Send netdisco-users mailing list submissions to
netdisco-users@lists.sourceforge.net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/netdisco-users
or, via email, send a message with subject or body 'help' to
netdisco-users-requ...@lists.sourceforge.net
You can reach the person managing the list at
netdisco-users-ow...@lists.sourceforge.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of netdisco-users digest..."
Today's Topics: 1. Re: SSH Collector Testing? (Jim Araujo)
--- Begin Message --- I wanted to also comment on the SNMP vs SSH collector of BigIP F5 information. We currently also are testing out LibreNMS another opensource community project which uses only SNMP. When discovering a BigIP F5 with LibreNMS it detects all the IP information include all the VirtualIPs. I am not sure how they do it, maybe another MIB or something. Just FYI.On 11/16/2021 8:32 AM, Jim Araujo wrote:Awesome! I've applied the code snippet modification and it now lists ONLY the mgmt IP. Is there way to have it list the IPs listed from the database command, since those IPs the BigIP-F5 owns as well?https://pastecode.io/s/xpthr4qb On 11/15/2021 6:42 PM, Christian Ramseyer wrote:From your device_ip dump it looks like the issue is the empty "port" column, this is what allows to map the IPs back to the physical interface it is configured on.I found a Big IP in a rarely visited corner of our network (BIG-IP vCMP Guest : Linux 2.6x, BIG-IP software release 12.1.4.1).There, it looks like the F5-BIGIP-SYSTEM-MIB::sysInterfaceName : .1.3.6.1.4.1.3375.2.1.2.4.1.2.1.1 is the problem. This data needs to be matched with IP-MIB::ipAdEntIfIndex : .1.3.6.1.2.1.4.20.1.2, but the former does not use the ifEntry ifindex, but a decimal ascii sequence of the interface names. This can be visualized with netdisco-do show:$ netdisco-do show -I -d 10.0.29.24 -e ip_indexSNMP::Info::_load_attr old_ip_index : IP-MIB::ipAdEntIfIndex : .1.3.6.1.2.1.4.20.1.2{ 10.0.29.24 33, 10.0.29.25 33, 169.254.73.9 112 } $ netdisco-do show -I -d 10.0.29.24 -e interfacesSNMP::Info::_load_attr i_index : F5-BIGIP-SYSTEM-MIB::sysInterfaceName : .1.3.6.1.4.1.3375.2.1.2.4.1.2.1.1{ 6.49.47.48.46.49.57 "1/0.19" (dualvar: 1), 6.49.47.48.46.50.48 "1/0.20" (dualvar: 1), 6.49.47.109.103.109.116 "1/mgmt" (dualvar: 1), 6.50.47.48.46.49.57 "2/0.19" (dualvar: 2), 6.50.47.48.46.50.48 "2/0.20" (dualvar: 2), 6.50.47.109.103.109.116 "2/mgmt" (dualvar: 2) }I tried a quick hack in lib/SNMP/Info/Layer3/F5.pm that looks up the actual ifIndex and adds this as an additional row to the result:$ netdisco-do show -I -d 10.0.29.24 -e interfacesSNMP::Info::_load_attr i_index : F5-BIGIP-SYSTEM-MIB::sysInterfaceName : .1.3.6.1.4.1.3375.2.1.2.4.1.2.1.1{ 33 "1/mgmt" (dualvar: 1), 34 "2/mgmt" (dualvar: 2), 177 "1/0.19" (dualvar: 1), 178 "2/0.19" (dualvar: 2), 193 "1/0.20" (dualvar: 1), 194 "2/0.20" (dualvar: 2), 6.49.47.48.46.49.57 "1/0.19" (dualvar: 1), 6.49.47.48.46.50.48 "1/0.20" (dualvar: 1), 6.49.47.109.103.109.116 "1/mgmt" (dualvar: 1), 6.50.47.48.46.49.57 "2/0.19" (dualvar: 2), 6.50.47.48.46.50.48 "2/0.20" (dualvar: 2), 6.50.47.109.103.109.116 "2/mgmt" (dualvar: 2) }Unfortunately this Netdisco installation is behind five tunnels and VPNs and I can not start the GUI, but I'm pretty confident it would now show up in the Adresses tab. You can give it a try, the interfaces method in F5.pm would need to look like this:# Override L3 interfaces sub interfaces { my $f5 = shift; my $partial = shift; # F5-BIGIP-SYSTEM-MIB::sysInterfaceName uses an ascii # string of the interface name as table index, # add an additional record with the regular ifIndex my $ifnames = $f5->ifName($partial); my %i2ind = reverse %$ifnames; my $if = $f5->i_index($partial); foreach my $k(keys %$if){ my $ifindex = $i2ind{$if->{$k}}; $if->{$ifindex} = $if->{$k}; } return $if; }Then run netdisco-do discover again. If it works maybe a resident SNMP::Info crack can give us some advice how to make a proper patch for this, it would need fixing in some more methods and be implemented module-wide somewhere (is there anything Munge-like for indexes?) Also I'm not sure if this breaks anything else and if we should keep the ascii string indexes around.I imagine the Palo Alto is something similar but I have no way to try currently. Might be a case for the hot new snapshot feature (https://github.com/netdisco/netdisco/wiki/Snapshot)Cheers Christian On 15.11.21 14:55, Jim Araujo wrote:Sure thing Christian.Both the below Device Types(BigIP * PaloAlto) seem to have similar issues with Addresses reporting in the DB, but not the WebGUI.This