration checks be performed. For some of the subsystems, that's pretty easy because the configuration is done per device and there are no external dependencies. For example, the desired SNMP, logging, VTY, or NTP configurations are well known and only...