NSO compliance reporting

Oh, good morning, good afternoon depending where you are. Today we are getting started with this NSO expert insight series and we have Fernando and we have George.00:00George is going to want that will introduce this session. He's been an NSO expert for the past eh, couple of years and he was presenting in Cisco Live Amsterdam 2026 this year.00:17And this session that today we are going to share with you about compliance. So the floor is yours George eh over to you. Thank you. Thank you so much David and thank you everyone for the patience for just these brief minutes.00:32And it's like you said, so back back in February I was in Cisco Live presenting not only about this topic but as well on the others around NSO. And today we decided to do just a little bit of refresh and since we have a little bit more.00:51Time to deep, to dig a little bit into other subjects as well and.01:11Just some weeks ago, six.seven came out. So I'm going to use six.seven today on the demo. I'm I'm still getting used to it as well because some, some of the new things just just came out and changed a little bit like the configuration editor module, the commit manager which.01:18Is now called transactions as well changed. So just be patience a little bit with me if I don't click very quickly in one button on another but but yeah, we have this 1 h and a half where where we will.01:38Dig into the depth. So what we will speak about today, automating network compliance, and we'll be leveraging NSO to do this compliance with auditing, reporting and remediation, ok? My name is George Miram and I am customer success specialist.01:55So I think if you are not new here to the, to this format, to export inside series and even to the Webex, you know that we have this, this slide, ok? So if you want to ask any question you can use either the chat or the Q and A or this Q and A.02:14Is always better but but yeah if you have any questions just let us know and feel free to ask and we'll be trying to answer your question as better as possible.02:35So, in what regards to the agenda, this is what we have for today. So we will dig into what is really the network compliance, right? We will do and show how to do compliance with Cisco NSO.02:46Which NSO just for the beginning because I remember I forgot to disclosure that in the last one, network services orchestrator for the ones that are new and we'll do some demo. Of course, we will show how to automate these continuous checks that we should and we.03:02We need to do in our network to keep it compliant.03:21And we'll do some real world scenarios, right? Like some PSIRT response, so if there is any PSIRT incident in your in the world and in the infra, how can you make sure all your network is secured and hardened and will not suffer from this, from this issue or from.03:25These from this vulnerability that's that is happening and it and it was discovered as well.03:45If we have time, we will go through other examples like using services for compliance etc. So we will keep it this flexible and in the end you will be able to to see the slides, the demos et cetera, in the community page.03:51So we'll do some network compliance, though, usually we like to use this type of analogy, right? So, you probably already have been in in a point in time in an elevator or a lift depending on where you are.04:09The designation might be different, but, but the the goal is the same, right? So in in this lift, if you entered in one in a point in time, you probably saw.04:29That if you look around, especially when it is more crowded, we usually look more around, right? We have the buttons, of course, to where we need to click to to say, ok, I wanna go to the 1st floor, second floor, 3rd floor etc. But we have as well a paper there.04:47Or it can be like a metal piece, it can be just a paper, but we have something there in the elevator usually is on the top, saying that there was a point in time that this elevator was certified and this is the number of people that the elevator is certified to carry.05:04And this is the maximum weight that can can be in the elevator at the same point in time, right?05:24Sometimes the elevators as well they they break, right? So sometimes there is something that you are gonna try to use the elevator and it's not possible because they say that there was something wrong and the elevator is not functional. Other times.05:34We have some planning maintenances on on the elevator and and we say ok there is some gear that needs to be changed and the elevator will not be working on Monday at at 05:00 A.M. because of this maintenance window.05:51And the good honor of an elevator will always do these daily inspections just to be sure everything is functioning well, right? There is NO small leads that is broken and needs to be changed etc. So just to be sure that the elevator.06:08Is fully working for everyone that, that uses it, right?06:28And when we we do this analogy to our networks, we can see a lot of similarities here, right? So, we, on our network, we want to always be doing continuous checks, so be sure our network is fully working not only in the day that we provision the devices.06:33In the day that we provision the changes, but every day, so we want to be sure we have our SLAs in place and we keep our network 100 % running.06:53Smoothly. We have our maintenance, right? So we have our maintenance windows in our network, so some, some changes need to be done which will trigger some equipments to go down, others as backup to come up et cetera. Sometimes we have as well breaks, so so we have this reactive approach where.07:04Something broke in our network, there is this incident, incident and we need to fix it. And we have as well a point in time where we might want to, to certify our network and say this network is 100 % compliant to this certification or that certification.07:22But to to make sure it's fully secured and compliant for our customers, right? So this is the analogy.07:42Right. And when we speak about compliance, that's we just spoke about a lot about already, what what is really compliance, right? So compliance is really like a mix of things, right? So it's like processes, policies, people, and when we trigger.07:49That's specific to networks. It can be things like.08:09Equipments that are end of life, different code versions that can be running on devices, responding to CVs and as well some certifications that we want to make