How-To: Verifying Device Compliance Using a Qapp

Goal

By following this "How-To", you'll be able to audit the configuration of any device on your network with immediate feedback on whether the device has passed or failed and if failed, which criteria it failed on.

Use Case (is this for you?)

Auditing device configurations for compliance with PCI, SOX, HIPAA or internal policies and best practices can be a long and tedious process prone to human error. By automating these checks, not only will network and security engineers save time, but they'll have more accurate results that are easily exported into a report for your records.

Getting Started

Before diving into your audit, you'll need some files:

1. The audit template
2. The Qapp itself

The Qapp and a sample template are attached to this article

The audit template will need to be uploaded to your Netbrain platform. You can do so by clicking "Files" on the left-hand side of the Netbrain interface, selecting the desired folder and clicking "Upload Windows Files".

The Qapp will also need to be uploaded. Do that by going to the Qapp Center from the top-left hamburger menu, selecting "Shared Qapps in Tenant" and clicking "Import Qapp".

Using the Qapp

Now that the config template and Qapp have been uploaded, it's time to run some audits!

1. Go into any map or a new map and open a fresh runbook.
2. Add the Qapp to the runbook
3. Select the devices you wish to audit using the dropdown on the top left:

4. Set the "Data Source" to "Pull live data once"
5. Select the config template as the "Golden Template File"
6. Hit "Run"

Results

Once the Qapp has finished running, you can find the results in two dedicated tabs at the bottom of the map:

The "Failed_Report" shows only the devices and criteria which failed to pass the audit, while the "Full_Report" shows everything that was checked and whether it passed or failed.

After reviewing the results, you can export them as a .csv for reporting, posterity and sharing purposes. When in the desired tab (either the "Failed" or "Full" report), click on the "export" button on the top right to download the file.

Wrapping up

Compliance auditing doesn't usually end with a simple report. There's verifications and remediation that need to happen too. Thankfully, Netbrain can help there as well!

Within a runbook you can add other commands to check why a certain device failed (ie check the aaa config on a specific router) and if you have the Change Management module, you can set up a change window and deployment plan to roll out corrections.

The customizability of both this Qapp and Netbrain itself allows for this process to be adapted into any workflow or network, and adopted by both operational and security teams.

YAML Basics 

The audit template file is written in the YAML format. Here's a sample:

Config_Audit_1:

 snmp community public:
     match:
     - '^snmp-server community public.*'
     exclude: True
     description: 'Make sure we are not using public as community string'

 no ip http:
     match:
     - '^no ip http server'
     - '^no ip http secure-server'
     description: 'Make sure neither http nor https is enabled'

login authentication vty telnet:
     match:
     - 'transport input ssh$'
     start: '^line vty \d+.+'
     end: '!'
     description: 'Make sure telnet is not allowed into the device for management'
     repeated: True

The file indicates which parts of the running config output to look for and what indicates a TRUE or FALSE result. Here's a general breakdown of what's going on:

• The first line of the paragraph is the name of the criteria being checked, it should be concise and descriptive. In this example we're using the config line itself that's being checked for maximum clarity.
• The "match" variable is required and should always be present under the criteria name, indented in once
• The items beginning with "-" are the variables being matched. Wildcards are accepted (as seen in the SNMP example)
• The "exclude" variable means that a match will indicate a FALSE result. In the SNMP example, it means that if the "public" community string is in the config of a device, it'll fail that criteria. The "exclude" variable cannot be used for a repeated criteria (see next bullet)
• The "repeated" variable indicates a criteria that will or can appear multiple times. In the telnet example, this is used to check every vty interface to make sure SSH is enabled on all of them. This variable requires both a "start" and "end" variable to be defined in the regex format (same as what's used in Netbrain parsers)