[ad_1]
Clear visibility of machine compliance is vital for community operations. One of many greatest challenges although is to agree upon the definition of compliance since totally different environments have totally different necessities. The aim of this weblog is to share the present compliance capabilities in Cisco DNA Heart that may assist community directors to maintain the infrastructure secure and constant.
The present model of Cisco DNA Heart, seems to be at machine compliance from 5 totally different lenses in a non-SD-Entry community: startup vs. running-config, community profiles, software visibility, software program picture, and significant safety advisories.
Startup vs Working Configuration
Have you ever ever configured a tool and forgotten to avoid wasting the working configuration solely to have the machine reboot unexpectedly? The results of this may very well be catastrophic leading to quite a few points within the community. Although the popular methodology for machine configuration is thru Cisco DNA Heart, handbook modifications are nonetheless permitted. To keep away from inconsistencies between startup and working configurations, Cisco DNA Heart supplies a compliance verify by flagging any gadgets which have a startup and working configurations that don’t match.
Within the snapshot under, we see how Cisco DNA Heart supplies visualization of the variations between the working and startup configuration. On this instance, the community administrator manually added an outline to an interface and forgot to avoid wasting the brand new configuration. Cisco DNA Heart additionally supplies a method to remediate this drawback with a button to “Synch Gadget Config” which saves the running-config into startup-config.
Community Profiles
One among Cisco DNA Heart’s best values is the automation it brings by leveraging Intent-Primarily based Networking (IBN). One of many constructs that Cisco DNA Heart makes use of to implement IBN is community profiles. Community profiles comprise totally different facets of intent-based networking together with wi-fi and model-based configuration (for wi-fi gadgets) and templates (for all gadgets). By way of compliance checks, Cisco DNA Heart can flag any configuration deviation from these constructs.
Let’s say that we’ve got a easy template in Cisco DNA Heart pushing a “vlan” configuration to a port:
TBRANCH-C9200L-2#present run int gig 1/0/7 Constructing configuration... Present configuration : 344 bytes ! interface GigabitEthernet1/0/7 description Description pushed by DNAC Template -- lan switchport entry vlan 419 switchport mode entry device-tracking attach-policy IPDT_POLICY ip circulate monitor dnacmonitor enter ip circulate monitor dnacmonitor output service-policy enter DNA-MARKING_IN service-policy output DNA-dscp#APIC_QOS_Q_OUT finish
On this instance, we are going to assume that somebody manually eliminated the “vlan” configuration that has been pushed by Cisco DNA Heart templates:
TBRANCH-C9200L-2#conf t Enter configuration instructions, one per line. Finish with CNTL/Z. TBRANCH-C9200L-2(config)#int gig 1/0/7 TBRANCH-C9200L-2(config-if)#no switchport entry vlan 419 TBRANCH-C9200L-2(config-if)#
This motion will set off a “Community Profile” compliance violation as seen within the snapshots under:
Cisco DNA Heart clearly identifies the template that has been modified within the machine and the particular traces of configuration which have been eliminated:
Software Visibility
Cisco DNA Heart additionally leverages Intent-Primarily based Networking (IBN) to provision gadgets for visibility of purposes by CBAR and NBAR. If there are any modifications to this intent, the gadgets will likely be marked as non-compliant for “Software Visibility” as seen within the instance under.
The machine has CBAR (Controller Primarily based Software Recognition) enabled through DNA Heart:
interface GigabitEthernet1/0/7
description Description pushed by DNAC Template -- lan
switchport entry vlan 419
switchport mode entry
device-tracking attach-policy IPDT_POLICY
ip circulate monitor dnacmonitor enter
ip circulate monitor dnacmonitor output
service-policy enter DNA-MARKING_IN
service-policy output DNA-dscp#APIC_QOS_Q_OUT
ip nbar protocol-discovery
finish
Configuration is manually faraway from the machine:
TBRANCH-C9200L-2(config)#int gig 1/0/7
TBRANCH-C9200L-2(config-if)#no ip nbar protocol-discovery
TBRANCH-C9200L-2(config-if)#
Software program Picture
Cisco DNA Heart makes use of the idea of “Golden Picture” to assist picture consistency inside a web site. When gadgets have photographs totally different from “Golden Picture”, it’ll set off the “Software program Picture” compliance violation as seen within the snapshots under:
Important Safety Advisories
Units with important safety vulnerabilities will even set off a compliance verify as proven within the snapshots under:
Our subsequent weblog will likely be masking facets of Cisco DNA Heart and configuration administration.
Keep tuned!
Share:
[ad_2]