to make sure they are in place in our network. Like e.g., we want to be certified for NIST. GPDR, HIPAA.08:12Etc etc. So, and these are the certifications that will, that will make sure we follow some standards that are recognized and we want to be sure some of our equipments run like that. So.08:32In when we speak about compliance, we, we usually identify these two types of personas that can act in our network, right? We have this net ops persona that wants to make sure the network is faster and and runs so smoothly for our, for our users etc.08:50And then we have the secops persona. We want to be sure.09:11Even if it's faster, the network, we, we will give priority to always the network to be secured and this sometimes introduces some delays, right? And some checks and some some alternative paths for the traffic to flow. So.09:15When we joined these two personas, we always see that the interests are not the same, right? So they are the same in what regards to this small piece that wants to deliver the network to the user, right? Or the network access. But usually the deployment of this network.09:32They can have different types of interests, right? One wants to make the, the network very faster and reliable. The other one wants to make the network very secure. So, and sometimes these interests collapse. So NSO enters here in place to help these both personas, which can be the same, but.09:52It's just like two types of thinking, let's say, to help these two personas to come together and make this change according to what both agree in a very easy way, ok? And we will show you some examples.10:12So, when we do, when we do compliance checks and one we just spoke about compliance, right? But what are, how do we do compliance, right? And usually these three types of matches are identified.10:30So match type, match logic and match scope, ok? So when it's regards to match type, we have the exact variable and regular expression. For match logic, we have enable, disable absent and comparison and for match scope, we have global next and section.10:47We will go into every one of these in just the next slides, right?11:08So, for the match type, we already saw we have the exact variable in the regular expression. When we speak into the exact types, we want to be sure that this command, like e.g., the logging user info.11:14Exists exactly like this in our devices, right? So the only thing we are trying to see is, is if this command exists there. When it, when it comes to variables, we want to be sure that we have, e.g., a template or with a chain of commands.11:31And they exist in multiple devices and just a piece of this configuration might be different, right? But we don't want to create multiple templates to access different types of devices if only the VLAN changes. So we create this template with a variable, like e.g. disabled port VLAN.11:46And for the device iOS XR zero, we test against one VLAN for the device iOS XR one, we might be testing against another VLAN. And when we think about VLANs, it can be as well the interface type. So imagine we want to test against a lot of different types of interfaces that are end user, e.g..12:05And we want to be sure that all of these interfaces.12:25For all the types of, they will be in exactly this shutdown mode and description of connected. We have as well regular expressions that we can test against, and for this is to be sure that e.g. in the line video zero four, we have the exact timeout.12:29From zero to five, not more, not less.12:49For the match logic, we now have the enabled, so we want to be sure that e.g. these commands are enabled, like e.g. service password encryption or are disabled like the IP domain lookup and.12:54If this command is disabled, it means that it has the NO wording before the command. And now we have another type of command here, absent or the or another type of match logic, absent, which is e.g. for the IP boot server.13:10So IP boot server in in the opposite of the IP domain lookup, why one is absent and why the other one is disabled? Because IP boot server, e.g., if it's not configured, it will not be shown in the running config of the device and the opposite of the IP domain.13:27Look up. That's why one it's disabled and the other one is absent because if we delete the IP domain, IP would be server, we will not see it in the running config. So we want to be sure the command is really absent for from the configuration, right?13:47Comparison mode, so we want to be sure that we have logging hosts 10001 or 10002, right? So we want to be sure these two longing holes are configured in the devices and the max scope.14:02So we want to be sure that, e.g., we have the some configurations sometimes they are in the global scope of the device running configuration. Others are nested, so they have like one one parents. So e.g. NO IP redirects, which is part which is a child of interface exhibited.14:17Sometimes our commands are part of or that we are testing are part of a list like if it's an access list, we want to be sure that e.g. we have to deny IP any in a certain position in the access list we can test against that as well or section type.14:39Section type is when we have, e.g., the, we want to test if our command is present in a nested environment, right? So e.g., we have logging enabled, log config archive, so it's like we want to be sure that it's exactly in this type of of next.14:56Nest that spans across multiple lines that our current exists.15:16So, this is compliance in general general, so how to do that with NSO? So NSO, for those who are not aware, of course, is a multi vendor environment. We support more than 100 network element drivers, we shared the nets.15:20Which is what makes the translation between the intent of the user and what the device understands, just like our computer, right? So our computer has the drivers that will understand that, e.g., if I move my mouse around the screen.15:40This my intent of moving the mouse physically will be translated into moving the mouse in screen, right? So the driver of the computer will do this job. In the NSO, these nets or network element drivers will do the same job but in the NSO.15:59So it will translate with what us users and our apps that interact with NSO using the northbound interfaces wanna do in the end devices. So, so this is this will be the job of, of the needs.16:17How can this be done? Like I said, we have a lot of northbound APIs, so usually the