Configuration Assurance Capabilities

[xrgarcia]

Hi all. I will be evaluating netbox and I am rethinking the tools our network engineers use to handle design, deploy and assurance. Right now we use a few different tools (home-grown, HPNA, etc) to handle these things, so my observation/question is this:

If netbox is at the front of the process where design happens, doesn't it make since for it to offer the capabilities to handle device configuration assurance?

I understand that netbox is extensible, but i think this is a core part to managing a network rather than an add on later....in my opinion.

I would expect for me to configure the deployment tool (i.e. ansible) to talk to devices, so it would come down to information exchange and keeping that as simple as possible, maybe through an ansible module as a start.

[candlerb]

You can already configure ansible to talk to Netbox, via the ansible netbox.netbox module.

Here is how I use it:

ansible.cfg

[defaults]
strategy = linear
forks = 25
inventory = netbox.yaml
host_key_checking = False
nocows = 1
retry_files_enabled = False

[inventory]
enable_plugins = netbox, ini

netbox.yaml

# Requires:
# ansible-galaxy collection install netbox.netbox
#
# To test:
# ansible-inventory -v --list -i netbox.yaml

plugin: netbox.netbox.nb_inventory
api_endpoint: https://netbox.example.net/
token: XXXXXXXX
validate_certs: True
config_context: True
group_by:
  - sites
  - device_roles
  - tags
query_filters:
  - tag: ansible

With the above configuration, the hosts are be grouped as "sites_XXX", "device_roles_YYY", "tags_ZZZ". Only devices and VMs with tag "ansible" will be visible in the inventory. The config_context provides layered configuration data to devices.

Can you be more specific about what else you are looking for?

[xrgarcia]

Yes definitely, I'll give two examples:

1. In the case of software vulnerabilities, an engineer would want to know all devices that are on version x.xx due to a CVE against it. Then you would know all devices that need to be upgraded.
2. A company might have a legal requirement to include specific content in the login banner. I would want to put a regex in netbox and using ansible identify the devices that not in compliance.

I understand netbox can generate device configuration (correct me please), so it seems like a natural place to identify devices (within the UI) that are not configured correctly. If I use another tool, like HPNA or Solar Winds to do this, then netbox isn't the source of truth.

Thank you for your reply

[candlerb]

Connecting to a device and managing its configuration is outside the scope of Netbox - you would use a tool such as ansible or napalm.

Netbox is the source-of-truth database: it can provide the inventory of devices, and the desired configuration state for each device.

For your specific applications:

1. The desired OS version can be stored in Netbox using Platform, or config context, or custom fields; connect using ansible or napalm to confirm the actual version matches.
2. The configuration is probably managed using templates (e.g. ansible templates) to include the desired text. If you want to connect to confirm that the text is actually present, then connect to each device and check the response.