Network Devices

Secure HPE Aruba Networking AOS-CX with cnspec

Scan HPE Aruba Networking AOS-CX switches against security and compliance best practices with cnspec.

Scan your HPE Aruba Networking AOS-CX switches to find security risks before they become incidents. cnspec connects to a switch through the AOS-CX REST API and evaluates local users and the password policy, AAA and its RADIUS and TACACS+ servers, management services such as SSH, HTTPS, SNMP, NTP, and syslog, certificates, firmware, and the interfaces, VLANs, and VRFs configured on the switch.

AOS-CX is one of the network devices cnspec can assess. For the full list of supported devices, see the network device scanning overview. New to cnspec? Start with the quickstart.

The AOS-CX resources are experimental. Field names and behavior can change in a future cnspec release.

Supported products

cnspec supports AOS-CX switches running firmware 10.09 or later:

  • CX 4100i, 6000, 6100, 6200, 6300, 6400, 8100, 8320, 8325, 8360, 8400, 9300, and 10000 series switches
  • The AOS-CX Switch Simulator

cnspec scans one switch per connection. A VSF stack counts as one switch. VSX peers are not discovered automatically, so scan each peer separately.

AOS-S (ProCurve) switches, AOS 8 controllers, and HPE Aruba Networking Central use different APIs and are not supported by this provider.

Prerequisites

To scan an AOS-CX switch with cnspec, you must have:

  • cnspec installed on your workstation
  • Network access to the switch's REST API (default port 443) on a VRF where the HTTPS server is enabled
  • A local account in the built-in operators group

Give cnspec access to your switch

cnspec reads from the switch and never changes its configuration. It requests only named attributes and never reads secret values such as user passwords, RADIUS and TACACS+ keys, SNMP communities, SNMPv3 pass phrases, NTP keys, or certificate private keys.

Create a read-only account

Only the built-in user groups can use the AOS-CX REST API; custom groups cannot. Create a dedicated account in the operators group, which can read the full configuration with sensitive values hidden. We also recommend putting the REST API in read-only mode. From the switch CLI, in configuration mode, run:

user mondoo group operators password plaintext YOUR_PASSWORD
https-server rest access-mode read-only
https-server vrf mgmt

The https-server vrf line enables the REST API on the VRF cnspec connects through. mgmt is the default; use the VRF that matches your management network.

If the account isn't allowed to read a setting, cnspec reports an access denied error for it. It never treats the setting as empty, so a check can't mistake missing evidence for an unconfigured feature.

Test your connection

Before running a full scan, verify that cnspec can connect by opening a cnspec shell. For SWITCH_HOST, substitute the hostname or IP address of the switch's management interface:

cnspec shell aoscx --hostname SWITCH_HOST --username mondoo --ask-pass

Switches ship with a self-signed certificate. To skip TLS certificate verification for a switch that still uses it:

cnspec shell aoscx --hostname SWITCH_HOST --username mondoo --ask-pass --insecure

If cnspec connects successfully and shows a prompt, you're ready to scan.

Connection options

OptionDescription
--hostnameHostname or IP address of the switch management interface (required)
--portREST API port (default: 443)
--usernameUsername for authentication (default: admin)
--password, -pPassword for authentication
--ask-passPrompt for the password
--insecure, -kSkip TLS certificate verification (for the factory self-signed certificate)

REST session limits

Each scan opens one REST session and logs out when the scan ends, including when it fails. AOS-CX allows 6 REST sessions per user and 48 per switch, so don't run more than a few scans at once with the same account.

A session that isn't logged out holds its slot until the idle timeout (20 minutes by default). If you hit the limit, close every open session from the switch CLI with https-server session close all. This also closes Web UI sessions.

Scanning more than one AOS-CX switch? Use an inventory file to define every switch and its credentials in one place, then scan them all with a single cnspec scan --inventory-file command.

Scan an AOS-CX switch

To scan a switch, use the cnspec scan command:

cnspec scan aoscx --hostname SWITCH_HOST --username mondoo --ask-pass

When the scan completes, cnspec prints a pass or fail result for each check and an overall risk score. To output results in other formats such as JSON, JUnit, or SARIF, read Report Results.

You can write your own policies to check your AOS-CX switches against the controls that matter to your organization.

Example checks

You can interactively explore and test checks using the cnspec shell. To open a shell connected to your switch:

cnspec shell aoscx --hostname SWITCH_HOST --username mondoo --ask-pass

Below are some example queries and checks you can run from the shell.

Retrieve the switch details

cnspec> aoscx.system { hostname platformName softwareVersion }

Ensure the running configuration is saved to the startup configuration

cnspec> aoscx.runningConfig.savedToStartup == true

Ensure the primary and secondary firmware images match

cnspec> aoscx.firmware.primaryMatchesSecondary == true

Ensure the password policy requires at least 12 characters

cnspec> aoscx.passwordPolicy { enabled == true minimumLength >= 12 }

Ensure Telnet is disabled on every VRF

cnspec> aoscx.telnet.enabledVrfs.length == 0

Ensure SSH password authentication is disabled

cnspec> aoscx.sshServer.passwordAuthEnabled == false

Ensure the REST API is read-only

cnspec> aoscx.httpsServer.restAccessMode == "read-only"

Ensure TLS 1.2 or later is required

cnspec> aoscx.tls.minVersion == /^tls1\.[23]$/

Ensure SNMPv3 users encrypt traffic with AES

cnspec> aoscx.snmp.v3Users.all(privProtocol == "aes")

Ensure NTP authentication is enabled

cnspec> aoscx.ntp.authenticationEnabled == true

List users and their groups

cnspec> aoscx.users { name group.name origin }

Find certificates that expire in the next 30 days

cnspec> aoscx.certificates.where(notAfter < time.now + 30 * time.day) { name subject notAfter }
cnspec> aoscx.interfaces.where(adminState == "up" && linkState == "down") { name description }

Learn more

Juniper Junos OS

Scan Juniper Networks devices running Junos OS against security and compliance best practices with cnspec.

Fortinet FortiOS

Scan Fortinet FortiGate firewalls running FortiOS against security and compliance best practices with cnspec.

On this page

Supported productsPrerequisitesGive cnspec access to your switchCreate a read-only accountTest your connectionConnection optionsREST session limitsScan an AOS-CX switchExample checksRetrieve the switch detailsEnsure the running configuration is saved to the startup configurationEnsure the primary and secondary firmware images matchEnsure the password policy requires at least 12 charactersEnsure Telnet is disabled on every VRFEnsure SSH password authentication is disabledEnsure the REST API is read-onlyEnsure TLS 1.2 or later is requiredEnsure SNMPv3 users encrypt traffic with AESEnsure NTP authentication is enabledList users and their groupsFind certificates that expire in the next 30 daysList interfaces that are administratively up but have no linkLearn more