A network security audit is a systematic evaluation of the security of a company’s information systems or network intermediary devices. We evaluate the secureness of the network using a few different sets of criteria, including measuring how well the devices conform to a set of established rules.

A thorough security audit typically assesses the system’s physical configuration, environment, software, information handling processes, and user practices. Traditionally, this process uses up a lot of valuable work hours, and can easily give inaccurate results if a tiny mistake is made anywhere along the way. But today, thanks to IP Fabric, teams can perform this security audit in just under an hour.

Let’s take a look at some of the ways that IP Fabric can help you conduct a network security audit quickly.

Zone-based firewall rules verification

When it comes to successfully exporting security policies from SRX, IP Fabric gives you plenty of options.

The very easy one is to export the configuration between security zones to a text file and upload and send them to a customer. But it could be time-consuming for non-Juniper technicians or managers. Also, for some people, it may be difficult to comprehend all the information in the configuration file.

Another option may be buying Junos Space software with the Security Director plugin. Or we could develop any customized script using Junos PyEZ library and export policies to multiple file formats. Both have their downsides.

With the IP Fabric platform, it’s a bit different, you can:

• Export any policies based on any zone, recorded source, or destination IP network or address.
• Evaluate whether a policy definition conforms to established criteria, such as naming convention, correctly assigned IP networks, or logical order.
• Verify historical correlations between past and present states thanks to IP Fabric’s Snapshot feature.

The use case for zone-based firewall rules

"As a DC service provider, we have implemented a robust firewall cluster that currently supports more than 2000 clients. These clients request the security reports on a daily basis. The reports have to include the most current security policies configuration as well.

As a result of using the IP Fabric platform, we can create and export a comprehensive report anytime. Typically, fulfilling this request would take all day, but with IP Fabric, this entire process takes mere seconds to finish."

Verify 802.1X implementation verification

In a multivendor environment, enforcing an authentication means verifying that everything is what it claims to be. The purpose of an 802.1x verification is to help you accept or reject users requesting full-access to a network that uses 802.1X protocol.

Today, more and more companies shift towards tighter LAN security. They’re discovering that this process can cost them countless hours on implementation and verification if they try to do it on their own.

The use case for 802.1X implementation

"In our company, we have more than 800 employees at 12 separate locations across the country. Using traditional methods, 802.1X protocol implementation is a long and arduous verification process. It can easily take more than three months to complete.

On the other hand, with the IP Fabric tool, we were able to tackle the verification process almost instantly. The tool simplifies and automates 802.1X verification, allowing us to run it as frequently as needed."

Access-lists compliance

Access-lists (or firewall filters) are a key feature when enhancing security across networks. They deny or grant access to devices based on specific combinations of source, destination IP, destination port, or other kinds of data. ACLs are fast and easy to implement. However, they are difficult to troubleshoot, even when appropriately applied. The IP Fabric platform compiles all of your ACLs into one place, allowing you to compare and correlate rules across all network devices easily.

The use case for an ACL compliance

"Our MPLS network has thousands of network devices. To ensure compliance, we need to quickly verify that an up-to-date firewall filter is protecting management loopbacks. The IP Fabric platform can complete this task almost instantly and will give you a comprehensive device list that you can easily export and share."

Authentication, Authorization, and Accounting (AAA) information

The Authentication, Authorization, and Accounting system is used to track user activity on an IP-based network and control their access to network resources. It is time-consuming to verify that all network nodes are configured along with the same AAA framework when managing complex network infrastructure.

The IP Fabric platform reduces the amount of time and hassle involved in AAA by giving you a highly detailed overview of all AAA-related information.

The use case for AAA compliance

"A few months ago we decided to migrate all of our network devices to a new AAA server, which meant that we also agreed to a change of authorization rules.

The IP Fabric platform made tracking the progress of the migration effortless, meaning we had more time to focus on more critical tasks."

SNMP and Syslog configuration

Simple Network Management Protocol (SNMP) and Syslog are the key protocols for maintaining and monitoring network. A network engineer needs to ensure that both protocols are reporting properly to dedicated SNMP and Syslog servers. Above all, one must apply security correctly to this type of communication.

Thanks to IP Fabric, you’ll have a detailed structure report related to these protocols.

Use case SNMP compliance

"Over the last 15 years, our network has evolved countless times, and we have lost track of correct SNMP configuration a few times along the way.

Since security is incredibly important to us, we designed the IP Fabric tool to help us verify that all SNMP traffic is sent to dedicated servers and that read-write rules are active at all times."

Interested in learning more about how IP Fabric’s platform can help you with analytics or intended network behavior reporting? Contact us through our website, request a demo, follow this blog, or try our self-guided demo.

Authentication, Authorization, and Accounting, otherwise known as AAA, or Triple A.

Many individuals who have had to implement AAA on a router or a switch most likely have little knowledge regarding the commands that they copy to the router configuration. Most will simply utilize the AAA configurations from another functioning router or switch. Today, we are going to analyze the best AAA practices and how one can ensure its proper setting with our IP Fabric's platform.

For those who are working with a larger network environment, you are most likely using a form of TACACS+ or ACS server running that is specifically designed for the management of logins to your devices. AAA works in unison with TACACS+ to provide efficient management of your logins’ security. In other words, this monitors who is able to log in (Authentication), what that user can do (Authorization), as well as track the commands that are used (Accounting). In the instance of server failure or reachability issues, it is recommended to have a backup local login user name and password that will allow access to your devices.

