
AshishP asked a question.
Network Discovery not working outside of the interface's subnet
Hi Folks,
Network Discovery not working outside of the interface's subnet. Network discovery configured with IP address ranges outside of the interface's subnet. Where we can see log file if there is any error?
We are using Snow Inventory Server v6.6.3
You can find log info at C:\ProgramData\SnowSoftware\Inventory\Server\snowserver-yyyy-mm-dd_hh*.log
I would advice to first configure the logging of IS to 'max' to really get 'full' logs which may point to a root-cause by the following actions:
a)
Set statup parameter for the IS-Servic in Registry to include the '-v' option (for verbose). E.g.:
at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SnowInventoryServer5
set "ImagePath" = "C:\Program Files\Snow Software\Snow Inventory\Server\snowserver.exe" -v
b) instruct IS to log all modules actions by setting the logging Tags in
"C:\Program Files\Snow Software\Snow Inventory\Server\snowserver.config"
<Logging>
<Tags>
<Tag>*</Tag>
</Tags>
</Logging>
</Configuration>
Note: If you want to restrict Logging to a certain module, command 'snowserver.exe lt' gives you a list of possible modules you can select for logging (* will select all)
If logs don't show any obvious reason, I would bet, that there is a firewall in between your segment that you are connected to and the other segments that you want to discover from.
Network-Discover uses an NMAP like 'fingerprinting' by using a bigger set of ports which may be blocked, so disvovery is 'blinded'.
If that would not have been blocked by FW, then possibly security systems like IPS/IDS (Intrusion prevention/Intrusion detection Systems) may fire alterts or step into the way...
So in most of the environments it is expected (because of Enterprise Security Best Practices) that Network discovery by IS is not able to discover outside of its own segment.
Hi @Thomas Hirsch​,
What is the best solution you will suggest to get enable the Network discovery? Do we have KB article or user guide to enable Network Discovery outside of the interface's subnet?
It seems, you must open up at least the following ports:
"... discovery feature, uses multiple protocols, and they use the default address for those LDAP: TCP 389 SNMP v1: UDP 162 SSL: 443 WinRPC\WMI: TCP 135,445 + 1024-1034 dynamicly ICMP: TCP 7"
Citation is taken form one of the following posts which may help you in digging deeper on how to do/configure the network discovery and the headaches associated with it.
https://community.flexera.com/s/question/0D51r00008OrDNyCAN/network-port-diagrams
https://community.flexera.com/s/feed/0D51r00008PwuEvCAJ
Because we almost never managed to convince security to open up all those ports and because you _never_ know, if you really had access to all segments this way the value of the network discovery is very 'questionable'.
I personally prefer to match the list of devices with agents reporting into snow to Lists from CMDB, Antivirus, Firewall-logs, etc to narrow down the gap between 'Devices-with-Agents' versus 'Devices known but still need an agent deployed'.
@Thomas Hirsch​, Thanks for the detailed explanation. Actually, I am trying to fetch network printers using Network Discovery. Already covered all devices through Snow Agents.
I will go through the link for better understanding. Thanks for your help.