Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.

share|improve this question
    
shrubbery.net/rancid –  user6559 Dec 23 '11 at 20:47
    
Hello Michael and welcome to Security StackExchange. Please provide some more information about the link. –  Hendrik Brummermann Dec 24 '11 at 22:45
2  
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  Scott Pack Aug 14 '12 at 1:47

6 Answers 6

up vote 5 down vote accepted

Cisco's own SDM (Security Device Manager) performs some basic auditing. "Cisco SDM allows users to perform one-step security audits to evaluate the strengths and weaknesses of their router configurations against common security vulnerabilities." For a list of features included, see AutoSecure Features Implemented in Cisco SDM .

Another well-known tool is Cisco RAT, available from the Center for Internet Security.

These are good starting points, but far from perfect.

A more recent option (which I haven't tried yet) is the Nessus IOS plugin from Tenable.

More ad hoc (single-function) tools can be found at

http://packetstormsecurity.org/cisco/page1/
and
http://www.cymru.com/Tools/index.html

share|improve this answer

You might check out AlgoSec and Lumeta to see if their products will do what you want.

Caveats: I have no personal experience with these vendors, nor do I have any financial relationship with them.

share|improve this answer

You can also check out Nipper (http://www.titania.co.uk/)

Nipper enables you to perform your own comprehensive security audits of your network devices. Nipper supports around 60 different network firewalls, switches and routers from a wide range of manufacturers such as Cisco, HP, Juniper, Check Point and Extreme Networks.

It's cheap: $85 for evaluating 5 devices (home license).

share|improve this answer
    
+1 for nipper, does a good job and seems to be kept up to date –  Rоry McCune Feb 2 '11 at 21:44

HP Network Automation is what we use. It's commercial software but works great.

share|improve this answer

For devices with ACLs you should try Tufin SecureTrack.

It reads in the running config file and allows you to perform various kinds of analysis such as ACL overlap report, finding ACLs that match certain access patterns, for example ACLs allowing access from one zone to another etc.

share|improve this answer

CiscoConfParse (download link) is an open-source audit toolset that lets you express the audit as Python code. Disclaimer: I am the author.

License: GPL

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.