pate-code is the -DISQ(first link) and DB commands(second link) from a BigIP F5 i2800https://pastecode.io/s/avkzee1x https://pastecode.io/s/y3ekxc8rThis Paste-code is the -DISQ(first link) and DB commands(second link) from a PaloAlto PA-5220https://pastecode.io/s/vagnng2z https://pastecode.io/s/wvsppfdh On 11/15/2021 7:17 AM, Christian Ramseyer wrote:Hi JimOk it wasn't quite clear to me earlier in this thread where you're not finding the expected IPs. For the addresses tab, the data is collected in the discover step, and written into the table device_ip. This is most likely empty for your device, you can check with:db=> select * from device_ip where ip = 'x.x.x.x';IIRC this uses IP-MIB, but you can see exactly what OIDs are queried, and what is returned by runningnetdisco-do discover -DISQ -d x.x.x.xUnfortunately your pastecode snipped expired so I can't tell if there were any errors there, but this should point the search in the right direction.Cheers Christian On 12.11.21 22:59, Jim Araujo wrote:Alrighty. I just erased the db from postgres and add a single device having the issue. Still occuring only with one device. https://pastecode.io/s/tuuc90gyand the address page On 11/12/2021 4:34 PM, Michael Butash wrote:Why I mentioned comparing the databases, though not sure how they link to each other, by a device column or some index, or combination thereof. If the ssh collected mac table is using a wrong device to link to snmp data, it'll just treat them as two broken sets of devices vs. merging and associating them. Could just be something dumb like ip vs. name vs. whatever you used for the sshcollector device spec in deployment.yml, but the data sounds just unassociated for whatever reason.I had to learn to nose around the psql tables and basic sql queries manually (select * from $table;), but it was helpful to see how things associate, and what data was available to build my own custom reports. I'd suggest a crash course in postgres and sql queries in your spare time if planning to stick with netdisco over time. I took a day or two over the weekend to do so and actually make a custom report or 3, if you know linux decently already it's not bad, and learning new stuff is never bad in general.-mbOn Fri, Nov 12, 2021 at 1:53 PM Jim Araujo <jimara...@gmail.com> wrote:I believe you are on to something with the problem associating anasset to the same device or different. The Palo is part of a HApair so the IP and MAC are used by both according to Netdisco. IfI search the database for a MAC or IP owned by the Palo it showsup on both units. Would this explain why searching in the the web gui shows two devices listed with the same IP but the unit itselfsays no address found? - On 11/12/2021 12:42 AM, Michael Butash wrote:I would think with snmp in any version working you would get*most* data back to build a device model, and arp would give youthe rest for mac associations as a router without a cam table would link device interfaces. Even stupid cisco firewalls thatstill don't support cdp/lldp or arp mib via polling usually giveme a proper response enough to build a netdisco device, but not enough to associate them properly to a switch link in topology without the mac->ip via arp tables polled with ssh as Christian mentioned. Do you get lldp neighbors show on the pan/f5 and switch both in netdisco? Maybe debug the device discovery to see what it's polling and results, or compare the data between the sql tables if not matching up? Seems perhaps something isn't associatingthe same device, snmp vs ssh collector, or conflicting? Should it?Good data to probably add to the site for troubleshooting ssh features out of this, something I was meaning to try at my last project but didn't get to for our pans there. -mbOn Thu, Nov 11, 2021 at 5:04 PM Jim Araujo <jimara...@gmail.com>wrote: Hi Christian,Thanks again for looking into this. Perhaps I am confused. Ithought for these particular devices SSHCollector performs the task of getting IP addresses? I've setup the stanza forhttps://metacpan.org/pod/App::Netdisco::SSHCollector::Platform::PaloAltoand looking at the code on github, it looks like the SSHCollector performs a "set cli scripting-mode on" and then a "show arp all". Ibelieve the collector is working as the database command youhad me runshows the database has the interface IP addresses. Just theWeb GUI is blank. If I search for an IP owned by the Palo it shows up under the switch it is plugged into, but not for the PaloAlto itself. On 11/11/2021 6:46 PM, Christian Ramseyer wrote: > Ok in the macsuck part it says that the device does not advertise > layer 2 functionality in the SNMP attributes, and so no macsuck is > performed. > > I think if you just enter the IP or Mac in the search box on top of > the UI, you should get an entry similar to the attached image. But > since there is no L2 mapping from Mac to Port it will not show up in> the ports of the device, it's just a disconnected ARP entry.