We shall now analyze what is considered the best practices for configuration.

aaa new-model
tacacs server ACS1
 address ipv4 1.1.1.1
 key 0 SECRET-KEY
tacacs server ACS2
 address ipv4 2.2.2.2
 key 0 SECRET-KEY
aaa group server tacacs+ ACS
 server name ACS1
 server name ACS2
aaa authentication login default group ACS local
aaa authentication enable default group ACS enable
aaa authorization config-commands
aaa authorization exec default group ACS local if-authenticated
aaa authorization commands 1 default group ACS if-authenticated
aaa authorization commands 15 default group ACS local if-authenticated
aaa accounting exec default start-stop group ACS
aaa accounting commands 1 default start-stop group ACS
aaa accounting commands 15 default start-stop group ACS

Upon dissecting this model by line, we have:

aaa new-model

This new-model essentially turns on the AAA functionality on the network device.

tacacs server <name>

This addresses the setup of the TACACS server details, such as the IP address, shared key, and all other optional details.

aaa group server tacacs+ <group_name>

This is intended for the grouping of specific servers into logical groups.

aaa authentication login default group ACS local

Here, we define how the device is authenticating the users who attempt to log into the device. First, there is the default authentication method with group of TACACS+ servers named “ACS”. Then, if it is unreachable, we shall implement the locally configured user account list.

aaa authentication enable default group ACS enable

This component explains that, for enable mode, the default authentication method with group of TACACS+ servers named “ACS” should be utilized.

aaa authorization config-commands

This is regarding our goal to authorize each command that is being issued to the device.

aaa authorization exec default group ACS local if-authenticated

This sets up the device and places the user directly into enable mode, upon his authentication (the if-authenticated keyword).

aaa authorization commands 1 default group ACS if-authenticated

In this command, we are authorizing the level 1 user commands, which is similar to the non-enable mode.

aaa authorization commands 15 default group ACS local if-authenticated

Here, we are providing authorization for level 15 users against TACACS+. If TACACS+ is unavailable, then the local user account is used, instead. Upon authentication, the user will immediately be placed into exec/enable mode.

aaa accounting exec default start-stop group ACS

AAA Accounting ensures the logging in and access into the device.

aaa accounting commands 1 default start-stop group ACS

This provides the tracking of user activity on a given device for privilege 1 commands.

aaa accounting commands 15 default start-stop group ACS

This provides the tracking of user activity on a given device for privilege 15 commands.

This provides tracking of user activity on a device, even if they have just logged in.

As you can see from this basic configuration, there is significant variability, resulting in complications of the verification of the proper function. This worsens with regular network operations, when the connectivity to the TACACS server fails, requiring a troubleshoot to determine the error. In such a situation, one would usually remove the TACACS configuration in attempt to resolve the issue. However, during the troubleshoot, it is common to forget about this change and leave the network open with local authentication or, perhaps, no authentication, whatsoever. Luckily, IP Fabric offers the newly released AAA verification, which can be used for the verification of the real live AAA settings.

Although our platform includes a few “out of the box” reports, we highly recommend adjusting these default reports in color with your custom verification checks, since the AAA settings differ between various companies. We recommend that you observe and spend time on the following:

• Setting up your own servers in the Servers tab and verifying its addresses, group names, and ports.
• Ensuring that the lines are configured for proper AAA method usage.
• Verifying proper Authentication, Authorization, and Accounting method list order, to ensure that there are no devices remaining half-configured or with local/none, if you are using central TACACS+ servers.

For example, let us assume that we want to set up the verification report for the Authentication methods to verify this:

• There is one method for login and a second for enable mode,
• Method is not named, it is “default”,
• TACACS server group to be used is ABACS,
• Fallback method for login is default,
• Fallback method for enable is enable,
• Anything else is redundant or incorrect.

which would be equivalent of the following piece of configuration

aaa authentication login default group ABACS localaaa authentication enable default group ABACS enable

It is generally recommended to have a single detection for all issues on the particular AAA method and to reveal the issue count on the dashboard.

This can be configured in the following manner:

• Create a new “Colorize column” rule or edit the existing one.
• Name it “AAA Authentication Method” with a colorized column “Type”.
• In green color, create two groups that are with OR logic — the first rule will apply to the enable method and the second, for the login method.
• Set the first group to AND logic and create the following logical tests:
   “Type” equal “enable”.
   “Name” equal “default”.
   “Primary method” equal to your server group name or default. In our case “ABACS”.
   “Secondary method” equal to “enable”.
• Set the second group to AND logic and create the following logical tests:
   “Type” equal “login”.
   “Name” equal “default”.
   “Primary method” equal to your server group name or default. In our case “ABACS”.
   “Secondary method” equal to “local”.
• Set the slider in orange color to the “Default color setting”.

For a more detailed overview of how to set this up, view the video below:

Proceed to colorize the columns with specific details to green or orange, so that you will immediately see what is wrong from the dashboard counter created previously. In our case, we would need to setup additional rules as follows:

• AAA Authentication method name
   Colorized column: Name
   Green color rule: “Name” equal “default”
   Orange color set as “Default color”
• AAA Authentication Primary method
   Colorized column: Primary method
   Green color rule: “Primary method” equal “ABACS”
   Orange color set as “Default color”
• AAA Authentication Secondary method
   Colorized column: Primary method
   Green color rule: create two logical groups as OR
   First group: (“Type” equal “enable”) AND (“Secondary method” equal to “enable”).
   Second group: (“Type” equal “login”) AND (“Secondary method” equal to “local”).
   Orange color set as “Default color”

AAA Authentication Secondary method would look like this:

This will ensure the setup of the Authentication on all devices in the network. In regards to the remaining tabs (servers, lines, authorization, and accounting), you may follow the same logic to create similar specific rules that will configure IP Fabric to verify your specific AAA needs consistently in a matter of seconds.

If you’re interested in learning more about how IP Fabric’s platform can help you with analytics or intended network behavior reporting, contact us through our website, request a demo, follow this blog or sign up for our webinars.