REGARDINNG AD DEVICE & USER DISCOVERY FUNCTIONALITY

kdpant asked a question.

January 14, 2022 at 1:28 PM

Hi Guys,

We need to allow either TCP ports 389 or 636 and UDP port 161 towards ADs in order to enable AD Device & User discovery for domains via inventory server or service gateways, right?

In light of the foregoing, can somebody assist me in learning more about the (detailed) requirements of Port 161 for AD Device and User discovery?

Actually, AD Discovery was not working in our environment, so we created a support case with Snow, who suggested that Port 161 be allowed to connect with AD server from the inventory server for AD Discovery.

We've been talking about it with our internal team about implementing it for a while, but there have been a lot of questions from the infrastructure and security teams about "Why UDP Port 161 needs to be open for AD Discovery to work?" if LDAP ports are already allowed.

Below is one of specific question from security team:

"What specific information do you need from Active Directory that is not available from the global catalog port or secure ldap ports?"

Is there anyone who has had a similar problem with AD discovery, and if so, how did they fix it or deal with it in their environment, or have they had any problems with it?

Awaiting for valuable suggestions & comments.

Kind regards,

Kishan Pant

Top Rated Answers

piideleteJune
5 years ago
In terms of the AD lookups going across domains it's been so hit and miss on the SIS working.

If the AD account used to run the SIS service on the gateway server is configured right and in the local admins group of the SIS server it usually allows and takes any extra LDAP lookups you create in the INV SMACC.
To test I normally ask a customer to use LDAP Explorer with that account from the SIS server to try browse the other domains - find it easier to explain than PowerShell.

I would add I normally end up having to have separate SIS servers per domain simply to do these LDAP lookups even if no agents will use the gateway server to relay data. This is the only reliable way I've got the AD discovery to work across domains.

Though looking over that KB article I have no idea how they came to produce it as there is no link between SNMP and LDAP and simple googles should show that to the tech that wrote that article. Totally different protocols
Expand Post
Selected as Best

All Answers

ColinHardie
5 years ago
There is a KB article here describing ensuring port 161 is open. Reason given is "Snow currently only supports SNMPV1 for Network Discovery which uses port 161."

Not sure how helpful that is in answering your security teams specific query TBH
Expand Post
- kdpant
  5 years ago
  Hi @Colin Hardie ,
  
  Thanks for your response.
  
  I already gone through that document, Actually KB article was published after I raised issue with Snow Support and for providing justification to stack holders, requested support team to provide any documentation for AD Discovery pre-requisites.
  
  But I want to get more detailed information about the requirement of Port 161 because by default SNMP service disabled in AD servers and due to security obligations it may not be enabled in AD's.
  
  If there any proper justification for must have requirement then it would be much helpful.
  
  Thanks,
  Kishan Pant
  Expand Post
  - ColinHardie
    5 years ago
    Ah, interesting. Well it seems that Snow's reliance on SNMP v1 (and opening port 161) for network discovery presents a pretty clear security vulnerability unless locked down with ACLs etc. Not Snow's issue as such but it seems that unless they provide clear guidance of configuration that would allow AD discovery to work whilst satisfying security teams, then you may be out of luck.
    Expand Post
  - kdpant
    5 years ago
    Hi @Colin Hardie ,
    
    Yes, You are right currently Snow only support SNMPv1 and it's big issue for security concern.
    
    Did you enabled AD discovery within your environment? If yes, Is it working?
    
    Thanks,
    Kishan Pant
    Expand Post
  - ColinHardie
    5 years ago
    Hi @Kishan Pant , no we don't use it, maybe another customer who has it configured can outline steps required to have it working and secure.
    Expand Post
  - kdpant
    5 years ago
    Thanks @Colin Hardie for confirmation and your responses.
    Expand Post
piideleteJune
5 years ago
Not sure why they would suggest opening port 161 if you are only using the LDAP side of things and not configuring the SNMP scanning as they two separate things.

LDAP ports are normally open within an organisation so i suppose the question is are you having issues with the AD discovery from your hosted platform and service gateways not being able to do the lookups in a single domain or across domains? the latter i struggle to get working even when the correct trusts are in place within domains/forests.
Expand Post
- kdpant
  5 years ago
  @James Joens Yes, you are right Joe, We are only targeting AD Device & User Discovery not Network Discovery. For those AD's we are trying to configure AD Discovery those are reachable over Ports 389 or 636 (Both). We have SAM Platform running into ABC domain and XYZ domain credentials used for login into servers.
  
  Trying to configure the AD discovery for the ABC, XYZ & PQR, etc. but same not working however while running PowerShell commands they are working fine and we are able to extract required information from AD.
  
  After opened ticket with Snow Support, they suggested that Port 161 also need to be open between Inventory and AD for issue resolution. And for same they published the KB article too.
  
  Is there any other thing need to be check for ensuring trust between domains (ABC and XYZ, PQR, etc.).
  
  If you require any further info then please do let me know.
  
  Thanks,
  Kishan Pant
  Expand Post
  - piideleteJune
    5 years ago
    In terms of the AD lookups going across domains it's been so hit and miss on the SIS working.
    
    If the AD account used to run the SIS service on the gateway server is configured right and in the local admins group of the SIS server it usually allows and takes any extra LDAP lookups you create in the INV SMACC.
    To test I normally ask a customer to use LDAP Explorer with that account from the SIS server to try browse the other domains - find it easier to explain than PowerShell.
    
    I would add I normally end up having to have separate SIS servers per domain simply to do these LDAP lookups even if no agents will use the gateway server to relay data. This is the only reliable way I've got the AD discovery to work across domains.
    
    Though looking over that KB article I have no idea how they came to produce it as there is no link between SNMP and LDAP and simple googles should show that to the tech that wrote that article. Totally different protocols
    Expand Post
    Selected as Best
  - kdpant
    5 years ago
    Thanks @Joseph Powell for your response. I will follow the suggestions which you provided.
    
    I want your one help to understand regarding What is the best way to put the ldap path for AD Discovery (Device & User):
    1) If SIS is member of Domain
    2) If SIS is not member of Domain
    
    However, above mentioned into document but just I want to re-confirm it.
    
    Also, What type of AD account and minimum permissions required for account which configured for AD Discovery.
    
    Thanks in advance!!
    
    Kind regards,
    Kishan Pant
    
    Expand Post

10 of 12

Related Product Forums

→ Flexera One

→ Snow Atlas

→ FlexNet Manager

→ Snow License Manager

→ App Broker

Need help finding an answer?

Ask a Question →