Use SNMP Network Discovery to Learn about Devices from Switches

2.1.x and Later

1. Open the SNMP settings for the Network Discovery plugin.

   Select DeviceIoT SecurityNetwork Discovery. In the SNMP Network Discovery section, click Edit (gear icon).

   The SNMP Network Discovery Settings dialog box appears with the Schedule Settings tab active. Select Enable SNMP Network Discovery Settings to configure SNMP Network Discovery.
2. Schedule how often the firewall runs an SNMP crawl job.

   In the Network Discovery Job section, schedule how often the firewall runs a job to learn all the switches and other network forwarding devices that run LLDP and CDP on the network or within a defined scope of the network. The default is once a day, which usually is often enough.

   In addition to when and how often you want to run the SNMP crawl job, you can specify a max duration for how long each job can take, up to 24 hours.
3. Schedule how often the firewall queries for information about the network and connected devices.

   In the Network Data Refreshment Job section, schedule how often the firewall runs a job to query switches and other forwarding devices for information about the network and devices connected to them. Consider how often DHCP lease times renew and schedule the job to run at half the lease time, which is when DHCP clients start requesting lease renewals and could receive different IP addresses. In environments without DHCP, consider running the network data refreshment job once every hour, which is the default setting.

   In addition to when and how often you want to run the device discovery job, you can specify a max duration for how long each job can take, up to 24 hours.

   If you select Site Overwrite, the network data refreshment job will create a site in IoT Security from sites it learns from SNMP crawling. If the subnet is already assigned to a site in IoT Security, then the subnet's site mapping will be overwritten based on the site assigned to the entry point in the Network Discovery job. Network Discovery won't overwrite any manually configured sites.
4. Click the Discovery Scope Settings tab and configure the scope of the SNMP crawl.

   1. Set the Maximum Number of Hops.

      Enter the number of switches away from the entry point switch that you want the SNMP crawling job to reach. The default number of hops is 10.
   2. Add up to 10 entry point switches in the Entry Point Switch section.

      You must configure at least one entry point switch. When you click Add, the Entry Point Switch pop-up appears. In the pop-up, enter the following information:

      • Name: Enter a name to use to identify the entry point switch.
      • Entry Point Switch: Enter the IP address of the entry point switch with which to begin the SNMP discovery process.
        A good choice for the entry point switch is a core switch because it would commonly have the broadest access to various distribution-layer and access-layer switches throughout the network.
      • Scope: Enter the prefix for the IP CIDR block to define the scope of the switches and endpoint devices to learn. By default, the scope is set to None, so SNMP will collect network topology for the entire network.
      • Site: Add the name of the site where the SNMP job queries switches for network data.

      When you're done, click OK to save the entry point switch.
   3. Optional Add service routes to the Service Route section.

      If your firewall uses a data interface rather than a management interface to do SNMP network discovery, set a service route specifying that interface and the network segment to query.

      Service routes configured on DeviceSetupServicesService Route Configuration are not applied. SNMP network discovery only uses service routes configured here.

      When you click Add, the Service Route pop-up appears. In the pop-up, enter the following information:

      • Destination: Enter the Destination IP address. An incoming packet with a destination address that matches this address will use as its source the Source Address you specify for this service route.
      • Source Interface: To limit the options for the Source Address, select a Source Interface. By default, the Source Interface is set to Any, which means all IP addresses on all interfaces are available in the Source Address drop-down. Selecting MGT causes the firewall to use the MGT interface for the service route.
      • Source Address: Select the Source Address for the service route. This address will be used for packets returning from the destination. You don't need to enter the subnet for the destination address.

      When you're done, click OK to save the service route.
5. Click the SNMP Settings tab and configure the SNMP credentials for the job to use.

   1. Set the Retries for the SNMP crawl job.

      Enter the number of times the job should try an SNMP query. If the job has reached the maximum number of retries, then it skips that SNMP query. The number of retries does not include the initial query. The default number of retries is 2.
   2. Set the Timeout (ms) for the SNMP crawl job.

      Enter the amount of time that the job should wait for a response to an SNMP query. The default timeout is 2000 ms.
   3. Add SNMP credentials for the job to use when querying the entry point switches.

      You can add multiple sets of credentials and change their ordering on the list. SNMP crawling tries the credentials in the order they appear in the list. The last successful credential used will be used first when authenticating with the next switch in the crawl.

      When you click Add, the SNMP Credentials pop-up appears. The options presented in the pop-up changes depending on what SNMP Version you select. In the pop-up, enter the following information:

      • Name: Enter a name to use to identify the credentials.
      • SNMP Version: Choose the SNMP version that the credentials can be used for, either V2 (SNMPv2c) or V3. If you choose V2, configure the Community String. If you choose V3, configure the Username and select a Security Level. Depending on the Security Level that you select, you might need to configure authentication and privacy protocols.
      • SNMP V2 Community String: Enter the SNMP community string configured on the switches to permit read-only access.
      • SNMP V3 Username: Enter a username for an SNMP user account with read-only access. This is the account for the firewall to use when accessing an SNMP server running on a switch.
      • SNMP V3 Security Level: Choose the security level for accessing an SNMP server on a switch.
        • noAuthNoPriv: Choose this to not authenticate and encrypt communications between the SNMP agent on the firewall and an SNMP server on a switch.
        • authNoPriv: Choose this to require authentication based on either MD5 or SHA hashes but not encrypt communications between the firewall and the switches.
        • authPriv: Choose this to require both authentication and encryption.
      • SNMP V3: authNoPriv OR authPriv Authentication Protocol: Choose the algorithm for authenticating communications between the firewall and the switches: MD5 (Message Digest Algorithm 5) or SHA for SHA-1 (Secure Hash Algorithm 1).
      • SNMP V3: authNoPriv OR authPriv Authentication Password: Enter the password used during the authentication process.
      • SNMP V3: authNoPriv OR authPriv Confirm Authentication Password: Confirm the password.
      • SNMP V3: authPriv Privacy Protocol: Choose the algorithm for encrypting communications between the firewall and the switches: DES (Data Encryption Standard) or AES (Advanced Encryption Standard).
      • SNMP V3: authPriv Privacy Password: Enter the password used during the encryption process.
      • SNMP V3: authPriv Confirm Privacy Password: Confirm the password.

      When you're done, click OK to save your SNMP credentials.
6. Click OK to save your SNMP Network Discovery settings.

   After enabling this feature, the settings are sent to the plugin, which checks the source interface IP address that will send and receive SNMP traffic and schedules the following tasks:

   • Send SNMP queries for Network Discovery using CDP and LLDP OIDs.
   • Send SNMP queries for Network Data Refresh using various OIDs for VLANs, subnets, switch interface or port information, device IP-to-MAC address bindings, and other attributes on a per-device level.

   After the SNMP jobs run, the resulting SNMP data is stored in files and converted to Enhanced Application logs. The firewall then sends the logs to the logging service. The logging service then streams the data to IoT Security, which updates its database and displays the SNMP discovery network topology data in the IoT Security portal.