Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
closed as off-topic by Xander, TildalWave, Jens Erat, RoraΖ, AviD♦ Jan 26 '15 at 9:00
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Xander, TildalWave, Jens Erat, RoraΖ, AviD
Cisco's own SDM (Security Device Manager) performs some basic auditing. "Cisco SDM allows users to perform one-step security audits to evaluate the strengths and weaknesses of their router configurations against common security vulnerabilities." For a list of features included, see AutoSecure Features Implemented in Cisco SDM .
Another well-known tool is Cisco RAT, available from the Center for Internet Security.
These are good starting points, but far from perfect.
A more recent option (which I haven't tried yet) is the Nessus IOS plugin from Tenable.
More ad hoc (single-function) tools can be found at
You can also check out Nipper (http://www.titania.co.uk/)
Nipper enables you to perform your own comprehensive security audits of your network devices. Nipper supports around 60 different network firewalls, switches and routers from a wide range of manufacturers such as Cisco, HP, Juniper, Check Point and Extreme Networks.
It's cheap: $85 for evaluating 5 devices (home license).
HP Network Automation is what we use. It's commercial software but works great.
For devices with ACLs you should try Tufin SecureTrack.
It reads in the running config file and allows you to perform various kinds of analysis such as ACL overlap report, finding ACLs that match certain access patterns, for example ACLs allowing access from one zone to another etc.