users, they will go through CLI or web UI. We can have as well interfaces like netconf, restconf, JSON rpc or we can we can do.16:38The connections through using Java or Python API that come with installation of NSO, right? After that, we connect with the devices, which are usually modeled in the Yang, ok? And they can be iOS XR XE and XOS or even 3rd party devices.16:57So what are the main challenges when we do compliance without NSO? So, we, the the challenge here is that, e.g., we might have to build a lot of scripts.17:19To create, updates and delete scenarios of configurations, right? We want to deploy and audit the configurations we have on the devices. We want to be sure that the configuration really deployed in the device, what is the version that my my production devices have and.17:35If we run into some issues, how can we do rollbacks of these type of configurations, right? And one of the big advantages of NSO is that solves all of that, all of that, right? So we have, e.g., these built in rollbacks, right? In the solution.17:55That will automatically do the, the rollback if if something goes wrong, ok? And if that's your, your willing. We have, we can deploy and audit configurations using compliance reporting that we were looking today and the neds and more and more that we will see in terms of.18:15Features today as well that we have here with NSO. So if you have been using NSO already and and you were using an old version like e.g. five.X or even you were in six.X already but not past six.one.18:34These compliance templates, they were introduced just in this version, right? Six.one. And they, they are like the response that we gave for, for the feedback that we have from the customers. So until six.one, we could do compliance with NSO.18:55So.19:13If you know nsos is probably for the version four, I don't really remember when the feature was implemented, but we could do compliance already for some time. But this compliance was done using device templates, ok? And device templates, they lack on capabilities that we will see today.19:14It were introduced using compliance templates, ok? So now we have these two types, device templates, which will be used to push like they were before, day zero conflicts, one time configs within our network, et cetera, et cetera.19:34And now we have compliance templates. So compliance templates, they will be used specifically for compliance. And this is because they introduced some set of, of, of new, new capabilities like the tags, which includes, e.g., the tag strict.19:49Tag allow empty and tag absent, which we will look into them in just a second. So how can we do a compliance template? So if you know how to configure the devices and you have been doing, e.g., the device templates.20:09You know exactly how to do the compliance template because it's almost the same in terms of schema, right? So you have here compliance template, you wanna do XC baseline check. We have our NED, Cisco iOS CLI.20:26And you have your configuration. Like e.g., we want to be sure service password encryption is in the devices that we check. Some of, of our devices, they are spreaded across the globe, so they belong to different time zones. So we set up like a variable here for the time zone, the same for the IP access.20:41This list, some have one some of another. And then we have some regex matched to be sure we have to deny any any in the end of the.21:01Off the access list as well. So when I told you about the tags, which is the game changer here for the compliance templates, you see that we have here, e.g., the absent tag.21:12Okay, so absent tag exists to be sure some configuration is not present in the running config of your devices, right? So imagine you want to be sure that, e.g., UDP small server and TCP small server are not present in the running config of the devices.21:27What you do, you create your compliance template, ok? And then you again you do the name, net ID configuration, and now you introduce this tag below or above the the command that you want to assert to, right? In this case, for the service CDP small.21:47Server, we are doing the tag absent and the same for this TCP small server. We are doing the tag absent. So this compliance report or this compliance template will only return green for the devices that have, that don't have.22:08These two configurations in the running config, ok? So if any device have these commands or just one command, that device will fail to the compliance report. The treet tag.22:26One of my favorites. So we had a lot of customers that they were using NSO to do compliance, right? But, this compliance sometimes due to the capabilities of the device templates.22:43We're not enough. Because e.g., imagine you are asserting your network for some, for some con for some certification like we just spoke, and you are asserting your network for, 40 that needs to be exactly like this.23:01Okay, but you know that inside tacacs you can configure multiple lines, like e.g. in the line console zero, you can configure multiple stuff, not only exact timeouts, login authentication and logging asynchronous, right? There, there is like a chain of commands that can be configured when we do line console.23:21Zero. So what this drug stricts will impose to your network is that the devices that will be tested against not only need to have these commands that are.23:41Sent in the compliance template, but they can only have these commands configured under the the place that we are putting the tag stricts. So in this case, when, when we are asserting that line console zero exists in the devices with the exact timeouts.23:57Login authentication and logging is synchronous.24:17This this report will only return green or it will only pass if the devices only have these configurations under line console zero. If there is anything else, like imagine a description failed configured, even if the device have these configurations, the report will fail.24:20Because there is an another team configured underlying console zero and that's not allowed. And this is what the street will do. Allow empty, another one that was very requested because.24:39Because sometimes and when using NSO more specifically, we always speak about automation, right? So we always speak about doing configurations for a big set of devices, testing big set of devices against compliance, et cetera.24:57And in this case, we, we were, we saw that customers were testing against devices