The discovery accounts get locked out .

[Hazik]

We are experiencing frequent account lockouts during Discovery because Discovery attempts multiple credentials before reaching the correct one.

Example:

Device:

• IP: 172.xx.x.xx
• Hostname: xxxxxxx.servereps.local
• DNS Domain: servereps.local

Discovery attempts the following credentials in order:

1. Linux Account
2. CP_Alpharetta_SSH_01
3. dctreg AD account
4. HT_RW_Windows_servereps (correct credential)
5. Dctseg AD SSH Credential
6. saas
7. Linux_Local_Account
8. Linux Server_Alpharetta
9. servicenow
10. AD Account for Linux
11. Linux Local Account
12. CP_Alpharetta_SSH_02
13. CP_PCI_SSH

Because the first few attempts fail, the account gets locked before Discovery reaches the valid credential. As a result, no devices in this domain are discovered.

Is there an OOTB way to configure Discovery so that:

• Discovery selects credentials based on DNS domain, hostname pattern, IP range, or Classification.
• Only relevant credentials are attempted for devices in servereps.local.
• Credential testing order can be controlled to avoid account lockouts.

Has anyone implemented Credential Affinity or another approach to solve this at scale?

[Vijaya_Mnpram]

@Hazik Yes. You can use Credential Affinity.  In the Discovery, first time discover below using the right credentials, then automatically that credentials will be added as affinity. Next time, when you schedule, it will not try whole list but instead use the affinity one. 

• IP: 172.xx.x.xx
• Hostname: xxxxxxx.servereps.local
• DNS Domain: servereps.local

[Hazik]

This problem occurs when discovery schedule runs and a new device is tried to discover.
Discovery attempts credentials in order and if the correct credential is not attempted in first three tries, the account is locked out.

I tried using credential alias for discovery schedules. It worked for single domain, but the real scenario is discovery schedules contain a mix of IP ranges and domains, how do we configure that?

if there is any way to stop wrong credentials used for authentication, that'd help a lot!

[AJ_01]

Hi  @Hazik  ,

You could either of the following:

1. Utilize behaviour based discovery, that will limit the type of credentials used for that subnet

2. use credential affinity, and run one successful discovery run to lock that credential in for a particular device, but its good only for small batches.

3. Use Credential-alias , again there are challenges to limit the tries.

I would prefer the Behaviour based if there are no other complications. 

Please Accept the solution if it assisted you with your question & Mark this response as Helpful.

Regards.

[Hazik]

Hi @AJ_01 
could you please tell me how I would implement behavior-based discovery in my scenario