question Struggling with network SNMP discovery - ID on class/serial number in ITOM forum

Struggling with network SNMP discovery - ID on class/serial number

cyked — Thu, 21 Apr 2016 17:05:05 GMT

We are starting to get more traction from the infrastructure teams in managing their inventory solely in CMDB and define/follow an inventory process. On the network side I've had to create some SNMP classifiers and OID entries to properly classify models on discovery. The issue I'm having is when serial number becomes available during discovery. I'm able to skate by in a sense, adding and OID for classification when needed, but not familiar enough with SNMP from a discovery standpoint to ensure Serial Number is returned from a device to be used during identification. In some cases i've resorted to writing a probe and sensor to populate SN on a CI, but this happens after identification.

This means identification happens on CI name and Class Name because serial number is not yet "known". This is a problem because normally the asset process works by having a CI created on the target table (network gear, IP router, etc) when an asset is received and loaded where we know class, model, and serial number (so the name of the CI is populated as the model ID). When discovery occurs a match on the table can be found by class and serial number.

What am I missing? Thanks!

Re: Struggling with network SNMP discovery - ID on class/serial number

A Westervelt — Thu, 21 Apr 2016 20:41:09 GMT

I've added our network appliances' serial identifiers to the SNMP - Identity probe/sensor to handle these scenarios.

As example, we have Infoblox appliances in our enterprise and I had to go out and find the SNMP string 'iso.org.dod.internet.private.enterprises.infoblox.ibSNMP.ibProduct.ibOne.ibPlatformOne.ibPlatformModule.ibSerialNumber' and define it in the probe and sensor to add the serial numbers to the Serial Number table, which in turn solves the Identification phase.

Check out the SnmpIdentityInfoParser script that handles this and note how the addSerial function is being used for other device types.

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Thu, 21 Apr 2016 22:25:56 GMT

Are you talking about the SNMP - Identity multiprobe which triggers the SNMP - Identity Info probe? SNMP - Identity probe has a sensor to process the info, and SNMP - Identity Info contains the SNMP OIDs. Given the MIB I have I'd add the below to the SNMP - Identity Info probe.

Also... SNMP - Identity Info is listed as Stage = Explore. does that matter?

We have some Aruba devices, so should I add this this to SNMP Identity Info:

iso.org.dod.internet.private.enterprises.aruba.arubaEnterpriseMibModules.switch.wlsxEnterpriseMibModules.wlsxSwitchMIB.wlsxSystemXGroup.wlsxSwitchLicenseSerialNumber

this is all that is in the OotB sensor:

//The ID sensor is an implementation of the multi sensor. In the related list "Responds to Probes", the script will be processed first.

new DiscoveryIDSensor({

       //

       // this sensor uses the common script include class "DiscoveryIDSensor"

       //

       type: "SNMP Identity"

});

Re: Struggling with network SNMP discovery - ID on class/serial number

A Westervelt — Fri, 22 Apr 2016 14:59:29 GMT

Since Aruba products are mostly network switches and routers, you should just associate the product OIDs to the existing Standard Network Switch and Router classifiers. The Identity probe will already be sent to Identification stage.

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Fri, 22 Apr 2016 16:58:09 GMT

The OIDs from the device (looking at XML payload after an unsuccessfuly classification discovery) and the one provided by the MIB and the network team I've added to the SNMP classifiers for switch and router and disabled the stand alone one I created.

1.3.6.1.4.1.14823.1.1.32 and 1.3.6.1.4.1.14823.2.2.1.1.1.2. I think its the second one that is working on the router classifier, but need to test some more and remove unneeded entries.

I updated the script for SnmpIdentityInfoParser as well and it works given serial is populated. otherwise it will populate serial and will match and ID on subsequent discoveries.

this.addSerial('aruba',snmp.getOIDText('iso.org.dod.internet.private.enterprises.unk_14823.unk_2.unk_2.unk_1.unk_1.unk_1.unk_12'));

Thanks!!

