Introduction

Network configurations are the backbone of any network. If your

configurations go down, they drag your entire network along with them,

costing you time and money. In order to avoid such mishaps, it's important

to track configuration changes, have configurations backed up, and monitor

every nook and corner of your network 24x7. But wait—is it possible to do

all of this manually?

The repetitive, labor-intensive, and error-prone work of manually monitor-

ing configurations can be mentally and physically draining. In fact, according

to Dennis Drogseth, vice president of IT consulting firm EMA, "90 percent

of network problems can be traced to configuration errors." While manual

configuration management takes a toll on your business, external factors

like network outages can happen unexpectedly, causing even more damage.

How do you overcome these challenges and make sure your network config-

urations stay healthy? In this e-book, we'll take a look at some best practic-

es that can help IT admins ensure hassle-free network configuration man-

agement.
Best practices for
better configuration
management

1. Back up network
configurations regularly
to instantly recover from
network mishaps.
Human error is a major contributor to network disasters and, consequently,

downtime. Even with multiple layers of verification at play, faulty

configuration changes can still occur.These incorrect changes can

cause network issues, vulnerabilities, or a full-blown network

outage. Although comparing configurations with previous
versions and identifying errors is an option, it's time-consuming.
Here's how you can have a readily available fallback mechanism during

outages:

Make sure your running and startup configurations are in sync to

retain any changes made whenever your network is rebooted.

Perform configuration backups on a scheduled or on-demand basis,

and ensure you have a backup of the latest version at all times.

Mark certain configurations as the best working configuration based

on their stability and scalability.

During a network mishap, upload the stable version of the

configuration and instantly restore your network.

By having a repository of network configurations, you don't have to spend a

whole lot of time troubleshooting an issue while the network remains

down.

Did you know?

According to Gartner's analysis, downtime can cost companies $5,600
per minute.
2. Implement role-based
access control (RBAC) to
prevent unauthorized
configuration changes.
Network configurations are continuously changing in order to cater to new

requirements in your network. These changes can prove to be catastrophic

if not done right, and can even render your entire network inaccessible in

some cases. Here are a few techniques to prevent hazardous configuration

changes by unauthorized users:

 Assign roles and define scope for all technicians in your network.

Restrict certain technicians from accessing critical network devices.

Verify configuration changes made by these users, and bar them from
directly applying those changes without your approval.

By enforcing fine-grained access restrictions on critical network devices,

you can rest assured that your network is completely secure.

Did you know?

US firms have reduced downtime costs by practicing RBAC, saving
$298,000 per employee in the process.—NIST report
3. Keep track of the who,
what, and when of
configuration changes,
and get notified about
each change.
As configuration changes happen on a daily basis, it's difficult to document

every change. If you end up losing track of changes, it can have a major

impact on your network; this is especially true during outages, where you

will be left not knowing which configuration change led to the outage. Let's

look at some of the best ways to manage configuration changes:

 Deploy a tool that will record every configuration change that has been
made so you can easily identify and correlate events during an issue.

Maintain a list of all the changes that have been made, along with the
date, time, and name of the user who made the change.

Set up a change notification system to get alerted when a change is

made to a particular device.

In case of outages, compare configurations with previous versions and

identify the change that caused the issue.

Managing configuration changes and keeping track of them will give you the

leverage to keep unnecessary configuration changes or users from

interrupting the otherwise smooth functioning of your network.

Did you know?

Gartner predicted that 80 percent of outages impacting
mission-critical services would be caused by people and process issues,
and more than 50 percent of those outages would be caused by
change/configuration/release integration and hand-off issues.
4. Automate mundane tasks,
and avoid frequent use of
command-line interface
(CLI) scripts.
When the need to fix faulty configurations or make changes in multiple

devices arises, network administrators often find it to be physically draining

and time-consuming; imagine doing a simple configuration change such as

enabling Simple Network Management Protocol (SNMP) on hundreds of

switches. On top of that, most admins use the difficult and error-prone CLI

administration method to modify configurations, which can cause failure in

SNMP settings, misconfigurations in switch ports, etc. Here's how you can

ease the process:

 Automate configuration changes and set up a mechanism to apply them
in bulk.

Avoid repetitive change application by scheduling command execution

scripts.

Keep track of command execution (including the date and time) by

generating reports, which will be useful in analyzing trends in
configuration modification. For example: If your organization changes
passwords once every six months, you can change passwords in bulk,
and having a report about the change will help you identify when
passwords should be changed next.

Configuration change automation can help you streamline labor-intensive

tasks, and works especially well for admins who wish to apply the same set

of changes to multiple devices.

Did you know?

Almost 43 percent of admins surveyed by Red Hat used CLI scripts on
individual devices to carry out changes, and around 48 percent
adopted automation to manage configurations.
5. Create policies based on
industry and government
compliance standards,
and conduct periodic checks
to prevent loopholes and
vulnerabilities.
With network resource security threats increasing every day, enterprises

have begun to implement standard safety practices and enforce internal

and external security policies to remain compliant with the latest industry

standards. However, many admins forget to carry out periodic compliance

checks, putting their network in danger. Here's how you can ensure your

network is safe from vulnerabilities:

 Find out the compliance regulations followed in your country, and
adhere to their rules and standards to avoid violations.

Identify and follow the standards set in place by your organization by

checking with your organization's legal team.

Implement audit policies that track who accesses regulated data, and
keep logs that provide details regarding when, how, and by whom data
was accessed.

Run periodic compliance tests to ensure all devices adhere to the latest
regulations.

