Configuration Manager - Policy Rule Settings

[Anon Anon]

Hello All,

I am looking to replace Ciscoworks with CA's Configuration Manager and am having trouble figuring out the commands that I can enter within the ncm policy editor that are the equivalents to what I am currently doing in Ciscoworks. Here is an example scenario of what I am currently able to do in Ciscoworks:

Case 1: Compliance check on community strings

Problem Definition: The user wants to make sure that only two community strings are present in the configuration.

Configuration of any extra SNMP community strings in addition to the ones mentioned below leads to noncompliance.

Mandatory community strings in the device configuration:
snmp-server community white ro
snmp-server community black rw

Solution: Use of the negation concept to solve the problem. The template to solve this issue is:
- snmp-server community [#!white#] ro
- snmp-server community [#!black#] rw

In this case, the beginning dash character (-) will make sure that the command is not present in the device configuration, and since the negation is applied, it will match all the community strings except those mentioned in the problem definition and will flag a noncompliance if there are any community strings except the desired ones.

Running a compliance check would list the additional community strings present in the configuration. An alternate way could be to deploy the changes (removing the unwanted ones from the configuration) in the same job. Refer to Figure 1 for a better understanding.

I've read through the documentation but can't seem to get the same results using the default "has line, does not have line, contains, does not contain, etc." unless there is something I am doing incorrectly. This would make creating policies much easier as I would not have to specify every statement that should not be in the configuration. Anyone have any suggestions on how this can be performed within CA's Config Manager?

Thanks,

Brian

[Anon Anon]

So I'm still seeking a solution to this - it's a pretty key feature that comes in handy with Ciscoworks for finding random configuration slip ups. Does anyone know when creating policies if you can only use plain cisco commands or can you use code to manipulate how the policy manager interprets the policy against the archived configuration?

For example in Ciscoworks I can run the following in the compliance manager:

- access-list 75 permit [#!192\.1\.1\.1|10\.1\.1\.1#]

With this statement it will flag any configuration as non-compliant if there are any IP addresses in access-list 75 besides 192.1.1.1 and 10.1.1.1. I tried punching in that command into the policy manager but it does not translate...

[Justin_Kulikowski]

Hi Brian, were you able to find an answer to your problem?

I'm just beginning to dive into Configuration Manager and I'm running into the same wall.

Thanks.

[Anon Anon]

Hi All,

I'm also having the same issue, to check config across 1500 devices,

I want to know if NTP is configured, password lengts on the devices, Telnet and SSH access, etc the list goes on,

regards,
James

[MichaelDavenport62353086]

Compliance checks.  Something I've been asking about as well.