Now that the API has been configured, it can be tested. In this post, I will show a few base GET requests that can be made to ISE in Postman.There is a lot of documentation built into ISE to view which gives examples on the types of calls and examples of calls and returned output.https://172.17.5.101:9060/ers/sdk#_ […]
ISE Lab: API 2 – First API GET Requests with Postman Read More »
ISE does not have the REST API enabled by default. It must be enabled in the ISE admin tab. When saved, there is information at the top showing the URL to an SDK info page that goes through the setup procedure.The most basic setup is only a single step to create an ERS admin. It
ISE Lab: API 1 – Setup Read More »
This is the completed Security Audit playbook.The playbook goes through a basic approved configuration for the devices. If there is anything missing, it is added. If there is anything that should not be there such as; an extra ACL line, or an extra NTP server or the enable secret being different this is fixed. The
Ansible Project: Network Security Audit 5 – Complete Security Audit Playbook Read More »
This is a test to get different commands added to different devices.There are multiple methods to achieve this.1. Use host_vars and set each var in the file. The task will pull the variables for the hosts. All need to be the same name2. Set individual plays for set commands. This does make the playbook longer.
Ansible Project: Network Security Audit 4 – Individual Device Commands Read More »
As I have been going through my list of configuration items for the security audit, I have only used Ansible to send commands. I haven’t used the ios_config module for any of its other abilities like interface configuration, gathering facts or ACL configuration.This post will cover 2/3 of those. Gathering facts, specifically ACL facts and
Ansible Project: Network Security Audit 3 – ios_acl Module Read More »
This test is designed to see if the VTY configuration is on the device. If there are any extra commands that are not part of the confirmed configuration, they will be removed. This is specifically for configuration items in the confirmed configuration. Anything outside this configuration scope will not have any changes made. The desired
Ansible Project: Network Security Audit 2 – VTY Configuration Read More »
During my project for an Ansible Security Audit I needed to use loops and if statements. This for me is a weakness and so I have written this to be used a quick reference guide on how to use Ansible “when “and “with_items”. Both of these have been used in my SNMP checking playbook. The
Ansible Ifs and Loops Read More »
This is the first of a series of tests that will create the Network Security Audit. In this first test I am going to create a single playbook that will check if SNMP is configured correctly on a router R1. The desired outcome will be for only a single SNMP read only string to be
Ansible Project: Network Security Audit 1 – SNMP Check Read More »
This is a mini project I created for myself in one of my previous roles. The problem, that it is designed to solve is given an IP address, where is that IP physically located? This is necessary in older network environments that aren’t using tools such as Solarwinds, or newer products like; Cisco ISE, DNA
Ansible Project: IP to Physical Port Mapping Read More »
Inventory & Group Vars The Ansible inventory file can be specified or a default location can be configured in the /etc/ansible/ansible.cfg file by adding the following lines. The group variables are a way of assigning groups inside the inventory file variables. The inventory can be either a single group of all devices, or split into
Ansible Inventory, Group Vars and Vault Read More »