Skip to main content

Ansible Network Compliance

Introduction

Network compliance is a critical aspect of network management that ensures your infrastructure adheres to organizational policies, industry standards, and regulatory requirements. As networks grow in complexity, manually verifying and enforcing compliance becomes increasingly challenging. This is where Ansible's network automation capabilities become invaluable.

Ansible Network Compliance combines the power of infrastructure as code, idempotent operations, and declarative configurations to automate compliance checks, remediation, and reporting across your entire network estate. In this guide, we'll explore how to implement network compliance automation with Ansible, providing you with the tools to maintain consistent, secure, and compliant network infrastructure.

What is Network Compliance?

Network compliance involves ensuring that your network devices and infrastructure:

  1. Follow security best practices (password policies, access controls, encryption)
  2. Adhere to regulatory standards (PCI DSS, HIPAA, SOX, NIST, etc.)
  3. Maintain operational standards (naming conventions, configuration parameters, routing protocols)
  4. Meet performance requirements (QoS settings, bandwidth allocation)

Traditionally, maintaining compliance involves manual configuration reviews, periodic audits, and reactive remediation efforts. With Ansible, we can transform this approach to be automated, proactive, and consistent.

Core Components of Ansible Network Compliance

1. Compliance as Code

With Ansible, compliance requirements are defined as code in playbooks and roles:

yaml
---
- name: Verify password complexity requirements
hosts: network_devices
gather_facts: no

tasks:
- name: Check password minimum length
ios_command:
commands: show running-config | include password
register: password_config

- name: Analyze password configuration
assert:
that:
- "'min-length 12' in password_config.stdout[0]"
fail_msg: "Password minimum length does not meet requirements"
success_msg: "Password minimum length meets requirements"

2. Declarative Compliance States

Instead of focusing on how to make a device compliant, Ansible allows you to declare what a compliant state looks like:

yaml
---
- name: Ensure NTP configuration compliance
hosts: cisco_routers
gather_facts: no

vars:
compliant_ntp_servers:
- 10.1.1.1
- 10.1.1.2

tasks:
- name: Configure NTP servers
ios_config:
lines:
- ntp server {{ item }}
parents: ntp
loop: "{{ compliant_ntp_servers }}"

3. Idempotent Compliance Checks

Ansible's idempotent nature ensures that compliance checks can be run repeatedly without changing already-compliant systems:

yaml
---
- name: Ensure banner configuration
hosts: network_devices
gather_facts: no

tasks:
- name: Configure login banner
ios_banner:
banner: login
text: |
AUTHORIZED ACCESS ONLY
This system is the property of Example Corp.
Unauthorized access is prohibited.
state: present

Implementing Network Compliance with Ansible

Step 1: Define Your Compliance Requirements

Begin by documenting your compliance requirements in a structured format. For example:

yaml
# compliance_requirements.yml
---
password_policy:
min_length: 12
complexity: true
encryption: type 9

access_control:
ssh_version: 2
timeout: 600
acl: management_only

logging:
servers:
- 10.2.2.1
- 10.2.2.2
level: informational

Step 2: Create Compliance Verification Playbooks

Develop playbooks that check current configurations against your compliance requirements:

yaml
---
- name: Verify SSH configuration compliance
hosts: all_network_devices
gather_facts: no

tasks:
- name: Get current SSH configuration
ios_command:
commands:
- show ip ssh
register: ssh_config
when: ansible_network_os == 'ios'

- name: Verify SSH version
assert:
that:
- "'SSH Version 2.0 Enabled' in ssh_config.stdout[0]"
fail_msg: "SSH version 2 is not enabled"
success_msg: "SSH version 2 is properly configured"
when: ansible_network_os == 'ios'

Step 3: Create Remediation Playbooks

Build playbooks that correct non-compliant configurations:

yaml
---
- name: Remediate SSH configuration
hosts: all_network_devices
gather_facts: no

tasks:
- name: Configure SSH version 2
ios_config:
lines:
- ip ssh version 2
when: ansible_network_os == 'ios'

- name: Set SSH timeout
ios_config:
lines:
- ip ssh time-out 600
when: ansible_network_os == 'ios'