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Mon, 03 Oct 2016 21:02:32 GMT

Another question. We have some security devices that have a single OID to get model, so I have a classifier, probe, OID set (serial number and model) and a sensor. I updated SnmpIdentityInfoParser in the same manner, but identification still happens on Name and Class instead of Class and serial.

Given this is a custom classifier and probe is there something i'm inherently missing that exists for my Aruba setup because its nested in standard network router/switch/

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Fri, 14 Oct 2016 17:22:37 GMT

I figured it out. You have to add an OID walk entry for the fireye serial number to 'SNMP - Identity Info' probe.

Re: Struggling with network SNMP discovery - ID on class/serial number

ggarcia1 — Tue, 12 Feb 2019 21:29:27 GMT

hello

i'm trying to get serial number to return for BlueCoats

I've updated SNMP - Identify Info probe with a walk

iso.org.dod.internet.private.enterprises.blueCoat.blueCoatMgmt.bluecoatSGProxyMIB.sgProxyConfig.sgProxySerialNumber

I've updated SnmpIdentityInfoParser with

// GGarcia 2-12-19 check for BlueCoat Serial Number...
this.addSerial('blueCoatProxy', snmp.getOIDText('iso.org.dod.internet.private.enterprises.blueCoat.blueCoatMgmt.bluecoatSGProxyMIB.sgProxyConfig.sgProxySerialNumber'));

I've validated via snmpget that this value is populated on my test bluecoat device.

First, I cannot see how to validate that the probe is even asking the new question with the walk.

Second, every discovery I've run on this device returns a "skipped identifier" for the serial number check.

Any suggestions or missing elements?

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Tue, 12 Feb 2019 21:51:13 GMT

Here's the steps.

Create a probe with:
1. probe type = SNMP Probe
2. stage = Explore
3. topic = SNMP
4. ecc queue = SNMP - Bluecoat or something similar
5. in the SNMP fields related list, enter the OIDs you want to walk (e.g. the one to return the serial numbers from classified Bluecoat devices)
6. add a multisensor script like below, as an example this is the code to get the SN back from a fireeye appliance
```
function(result, ciData, debug, sensor) {
	var Serial = 'iso.org.dod.internet.private.enterprises.fireeye.feCommon.feSystem.feSystemInfo.feSerialNumber';
	var idutil = new IDSensorUtil();
	var serialNumber = idutil.calculateSnmpSerialNumber(result, Serial, null, 'SNMP - fireeye');
	idutil.addToSerialNumberTable(serialNumber, ciData);
}
```
Create a new multiprobe
1. Name = whatever you want
2. probe type = multiProbe
3. ecc queue topic = multiprobe
4. ecc queue name = SNMP - Bluecoat or something similar
5. in the includes probes related list ad your probe above + SNMP - Identity Info
6. add a sensor with script = new DiscoveryIDSensor({});

these probes/scripts should be what you need to pass the SN from the SNMP probe to the out of the box identity engine so match will happen on serial number instead something else.

Note, in the probe sensor code I pasted above result, Serial, null, 'SNMP - fireeye'.. The item in single quotes is the name of the sensor in your multiprobe.

Re: Struggling with network SNMP discovery - ID on class/serial number

ggarcia1 — Wed, 13 Feb 2019 14:25:12 GMT

Thank you!

This worked AFTER I found and added a MIB for the BlueCoats.

I suppose that was a prerequisite that I overlooked.

They now return serial number.

Thanks again.

Re: Struggling with network SNMP discovery - ID on class/serial number

Alex Pandian1 — Wed, 13 Feb 2019 15:47:43 GMT

Hi,

I am struggling similar kind of issue. May i know how did you find the MIB and SNMBwalk for serial number.

Re: Struggling with network SNMP discovery - ID on class/serial number

cyked — Wed, 13 Feb 2019 15:54:05 GMT

Google, sometimes they are publicly available. If not, ask the hardware owning team for the MIB for the devices. They should be able to get them from the manufacturer. Install a MIB browser on your machine and you can look through the MIB and see what all the OIDs do and also find the OID that returns the device SN.

