Chapter 22 — Network and communications security: automation
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Why automate"]
N2["22.2 Configuration backups"]
N3["Lab — Configuration drift"]
N4["22.3 Reading the drift"]
N5["22.4 Automating safely"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Why automate"]
N2["22.2 Configuration backups"]
N3["Lab — Configuration drift"]
N4["22.3 Reading the drift"]
N5["22.4 Automating safely"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Why automate]
|
v
[22.2 Configuration backups]
|
v
[Lab — Configuration drift]
|
v
[22.3 Reading the drift]
|
v
[22.4 Automating safely]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) automate configuration backups; (2) detect drift with diffs; (3) automate safely.
22.1 Why automate
Gareth has many routine tasks and little time. Automation handles tasks that are repetitive, error-prone and easy to define: backing up configurations, comparing them with approved versions and checking certificates for expiry. Tomás chooses these first because they need no judgement and their output is easy to check. He avoids automating changes to live devices at this stage, since a mistaken automated change could affect the whole school at once, and a technician working alone may not notice quickly. Each automated task replaces a manual one.
22.2 Configuration backups
Each night, a small script collects the running configuration of each switch and the firewall using their export features, over encrypted management connections from the management zone. Configurations are stored with dates in a protected folder, and the script reports which devices failed to export. Backups support recovery after failures and give a history of changes. Tomás tests restoring a switch configuration in the lab to confirm the backups are complete and usable. Backups are kept for one year, and the folder is itself copied to the school's cloud backup service.
Lab — Configuration drift
"""Show drift between an approved and a running synthetic switch configuration (stdlib difflib)."""
import difflib
approved = """hostname sw-library
vlan 10 name staff
vlan 20 name students
vlan 30 name guest
interface port1 vlan 20
interface port2 vlan 20
ssh enable
telnet disable
logging host 10.50.9.10""".splitlines()
running = """hostname sw-library
vlan 10 name staff
vlan 20 name students
vlan 30 name guest
interface port1 vlan 20
interface port2 vlan 10
ssh enable
telnet enable
logging host 10.50.9.10""".splitlines()
d = [l for l in difflib.unified_diff(approved, running, "approved", "running", lineterm="", n=0) if l[:1] in "+-" and l[:3] not in ("+++", "---")]
print("\n".join(d)); print("changed lines:", len(d) // 2)
Run with python3 lab_diff.py. Verified output:
-interface port2 vlan 20
+interface port2 vlan 10
-telnet disable
+telnet enable
changed lines: 2
22.3 Reading the drift
The synthetic comparison of the library switch's approved and running configuration shows two changes. Port 2 moved from the student zone to the staff zone, and Telnet has been re-enabled. Either could have a good explanation, such as a temporary fix, but neither went through change control. Gareth checks: a teacher asked for a staff connection in the library, and Telnet was enabled by mistake during a firmware update. Port 2 is approved with a change record; Telnet is disabled again.
Recording the cause of each change also shows that firmware updates need a configuration check afterwards.
22.4 Automating safely
Automated scripts run with privileged access, so they must be protected. Tomás stores the script's credentials in the operating system's protected store rather than in the script, limits the account to read-only export permissions and logs every run. The script is version-controlled and tested. If it fails, it alerts Gareth rather than retrying endlessly. These precautions ensure automation reduces risk rather than adding a new weakness that an attacker could exploit to change devices. Gareth reviews the script's run log each week as part of his routine.
Worked example
Nightly backups cover thirteen devices; the drift report finds two changes, one approved and one reverted.
Synthetic case. Configurations are synthetic.
Errors and limits
Automation with broad write access can spread one mistake to every device.
Exercises
- EX064 — Drift findings. What two changes does the drift comparison show? Rubric: 3 = port 2 to staff VLAN, Telnet enabled;; 2 = two;; 1 = one;; 0 = none.
- EX065 — Read-only account. Why give the backup script read-only permissions? Rubric: 3 = limits harm if misused or compromised;; 2 = safety;; 1 = speed;; 0 = none.
- EX066 — Restore test. Why test restoring a backup in the lab? Rubric: 3 = confirm backups complete and usable;; 2 = verify;; 1 = unnecessary;; 0 = none.
Synthesis
Safe, read-only automation for backups and drift detection saves time and catches unapproved changes.
Continue studying — chapter 22 of 30
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →