Network Automation and Compliance Auditing Platform

A Python-based network auditing platform that automates compliance checks, configuration backups, and drift detection for network devices.

Features

• Compliance Auditing: 8 built-in security and configuration checks
• Configuration Backup: Automated backup with timestamp tracking
• Drift Detection: Compare configurations against baselines
• Ansible Integration: Playbooks for validation, backup, and drift detection
• Multi-device Support: Audit multiple devices efficiently
• Flexible Output: JSON and Markdown reports

Quick Start

# Setup
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
ansible-galaxy collection install cisco.ios ansible.netcommon

# Configure devices in inventory/devices.yaml
# Set credentials
export NET_USER=admin
export NET_PASS=your_password

# Initialize baselines
python audit.py --inventory inventory/devices.yaml --baseline-init

# Run audit
python audit.py --inventory inventory/devices.yaml

Project Structure

network-audit/
├── audit.py                    # Main auditing script
├── compliance_rules.py         # Compliance check definitions
├── test_compliance.py          # Test suite
├── requirements.txt            # Python dependencies
├── inventory/
│   └── devices.yaml           # Device inventory
├── baseline/                   # Baseline configurations
├── artifacts/                  # Audit outputs
│   └── <device_name>/
│       ├── running_config.txt
│       ├── facts.json
│       ├── audit_report.md
│       └── drift.diff
└── ansible/
    ├── validate.yml           # Validation playbook
    ├── backup.yml             # Backup playbook
    └── drift.yml              # Drift detection playbook

Compliance Rules

Rule	Severity	Description
SSH Enabled	Critical	Verifies SSH is configured
Telnet Disabled	Critical	Ensures telnet is not enabled
Password Encryption	Critical	Checks service password-encryption
SNMP Security	High	No default public/private communities
AAA New-Model	High	AAA authentication enabled
NTP Configured	Medium	Time synchronization setup
Logging Buffered	Medium	Local logging enabled
Banner Configured	Medium	Login banner present

Usage

Python Script

# Audit all devices
python audit.py --inventory inventory/devices.yaml

# Audit specific device
python audit.py --inventory inventory/devices.yaml --device router01

# Initialize baselines
python audit.py --inventory inventory/devices.yaml --baseline-init

# Custom paths
python audit.py --inventory inventory/devices.yaml --baseline baseline/ --out artifacts/

Ansible Playbooks

cd ansible/

# Validate devices
ansible-playbook validate.yml

# Backup configurations
ansible-playbook backup.yml

# Check drift
ansible-playbook drift.yml

Configuration

Device Inventory (inventory/devices.yaml)

devices:
  - name: router01
    host: 192.168.1.1
    device_type: cisco_ios
    port: 22
    timeout: 30

Credentials

Environment Variables (Recommended):

export NET_USER=admin
export NET_PASS=your_password
export NET_SECRET=enable_password  # Optional

Interactive Prompt: If environment variables are not set, the script will prompt for credentials.

Output Files

artifacts/<device_name>/

• running_config.txt: Complete running configuration
• facts.json: Compliance check results (machine-readable)
• audit_report.md: Human-readable report with recommendations
• drift.diff: Configuration changes from baseline

Dependencies

• Python 3.8+
• netmiko >= 4.3.0
• ansible >= 8.0.0
• PyYAML >= 6.0.1

Testing

# Test compliance checker
python test_compliance.py

Troubleshooting

Connection Issues:

ping 192.168.1.1
ssh admin@192.168.1.1

Module Not Found:

source venv/bin/activate
pip install -r requirements.txt

Ansible Issues:

ansible-galaxy collection install cisco.ios
ansible cisco_devices -m ping

Extending

Add Custom Compliance Rule

Edit compliance_rules.py:

@staticmethod
def check_custom_rule(config: str) -> Tuple[bool, str]:
    """Check for custom requirement"""
    if re.search(r'your_pattern', config, re.IGNORECASE):
        return True, "Custom check passed"
    return False, "Custom check failed"

Add the method to the rules list in __init__().

License

MIT License