CLI Golden Configurations

CLI Golden Configurations evaluate whether the running configuration for a device matches its node’s baseline configuration. In this guide, you will learn how to:

• Create a baseline configuration
• Add devices to a Golden Configuration node
• Run compliance checks against those devices
• Use compliance reports to take corrective action against any detected compliance violations

How CLI Golden Configurations work

Every node in a CLI Golden Configuration has an associated baseline configuration, which consists of:

• Lines of text that mimic the syntax used when configuring a device natively
• Rules that determine how those lines are interpreted (whether the line should be present or absent from the device’s running configuration)

Once a device has been added to a node, you can run compliance checks against it. The device’s running configuration is compared against the node’s baseline configuration, and any discrepancies are noted in the resultant compliance report.

Configuration tab

Before devices can be managed on the current node, a baseline configuration for them to be compared against must be defined via the Configuration tab. Here, you can:

• Write configuration lines via text editor
• Set the rules that are applied to each line
• Define variables for use in the configuration

Add configuration lines

To begin writing a configuration, start typing in the text editor as if you were issuing commands on a device’s native command-line interface (CLI). Alternatively, you can paste an existing configuration into the text editor from another source, or import it from an available device.

Import a device configuration

To import a configuration from an available device into your Golden Configuration:

Apply rules to configuration lines

Configuration line behavior is determined by two rules, both assigned on a line-by-line basis:

• Evaluation mode
• Severity type

Evaluation mode

Evaluation mode determines how the presence or absence of a line from a device’s running configuration is interpreted by compliance checks.

To change a line’s evaluation mode, prepend the relevant delimiter to the line, or:

Severity type

Each line violation is assigned a severity type that reflects a weight value used when calculating a device’s configuration grade. In descending order of severity:

• Warning (default)
• Error (delimited by <e/>)
• Info (delimited by <i/>)

These values are useful for approximating the potential impact a line may have on a device’s performance if it deviates from the baseline configuration. A line that defines the description field for an interface may be assigned Info, while a line that sets that interface’s management IP address may be assigned Warning.

The steps to change a line’s severity type are similar to those used to change its evaluation mode—hover over the Severity (ℹ) icon on the toolbar.

Variable and regular expression support

You can add more flexibility to your configuration by defining variables for values that may be dynamic (hostnames, interface numbers, etc). For example, you may wish to allow your configuration to be updated by other sources, such as workflows. Or you might want to define an IP address used throughout the configuration as a variable so that only one update needs to be made if that address changes in the future.

1
    {
2
        "hostname": "Itential"
3
    }

Call a variable

To call a variable in your configuration, enclose its name in the {{ }} delimiters:

hostname {{hostname}}

Use regular expressions

Configurations also support regular expressions. To use one, enclose it in the {/ /} delimiters:

hostname {/[A-Za-z]/}

Devices & Groups tab

The Devices & Groups tab contains all actions related to managing devices and device groups associated with the current node. From this tab, you can:

• Add devices or groups to the node
• Run compliance checks against devices and groups
• Perform basic remediation based on the results of these compliance checks

Devices and groups are each managed under their own respective subtab. Click the subtabs to switch between them.

Add devices and device groups

To evaluate whether a device is compliant with your baseline configuration, you must first add it to the node:

All devices and groups associated with the node are displayed in a table view on their respective subtab.

Compliance

Once you have added a device or group to the node, you can run compliance checks against it:

After the check is complete, you can view a report that details any detected compliance violations. The steps taken to view the report are similar between devices and groups, but there are slight differences.

View compliance report for a device

View compliance report for a device group

To view a compliance report associated with a device group, click the menu (⋮) button of the group and select the Review Group option. A list of devices will be displayed—from here, follow the instructions given above for viewing device compliance reports.

Perform remediation

Compliance reports list any violations detected in a device’s running configuration beneath the Configuration Errors header. To view more details about any item on the list, including potential remediation options, click its dropdown arrow.

To apply one of the suggested remediation options to the device:

By default, a backup of the device’s running configuration will be made before any changes are applied. This behavior can be toggled via the Take backup before remediation switch.

Define severity weight and grade benchmark values

The grade a device’s running configuration receives (Pass, Review, or Fail) in a compliance report can be influenced by changing:

• The default weight value assigned to each line severity type
• The default benchmark value assigned to each grade

Calculate the grade of a device configuration

When a compliance report is run against a running configuration, the following formula is used:

Score = (totalNumPassLines / ((numOfErrorLines * errorWeightValue) + (numOfWarnLines * warnWeightValue) + (numOfInfoLines * infoWeightValue) + totalNumPassLines)) * 100

The following severity type weight values are used in this formula by default:

• Error: 2
• Warning: 1
• Info: 0.5

The score returned by this formula is compared to the following grade benchmark values by default to assign a grade to the running configuration:

• Pass: 90
• Review: 80
• Fail: 0

81.82 = ((9 / ((1 * 2) + (0 * 1) + (0 * 0.5) + 9)) * 100)

Use a workflow to define custom values

You can use a workflow to run a compliance report with custom severity type weight and grade benchmark values:

1
{
2
  "error": 1,
3
  "warning": 0.5,
4
  "info": 0.25,
5
  "pass": 45,
6
  "review": 40,
7
  "fail": 0
8
}