• This is an API enhancement that enables the customer to script their own configuration collection.  This means that unsupported devices can have change management and configuration policy audits supported.  This went in specifically for a customer that wanted policy checks done on SD-WAN Viptela routers.

The Script:

# BEGIN-SCRIPT-BLOCK
#
# Script-Filter:
#     true
#
# END-SCRIPT-BLOCK

import requests
#
# Stops us from erroring out when making a request call to a Self Signed Cert
#
requests.packages.urllib3.disable_warnings()
#
# "netmri_ipaddress" is a well known variable of your NetMRI
# I broke up the API version and the API call
#
api_v = "/api/3.3"
api_command = "/config_revisions/import_custom_config"
url = "https://"+ netmri_ipaddress + api_v + api_command
#
# Below I statically define the "DeviceID" which is "2" in this example this is my "Home Router" :)
# We are going to add the following to 'RunningConfig': 'Testing 123456','SavedConfig': 'Testing 654321'
#
payload = {'DeviceID': '2', 'RunningConfig': 'Testing 123456','SavedConfig': 'Testing 654321'}

#
# We are going to use the "Username" and "Password" you logged in with for the API call
# http_username and http_password
#
r = requests.get(url, auth=(http_username, http_password), data=payload, verify=False)

Now for the fun stuff, we run the script

Now to back up a device that we do not support

Install Process

• SSH into the NetMRI and run “sandbox login”
• Login with sbuser/sbuser (you might have to change the password)

• Installing PIP(PIP is not installed by default)

• wget https://bootstrap.pypa.io/get-pip.py

• python3 get-pip.py

• This will run and download the binary of PIP and install it

• pip install paramiko

• Note - Paramiko
• The high-level client API starts with the creation of an SSHClient object. For more direct control, pass a socket (or socket-like object) to a Transport, and use start_server or start_client to negotiate with the remote host as either a server or client.

This following slide is one script that will “SSH” to a device you have selected and login via the “username” and “password” you supplied.

For this example, I’m just using a basic show command “show ip int brief”.

You can find on our Infoblox-Open GitHub - https://github.com/infobloxopen/netmri-toolkit/tree/master/NetMRI_GUI_Python

# BEGIN-SCRIPT-BLOCK
#
# Script-Filter:
#     true
#
# Script-Variables:
#     $cliuser string
#     $clipwd password
#
# END-SCRIPT-BLOCK
from infoblox_netmri.easy import NetMRIEasy
import paramiko
import time
import requests
#
# This will not error when you are not verifing Certs for https
#
requests.packages.urllib3.disable_warnings()
#
# "netmri_ipaddress" is a wellknown variable of your NetMRI
# I broke up the API version and the API call
#
api_v = "/api/3.3"
api_command = "/config_revisions/import_custom_config"
url = "https://"+ netmri_ipaddress + api_v + api_command

def disable_paging(remote_conn):
    '''Disable paging on a Cisco router'''
    remote_conn.send("terminal length 0\n")
    time.sleep(1)
    # Clear the buffer on the screen
    output = remote_conn.recv(1000)
    return output
if __name__ == '__main__':
    # We will prompt you for the username and password
    # "ip" will equal the well known variable "ipaddress"
    ip = ipaddress
    username = cliuser
    password = clipwd
    # Create instance of SSHClient object
    remote_conn_pre = paramiko.SSHClient()
    # Automatically add untrusted hosts (make sure okay for security policy in your environment)
    remote_conn_pre.set_missing_host_key_policy(
         paramiko.AutoAddPolicy())
 # initiate SSH connection
    remote_conn_pre.connect(ip, username=username, password=password, look_for_keys=False, allow_agent=False)
    print ("SSH connection established to %s" % ip)
    # Use invoke_shell to establish an 'interactive session'
    remote_conn = remote_conn_pre.invoke_shell()
    print ("Interactive SSH session established")
    # Strip the initial router prompt
    output = remote_conn.recv(1000)
    # See what we have
    print (output)
    # Turn off paging
    disable_paging(remote_conn)
 # Now let's try to send the router a command
    remote_conn.send("\n")
    remote_conn.send("show ip int brief\n")
    # Wait for the command to complete
    time.sleep(2)

 output = remote_conn.recv(5000)
    print (output)
    #
    # Below I statically define the "DeviceID" which is "2" in this example this is my "Home Router" :)
    # We are going to add the following to 'RunningConfig': 'Testing 123456','SavedConfig': 'Testing 654321'
    #
    payload = {'DeviceID': device_id, 'RunningConfig': output,'SavedConfig': 'Testing 654321'}
    #
    # We are going to use the "Username" and "Password" you logined it with for the API call
    # http_username and http_password
    #
    r = requests.get(url, auth=(http_username, http_password), data=payload, verify=False)

This is what the running Config Saved looks like

While non-government organizations may not be forced to pass a DISA STIG audit, the majority have their own compliance standards or best practices they must follow.  In the enterprise world, there are two broad types of requirements – external standards imposed on enterprises and internal best practices that are self-imposed. 

