Automating Network Configuration Compliance with Ansible and Network Compliance Engine (NCE)

Introduction#

Maintaining network configuration compliance is crucial for security, stability, and operational efficiency. Manually auditing network devices for compliance against defined standards is time-consuming and prone to errors. This article explores how to automate network configuration compliance checks using Ansible and Network Compliance Engine (NCE). We’ll cover the benefits of automation, the architecture of NCE, how to integrate Ansible with NCE, and provide practical examples to get you started.

The Importance of Network Configuration Compliance#

Non-compliant network configurations can lead to various problems, including:

Security Vulnerabilities: Misconfigured firewalls, routers, or switches can create security loopholes, making the network susceptible to attacks.
Performance Issues: Incorrect QoS settings or routing configurations can lead to network congestion and performance degradation.
Operational Inconsistencies: Inconsistent configurations across devices can complicate troubleshooting and increase the risk of human error.
Audit Failures: Non-compliance with industry regulations (e.g., PCI DSS, HIPAA) can result in penalties and reputational damage.

Automating compliance checks helps address these challenges by providing a consistent, repeatable, and auditable process for verifying network configurations against defined standards.

Introducing Network Compliance Engine (NCE)#

Network Compliance Engine (NCE) is a software platform designed to automate network configuration compliance management. It provides a centralized repository for storing compliance rules, a mechanism for executing compliance checks against network devices, and reporting capabilities for tracking compliance status. Key features of NCE include:

Rule-Based Compliance: Define compliance rules based on regular expressions, configuration snippets, or other criteria.
Multi-Vendor Support: Supports a wide range of network devices from different vendors.
Automated Remediation: Automatically remediate non-compliant configurations based on predefined actions.
Reporting and Analytics: Generate reports on compliance status, identify non-compliant devices, and track remediation efforts.
Integration with Automation Tools: Integrates with popular automation tools like Ansible, enabling automated compliance checks as part of broader automation workflows.

While specific NCE implementations vary depending on the vendor (e.g., Cisco DNA Center, Juniper Apstra), the core principles remain the same. For the purpose of this article, we will focus on the general concepts and how Ansible can interact with an NCE-like system, regardless of the specific vendor.

Integrating Ansible with NCE for Automated Compliance#

Ansible is a powerful automation tool that can be used to orchestrate network configuration compliance checks with NCE. The integration typically involves the following steps:

Retrieve Compliance Rules from NCE: Ansible retrieves the compliance rules from the NCE platform. This can be done using API calls or by accessing a shared repository where the rules are stored.
Connect to Network Devices: Ansible connects to the network devices using SSH or other supported protocols.
Retrieve Device Configuration: Ansible retrieves the current configuration from each network device.
Execute Compliance Checks: Ansible executes the compliance checks against the device configuration based on the rules retrieved from NCE.
Report Compliance Status: Ansible reports the compliance status of each device, including any violations found.
Remediate Non-Compliant Configurations (Optional): Ansible can automatically remediate non-compliant configurations by applying corrective actions.

Practical Example: Automating Firewall Rule Compliance#

Let’s consider a practical example of automating firewall rule compliance using Ansible and NCE. Assume we have a requirement that all firewall rules must have a description. We can define a compliance rule in NCE to enforce this requirement.

1. Define the Compliance Rule in NCE (Conceptual):

In NCE, you would define a rule that checks for the presence of a “description” field in each firewall rule configuration. The specific syntax and method for defining this rule will depend on the NCE platform you are using. For example, it might involve defining a regular expression that matches firewall rules without descriptions.

2. Ansible Playbook for Compliance Check:

---
- name: Check Firewall Rule Compliance
  hosts: firewalls
  gather_facts: false

  tasks:
    - name: Get Firewall Configuration
      ios_command:
        commands:
          - show running-config | section ip access-list extended
      register: firewall_config

    - name: Check for Rule Descriptions
      set_fact:
        non_compliant_rules: "{{ [] }}"

    - name: Identify Non-Compliant Rules
      set_fact:
        non_compliant_rules: "{{ non_compliant_rules + [item] }}"
      loop: "{{ firewall_config.stdout[0].split('\n') }}"
      when: item | regex_search('^permit|deny') and item | regex_search('no description', ignorecase=True)

    - name: Report Compliance Status
      debug:
        msg: "Firewall {{ inventory_hostname }} - Non-Compliant Rules: {{ non_compliant_rules | default([]) }}"
      when: non_compliant_rules | length > 0

    - name: Report Compliance Status - Compliant
      debug:
        msg: "Firewall {{ inventory_hostname }} - All rules compliant."
      when: non_compliant_rules | length == 0

    - name: Remediate Non-Compliant Rules (Example - Requires further development)
      # This is a placeholder.  Real remediation would involve more complex logic
      # and potentially interaction with an NCE API or configuration management system.
      debug:
        msg: "Remediation required for firewall {{ inventory_hostname }} on rules: {{ non_compliant_rules }}"
      when: non_compliant_rules | length > 0
      #  ios_config:
      #    lines:
      #      - description Added by Ansible
      #    parents: "{{ item.split(' ')[1] }}" # This is a very simplistic example and needs adaptation
      #  loop: "{{ non_compliant_rules }}"

Explanation:

hosts: firewalls: Specifies the target devices for the playbook (defined in your Ansible inventory).
ios_command: Retrieves the firewall configuration using the show running-config command and filters for access lists. Adapt this to your specific firewall vendor.
set_fact: Initializes an empty list to store non-compliant rules.
loop: Iterates through each line of the firewall configuration.
when: Checks if the line represents a firewall rule (permit or deny) and if it does not contain a description (using regex_search). The ignorecase=True flag ensures case-insensitive matching.
debug: Reports the compliance status, including the list of non-compliant rules.
Remediate Non-Compliant Rules: This section is a placeholder and requires significant development. A real-world implementation would involve:
- More sophisticated parsing of the firewall rule.
- Potentially calling an NCE API to trigger remediation.
- Using the ios_config module to add the missing descriptions. The provided example is a very basic starting point.
- Proper error handling and rollback mechanisms.

3. Running the Ansible Playbook:

Execute the Ansible playbook using the following command:

ansible-playbook firewall_compliance.yml

The playbook will connect to each firewall, retrieve the configuration, check for rule descriptions, and report the compliance status.

Important Considerations:

Vendor-Specific Modules: The ios_command and ios_config modules are specific to Cisco IOS devices. You’ll need to use the appropriate modules for your specific network device vendor (e.g., junos_command, junos_config for Juniper).
NCE API Integration: For more advanced compliance management, integrate directly with the NCE API to retrieve compliance rules, report compliance status, and trigger remediation actions. This will provide a more centralized and automated approach.
Error Handling: Implement robust error handling in your Ansible playbooks to gracefully handle unexpected errors and prevent disruptions to the network.
Idempotency: Ensure that your remediation tasks are idempotent, meaning that they can be run multiple times without causing unintended changes.

Benefits of Automating Network Compliance#

Automating network configuration compliance with Ansible and NCE offers several benefits:

Improved Security: Reduces the risk of security vulnerabilities by ensuring that network devices are configured according to security best practices.
Increased Efficiency: Automates the compliance checking process, freeing up network engineers to focus on more strategic tasks.
Reduced Errors: Eliminates human error associated with manual compliance checks.
Enhanced Auditability: Provides a clear audit trail of compliance checks and remediation actions.
Faster Remediation: Enables rapid remediation of non-compliant configurations, minimizing the impact of security vulnerabilities and performance issues.

Conclusion#

Autom