and the reports were creating a lot of noises because this tag didn't exist.25:15So imagine you build a template like this one to check if all the devices of your network that are, that are iOS CLI based, they have IP and reachables falls for.25:31Gigabit internet interfaces and for 10 gb internet interfaces, right? So what, what was happening is that by running the previous version of compliance reporting, if we found that the device if a device like e.g. iOS.25:49XE zero didn't have.26:09Interfaces. This report would be failing because it was detecting that this interface didn't exist, so the command didn't exist and then if the goal was to have this command present in the device, the report was returning as red for.26:14This device because this inter this interface didn't exist. But for this specifically device, this interface didn't exist physically, so it was not possible for this, this compliance report to pass anytime, right? So with the tag allow empty.26:32What we prevent this type of situation. So what happens now is that, e.g., if you see that you are testing against a very big chunk of devices and you acknowledge already that some devices don't have these type of interfaces.26:52Okay, you can say, you can add this tag, allow empty, and this will make the devices to pass when the devices don't have this interface type. So we will basically kind of like ignore the the device for this interface if the interface doesn't exist.27:07And when we speak about interface is the interface and all the configurations below it, right? So for this case, using the allow empty tag, this iOS zero device or iOS XE zero device would now pass even if it doesn't have the ten, the physically 10 gb internet interface.27:27Right?27:47This is what this is about. Of course in NSO we always speak about automation and programmability and all of these can be seen in your in your perfect format, right? More specifically as well if you, if you want to deploy these configurations using.27:48Of in terms of compliance templates etc. You can display the existing ones in XML.28:08And you will be able to see your tags exactly like, like you see on the screen, right? So you have your flags like encryption, and then you will have the tags absent inside, ok?28:15So, creating compliance templates, how can this be done? We already saw, so we can do using the manual way, so using CLI or XML of course in the XML, you can, if you have your pre built XML files with the templates in it, you can.28:34Load them using the the NCS load with the load and merge flag. You can load them inside NSO as well. You can create device templates or or compliance templates using already built in device templates, ok? So you can.28:53And if you already have a device templates.29:13And you just want to add some tags or some variables to test against your network. You can already create the compliance template based on a previous device template and you can create, and this is something that is new from a specific device configuration that exists, ok?29:16So e.g., if you have one device that has, e.g., that is an iOS CLI device and already has like a golden config of a router OSPF configuration, and you want to be sure that I mean.29:36You just want to be sure that all your network is compliant with this type of configurations. You can, you can check against the paths of the, all the devices that you have against router SPF. It will pull.29:52The configuration that exists in the network and then it's up to you on creating now the variables because e.g., not every router will belong to the area zero, etc. So you want to be sure you create the correct templates to test your network against, right? So, but at least from here, you will have like a match of all.30:07What is already configured in your golden devices and you can start testing your network against it.30:27So I've been speaking already for so long. Let's try to do some, some demo here. So I'll be pushing here NSO for those who haven't seen NSO since six.one or six.zero, we have this new login web interface.30:35So I will just go with admin admin.30:55We have some learnings that are normal, and this is what you will see, right? And it's all now looks like this. If you click here on the, on the question, question button, you will assert that I am in the newest version that exists six.seven and we have some changes, even from six.six.31:00Which was the version that I was most used, most used to until today, or until some days ago when six.seven was launched. So now I'll be start using six.seven for the demos. So what you will see here is that on the homepage you will have your device management.31:20Okay, so you you have you you can have your your devices, you have your device groups and and this is something that let me just log out and log in again.31:37There must be something wrong with my session. Yeah. So I was logged in, so there was an issue with my session and now I can correctly see the the things. So back to, back to what where where I were.31:53So you can see that I have my devices here and this is the new UI of what is in device management. I can just quickly, for those who are seeing 1st the device management and don't see it for so long, this is how it looks right now.32:09So I can do, e.g., the, the connection, I can do other actions like e.g., the sync from et cetera, and you can do them from, from here. Other ways that you can do it as well is when you click here on the on the right side.32:24You will have all the options that that are available and you can do e.g. the connect and the pop up will show up. Like it should show up in the other one, like let's try again Sync from and yes, you can see here that we have the sync from of of our devices completed.32:41Okay, so we have our devices, we have services as well here. You can see here we have just a simple service NTP. We have the transactions which is now where all our commits are handled, ok? You can see your rollback files.32:59You can see the commit queues that you have completed and in queue, so pending to be completed. And you can see your uncommitted changes. We will just do some in a minute for you to see.33:19You have your tools where you have your insights like we had before, and you have as well here the package manager, so where you can see all the packages that you have with with the neds and the services.33:31High availability module which I don't have enabled for now for the demo purposes alarming, and