Struggling with network SNMP discovery - ID on class/serial number

cyked · ‎04-21-2016

We are starting to get more traction from the infrastructure teams in managing their inventory solely in CMDB and define/follow an inventory process. On the network side I've had to create some SNMP classifiers and OID entries to properly classify models on discovery. The issue I'm having is when serial number becomes available during discovery. I'm able to skate by in a sense, adding and OID for classification when needed, but not familiar enough with SNMP from a discovery standpoint to ensure Serial Number is returned from a device to be used during identification. In some cases i've resorted to writing a probe and sensor to populate SN on a CI, but this happens after identification.

This means identification happens on CI name and Class Name because serial number is not yet "known". This is a problem because normally the asset process works by having a CI created on the target table (network gear, IP router, etc) when an asset is received and loaded where we know class, model, and serial number (so the name of the CI is populated as the model ID). When discovery occurs a match on the table can be found by class and serial number.

What am I missing? Thanks!

cyked · ‎04-22-2016

The OIDs from the device (looking at XML payload after an unsuccessfuly classification discovery) and the one provided by the MIB and the network team I've added to the SNMP classifiers for switch and router and disabled the stand alone one I created.

1.3.6.1.4.1.14823.1.1.32 and 1.3.6.1.4.1.14823.2.2.1.1.1.2. I think its the second one that is working on the router classifier, but need to test some more and remove unneeded entries.

I updated the script for SnmpIdentityInfoParser as well and it works given serial is populated. otherwise it will populate serial and will match and ID on subsequent discoveries.

this.addSerial('aruba',snmp.getOIDText('iso.org.dod.internet.private.enterprises.unk_14823.unk_2.unk_2.unk_1.unk_1.unk_1.unk_12'));

Thanks!!

View solution in original post

Alex Pandian1 · ‎02-13-2019

Hi,

I am struggling similar kind of issue. May i know how did you find the MIB and SNMBwalk for serial number.

cyked · ‎02-13-2019

Google, sometimes they are publicly available. If not, ask the hardware owning team for the MIB for the devices. They should be able to get them from the manufacturer. Install a MIB browser on your machine and you can look through the MIB and see what all the OIDs do and also find the OID that returns the device SN.

ggarcia1 · ‎02-13-2019

In addition, ask your network team if they use anything like HP NNMi or SolarWinds or something to track/manage their devices. It's likely they have a MIB library already, whether they know it or not.

Our guys use NNMi and after I got over the learning curve and knew what a MIB/OID was, then I knew what to ask them for; they understood right away and I was good to go.

cyked · ‎10-03-2016

Another question. We have some security devices that have a single OID to get model, so I have a classifier, probe, OID set (serial number and model) and a sensor. I updated SnmpIdentityInfoParser in the same manner, but identification still happens on Name and Class instead of Class and serial.

Given this is a custom classifier and probe is there something i'm inherently missing that exists for my Aruba setup because its nested in standard network router/switch/

cyked · ‎10-14-2016

I figured it out. You have to add an OID walk entry for the fireye serial number to 'SNMP - Identity Info' probe.