Network Security and Automation
Security and automation in the SRA Composite exam cover SR OS hardening, control-plane protection, model-driven management, and automated service delivery. Questions test operational safety: who can reach the router, what traffic reaches the CPM, and how changes are validated.
Hardening and automation rules
- Apply CPM filters to restrict management protocols; use SSH, disable Telnet, and authenticate with TACACS+ or RADIUS.
- Use uRPF and ACLs on subscriber and core interfaces to reduce spoofing.
- MD-CLI uses a candidate configuration with commit; compare and rollback before committing.
- YANG models, gNMI, and telemetry enable automation; NSP can orchestrate services.
- Use apply-groups and templates to avoid inconsistent per-node configuration.
Worked example
A management VLAN must be reachable only from 10.0.0.0/24. Create a CPM ACL permitting that prefix to SSH and SNMP, deny other management access, and apply it to the CPM. Verify with a show command and a login test from an out-of-prefix host. The reasoning: router ACLs on data ports do not protect the CPM; CPM filters do.
Traps
Do not apply a data-plane ACL and assume it protects management. Do not commit without a compare and rollback plan. Do not leave default community strings or unauthenticated telemetry.