now we have here our compliance reports and compliance templates and compliance results, ok? So.33:501st things 1st, we want to test our next work against some configurations, right? So what we will do, we will create a compliance template like we have been speaking. Just for the demo purposes and because i'm creating everything live, I will just I will just do this in an exact match way.34:05Right? So e.g. I do create templates.34:25We have here the options that we just saw, so we can create directly from the config, we can create from an existing device template and we can create manually by going into the configuration editor. I'll just click on it and this is how the new configuration editor looks like. So before six.seven.34:29Configuration in the web UI.34:49Looked like the the configuration editor that you have been used to and until from from five.x, ok? Now it looks like this it might get you some time to get used to it but but once you get it, you see that there is a lot of advantages.34:51So e.g., I'll create here a template called domain check.35:10Okay, I will click on it and now I need to provide what? The net ID like before, I will add it and select e.g. iOS XR. And now inside the iOS XR is the same thing. Now since MSO six.35:14Dot six if I'm not wrong, you can test against life status data, ok? So e.g., imagine you want to create a compliance report to assert that.35:34These devices have this configuration, ok, or sorry, these devices have these interfaces up or down, et cetera, so you can do assert against life status data. This is what it is about. But for now we will just assert against configuration data.35:44We can use the filter, so e.g. domain, and I'll say domain name, e.g. Cisco.com, and then in the list I can I will put e.g., I will insert against 1.2.3.4.36:01Okay, now it's create what, ok. Every time we see these these these blue bars, let's say close to the close to the data. It means that that this configuration is pending, right? And when we go to our here to our lunchpad, we can see exactly what is missing or so we have.36:18Four changes, ok? Now in six.seven, you can automatically, I mean validate the changes from here and apply it. I will not do it right now, so I'll just click on changes for you to see the full spectrum.36:38And we have here the changes that we have done. I can try to export them and you see here the full changes in the XML format, right? Very useful, e.g., if you were about to do your services et cetera, this is like your dry run out format XML.36:53Or you can load transactions already from here. So e.g., if you have your XML files ready to be loaded into the solution, you can use the nCS_load with the load and merge or you can go directly from here to the transaction menu where you can do load transaction and.37:12Do it from here. We can revert changes and we can validate them. So right now we'll just validate them. Everything you can see here the, that they are valid and they are valid so the comment button showed up. So just hit the comments.37:31We have here, all the options of the commit as well. I will just keep it simple and hit commit. Committee is completed. Now we have these rollbacks roll rollback section where you can click on it and you will see exactly what is, what is this comment about, right? So we.37:47Before you could achieve this as well by just going into the lots folder of your NSO and looking to all the comments because they are UTF codified. Now you can just look very easily the comments from here, right?38:08So e.g. you have more comments from here, et cetera, et cetera, and you can look from everything. And this is and this makes even more important to create comments and labels for your comments so you can quickly identify them and search for them using the filter, right?38:21So, I've just committed my change. So if I come here to compliance templates, I can find here my template, right? Which asserts this configuration, ok? So we can see exactly that we are asserting the template to domain check for the iOS XR NED and then the configuration.38:38We are certain exact match, very simple one, domain name and and do domain list, ok? So let's check our devices, right? So we create, we go to the compliance reports and then we say.38:57Domain report. We now have the option to test against devices or services. We go against devices for now. We want to, we, we can say that we want to test against all devices or just a group of devices, ok? In my case I've created already like a iOS XR group of devices.39:14That you might be seeing from here.39:34I'll show you after. So I will select device and add to the list, ok? And after that, I just need to scroll down, add my template, domain check that we just created, and I want to create a reports.39:37And run it, ok? So I will just call it domain run, it enter and so fast. I got to report results. I come here and I can already see that I have some violations in my network, right? So it seems that I tested four devices and all of them.39:55Are non compliant, ok?40:15So when we look into here, into the table, we can see exactly what is, what is wrong, right? So we can see we have four devices that we tested against iOS XR 023, and we have all our non compliance, and when we click on the view details, which is like my favorite buttons.40:17So far, you can click here and you will be able to see that we have what is exactly the configuration that is missing on the device for this device to be compliant, right? And now we have two ways of making this change, right? I will do it two ways. So 1st way, the boring way.40:37We go into the device and I'm just doing this for you and for me, for us to get used to the configuration editor. So I go into the config mode, I click edit mode, ok? And now I go e.g. here to the, to the.40:57To the domain parts, I'll put here the domain name, Cisco.com, and I'll put here on the list the IP that we have.41:17Okay, so we just made these changes and now I'll just validate them and upload them very quickly. By just clicking on validate commit, we can see here the the changes in the transactions, but you can see that you can do everything from the launchpad there now.41:33I'll just hit commit and comment is successful. So now let's try to run my my reports again. I'll just go to compliance reports run, and I'll call it domain run two. It came.41:52Still with violations, but now when we open it, we can see that with this graph that we were