> > I have no Palo Altos to try, in some cases you can get lucky by just> enabling layer 2 in the snmp settings, but more likely PaloAlto does > not support these MIBs and will not give you any useful data. Maybe > somebody else on the list has experience with this brand. > > Cheers > Christian > > > On 11.11.21 17:29, Jim Araujo wrote:>> Hi Christian, thanks for the troubleshooting steps. I seethat the >> last query shows the database has the IPv4 addresses in it, but the >> Web Gui does not. The troubleshooting log is from a Palo alto PA-5220. >> >> https://pastecode.io/s/0i2kdb37 >> >> >> On 11/11/2021 8:08 AM, Christian Ramseyer wrote: >>> Hi Jim >>>>>> The SSH collector only collects ARP tables. There are twomore>>> pieces that are needed for everything to show up properlyin the web >>> interface: >>>>>> - discovery of the L2 device: netdisco-do -D discover -d <IP> >>> this will give the list of interfaces and other hardware>>> - collection of the mac address tables: netdisco-do -D macsuck -d <IP>>>> this will give the interface -> connected MAC addresses>>> >>> If you see ARP entries collected that later can not be found in the>>> UI, most likely one of these is not working properly withyour gear. >>>>>> I usually look into the database using SQL after running>>> discover/macsuck/arpnip: netdisco-do psql , then: >>>>>> select * from device where ip = <ip of l2 or l3 device>;>>> -- if there's nothing here, discovery or credentials is the problem>>> -- all your routers and switches involved should show up here>>> >>> select * from device_port where ip = <ip of l2 device>; >>> -- if there's nothing here, discovery found no ports:>>> -- shitty SNMP support or switch is not added to netdisco>>> >>> select * from node where switch = <ip of l2 device>; >>> -- here you should see some connected macs on ports, otherwise >>> -- macsuck issue >>>>>> select * from node_ip where mac = <a mac found on a portin prev. >>> step>;>>> -- you should find your arp tables here, otherwise arpnipissue or>>> -- you're not pointing netdisco at the correct L3 devices>>> >>> Maybe that helps narrowing the issue down a bit. >>> >>> Cheers >>> Christian >>> >>> >>> >>> >>> On 10.11.21 17:58, Jim Araujo wrote: >>>> I believe SSHCollector is getting the ARP entries as when i do a >>>> '~/bin/netdisco-do arpnip -d 1.2.3.4 -D' shows 'processed 43 ARP>>>> cache entries. However nothing is listed in the web guifor this >>>> node...Am I running into a bug? >>>> >>>> https://sourceforge.net/p/netdisco/netdisco2/254/ >>>> >>>> On 11/10/2021 8:43 AM, Jim Araujo wrote:>>>>> Hello netdisco team! First off great work on this app,it is >>>>> incredible. SNMPv3 seems to work correctly, however when I create>>>>> a new stanza for SSH collection for devices like BigIP,PaloAlto,>>>>> and NXOS is there a way to test if they are working? Onthe web >>>>> gui these particular devices do not show any information under >>>>> Addresses, nor anything under Ports...I am hoping to get this>>>>> working as we have a large F5 environment and would behelpful to>>>>> be able to search for IPs that the F5 or PaloAlto owns.>>>>> >>>>> Thanks again! >>>>> -- -Jim _______________________________________________ Netdisco mailing list netdisco-users@lists.sourceforge.net https://sourceforge.net/p/netdisco/mailman/netdisco-users/ _______________________________________________ Netdisco mailing list netdisco-users@lists.sourceforge.net https://sourceforge.net/p/netdisco/mailman/netdisco-users/-- -Jim _______________________________________________ Netdisco mailing list netdisco-users@lists.sourceforge.net https://sourceforge.net/p/netdisco/mailman/netdisco-users/ _______________________________________________ Netdisco mailing list netdisco-users@lists.sourceforge.net https://sourceforge.net/p/netdisco/mailman/netdisco-users/-- -Jim _______________________________________________ Netdisco mailing list netdisco-users@lists.sourceforge.net https://sourceforge.net/p/netdisco/mailman/netdisco-users/-- -Jim
--- End Message ---
_______________________________________________ Netdisco mailing list - Digest Mode netdisco-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/netdisco-users
