Monitoring Config Changes

Hi,

please check this: https://community.sophos.com/sophos-xg-firewall/f/discussions/130686/cli---which-settings-are-changed

I too would love to know what people do about this. For our Cisco equipment we have a great program called Cattools that on a regular interval, or on demand, login to the equipment, take a dump of the existing running config and compare it against the last config saved on our server. It then emails us if there are any changes, including a text file with just the lines that have changed, and an html side by side comparison of the full config with all the changed lines highlighted. It then saves the new config to our server and archives the old config and the changes files.

It's great both as a security tool to look out for any unauthorised changes and to review changes after they have been made. Would love something that allowed us to keep track of XG changes in a similar manner.

Thank you @lherzog for your quick reply and @JasP for the followup...

  @LHezog Interesting pull from the backup option.  I was hoping more for simply a list of the configs in play instead of running all of the of the show commands, but if that's what it is - so be it.

  @JasP That's close to what I was looking for as well.  Appreciate the add on to the conversation.  

Dennis

I'm certainly no expert on this but just about all the config seems present in the entities.xml file of a config export. I know next to nothing about XML but could this extraction mechanism and appropriate formatting of this file be the basis for a test based config file? Or am I just talking rubbish?!

@JasP OK, and that's from the same manual backup yes?  Though. not a self proclaimed 'expert' you're coming up with good info - TY!

It's not from a backup, it's from an export (same page, different option). I needed it once to transfer a config from one XG to another that wasn't a supported option for backup/restore. It doesn't contain some of the sensitive stuff like passwords (the export file is not encrypted or protected in any way) but I found it transferred most of the config. I did a bit of poking around in the export file at the time and found it was all in an xml file as described.

Thank you again!

  I was hoping it would be something I could automate easily.  i.e. programmatically ssh in, pull down the config, check for differences to a previously saved config, repeat.  

Thank you,

Dennis

Again, this is not an area I have any experience with but their is an API which can be accessed via the CLI and which, on a few minutes of browsing seem to allow you to read (and write) the system config.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/API.html

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/APIUsingAPI.html

https://docs.sophos.com/nsg/sophos-firewall/18.5/API/index.html

@JasP Much appreciated!  I'm working with our team to see if that's something we can implement.  TY!

i want basic configuration