• External standards imposed on enterprises – These are the most visible compliance standards because regulatory bodies place requirements on an organization based on certain criteria. Examples include standards like PCI DSS for organizations accepting credit cards or industry-specific mandates like HIPAA for the healthcare industry and NERC/FERC for the utility industry.
• Internal best practices that are self-imposed – Regardless of mandatory external standards applied to an organization, most successful enterprises have evolved a set of internal best practices that help maintain a safe, secure, and reliable network. Custom rules or policies should be created to ensure that goal. 

Compliance – Love or Hate?

In a playful way, I tend to group compliance mandates with personal healthcare traits.  Should I exercise more?  Track what I eat better? Schedule preventive doctor appointments?  We all say yes, yes, and yes, but many of us don’t do it well because we are too busy with other things and only think about it when we get sick. 

Compliance can be the same thing: we know we should be tracking and monitoring continuously.  But do we?  Typically it’s something we put off because it’s a tedious, manual process for most IT teams for implementation – and we all are too busy already.  As a result, we tend to ignore compliance measures until we can’t – either when something breaks (or is broken into) or when an audit is required. 

There is a Better Way

While there are many nuances and details, there are three high-level processes that need to be followed for building and adhering to internal best practice policies and/or external mandates:

• Build the definition of what policy must be followed by which device.
• Implement the policies and ensure the current state of each device is compliant.
• Continuously monitor any change over time and ensure the policy isn’t violated.

Defining policies can be extremely challenging because organizations need to think about many different requirements and goals across the enterprise.  Too often, the IT team is overworked with day-to-day requirements to set aside weeks or months to build detailed best practices and standards because there is often no clear starting point. 

For many standards, policies are not well defined.  What does “keep a safe and secure network” mean?  How do I take that from a vision to something that can be implemented?  Do I have the expertise in-house?  Do I have budget to hire a consultant?  I don’t have an audit coming up, so should I just ignore it? 

Someone Else Already Did the Hard Work for You

This is where DISA STIG can help an enterprise or non-government organization – the building of definitions and policies for devices.  From a network infrastructure point of view, the DISA STIG standards has hundreds of category 1, 2, and 3 rules/best practices for devices including:

• Firewall
• Infrastructure Layer 2 Switch
• Infrastructure Layer 3 Switch
• Infrastructure Router
• Network Devices
• Perimeter Layer 3 Switch
• Perimeter Router

The DISA STIG standards highlight many things IT and networking teams should be looking for with regard to standards and best practices, so it’s a great starting place for taking the first step of compliance – defining the individual policies for both internal and external mandates.  Don’t guess and build from scratch when you have a well-defined blueprint available that can be tweaked for your needs. 

When it comes to an audit, you’ll be much more successful if you can say “we are using the DISA STIG policies and rules as our standards” instead of “we’re good, trust me.”

It’s a Start, but There is More

When it comes to step 2 (initial deployment of policies) and step 3 (continuous monitoring of policies), this is where an automated network change and configuration management solution can come in handy.  This type of solution helps automate many of the manual tasks typically associated with compliance monitoring.

If you’re looking to improve and automate network compliance or best practice monitoring, there are several things you should look for in a solution:

• Built-in policies and standards for common mandates (i.e. DISA STIG, PCI DSS, NSA, etc.) with automated updates
• Ability to easily modify policies and/or create new rules bases on your individual requirements
• Discovery of devices, device types, and operating systems because rules likely vary across different attributes
• Templates to build policies based on needs (i.e. vendor, device type, application, internal/external facing, etc.)
• Immediate comparison of current configuration against the rule
• Ongoing tracking of all configuration changes with the ability to compare new configurations to the rule templates
• Notification of rule violations with the ability to remediate immediately or on demand
• Reporting and documentation for both troubleshooting and auditing

While starting and defining an internal best practice or deciphering an external mandate can be overwhelming at first, don’t put your head in the sand and wait until there is a breach or an audit.  There are steps you can take to make the process bite-sized and digestible.  Leverage existing standards such as DISA STIG as a starting point and modify based on your requirements.  Take advantage of automated network change and configuration management tools to eliminate the tedious, manual, repetitive processes.

Setting up policies for tracking and monitoring best practices or mandates isn’t binary or a flip of a switch.  It’s an evolutionary process where you build the standards, start tracking, monitor over time, and make continuous tweaks based on your individual needs.  Take advantage of what others have built to make your job easier.