Network Configuration Management Practices

Wed Sep 15 09:25:41 UTC 2004

On Wed, Sep 15, 2004 at 12:27:20AM -0700, Alexei Roudnev wrote:
> 
> One more thing. We tried to review _proposed changes_ and _changed applied_.
> Practice showed, that it is impossible to see errors in proposed updates,
> even if 3 - 4 engineers review it (not design flaws, but syntac and
> semantics errors), so we did not got many use from pre-change reviews
> (except design ones). But we got extremely high profit from post-change
> reviews (verifying, what really changed on the router / firewall after
> maintanance window) - it allows to see some unwanted changes and avoid few
> possible service disruptions.
> 

	This doesn't seem to scale too well. When you have frequent changes
(i.e. many access devices) the diff load becomes unmanageably large.
	My ideal would be to have a network monitoring tool which compares the
actual network against a configured baseline. The presumption would be that
if the network matches what have been set forth as engineering rules, I don't
really care what the specific settings are.
	Currently we do something sort of halfway: archive the actual configs
and then run audit scripts against them, which parse the configs. Definitely
not ideal but it helps catch simpler errors. One of these days when I have
extra cycles.. (yeah, right)

	Austin