Tutorial 9: Configuration Management and Change Control

COMP347 Unit 8 – Network Management and Network Operations

Table of Contents

• Learning Objectives
• Overview
• Technical and Theoretical Content
  • 1. Introduction to Configuration Management
  • 2. Configuration Lifecycle Management
  • 3. Configuration Backup and Archiving
  • 4. Version Control for Infrastructure as Code
  • 5. Auditing, Compliance, and Policy Enforcement
  • 6. Change Control Processes and Best Practices
  • 7. Automated Configuration Generation and Deployment
  • 8. Configuration Management Tools (Ansible, Terraform, NETCONF)
  • 9. Best Practices and Common Pitfalls
  • 10. Case Studies
• Quiz (44 questions)
• Exercises (22 problems)
• Homework (18 assignments)
• Summary

Learning Objectives

After completing this extended tutorial, you should be able to:

• Define configuration management and explain its role in network operations.
• Describe the configuration lifecycle: planning, deployment, monitoring, and optimization.
• Design backup and archiving strategies for device configurations.
• Implement version control for network configurations using Git and related tools.
• Explain compliance auditing and the importance of configuration drift detection.
• Analyze change control processes (ITIL framework) and their application in networking.
• Automate configuration generation and deployment using IaC and tools like Ansible, Terraform, and NETCONF/RESTCONF.
• Evaluate configuration management tools and select appropriate ones for different environments.
• Apply best practices to avoid common configuration mistakes and ensure security.
• Analyze real‑world incidents caused by configuration errors and propose preventive measures.

Overview

Configuration management is the discipline of systematically handling the state of network devices — from initial deployment to ongoing maintenance, updates, and decommissioning. It ensures that devices are in a known, consistent, and compliant state, and that changes are tracked, reviewed, and reversible. This tutorial provides a comprehensive, in‑depth exploration of configuration management and change control, covering the full lifecycle: planning, deployment, monitoring, auditing, and optimization.

We start with the fundamentals: why configuration management is critical for reliability and security. Then we dive into specific practices: configuration backup (automated retrieval and archiving), version control (using Git for network configurations), and compliance auditing (detecting drift and policy violations). The change control process — including request, review, approval, implementation, and rollback — is detailed within the ITIL and DevOps context. We explore automation: using infrastructure‑as‑code (IaC) tools like Ansible and Terraform, and leveraging NETCONF/RESTCONF with YANG for programmable configuration. Best practices, common pitfalls, and case studies are provided to ground the theory in real‑world operations.

Technical and Theoretical Content

1. Introduction to Configuration Management

Configuration management (CM) encompasses the processes, tools, and practices used to manage the configuration of network devices. Its key goals:

• Consistency: All devices in a similar role share the same baseline configuration.
• Traceability: Every change is logged with who, when, and why.
• Auditability: Configurations can be reviewed for compliance with policies.
• Recoverability: Rollback to a known good state is possible after failed changes.
• Automation: Reducing manual errors and speeding up deployments.

Configuration management is a core part of the FCAPS framework (Configuration Management). It interacts with other areas: fault management (errors often due to misconfigurations), performance (optimizing parameters), and security (ensuring secure settings).

2. Configuration Lifecycle Management

The configuration lifecycle (adapted from ITIL) includes:

1. Planning and Design: Define desired state, choose templates, and version schemas.
2. Deployment/Provisioning: Apply initial configuration to new devices.
3. Operation: Monitor configurations, detect drift, and handle changes.
4. Change Management: Formal process for modifications.
5. Retirement: Remove configurations for decommissioned devices.

The lifecycle is continuous: monitoring feeds back into planning, and changes are documented and versioned.

3. Configuration Backup and Archiving

Regular backups of device configurations are essential. Strategies:

• Automated retrieval: Use scripts or tools (RANCID, oxidized) to fetch configurations via SSH/Telnet.
• Versioned storage: Store each backup with a timestamp in a repository.
• Archiving: Retain historical backups for compliance (e.g., 1 year).
• Comparison: Diff tools to highlight changes between versions.
• Restoration: Ability to push a backed‑up config to a device.

Backup frequency should match change frequency: daily for stable networks, after each change for dynamic environments.

4. Version Control for Infrastructure as Code

Treating network configurations as code (IaC) enables modern DevOps practices:

• Git repositories: Store configurations, templates, and scripts.
• Branching: Isolate changes for different environments (dev, test, prod).
• Pull requests: Review changes before merging.
• Commit hooks: Validate syntax, run linters, or trigger deployment pipelines.
• Change history: Full audit trail with blame and revert capability.

This practice is foundational for network automation and aligns with infrastructure‑as‑code (IaC) methodologies used in cloud and on‑prem environments.

5. Auditing, Compliance, and Policy Enforcement

Configuration auditing ensures devices adhere to security and operational policies. Key aspects:

• Policy definition: Specify required settings (e.g., enable SSH v2, disable default passwords).
• Drift detection: Compare current configurations against the desired state (baseline).
• Compliance scoring: Evaluate and report on policy adherence.
• Remediation: Automatically correct drift or alert operators.

Tools like Ansible (with compliance modules), Chef InSpec, or vendor‑specific solutions (Cisco DNA Center) help automate auditing.