Step 4: Develop Compliance Reports

Create playbooks that generate and distribute compliance reports:

yaml
---
- name: Generate compliance reports
hosts: localhost
gather_facts: no

vars:
report_date: "{{ lookup('pipe', 'date +%Y-%m-%d') }}"

tasks:
- name: Compile compliance results
template:
src: templates/compliance_report.j2
dest: "reports/network_compliance_{{ report_date }}.html"

- name: Email compliance report
mail:
host: smtp.example.com
port: 25
to: network-[email protected]
subject: "Network Compliance Report - {{ report_date }}"
body: "Please find attached the latest network compliance report."
attach:
- "reports/network_compliance_{{ report_date }}.html"

Real-World Compliance Scenarios

Scenario 1: PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) requires specific network security controls:

yaml
---
- name: Ensure PCI DSS firewall compliance
hosts: edge_firewalls
gather_facts: no

tasks:
- name: Get current firewall configuration
ios_command:
commands:
- show access-lists
register: acl_config

- name: Verify cardholder data network isolation
assert:
that:
- "'permit ip host 10.100.0.0 0.0.255.255 any' not in acl_config.stdout[0]"
fail_msg: "Cardholder data network is not properly isolated"
success_msg: "Cardholder data network isolation is compliant"

- name: Configure compliant access list
ios_config:
lines:
- "no access-list 110 permit ip any 10.100.0.0 0.0.255.255"
- "access-list 110 deny ip any 10.100.0.0 0.0.255.255"
- "access-list 110 permit ip 10.200.0.0 0.0.0.255 10.100.0.0 0.0.255.255"
when: "'permit ip any 10.100.0.0 0.0.255.255' in acl_config.stdout[0]"

Scenario 2: Operational Configuration Standards

Ensure network devices follow organizational standards:

yaml
---
- name: Validate device naming convention compliance
hosts: all_network_devices
gather_facts: yes

vars:
naming_pattern: "^(sw|rt|fw)-(\\w{3})-(\\d{2})$" # Example: sw-nyc-01

tasks:
- name: Check hostname against naming convention
assert:
that:
- "inventory_hostname | regex_search(naming_pattern)"
fail_msg: "Device name {{ inventory_hostname }} does not follow naming convention"
success_msg: "Device name {{ inventory_hostname }} follows naming convention"

- name: Update hostname if non-compliant
ios_config:
lines:
- "hostname {{ inventory_hostname }}"
when: "inventory_hostname | regex_search(naming_pattern) and ansible_net_hostname != inventory_hostname"

Implementing Continuous Compliance

For effective compliance management, implement a continuous approach:

Schedule with Ansible Tower/AWX

Implement scheduled compliance checks using Ansible Tower or AWX:

yaml
---
- name: Set up compliance workflow
hosts: localhost
gather_facts: no

tasks:
- name: Create compliance job template
awx.awx.job_template:
name: "Network Compliance Check"
job_type: "run"
inventory: "Network Inventory"
project: "Network Compliance"
playbook: "compliance_check.yml"
credential: "Network Credentials"
state: present

- name: Schedule daily compliance checks
awx.awx.schedule:
name: "Daily Network Compliance"
unified_job_template: "Network Compliance Check"
rrule: "FREQ=DAILY;BYDAY=MO,TU,WE,TH,FR"
state: present

Building a Compliance Framework

For comprehensive network compliance, create a structured framework:

yaml
# File: compliance_framework/main.yml
---
- name: Import compliance modules
import_playbook: "modules/{{ item }}.yml"
loop:
- password_policy
- access_control
- logging
- snmp
- ntp
- interface_security

Each module addresses specific compliance domains:

yaml
# File: compliance_framework/modules/password_policy.yml
---
- name: Password policy compliance
hosts: all_network_devices
gather_facts: no

tasks:
- name: Import tasks for specific device types
include_tasks: "../tasks/{{ ansible_network_os }}_password_policy.yml"

Practical Example: STIG Compliance for Cisco Devices

Security Technical Implementation Guides (STIGs) provide security standards for network devices:

yaml
---
- name: Apply Cisco Router STIG compliance
hosts: cisco_routers
gather_facts: no

tasks:
# STIG-ID: CISC-ND-000010
- name: Ensure password encryption is enabled
ios_config:
lines:
- service password-encryption

