How to be notified when you Cisco router configuration has changed

[LEFT][CODE]http://www.petri.co.il/notified-cisco-router-configuration-change.htm[/CODE]Traditionally, to be notified if your Cisco router configuration has changed, you had to use a configuration management and monitoring tool like [URL="http://tripwire.com/"] Tripwire[/URL]. Applications like that have their use but if you just want a simple email when someone modifies your Cisco router configuration, there is a much easier route.

[B]Using SNMP to alert your NMS of Cisco IOS configuration changes[/B]

To get alerted whenever someone changes your Cisco IOS router configuration, all it takes is a few simple commands. These commands alert your network management system (NMS) of this and your NMS must alert you, or your group, in some form (cell, email, SMS, or whatever).
First, your Cisco router will need to be configured to point to your NMS. To do this, enter this command:

[B]Router(config)# snmp-server host x.x.x.x {community string} [/B]

The x.x.x.x is the IP address of your NMS. The community string, configured for this device, on your NMS, and the router must match.
If you don't yet have a NMS, stay tuned for the section section of this article and you can come back to the step above.
Next, you need to tell the router what you want it to alert you about. In our case, we want to be alerted to router configuration changes so we use the "trap config" option, like this:

[B]Router(config)# snmp-server enable traps config [/B]

For more information on how to configure these SNMP management traps, see this link: [URL="http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml"]Cisco IOS SNMP Traps Supported and How to Configure them[/URL].
[B]Configuring your SNMP Network Management Station (NMS)[/B]

So now that your Cisco router is sending your NMS an alert that the configuration has changed, the NMS needs to alert you of that somehow. The point of the NMS is to be the "middle man" and be the place where you dispatch all these alert to various individuals or groups and through various methods like email, SMS, pager, or cell.
As there are so many different NMS options available. I cannot begin to tell you how to configure the one that you already have in place to do this. If you don't have a NMS yet, I recommend either Whatsup or OpenNMS. Whatsup is relatively inexpensive compared to a large enterprise NMS like HP Openview and you can get a free demo of Whatsup. OpenNMS is free but not quite as intuitive as Whatsup. Still, OpenNMS is a fully capable network management station. I recommend starting with either the [URL="http://www.ipswitch.com/products/whatsup/index.asp"] Whatsup[/URL] demo or the [URL="http://www.opennms.org/"]OpenNMS[/URL] virtual appliance for VMware Player (virtual appliances are available at the [URL="http://www.vmware.com/appliances/"]VMware Virtual Appliance Marketplace[/URL]). Either one will allow you to configure your NMS to alert you when your router's configuration has changed.
Here is the basic action I setup inside Whatsup to tell it what to do when it received an SNMP trap for a configuration change from this particular router:

[URL="http://ad.doubleclick.net/click;h=v8/393e/0/0/%2a/i;44306;0-0;0;43710412;3823-300/100;0/0/0;u=,ns-19444741_1265918424,116e203c778f34e,it_internet_webdev,;%7Eaopt=2/0/ff/1;%7Esscs=%3f"][IMG]http://s0.2mdn.net/viewad/817-grey.gif[/IMG][/URL] [URL="http://ad4.netshelter.net/jump/ns.petri/bieb;kw=;tile=2;sz=300x100;ord=123456789?"][IMG]http://ad4.netshelter.net/ad/ns.petri/bieb;kw=;tile=2;sz=300x100;ord=123456789?[/IMG][/URL] [URL="http://www.petri.co.il/images/notified-cisco-router-changes-01.jpg"][IMG]http://www.petri.co.il/images/notified-cisco-router-changes-01.jpg[/IMG][/URL]

Once I had this all setup and working, if I logged into my router did a [B]config terminal[/B], when into global configuration mode, then exited, I would get an email from my Whatsup NMS that my configuration had changed, like this:

[IMG]http://www.petri.co.il/images/notified-cisco-router-changes-02.jpg[/IMG]
[B]Cisco IOS new feature: Configuration Change Notification and Logging[/B]

If you want to take this a step further, you can actually log every command that is entered on the router and then be notified of those command changes. This is a new feature in the Cisco IOS, beginning with IOS 12.2(25)S and 12.3(4)T. This method uses the [B]archive[/B] logging feature and you can view all commands performed on the router with the [B]show archive log config[/B] command. It will even record the username of the logged in user who entered that command.
For more information on how you can record all router configuration commands, see [URL="http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080454f73.html"]this link[/URL].
There is a long list of optional SNMP traps that can be sent. I highly recommend that you use the [URL="http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml#trps"] snmp-server enable traps[/URL] command to tweak your router to alert your NMS of only the traps that you want to be informed of. If you just use this command by itself, you will get alerted via SNMP of just about every possible event on the router.
Here are some of the more common traps that I have configured:

[LIST][*][B]bgp[/B] - sends notification for BGP state changes[*][B]envmon[/B] - sends notifications if the router has an environmental monitoring issue like a power supply has gone out or the router is overheating[*][B]snmp[/B] - to be notified of router reboots, linkup, linkdown, or SNMP authentication failures[/LIST]
You can find many more at this URL: [URL="http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml#trps"]snmp-server enable traps[/URL]
Summary
If you didn't yet have a NMS, you will certainly need it for other network management functions as your network grows so you might as well implement one now. If you want full scale configuration monitoring and alerting, I suggest either the new Cisco feature or try out the free [URL="http://sourceforge.net/projects/tripwire/"]open-source version of Tripwire[/URL] that runs on Linux. In conclusion, being notified of configuration changes on your router helps you to know what is going on and it helps to keep your network more secure. I suggest you give it a try today
[/LEFT]