6. Change Control Processes and Best Practices

Change control is the formal process for managing modifications to the network. Based on ITIL, the process includes:

• Request: Submit a change request (CR) with justification, impact analysis, and implementation plan.
• Review: Technical review by subject matter experts.
• Approval: Change Advisory Board (CAB) or designated approvers.
• Scheduling: Plan during maintenance windows.
• Implementation: Apply the change with rollback readiness.
• Verification: Test and validate functionality.
• Closure: Update documentation and close CR.
• Post‑implementation review: Evaluate success and learn.

In agile/automated environments, changes may be more frequent; approval processes may be streamlined with automated testing and gradual rollout (canary deployments).

7. Automated Configuration Generation and Deployment

Automation reduces manual errors and speeds deployments:

• Templating: Use Jinja2 or similar to generate device‑specific configs from a set of variables.
• Push vs. Pull: Push models (e.g., Ansible) push configs to devices; pull models (e.g., device retrieves from a server) are less common.
• Orchestration: Coordinate multi‑device changes (e.g., upgrades, ACL updates).
• Integration: Combine with CI/CD pipelines for continuous deployment.

Protocols: NETCONF and RESTCONF enable programmatic configuration using YANG models, with transactional and candidate configurations.

8. Configuration Management Tools (Ansible, Terraform, NETCONF)

• Ansible: Agentless automation using SSH, modules for network devices (e.g., ios_config, nxos_config).
• Terraform: Infrastructure as Code for cloud, but also supports network devices via providers (e.g., Cisco IOS, Juniper).
• NETCONF/RESTCONF: Standardized protocols using YANG; provide transactional changes, candidate configurations, and rollback.
• RANCID/oxidized: Backup and version control for legacy device configurations.
• NMS integrated: Many NMS platforms include config management modules (SolarWinds, HP Network Automation).

Choice depends on environment (cloud vs. on‑prem), device types, and team skills.

9. Best Practices and Common Pitfalls

• Documentation: Maintain templates, variable definitions, and topology maps.
• Testing: Validate configs in staging before production.
• Rollback plans: Always have a known‑good config ready to revert.
• Segregation of duties: Separate approval and implementation roles.
• Regular reviews: Periodic audits and cleanup of stale configs.
• Monitor change impact: Use performance and fault metrics to detect negative effects.
• Avoid hard‑coded values: Use variables and templates for flexibility.
• Common pitfalls: Untested changes, lack of rollback, no change logging, and drift.

10. Case Studies

• Case 1 – Accidental configuration wipe: An engineer mistakenly overwrites the startup config on a core router. Without a backup, the network experiences an outage for 2 hours. Prevention: automated backups and change approval.
• Case 2 – Drift detection: A security policy mandates SSH version 2. Over time, some devices revert to SSHv1 due to manual changes. A compliance scan detects the drift and automatically reapplies the correct setting.
• Case 3 – Automated ACL update: A new subnet is added. Using Ansible, the ACLs on all firewalls are updated, verified, and the change is committed with a Git commit and peer review.

Quiz (44 Questions)

All answers are hidden; click Show Answer to reveal.

Exercises (22 Applied Problems)

Sample solutions are hidden – click to reveal.

- name: Apply ACL
  hosts: routers
  tasks:
    - name: Push ACL config
      ios_config:
        lines:
          - ip access-list extended 101
          - permit ip any any
        before: "no ip access-list extended 101"
      register: result
    - name: Rollback if failed
      fail:
        msg: "Rollback needed"
      when: result.failed
    - name: Backup before change
      ios_config:
        backup: yes
            

import netmiko
import yaml
import datetime
with open('devices.yml') as f:
    devices = yaml.safe_load(f)
timestamp = datetime.datetime.now().strftime('%Y%m%d_%H%M')
for device in devices:
    conn = netmiko.ConnectHandler(**device)
    output = conn.send_command('show running-config')
    with open(f'backups/{device["host"]}_{timestamp}.cfg', 'w') as f:
        f.write(output)
            

container interfaces {
    list interface {
        key "name";
        leaf name { type string; }
        leaf enabled { type boolean; default true; }
        leaf description { type string; }
    }
}
            

Homework (18 In‑Depth Assignments)

Sample answers are hidden; use them to guide your study.

Summary

This extended tutorial has provided a comprehensive exploration of configuration management and change control. We covered the fundamentals: the importance of consistency, traceability, and auditability. We examined the configuration lifecycle, backup strategies, version control with Git, compliance auditing, and the formal change control process. Automation using Infrastructure as Code (IaC) tools like Ansible and Terraform, and standard protocols like NETCONF, was discussed in detail. Best practices and common pitfalls were highlighted, and case studies illustrated real‑world applications.

Effective configuration management is foundational to reliable, secure, and agile network operations. It reduces downtime, speeds up troubleshooting, and enables the automation required for modern networks. The quiz, exercises, and homework assignments are designed to reinforce both theoretical understanding and practical skills.

In the next tutorial, we will explore Network Automation, NETCONF, RESTCONF, and APIs, diving deeper into the programmatic interfaces that underpin modern network management.