# STIG-ID: CISC-ND-000020
- name: Disable unused services
ios_config:
lines:
- no service tcp-small-servers
- no service udp-small-servers
- no ip finger
- no ip bootp server

# STIG-ID: CISC-ND-000030
- name: Configure AAA authentication
ios_config:
lines:
- aaa new-model
- aaa authentication login default group tacacs+ local
- aaa authorization exec default group tacacs+ local
- aaa accounting exec default start-stop group tacacs+

Output and Reporting

Generate formatted compliance reports to demonstrate adherence:

html
<!-- templates/compliance_report.j2 -->
<!DOCTYPE html>
<html>
<head>
<title>Network Compliance Report</title>
<style>
.compliant { color: green; }
.non-compliant { color: red; }
table { border-collapse: collapse; width: 100%; }
th, td { border: 1px solid #ddd; padding: 8px; }
</style>
</head>
<body>
<h1>Network Compliance Report - {{ report_date }}</h1>

<h2>Summary</h2>
<p>Devices Checked: {{ compliance_results | length }}</p>
<p>Compliant Devices: {{ compliance_results | selectattr('compliant', 'equalto', true) | list | length }}</p>
<p>Non-Compliant Devices: {{ compliance_results | selectattr('compliant', 'equalto', false) | list | length }}</p>

<h2>Detailed Results</h2>
<table>
<tr>
<th>Device</th>
<th>Status</th>
<th>Issues</th>
</tr>
{% for device in compliance_results %}
<tr>
<td>{{ device.name }}</td>
<td class="{% if device.compliant %}compliant{% else %}non-compliant{% endif %}">
{% if device.compliant %}Compliant{% else %}Non-Compliant{% endif %}
</td>
<td>
{% if not device.compliant %}
<ul>
{% for issue in device.issues %}
<li>{{ issue }}</li>
{% endfor %}
</ul>
{% endif %}
</td>
</tr>
{% endfor %}
</table>
</body>
</html>

Integration with Compliance Tools

Enhance your network compliance by integrating Ansible with specialized tools:

yaml
---
- name: Run compliance scan with third-party tool
hosts: localhost
gather_facts: no

tasks:
- name: Execute Nessus scan
command: >
/opt/nessus/bin/nessuscli scan --targets {{ inventory_hostname }}
--policy 'Network Device Compliance'
register: nessus_results
delegate_to: localhost

- name: Parse scan results
set_fact:
compliance_issues: "{{ nessus_results.stdout | from_json | json_query('findings[*].description') }}"

- name: Remediate findings with Ansible
include_tasks: "remediation/{{ item | regex_replace(' ', '_') }}.yml"
loop: "{{ compliance_issues }}"

Summary

Ansible Network Compliance provides a powerful approach to maintaining secure, consistent, and policy-compliant network infrastructure. By leveraging Ansible's automation capabilities, you can:

  • Transform manual compliance processes into automated, repeatable workflows
  • Detect and remediate compliance issues proactively
  • Generate comprehensive compliance reports for auditing purposes
  • Scale compliance efforts across your entire network infrastructure
  • Reduce human error and configuration drift

The approach outlined in this guide helps you build a robust compliance framework that adapts to changing requirements and scales with your network.

Additional Resources and Exercises

Resources

Exercises

  1. Basic Compliance Check: Create a playbook that checks your network devices for basic security settings like SSH version, timeout values, and AAA configuration.

  2. Custom Compliance Module: Develop a custom Ansible module that verifies a specific compliance requirement unique to your organization.

  3. Compliance Report Dashboard: Build a simple web dashboard using the Ansible-generated compliance reports that displays compliance status across your network.

  4. Multi-Vendor Compliance: Extend your compliance framework to support different network vendors (Cisco, Juniper, Arista) while maintaining consistent compliance requirements.

  5. Integration Challenge: Integrate your Ansible compliance framework with a version control system like Git to track compliance changes over time.



If you spot any mistakes on this website, please let me know at [email protected]. I’d greatly appreciate your feedback! :)