Network devices

Machines > Network devices reads your switches, routers, and firewalls once a day over SSH. For each device it:

• keeps the configuration (the last 30 versions) and shows what changed between them,
• checks 11 settings that CMMC asks of network gear, plus the firmware,
• matches the firmware version against the National Vulnerability Database, with the ones CISA lists as actively exploited first,
• puts the results into the CMMC assessment, next to the same requirements for your servers and workstations.

Gardience runs only read commands (show and get). It never changes a device, and the account you give it should not be able to either.

Platforms#

The read-only account#

Give Gardience an account that can read the whole configuration but change nothing. Gardience signs in with a password or an SSH private key (OpenSSH or PEM, without a passphrase). The Arista, Junos, and FortiGate setups below were tested: the account read the configuration, and an attempt to change the device with it was refused. The Cisco devices were tested with Cisco's lab accounts; the read-only setup for them follows Cisco's own guidance.

Cisco IOS and IOS XE. An account at privilege 15 (lower levels cannot run show running-config), with AAA command authorization on your TACACS+ or RADIUS server allowing only show commands for it.

Cisco NX-OS. An account with the network-operator role.

Arista EOS. Privilege 15 with the network-operator role, a secret, and command authorization turned on. Without aaa authorization exec default local the account starts below privilege 15 and cannot read the configuration. Without aaa authorization commands all default local, Arista does not enforce the role, and the account can change the switch. Before turning command authorization on, give your own administrator accounts the network-admin role, because every local account is then held to its role.

username gardience privilege 15 role network-operator secret <a long password>
username gardience ssh-key <the public key, if you sign in with a key>
username <your admin account> role network-admin
aaa authorization exec default local
aaa authorization commands all default local

Do not use nopassword for this account: it lets the account sign in without a password, and the password check (NET-06) fails on it.

Juniper Junos. A login class with view and view-configuration. Gardience reads the configuration with groups applied (display inheritance), so settings that come from a group count. This class sees password hashes as SECRET-DATA; the password check then reads the hash format setting instead.

set system login class gardience-ro permissions [ view view-configuration ]
set system login user gardience class gardience-ro authentication ssh-ed25519 "<the public key>"

FortiGate. An administrator with a read-only profile. On FortiOS 8, the profile also needs cli-get and cli-show turned on, or the account cannot run get and show.

config system accprofile
    edit "gardience-ro"
        set sysgrp read
        set netgrp read
        set loggrp read
        set fwgrp read
        set authgrp read
        set cli-get enable
        set cli-show enable
    next
end
config system admin
    edit "gardience"
        set accprofile "gardience-ro"
        set ssh-public-key1 "<the public key>"
    next
end

FortiOS pages long output (--More--) even for one command. Gardience reads through the pages without changing the console setting.

If the account cannot read the whole configuration, Gardience says so and does not judge anything. It never treats an error message from the device as a configuration.

Adding a device#

Under Add a device, enter a name, the device's address (an IP address or DNS name; private addresses are fine), the platform, the SSH port, the account, and its password or private key, then Add and read. Gardience signs in and reads the device before keeping it. A wrong password, the wrong platform, or an account that cannot read the configuration is refused, and nothing is kept.

The password or key is sealed in Gardience's vault and never stored in plain text. Only admins add, change, and remove devices. Admins and approvers can download configurations.

The device's SSH key#

The first read keeps the device's SSH host key. If a later read finds a different key, Gardience stops reading that device and says so, because the device may have been replaced or someone may be in between. When you know why it changed, choose Accept new key. The change is recorded in the audit log.

The checks#

Where the platform's default meets a check and the configuration does not mention it, the check passes and says it is the default (for example, the IOS 10-minute session timeout, or FortiOS locking an administrator out after 3 failed sign-ins).

Firmware#

Gardience looks up the firmware version in the National Vulnerability Database, written the way the database writes it (for example, IOS XE 17.15.04c is 17.15.4c, and Junos 23.4R2-S8.9 is release 23.4, update r2-s8). The check fails if any vulnerability is in CISA's Known Exploited Vulnerabilities catalog or scores 9.0 or higher. Lookups are kept for a day. The database lists few recent Arista EOS releases, so an Arista device often shows no known vulnerabilities; check Arista's own advisories as well.

What changed#

Each read keeps the configuration if it differs from the last one. What changed shows the lines added and removed since the version before, and a change is also recorded in the audit log, so a change made on the device outside your change process shows up the next day, or at once with Check now.

In the CMMC assessment#

Each check counts for its requirement across every device, the same way the machine checks do: "4 of 5 network devices pass", with the failing devices named. Kept configurations are evidence for 3.4.1 (baseline configurations). Removing a device takes it out of the assessment at once.