Compliance

Contents Overview How does compliance check work? How does compliance check benefit me? How do I enable compliance check? Running compliance check Running adhoc tests

Overview

Government and industry regulations require IT organizations conform to some standard practices. To become compliant with the regulations such as CIS, SOX, HIPAA, PCI DSS and others, device configurations should conform to the standards specified. The standards could be anything - ensuring the presence or absence of certain strings, commands or values. Network Configuration Manager helps in automatically checking for compliance to the rules defined. Also, detailed reports on policy compliance and violations are generated.
 

How does compliance check work?

Users can define a set of rules specifying the mandatory requirements - what the configuration should contain and/or what it should not contain.  The rules can be grouped and defined as 'Compliance Policy'. Each device or a group of devices can be associated with the required policy or policies. Upon backing up configurations, Network Configuration Manager will automatically scan the configuration for compliance to the policy defined and report violations. Users can also run manual compliance checks at any given instance. Additionally, compliance checks can be scheduled to run on a hourly, daily weekly and monthly basis.

How does compliance check benefit me?

Compliance check enables network administrators save a lot of time by automating the standards checking process. Besides it helps in

• automating the process of ensuring that every device configuration in the network adheres to important security policies and best practices

• ensuring that the configuration confirms to standard practices to satisfy Government and industry regulations

• simplifying the requirements for standards compliance audit through comprehensive and intuitive reports

 

How do I enable compliance check?

Enabling compliance check starts with compliance policy creation, which is a three-step process:

 

1. Add a Rule

Define the line or lines that are to be either compulsorily present or should not be present in the configuration file. A typical example for a rule is checking the access list configuration or checking the community string. Decide what amounts to violation - presence or absence of a particular line or a set of lines in the configuration file

To add a rule,

1. Click on Compliance tab >> Rule >> "+" icon

2. Enter Rule Name, Description and other details

3. Select 'Simple Criteria' if your requirement is just to check for the presence or absence of a single line or a group of lines in the configuration file

4. If you want to specify more complex criteria using Regular Expression, select 'Advanced Criteria' and then enter the line in the text field

5. If you want to define the beginning and the end of the required configuration blocks for selective compliance check, select 'Advanced custom Criteria'. This is just an extension of 'Advanced Criteria'

 

How to choose the required criteria?
 

 

Simple Criteria

To check for the presence or absence of configuration lines (single or group of lines) with certain conditions. Here are some of the conditions in Simple Criteria:

 

 

 

Advanced Criteria

You can make use of certain regular expressions in providing the criteria for checking the configuration for compliance along with certain conditions. You can provide multiple lines separated by and/or. Here are some of the conditions in Advanced Criteria:

 

 

Advanced Custom Criteria

To check for the presence or absence of single line block in the configuration file or to define the beginning and the end (optional) of the required configuration blocks (multi line block) along with additional criteria for selective compliance check. In the Additional Block Criteria, you can add multiple lines separated by and /or. This also includes Advanced Criteria options as well, where you can add multiple lines separated by and / or.

Single Line Block:

Network Configuration Manager now supports Single Line Block as well where you can provide the start block of single line configuration alone along with additional block criteria to check the compliance status.

In Additional Block Criteria, you can also specify some extra conditions such as shutdown. This gives you the option to exclude any configuration block within the interface block specified above for compliance check. Here, you can provide multiple criteria separated by and / or.

Single Line Block example:

To identify a specific block, such as "snmp-server host test community version 2," and ensure its compliance in the given example of three single-line block configurations, please adhere to the following procedure:

1. Input "snmp-server" in the "Config Block Start" field.
2. In the Additional Block Criteria, from the Condition dropdown menu, choose "should contain" and enter "test" in the value field.
3. Add another additional block criteria by clicking the "+" button.
4. Select "and" as the logical operator and "should contain" from its respective dropdown menu.
5. Enter "version" in the value field for the second additional block criteria.

By following these steps, you will identify the blocks that meet the specified criteria. For precise identification, you can define multiple additional block criteria. If needed, you can utilize the "should not contain" option within the additional block criteria.

Applying these steps will allow you to identify the desired blocks and conduct compliance checks accordingly.

Multi Line Block:

An admin can simply define the starting and ending of the interface blocks (the end block is optional). Once this is done, Network Configuration Manager will split the configuration into configuration blocks and check for compliance. The compliance result for each block will be reported individually. Also, you can add multiple criteria in Additional Block Criteria separated by and / or.

Multi Line Block example:

To identify and ensure compliance for the first block in the given example with two multi-line block configurations, please follow these steps:

1. Input "interface" in the "Config Block Start" field.
2. Input "!" in the "Config Block End" field (this is optional).
3. In Additional Block Criteria, select "should contain" from the Condition dropdown menu and enter "FastEthernet0/0" in the value field.
4. Add another additional block criteria by clicking the "+" button.
5. Choose "or" as the logical operator and "should contain" from its respective dropdown menu.
6. Enter "FastEthernet0/1" in the input field for the second additional block criteria.

By following these steps, you will identify the blocks that meet the specified criteria. For accurate identification, you can define multiple additional block criteria. If necessary, you can utilize the "should not contain" option within the additional block criteria.

Applying these steps will allow you to identify the desired blocks and conduct compliance checks accordingly.

Regular expression in compliance rule with examples

How Network Configuration Manager checks compliance?

When you specify as above, all the blocks in the configuration starting with the word 'interface' and ending with ! will be tested for compliance to the criteria defined. The compliance result for each such configuration block will be presented individually. Overall result will be presented based on 'AND' of all the individual results. Even if only one configuration block shows violation, the overall result will be 'violation'. You can dig the report deep, analyze the individual results and find out what is wrong with the violations.

• Finally specify the severity for violation. And select the remediation configlet and provide the remediation description if any.

• Click on "Save"

 

2. Group the Rules

You can create many rules to cater to specific requirements.  A 'Rule Group' refers to a collection of rules. Create a 'Rule Group' by selecting the required rules.

To create a rule group,

1. Click on Compliance tab>> Rule Group >> "+". Enter Rule Group Name, Description and other details

2. Select the rule/rules to be added to this group. Click "Save".

 

3. Create Policy

Once a rule group is created, you can go ahead to create the required compliance policy by selecting the required Rule Groups. Compliance check is done on all policies associated with a device.

To create a policy,

1. Click on Compliance tab>> Policies >> "+" Enter Policy Name, Description and other details

2. Specify the configuration file type (running/startup) against which the rules in this policy should be checked. For example, if you choose 'Running' only the current running configuration of the device will be checked for compliance with this policy

3. Select the 'Policy Violation Criteria' - i.e specify what amounts to policy violation - your policy might contain different rules with different severities; you can specify here as violation

   • if any rule (irrespective of the severity is found violated) (OR)
   • only critical or major rules are violated
      
4. Select the required rule groups and click 'Save'

 

4. Associate Devices with Compliance Policy

After creating a policy, you need to associate it with the required devices/device groups.

To associate a policy with a device/devices,

1. Click on Compliance >> Policies. Click the link 'Associate devices' present against the policy

2. Select the devices / device groups and click 'Save'

 

Running Compliance Check

After associating a policy with a device or device group, you are ready to run compliance check.

To run compliance check for a single device,

1. Go to "Device Details" page of the specific device

2. Click "Run Compliance Check" present under "More Actions". You can even add a schedule for compliance check to be executed at a future point of time. To schedule this, goto Settings >> NCM >> All Schedules >> "Schedule Compliance Check" and fill in the details. When you schedule compliance check, you get the option to notify policy violations to desired recipients by email 

To run compliance check for a device group,

1. Go to "Inventory" >> "Device Group" page and click device group for which compliance check has to be run

2. Click "Run Compliance Check" present under the box "More Actions". You can even add a schedule for compliance check to be executed at a future point of time. To schedule this, goto Settings >> NCM >> All Schedules >> "Schedule Compliance Check" and fill in the details. When you schedule compliance check, you get the option to notify policy violations to desired recipients by email

 

Running Adhoc Tests

During any stage of compliance policy creation (rule creation, rule group creation & policy creation), you can perform checks on adhoc basis to test the validity of the rule/rule group/policy added by you. The adhoc tests depict the results then and there. After adding a rule, you can perform adhoc test for a device/device group by clicking the "Adhoc Test" button present in Compliance tab >> Rule Similarly, adhoc tests can be performed for rule group from Compliance tab >> Rule Group GUI and for Policy from Compliance >> Policy GUI.

 

---