Drift and Reconcile for Security Settings

Drift is calculated by comparing the settings on the device and the global security settings as these settings are the user intended settings that must be available on the system. SSH server restarts whenever applicable.

Table 1. Drift Reconcile & Idempotency support
Identify Drift Reconcile configuration Idempotency
Yes Yes Yes
(efa:extreme)extreme@tpvm:/opt $ efa inventory drift-reconcile detail --uuid 3d073e9c-879f-4db7-9ab9-852c3f669d51
+--------------------------------+--------------------------------------+
|              NAME              |                VALUE                 |
+--------------------------------+--------------------------------------+
| UUID                           | 3d073e9c-879f-4db7-9ab9-852c3f669d51 |
+--------------------------------+--------------------------------------+
| Device IP                      | 10.x.x.x                             |
+--------------------------------+--------------------------------------+
| Status                         | success                              |
+--------------------------------+--------------------------------------+
| Execution Reason               | manual                               |
+--------------------------------+--------------------------------------+
| operation                      | drift-and-reconcile                  |
+--------------------------------+--------------------------------------+
| Inventory Status               | inventory-dr-success                 |
+--------------------------------+--------------------------------------+
| Is Inventory config Refreshed  | true                                 |
+--------------------------------+--------------------------------------+
| Inventory Duration             | 15.586983384s                        |
+--------------------------------+--------------------------------------+
| Fabric Status                  | fabric-dr-success                    |
+--------------------------------+--------------------------------------+
| Is Fabric config Refreshed     | false                                |
+--------------------------------+--------------------------------------+
| Fabric Duration                | 121.479233ms                         |
+--------------------------------+--------------------------------------+
| Policy Status                  | policy-dr-success                    |
+--------------------------------+--------------------------------------+
| Is Policy config Refreshed     | false                                |
+--------------------------------+--------------------------------------+
| Policy Duration                | 88.764104ms                          |
+--------------------------------+--------------------------------------+
| Tenant Status                  | tenant-dr-success                    |
+--------------------------------+--------------------------------------+
| Is Tenant config Refreshed     | false                                |
+--------------------------------+--------------------------------------+
| Tenant Duration                | 49.042052ms                          |
+--------------------------------+--------------------------------------+
| Device Update Count            | 2                                    |
+--------------------------------+--------------------------------------+
| Device Update Total Duration   | 2m34.074986291s                      |
+--------------------------------+--------------------------------------+
| Maintenance Mode Disable       |                                      |
| Duration                       |                                      |
+--------------------------------+--------------------------------------+
| Start Time                     | 2022-09-19 20:25:47 +0530 IST        |
+--------------------------------+--------------------------------------+
| Last Modified                  | 2022-09-19 20:29:16 +0530 IST        |
+--------------------------------+--------------------------------------+
| Duration                       | 3m29.931352961s                      |
+--------------------------------+--------------------------------------+


Inventory Service Response:
Config Drift: Device Secure Settings
+------------------------+---------------+--------------------------------+
|          NAME          |   APP STATE   |          CHILD CONFIG          |
+------------------------+---------------+--------------------------------+
| Device Secure Settings | cfg-refreshed | Secure Setting Max Password    |
|                        |               | Age                            |
+------------------------+---------------+--------------------------------+

Reconcile Status:
+-------------------+---------------+---------------+
|    CONFIG-TYPE    |   APP STATE   | ERROR-MESSAGE |
+-------------------+---------------+---------------+
| NtpAuthKey        | Not-Attempted |               |
| SnmpHost          | Not-Attempted |               |
| MMOnReboot        | Not-Attempted |               |
| InterfaceConfig   | Not-Attempted |               |
| SnmpUser          | Not-Attempted |               |
| DeviceTimezone    | Not-Attempted |               |
| ThresholdMonitor  | Not-Attempted |               |
| SecureSetting     | Success       |               |
| NtpDisable        | Not-Attempted |               |
| SnmpView          | Not-Attempted |               |
| SnmpGroup         | Not-Attempted |               |
| DeviceSetting     | Not-Attempted |               |
| NtpServer         | Not-Attempted |               |
| SnmpCommunity     | Not-Attempted |               |
| BreakoutInterface | Not-Attempted |               |
+-------------------+---------------+---------------+


Fabric Service Response:


Policy Service Response:


Tenant service Response:
--- Time Elapsed: 75.311491ms ---

The following table describes scenarios for the device secure settings:

Scenario Secure Settings Device Config
Fresh installation of XCO Enabled (Default) Applied on device registration
Fresh installation Disabled No settings are applied during registration
Upgrade from prior releases. Security hardening configuration is executed on the device with same configuration as the default settings in XCO. Enabled (Default) Device update will result in cfg-in-sync
Upgrade from prior releases. Security hardening configuration is executed on the device with different configuration than the default settings in XCO. Enabled (Default) Device update will result in cfg-refresh
Upgrade from prior releases. No security hardening configuration is executed on the device. Enabled (Default) Device update will result in cfg-refresh
Upgrade from prior releases Disabled Device update will result in cfg-in-sync