Most infrastructure must meet certain standards mandated by the

government. By complying with IT standards like HIPAA, SOX, and PCI DSS,

you can more easily avoid vulnerabilities and data breaches.

Did you know?

When a data breach occurs, companies take an average of 191 days to
realize it has happened. - A study by Ponemon Institute
6. Detect firmware
vulnerabilities in your
network, and periodically
upgrade firmware.
Firmware vulnerabilities can put your business and your
customers’ sensitive data at risk, leading to easy entry for hackers,
diminished sales, loss of reputation, and legal penalties. Many
admins are unaware of the vulnerabilities in their network, and
those that are aware undergo the tedious process of collecting the
vulnerability data of different vendors from external sources.
Here's how you can simplify the process:
 Deploy a tool that can identify firmware vulnerabilities in the device
configurations in your environment.

Apply a suitable patch for any identified issues.

Periodically upgrade firmware to avoid loopholes.

Conduct vulnerability assessments at regular intervals.

Here are a few steps you can follow during the vulnerability
assessment:

By identifying potential threats in your network and applying

fixes, you can prevent data breaches and ensure your information
is safe and secure.

Did you know?

"Company culture and overall attitude to security is a major
contribution to vulnerability to cyber attack through firmware."
- A study by ISACA
How Network
Configuration
Manager can help
1. Network configuration
backup
Network Configuration Manager provides a simple, affordable, one-step

solution for backing up updated configuration files.

Here's how you can use Network Configuration Manager's backup

mechanism to benefit your organization:

Back up any number of devices or device groups with a single click, and
view the status of the backup process.

View the devices that have a conflict between running and startup
configurations after every backup, and instantly sync them using the
Sync Configuration option.

In case of a network mishap, upload a stable configuration using

configuration restoration, and bring your network back up and running
in seconds.

Schedule configuration backup tasks, and get alerted when there is an

interruption or failure while backing up configurations.
2. Role-based access
control
Network Configuration Manager helps you assign user roles and scope,

which can be vital in a multi-user network environment. Let's see how you

can achieve RBAC in your environment with Network Configuration

Manager:

Assign access level roles such as "Administrator" and "Operator."

Define the scope of access for users to control the changes they can
make to the network.

Receive notifications when an operator makes a change to any

configuration.

Review the change, and reject or approve it based on your network's

requirements and the necessity of the change.
3. Change management
Network Configuration Manager provides an efficient configuration change

management mechanism to keep you updated on all the changes made in

your network. Using this feature, you can:

See all the changes made in your network, along with the exact date
and time of each change.

View the details of the operator or admin who carried out a particular
change.

Get real-time change notifications in the form of emails, syslog

messages, SNMP traps, or trouble tickets.

Spot changes between the latest configuration version and previous

versions using Diff View.

Activate the Rollback option on all critical devices, like core routers
and firewalls, to revert undesirable changes.
4. Automation with
configlets
With Network Configuration Manager, you can use configlets to automate

mundane configuration tasks and make changes in multiple configurations.

Here's how you can achieve automation using configlets:

Remotely upload a configuration file in multiple configurations.

Execute simple commands like changing passwords, enabling or

disabling SNMP, forwarding syslog messages, and changing interfaces.

Execute troubleshooting commands like synchronizing running and

startup configurations, as well as commands for access control.

Execute complex network commands like uploading OS images or

firmware upgrades, configuring banner messages, and deleting files
from flash.
5. Compliance auditing
Network Configuration Manager helps administrators audit network

devices to achieve compliance with various industry-specific compliance

policies. Here's how you can audit compliance with Network Configuration

Manager:

Adhere to compliance policies like HIPAA, SOX, PCI DSS, and Cisco

IOS, all of which are supported by default in Network Configuration

Manager.

Create custom policies based on your requirements, and ensure your

network meets your organization’s internal regulations.

View the compliance status of individual network devices using

compliance reports.

Get alerts when a particular rule is violated, and apply remediation

configlets as a fix.

Periodically run compliance checks in your network on a weekly,

hourly, or daily basis.

6. Firmware vulnerability
management
With Network Configuration Manager, you can identify potential

vulnerabilities in your network devices and take action. Network

Configuration Manager works in accordance with the National Institute of

Standards and Technology (NIST) by fetching firmware vulnerability data

and correlating it with the network devices currently managed in your

infrastructure. This feature helps you:

View the vulnerabilities in your network and the number of devices

affected by those vulnerabilities.

View the details of the vulnerability associated with a particular

Common Vulnerability and Exposure (CVE) ID, and immediately carry

out remediation methods.

Update the vulnerability data in Network Configuration Manager at

your convenience by scheduling a database update.

Remotely upgrade firmware using configlets to prevent vulnerabilities

and loopholes.
Summary
In short, Network Configuration Manager helps administrators take total

control of the entire life cycle of device configuration management. It

serves as a secure repository for device configurations, helps continuously

monitor changes with change notifications and reports, easily and safely

recovers trusted configurations, and helps automate all configuration

management tasks. If you're in need of a solution that can simplify

configuration management, Network Configuration Manager might be the

ideal tool for you!

What platforms, vendors,
and technologies does it support?
Platforms: Windows and Linux

Default device templates: Around 300 for over 45 vendors

Vendors: Juniper, HP, Nortel, Cisco, Force10, 3Com, D-Link, Foundry, Dell,

Aruba, Extreme, ADTRAN, Enterasys, Huawei, Blue Coat, Proxim Wireless,

NetScreen, NETGEAR, Fortinet, ALAXALA, Brocade, Radware, Dax, H3C,

Yamaha, Vanguard Networks, and Allied Telesis.

Download free trial Request a demo