Re: Struggling with network SNMP discovery - ID on class/serial number

ggarcia1 — Wed, 13 Feb 2019 17:25:46 GMT

In addition, ask your network team if they use anything like HP NNMi or SolarWinds or something to track/manage their devices. It's likely they have a MIB library already, whether they know it or not.

Our guys use NNMi and after I got over the learning curve and knew what a MIB/OID was, then I knew what to ask them for; they understood right away and I was good to go.

Re: Struggling with network SNMP discovery - ID on class/serial number

SimonDi — Wed, 12 Feb 2020 00:33:01 GMT

Hi,

This is also something that we are looking into at the moment and the answers above are helpful to advancing us.
One question: What table have you populated your Bluecoat CIs into?

Did you create a new table or insert into existing?

Re: Struggling with network SNMP discovery - ID on class/serial number

bharath10 — Mon, 02 Mar 2020 15:07:32 GMT

Hi Folks,

i am trying to discover NetBotz Devices(OOTB not supported) with custom probe-sensor.

i have created classifier, oid and added mib but i am struggling with retrieving serial number.

what will be the oid path if i want to add it into probe- with walk. and i tried to get from internet but no luck.

Example- (

iso.org.dod.internet.private.enterprises.fireeye.feCommon.feSystem.feSystemInfo.feSerialNumber';

)

can anyone help here.

thanks in advance.

Re: Struggling with network SNMP discovery - ID on class/serial number

ggarcia1 — Mon, 30 Mar 2020 12:48:57 GMT

We left them on IP Switch, more out of that's where we put them and we just haven't moved them; getting discovered was the goal at the time.

We've entertained either creating another class or just using the Device Type attribute that already exists.

Having asked our network engineers, they don't really care how it's classified, just that it's captured; so there's not a lot of urgency.

Have you had this discussion with anyone else? I'd love some input.

Re: Struggling with network SNMP discovery - ID on class/serial number

ggarcia1 — Mon, 30 Mar 2020 13:13:59 GMT

I've been adding the Serial OID to the SNMP - Identity Info probe, then updating the SnmpIdentityInfoParser script include.

The probe is pretty straight forward, but the script include has two things;

a pile of variablized OIDs

and a chain of serial number checks

Depending on your instance version, your script may have a different layout, but both sections still exist.

In the the pile of var OIDs, enter something like this: (copied three so you can see its pretty much the same each time)

var oid_blueCoat = 'iso.org.dod.internet.private.enterprises.blueCoat.';
var oid_gigamon = 'iso.org.dod.internet.private.enterprises.gigamonSnmp.';
var oid_infoblox = 'iso.org.dod.internet.private.enterprises.infoblox.';

Then in the chain of serial number checks, add an appropriate check. This requires knowing the rest of the path to the serial number location, so have the OID from the probe ready. In my instance version, this series of serial checks ends at an APC check, so I just started my checks right after that.

//2-12-19 check for BlueCoat Serial Number...
this.addSerial('blueCoatProxy', snmp.getOIDText('iso.org.dod.internet.private.enterprises.blueCoat.blueCoatMgmt.bluecoatSGProxyMIB.sgProxyConfig.sgProxySerialNumber'));

//2-13-19 check for Gigamon Serial Number...
this.addSerial('gigamon', snmp.getOIDText(oid_gigamon + 'gigamonSystem.serialNumber'));

//2-20-19 check for InfoBlox Serial Number...
this.addSerial('infoblox', snmp.getOIDText(oid_infoblox + 'ibSNMP.ibProduct.ibOne.ibPlatformOne.ibPlatformModule.ibSerialNumber'));

We're preparing to move to the New York version, which uses patterns more heavily, so we'll see what sorts of adjustments we'll have to make there to keep life consistent.

Let me know if you need a hand.