Find and remediate policy violations

You can use policy reports to find device configurations that do not comply to policies. To view information about policy violations, you must:

1. Make sure the cached policy compliance information is up-to-date.

2. View a policy report to display the cached information.

After you have viewed a report and remediated one or more violations, you can verify that the violations were successfully remediated.

Update cached policy compliance information

NCM runs policy reports against the selected nodes to locate any policy violations, and then caches the results so that the data can be accessed quickly. You can update cached policy compliance information in any of the following ways:

• Enable the policy cache to automatically update information each day. (This option is enabled by default.)
• Manually update the policy cache.
• Schedule a policy report job to update cached information for that report and send emails about violations.

Automatically update cached policy compliance information

When the policy cache is enabled, NCM automatically runs policy reports at the specified time to check for policy violations. By default, the policy cache is updated daily at 11:55 PM.

1. Click Settings > All Settings.
2. Under Product Specific Settings, click NCM Settings.
3. Under Advanced, click Advanced Settings.
4. Under Cache Settings, select Enable Config and Policy Caches.
5. Specify what time to generate the policy cache.
6. Click Submit.

Manually update cached policy compliance information

After you modify policy rules or download updated configuration files, you can manually update cached policy compliance information to reflect the changes.

The NCM role of WebUploader or higher is required to manually update cached policy compliance information.

1. Click My Dashboards > Network Configuration > Compliance.

2. To manually update the cached information:

   • To update all reports, click Update All.
   • To update one or more reports, select the reports and click Update Selected.

Schedule a policy report job

You can configure a policy report job to send emails each time the job runs or only if it finds policy violations. When the job runs, it updates the cached policy compliance information so that the report provides a snapshot of current policy compliance.

1. Click My Dashboards > Network Configuration > Jobs.
2. Click Create New Job.
3. Name the job, and select Generate a Policy Report from Job Type.

4. Specify when the job runs:

   • To run the job once or on a simple schedule, select Basic. Click the tab that identifies how frequently the job runs, and then specify the start time and (if needed) the day(s).

   • To create a more complex schedule, select Advanced and then use the five fields to create a CRON expression.

5. Add a comment if this job relates to a business rule, and click Next.
6. On the Choose Nodes tab, click Next.
7. Select an email notification option, and click Next. If you click Email Results, the default email notification and SMTP server settings are populated. These settings can be overridden in each job.
8. Select the policy report to generate as part of the job.
9. If you want to suppress notifications when no violations are found, select Send Notification Only When There Are Policy Violations.
10. Click Next.
11. Review the settings for the job, and click Finish.

View a policy report

When you view a report, it displays the latest cached policy compliance information. Use this information to investigate and remediate policy violations.

If compliance information for a report is not current, you can manually update the information.

1. Click My Dashboards > Network Configuration > Config Summary.

   • If you are using the classic Config Summary dashboard, the Policy Violations widget lists the reports that found policy violations the last time each report ran.

   • If you are using the new Config Summary dashboard (available in NCM 2022.3 and later), the Policy Violations widget shows the number of policy reports that found violations with each status.

     Click any status to open the Policy Violations report, which lists all reports that found policy violations.

2. Click a report name to open the Report Details page.

   The upper left corner shows the Last Updated date and time.

   Icons indicate which rules were violated on each node:

   • A green check mark indicates that the rule was not violated.
   • Any other icon indicates that the rule was violated. The type of icon indicates the severity of violating that rule.

   

3. Click a violation icon.

   The Violation Details dialog shows the rule that was violated and indicates if a remediation script is available.

   If the violation occurred because the string was found, you can click the arrow to display the line number in the config file.

   

4. (Optional) Click View Config to open the Config Details view in a different tab.
5. (Optional) If a remediation script is available, you can run it to automatically remediate the issue. Click a Management option to run the script on this node or on all nodes that violate this policy rule.

Verify that a policy violation was remediated

When you discover a policy violation, complete the following steps to resolve the issue and verify that the remediation was successful.

1. Update the configuration file to resolve the policy violation, either by editing the file or by running a remediation script.
2. Download the updated configuration file.
3. Update the cached policy compliance information for the report that detected the policy violation.
4. View the report to verify that the policy violation is not found.