at 0 % compliant and now we are 25 % compliant, right? So we have one device compliant and three devices not compliant. And we can see this from the list as well.42:10But this is this can be like a huge effort if you just go into device by device making these these the devices compliant. So, and we are using NSO and we have a lot of capabilities to make these automated. So we can just go to the devices.42:27Configuration editor and we just come here and and we can create something that is called the, the, the device templates, right? So let me just search for them.42:46Edit mode, of course, I was missing it. Second, devices, templates. Exactly.43:06I told you I was get I'm still getting used to it. So I'll just say domain fix, and I'll create these templates for the net ID, iOS XR.43:21And I will say that the configuration that we will have is, of course, domain and we will say domain name, cisco.com and domain list. We just use the IP that we selected, right?43:39Create, we can validate the changes by by just clicking on export and we see that we are creating a device template. I'll validate and commit.43:58The changes. Now what we need to do, we can go to our device group, click on the three dots, apply templates, and we will just select the domain fix template that we just created. We have two options now. We can upload it in the open transaction, so we see the changes that will be happening.44:13The devices or we can just commit it, ok? Committed, it will mean we will not even see like any message in the transactions, so just see that the successful or not and the rollback file created. I'll click here so you can see that it was applied to all the devices and clicked on.44:33Now I can see here the changes that will be happening to all the devices. We can see here that we have iOS XR one, two and three. IOS XR zero is automatically excluded because NSR already knows that this device already has the configurations, so, so doesn't need it.44:53I'll commit the changes and run my reports again. Domain run Report is successful.45:11And we can see that now with the automation that we have used, we are now 100 % compliant, ok? So we were 0 % 25 % and now 100 %. One of the things that we allow here is to export this to PDF in any point in time. So you get just an exact view of what.45:26What had happened in your, in your network and how is your compliance.45:46Compliance going, using these graphs et cetera, right? But compliance is something very important because when we think about the elevator or the lifts, I told you and the last point there is to do continuous checks. Why? Because.45:51Imagine that the imagine just, e.g., we go to the transactions and we can, we can apply e.g. the last rollback, right? Which will delete the configuration from the devices. I'll just do it.46:11Run, result true, so I come here, I have the changes, I'll validate them and commit them. So let's run the report again.46:28Domain run for. So now what happened? And we can see this in the graph, right? So, with the device template, I applied the change that made my whole network compliant, right? Because we identified the changes that were needed.46:48And we just made the we just applied to the device group, which had all the devices that we were asserting to, and we made the network 100 % compliance. What is happening now is that with the rollback.47:08We just deleted the configurations from the devices again, and now the network is not compliant again. But if we don't do these continuous checks in the network, we achieve a point in time that our network is compliant.47:25And if, and our network have new users, new changes that are happening every day. And one simple configuration change can trigger that the network is not compliant again, right? But if we don't check it regularly.47:40We will not be able to know if our network is still compliant or not. And if in a point in time we made our network compliant was for a reason and we want to make sure the network stays like that, ok? Speaking about these two personas that we spoke in the beginning, right? The net ops and the persona. So we want to be sure the network.47:56Work stays compliant with whole time.48:16So, what are the mechanisms that we have here to be sure that our network stays at 100 % all the time? And this brings me back to the slides. So these compliance runs, of course, you can run them like I just showed, showed to you, like you can.48:18Just go into them, to the devices and and run it to the compliance reports and run it over and over again for how much how much time you want, right? But there are ways to automate it as well. So you can use tools like the scheduler, ok, that will.48:37Allow you to automate this task, this task report run so you can just create a task to run these compliance reports within a certain times. Okay, these times use these uses like the Chrome job of the system. So you just need to to do your, your chrome, your your Chrome.48:56String into there that will identify when will these reports run and by just doing scheduler task, the name of the task and get next running times, you can see these here that by using this, this method, we will be running this compliance report and.49:19The 1st day of the month.49:37So every 1st day of the month, we will assert that our network is still compliant. Of course, if this doesn't fit your use case and you can, you want to run it like every week or every day or every two days or every Saturday, you will just have here the, you just need to change this expression, ok?49:38And you'll be able to make this recurring action to happen when you need the most.49:58Of course, this can be done using other methods as well. You can run the compliance reports using using rest of and you have here the way, so you just need to put the the protocol IP of NSO in the port, which by default is.50:05He's the HTTP port, but you can use our others. You have the, the path in this case and CS compliance reports, the report equal to the report name and then the action, and then you will get the output, right? In this case, e.g., we had violations, so the.50:24This means that the our network is on compliant, not compliant. So we check four devices and we have here the location of our report in HTML HTML format.50:43Right for us to check. So with what we have learned today, how can we respond and how can we apply this knowledge to respond to a real world scenario, right? And this is a real world scenario. So back in September 25 of 2000.50:55There was this CV that was launched, right? There is this high vulnerability and we want to be sure that when we see something like this, we have our.51:16Networks secured against it, right? Because we don't have we don't want any external threats going into our network, right? So we have these new pcert that we need to respond. So the 1st thing we need to determine is what is the scope?51:28And what are the conditions that we, that we need to, to match to be vulnerable, right? And by reading into the, into the issue, we see that the scope of the vulnerability are all iOS XE devices.51:43In our old, our iOS XE devices in all software versions, right? The conditions for this vulnerability is to have these two configurations, service internal and APH IPHDP server.52:00And IPHDP secure server configured in the devices, right? So we want to make sure that our devices don't have any of these configurations as part of the running config. So condition number one, service internal. From what we identified today, this is.52:17A match type. Exact, ok, so we are just testing against this commands. It's absent because by default is a command that is disabled and is not showing in the running config of the device. And the match scope is part of the global configuration, it's not nested, doesn't have like any parent etc. So.52:36It's really part of the global configuration of the device.52:56Condition number two, IPHDP server and IPHDP secure server. For this case, still an exact match, but in terms of the logic, it's disabled because by default it's present in the it's always present in the running config of the device. So we want to be sure.53:01Sure that this configuration has the NO wording before it. So we are testing against the disabled match logic.53:20In terms of match scope, it keeps the global, the global view because it doesn't have like any nested value etc. So how do we do it? We already learned it and I did show you how to do it in the, in the web UI using the demo and as well, we have some.53:27Some splitted slides where we saw how can we do it. But here is the specific example for this use case. So we create the compliance template with the net ID, we create the tax absent for the service internal and false for the IPHTTP server false because we are forcing the NO command view.53:47For absent because we are forcing that this doesn't exist in the device.54:06We are creating the compliance reports, we are running it. And after that we see we see that after running it we have like four devices, three are compliant, one is not compliant. When we look at why the device is not compliant, we can automatically see the diff of the changes on why the.54:12This device is not complaint, right?54:32So e.g. HTTP secure server is a true or it should be false. Server service internal exists as well in this device. So we want to be sure we patch this device as quickly as possible. It's just one device, so we could just go into the device but of course we want to do it in the best automated way because if.54:34This happens in another another part of the network. We already have the fix.54:54So for this case, we can just create some remediation templates, and in this case we are creating two. We could have just created one, but we have here device template, NO service internal and device template NO HTTP, and for this case we are doing the delete for the service internal and putting as false.54:59The, the, the PHDP server, ok? So where how to apply the remediation templates, we just apply it, right? So we go into the config, device to device, and then we apply the template with the template name. We can preview the changes by doing the try run, we already know.55:18All of these commands and after reapplying it, doing the exactly commit commands, we can see that we are now 100 % compliant and secure against this threat, ok? These are real scenario that you can use for your use cases going forward.55:39But compliance is not only done using using templates, right? You can use, you can use services, so your services that you already have in your network, you can use services for compliance as well. So for this scenario.55:57There is a change, right? So with compliance templates, you have these regular expressions, these tags that can be used etc. In the services, what you will be testing against is about the config that that you defined for the service to be, to be to be to be present.56:13In the device. So very similar to what the checks in does et cetera, but here is in this compliance report format, right?56:32So, how can this be done? So you define the service intent, right? So like we have done, you have your pythons, your files or Java, you have your templates, you have your young models, you created, e.g., against an L three VPN, golden configuration, port.56:42Turned up or down and you applied, right?57:02After that, you just need to assert against. And I'll just give another example with using NTP services. So, let's imagine this scenario where I have this new organization policy from the CISO that requires NTP to to be to be to be.57:07Be created in a secure way and baselined for all our devices, ok? So.57:26The 1st thing we do, we check the scope, so all our routers, all our software versions will be affected, the configurations that we have, et cetera et cetera. So with that, we get the standard of configurations. So we will enable 1st the.57:32The NTP configuration.57:52With the NTP authenticate, authentication key and trusted key. Then we define the control groups in our access list and as well we will need some to restrict some IP addresses from the peers and the clients and we create the fault tolerance of configuration.57:54Right so we have all of these configurations that we will be spreading. With that, we go into NSL, we do what we know what to do, right? We do create the configurations, we get the equivalent in XML format.58:15For what to paste it in our, in our service templates, ok? In this case we just have one. So we just put the IP access list part of the template on the top, and then we generate the same for the NTP configuration part and we put it on the.58:31Okay, with this, we get the big XML templates. We could have splitted these into templates. Of course, there are many ways of doing this using using NSO, this is the beautiful part of being programmatic, right? But after that we create our young model which will end up like