As an Amazon Associate I earn from qualifying purchases from amazon.com

Compliant or not? Cisco DNA Heart will show you how to determine this out.


Clear visibility of gadget compliance is vital for community operations. One of many largest challenges although is to agree upon the definition of compliance since completely different environments have completely different necessities. The aim of this weblog is to share the present compliance capabilities in Cisco DNA Heart that can assist community directors to maintain the infrastructure protected and constant.

The present model of Cisco DNA Heart, seems to be at gadget compliance from 5 completely different lenses in a non-SD-Entry community: startup vs. running-config, community profiles, software visibility, software program picture, and important safety advisories.

Compliance Types
Determine 1: Compliance Varieties

Startup vs Working Configuration

Have you ever ever configured a tool and forgotten to save lots of the operating configuration solely to have the gadget reboot unexpectedly?  The results of this could possibly be catastrophic leading to quite a few points within the community. Although the popular technique for gadget configuration is thru Cisco DNA Heart, guide modifications are nonetheless permitted. To keep away from inconsistencies between startup and operating configurations, Cisco DNA Heart offers a compliance test by flagging any units which have a startup and operating configurations that don’t match.

Within the snapshot under, we see how Cisco DNA Heart offers visualization of the variations between the operating and startup configuration.  On this instance, the community administrator manually added an outline to an interface and forgot to save lots of the brand new configuration. Cisco DNA Heart additionally offers a solution to remediate this drawback with a button to “Synch Machine Config” which saves the running-config into startup-config.

Config Differences and Remediation option
Determine 2: Config Variations and Remediation choice

Community Profiles

Certainly one of Cisco DNA Heart’s best values is the automation it brings by leveraging Intent-Primarily based Networking (IBN). One of many constructs that Cisco DNA Heart makes use of to implement IBN is community profiles. Community profiles comprise completely different facets of intent-based networking together with wi-fi and model-based configuration (for wi-fi units) and templates (for all units). Through compliance checks, Cisco DNA Heart can flag any configuration deviation from these constructs.

Let’s say that now we have a easy template in Cisco DNA Heart pushing a “vlan” configuration to a port:

TBRANCH-C9200L-2#present run int gig 1/0/7
Constructing configuration...

Present configuration : 344 bytes
!
interface GigabitEthernet1/0/7
description Description pushed by DNAC Template -- lan
switchport entry vlan 419
switchport mode entry
device-tracking attach-policy IPDT_POLICY
ip stream monitor dnacmonitor enter
ip stream monitor dnacmonitor output
service-policy enter DNA-MARKING_IN
service-policy output DNA-dscp#APIC_QOS_Q_OUT
finish

On this instance, we’ll assume that somebody manually eliminated the “vlan” configuration that has been pushed by Cisco DNA Heart templates:

TBRANCH-C9200L-2#conf t
Enter configuration instructions, one per line. Finish with CNTL/Z.
TBRANCH-C9200L-2(config)#int gig 1/0/7
TBRANCH-C9200L-2(config-if)#no switchport entry vlan 419
TBRANCH-C9200L-2(config-if)#

This motion will set off a “Community Profile” compliance violation as seen within the snapshots under:

Network Profile Compliance Violation
Determine 3: Community Profile Compliance Violation

Cisco DNA Heart clearly identifies the template that has been modified within the gadget and the precise traces of configuration which have been eliminated:

CLI commands from Template not present in the config
Determine 4: CLI instructions from Template not current within the config

Software Visibility

Cisco DNA Heart additionally leverages Intent-Primarily based Networking (IBN) to provision units for visibility of purposes via CBAR and NBAR.  If there are any modifications to this intent, the units might be marked as non-compliant for “Software Visibility” as seen within the instance under.

The gadget has CBAR (Controller Primarily based Software Recognition) enabled by way of DNA Heart:

interface GigabitEthernet1/0/7
description Description pushed by DNAC Template -- lan
switchport entry vlan 419
switchport mode entry
device-tracking attach-policy IPDT_POLICY
ip stream monitor dnacmonitor enter
ip stream monitor dnacmonitor output
service-policy enter DNA-MARKING_IN
service-policy output DNA-dscp#APIC_QOS_Q_OUT
ip nbar protocol-discovery
finish

Configuration is manually faraway from the gadget:

TBRANCH-C9200L-2(config)#int gig 1/0/7
TBRANCH-C9200L-2(config-if)#no ip nbar protocol-discovery
TBRANCH-C9200L-2(config-if)#

 

Application Visibility Compliance Violation
Determine 5: Software Visibility Compliance Violation

 

Configuration removed for this interface
Determine 6: Configuration eliminated for this interface

Software program Picture

Cisco DNA Heart makes use of the idea of “Golden Picture” to assist picture consistency inside a web site. When units have pictures completely different from “Golden Picture”, it’s going to set off the “Software program Picture” compliance violation as seen within the snapshots under:

Software Compliance Violation
Determine 7: Software program Compliance Violation

 

Device Image different from Golden Image
Determine 8: Machine Picture completely different from Golden Picture

Important Safety Advisories

Units with important safety vulnerabilities can even set off a compliance test as proven within the snapshots under:

Critical Security Advisories Compliance Violation
Determine 9: Important Safety Advisories Compliance Violation

 

Detailed list of security advisories
Determine 10: Detailed listing of safety advisories

 

Our subsequent weblog might be protecting facets of Cisco DNA Heart and configuration administration.
Keep tuned!

Share:

We will be happy to hear your thoughts

Leave a reply

Dealssoreal
Logo
Enable registration in settings - general
Compare items
  • Total (0)
Compare
0
Shopping cart