Mask configuration fails to ignore encrypted private key changes in NCM: Spectrum

Products

• Network Observability
• Spectrum

Issue/Introduction

Spectrum Network Configuration Manager (NCM) flags configuration changes on Fortinet or similar devices when encrypted private keys or certificates are re-hashed during captures. Despite using valid multiline regular expressions, NCM identifies these blocks as changes.

Environment

• DX NetOps Spectrum 23.3 and earlier
• Network Configuration Manager (NCM)
• Fortinet devices (or any device with changing Base64 key blocks)

Cause

Spectrum NCM comparison masks are applied on a line-by-line basis during the getDiff process. NCM does not support multiline or block-level regex matching. Therefore, a regex intended to match a block from a start tag to an end tag will fail to mask the individual lines within that block.

Resolution

To ignore the changing lines within a private key or certificate block, use a regex that identifies the specific character patterns found on each individual line.

1. Log in to the OneClick Console.
2. Navigate to the Explorer tab and select Information > Network Configuration Manager.
3. Select Mask Configuration.
4. Add the following regex to the Comparison Mask list to match individual Base64 lines: ^[A-Za-z0-9+/]{20,}={0,2}$
5. Click OK.
6. Run a manual capture on the affected device to verify that the changes are now ignored as "uninteresting."