eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
If Alterpoint Inc.s DeviceAuthority Suite, Rendition Networks Inc.s TrueControl 3.0 and Tripwire Inc.s Tripwire for Network Devices 3.0 are any indication, the latest wave of tools for managing network device configuration will help IT managers cut operational costs and smooth audits to meet security requirements.
Click here to read the full review of TND 3.0.
2
If Alterpoint Inc.s DeviceAuthority Suite, Rendition Networks Inc.s TrueControl 3.0 and Tripwire Inc.s Tripwire for Network Devices 3.0 are any indication, the latest wave of tools for managing network device configuration will help IT managers cut operational costs and smooth audits to meet security requirements.
eWEEK Labs tests showed that each of these products will more effectively manage a multivendor network than would a collection of single-vendor management tools. As recently as last year, vendor tools such as Cisco Systems Inc.s Cisco Works provided greater configuration control than any of the products in this review. But this is no longer the case.
The three software-based tools we tested use ordinary network protocols, including Trivial File Transport Protocol, to retrieve a copy of the current configuration of network devices, including routers, switches, firewalls, VPN concentrators and load balancers. The major appeal of these products is that they can corral many brands and types of products into one administrative console. In our tests, we found some platforms that werent supported by any of the tools, such as a WatchGuard Technologies Inc. Firebox V80 firewall. Nevertheless, all three packages made it easy to request support for an unlisted product.
All three products support a wide range of Cisco network equipment, but support for non-Cisco gear isnt as comprehensive.
Configuration management tools should be judged on three features: real-time configuration tracking, logging when changes were made and by whom, and integration with authentication systems.
Its also worth noting that any of these network management tools could assist IT managers who must provide records to security auditors checking for compliance with the rules of the Sarbanes-Oxley Act of 2002 regarding verifiable change process and control. This is because all three tools we tested can integrate with authentication, authorization and accounting services running on Remote Authentication Dial-In User service or TACACS+ servers.
Each product has different feature strengths. We liked Tripwire TND 3.0s ability to create a base-line configuration that allowed us to revert to an approved setting, regardless of the number of changes we made. The other products made us step back to the last good configuration.
Hierarchical device assignment capabilities made TrueControl (see review) the most flexible of the products in terms of setting up administrative groups, but we think the company made fundamentally clumsy choices about user interface development that will make this product more difficult to use than other network configuration tools.
TrueControls tedious rules, actions and node definitions made it the hardest to learn and the hardest to use of all the products we tested.
In addition, as much as we admire TrueControls policy assurance manager and patch features, we cant see why the product costs double the other products: $19,995 to manage 50 nodes. AlterPoints DeviceAuthority Suite (see review) starts at $19,950 for 100 devices, and Tripwires TND 3.0 costs $19,900 for 100 devices. DeviceAuthority Suite and TrueControl 3.0 shipped last month; Tripwire shipped this month.
TND 3.0
Tripwires TND 3.0 uses a base-line configuration to establish an approved configuration for a network device, much like TrueControls policy assurance manager. The key advantage of TND 3.0 is that IT managers can roll back a network device to the approved base line or step back through changes. This kind of flexibility is especially important for organizations that are implementing VOIP or other network-based technologies, such as wireless networking, where getting a working configuration may depend on making a substantial number of adjustments to device parameters such as QOS (quality-of-service) settings.
VOIP and wireless traffic bring QOS and security configuration requirements that require a flexible approach to matching corporate-approved configurations with location-specific needs, especially in branch offices. TND 3.0 should work well in organizations with growing networks that are adding new services.
As with DeviceAuthority Suite, we were able to associate configuration changes with users based on information from our log server. In this version of TND, we could quickly remediate all devices—for example, our Cisco routers—to a known and functioning configuration with just a couple of mouse clicks.
After making sure that all our devices were running the approved configuration, we used the new integration with Hewlett-Packard Co.s OpenView Network Node Manager. When we made a change to the configuration, TND 3.0 received an SNMP trap that launched a real-time check of the configuration of the router. The user interface made it easy to see changes, and we could drill down on device icons to see which element had changed—for example, the running config or the startup config.
Unlike the previous version of the product, TND 3.0 put configuration changes in a contextual difference file. Instead of downloading the devices entire configuration file, which can be quite large, especially on some Unix-based machines, this file shows only the section of the configuration that has changed.
Although TND 3.0 was easy to use, we often felt as if we had to click around to dig out the relevant information. This slowed our identification of some configuration problems in the test network and is an area that we hope Tripwire improves on in the next version.
Senior Analyst Cameron Sturdevant can be reached at [email protected].