this.58:51So we have some required methods like the device list and the servers etc. We have some that are optional and we can see here the the types, right? So we have the string, we have a leaf ref for the devices, device name we have here some enumerations, some integers et cetera.59:11We end some lists.59:31So this is our young model in in the tree formats. After that we have our simple python. Again, just a simple script and just a simple service to make the things easier. That will just for each device in the in the device list, it will apply.59:33These templates, right? In this case, the pattern is just like this, so we are just getting the variables and putting them in the, in the templates. Of course by using Python, you can do many other things and you and and you can modify the.59:53The, you can modify the values ongoing, right? For depending on the device that you are asserting to, but in this case, we just created a very simple service tool for the scenario that we have here. So we have the service intent, ok, that then will be.01:00:09Translated to the minimum this.01:00:29To the device, ok, that we have on the bottom, then we create a dedicated reports that will just use this service, ok? And we run the reports and e.g. for one device we will see that we are out of sync, ok? And then.01:00:31This is the beautiful part. The remediation with services is just about doing the redeploy, right? So you don't need to create a remediation template et cetera. You just need to to redeploy the service, right? And this is something I have here as well. So I have here, e.g., just a quick service that will do it exactly the.01:00:51Same, e.g., this service NTP name tests, ok, that is being tested against iOS XR zero, and e.g. when we do e.g. compliance reports, we can create an NTP.01:01:11Reports oops, NTP reports. Instead of devices I'll just select services. We can, we can test like against all services that we have in all service instances. But I will just test against some services, ok? In this case for the NTP.01:01:27I will add to the list. We could just being testing some service instances, I will just test against every NTP service that, that we have. Then I'll just run the reports and when when I come here, I'll see that I have NO violations. Okay, so I open the report.01:01:45And I see that the, the service is in sync, all the devices have the configurations et cetera. If I go to the service and I am deployed, e.g., now if I do, e.g., the check sync, it says that the service is not deployed.01:02:05And when I go to the compliance reports and run it again, we come here and now we have violations, right? Because our service is not deployed. So the configurations are not present in the devices, right? So view details.01:02:24We can just see the service is not deployed. If we were missing some configuration in the device, this would result in a service not in sync as well. This is the beautiful part. We just go back to our services, we click redeploy, services now redeployed.01:02:43And now if we run the compliance reports again, we can just do NTP run three and we can see that we have NO violations now, right? So we were.01:03:00100 % and we want to zero and now we are back at 100. Biggest biggest advantage here, you can test against multiple service paths at the same time. So imagine this NTP service is built different for many devices that we have, and we want to just assert again.01:03:14As multiple service instances, so you can just do that using the compliance reports very easily, right?01:03:34And this is why and how we we can do a compliance using services as well. So just a quick summary for what we saw today, right? So what we saw today was that we can do audit report and remediate.01:03:41Using NSO in our network, ok? Either using compliance templates or services. We have these out of the box, out of the box capabilities of NSO to do compliance.01:04:01And reporting that we can use and remediation, right? So we can just use device templates like we did or just using service templates as well or service redeploy action to just remediate here the devices. And the biggest advantage, if we are not happy or if we just want to roll back the.01:04:14Changes that we did, by using the remediation methods. We can do it as well using NSL because every commit that we do.01:04:34Be saved under the rollback files. So in summary, network audit details, NSO simplifies compliance world, right? So, if you want to keep learning about NSO, you have a lot of content around there more specifically around.01:04:42In the Cisco NSO devnet community, we have a lot of examples there. You have some free copy of NSO that you can use in a trial mode in your own machine, especially e.g. if you're.01:05:02If you are studying for certifications like CCIE automation and automation tracks or if you have or if you didn't decide to purchase the solution yet, you can test it freely for the trial version.01:05:16Within your infra using these these links, and as well you have our GitLab where we share a lot of examples on NSO, not only for compliance, but as well for other automation initiatives that customers have built, right? As well.01:05:32Here today these expert inside series, if you are used to it, we already have done ton of it. We are doing more. So today it ends up with the, this compliance reporting session. We will have another presenter doing it next week for deep dive in service design and in.01:05:48The week after we will have best practices for NSO, R back and triple AAA on the 27th, right? This.01:06:08Hands up everything I had for today. I don't know if there is any pending questions on the chat. I wasn't monitoring it, but I hope this was, this was fulfilling for you in terms of time. Really sorry for the beginning. There was some issues here with the computer and as well with with the solution cookies.01:06:18But we ended up solving it all of it and had a smooth session overall, right? So, so yeah, David, Fernando, Sonia, is there any question pending from the audience or.01:06:40Or should we don't have any question in the chat, so I think we are all covered. Thank you very much for for the attendance today. Remember that we have the next week, we have the next session, deep dive into service design and.01:06:53Share the registration links with your team, with other members that might be beneficial for them as well. And thank you very much again and see you next week. Thank you.01:07:11