Send netdisco-users mailing list submissions to
[email protected]
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/netdisco-users
or, via email, send a message with subject or body 'help' to
[email protected]
You can reach the person managing the list at
[email protected]
When replying, please edit your Subject line so it is more specific
than "Re: Contents of netdisco-users digest..."
Today's Topics:
1. Re: [EXT] Re: SNMPv3 configured Palo Altos no longer showing
up in Netdisco (Christian Ramseyer)
2. Re: [EXT] Re: SNMPv3 configured Palo Altos no longer showing
up in Netdisco (Cleveland, Damian R)
--- Begin Message ---
ok great, the try_connect stuff shows that some credentials from
deployment.yml device_auth are tried but none of them work. Either you
don't have the same values in there that work with the snmpwalk command
line, or there is a more subtle difference caused by YAML formatting or
defaults picked by one tool but not the other.
You can use
https://github.com/netdisco/netdisco/wiki/Environment-Variables#nd2_show_community
to show the value being sent, and check
https://github.com/netdisco/netdisco/wiki/Configuration#device_auth for
examples with correct v3 parameters.
One common scenario of "it worked once" is upgrades on the Palo side
requiring stronger crypto in the SNMP config now. There is some pointers
to the correct names like AES128 here:
https://github.com/netdisco/netdisco/wiki/Vendor-Tips#snmpv3-on-cisco-with-non-standard-priv-algorithms
Good luck
On 29.07.2026 17:39, Cleveland, Damian R wrote:
Thanks for responding, Christian
Here's what's happening:
[netdisco@greennetadmin ~]$ netdisco-do -D discover -d 192.168.42.220
[1710551] 2026-07-29 15:34:49 info App::Netdisco version 2.080003 loaded.
[1710551] 2026-07-29 15:34:49 info discover: [192.168.42.220] started
at Wed Jul 29 11:34:49 2026
[1710551] 2026-07-29 15:34:49 debug discover: running with timeout 600s
[1710551] 2026-07-29 15:34:49 debug //// CHECK \\\\ phase
[1710551] 2026-07-29 15:34:49 debug ⮕ worker Internal::BackendFQDN p1000000
[1710551] 2026-07-29 15:34:49 debug ⮕ worker Internal::SNMPFastDiscover
p1000000
[1710551] 2026-07-29 15:34:49 debug running with configured SNMP timeouts
[1710551] 2026-07-29 15:34:49 debug ⮕ worker Discover p0
[1710551] 2026-07-29 15:34:49 debug ⬅ (done) Discover is able to run.
[1710551] 2026-07-29 15:34:49 debug //// EARLY \\\\ phase
[1710551] 2026-07-29 15:34:49 debug ⮕ worker Discover::Properties p100
[1710551] 2026-07-29 15:34:49 debug snmp reader cache warm: [192.168.42.220]
[1710551] 2026-07-29 15:34:49 debug [192.168.42.220:161] try_connect
with v: 3, t: 0.2, r: 0, class: SNMP::Info, comm: <hidden>
[1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
with v: 2, t: 0.2, r: 0, class: SNMP::Info, comm: <hidden>
[1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
with v: 3, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
[1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
with v: 2, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
[1710551] 2026-07-29 15:35:17 debug [192.168.42.220:161] try_connect
with v: 1, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
[1710551] 2026-07-29 15:35:44 debug ⬅ (defer) discover failed: could not
SNMP connect to 192.168.42.220
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
[1710551] 2026-07-29 15:35:44 debug //// MAIN \\\\ phase
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::CanonicalIP p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Entities p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Neighbors p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Neighbors::DOCSIS
p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker PythonShim
netdisco.worklet.discover.nexthopneighbors.main.cli.juniper_junos p200
[1710551] 2026-07-29 15:35:44 debug ⬅ (info) skip: acls restricted
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::NextHopNeighbors p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::PortPower p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::PortProperties p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties::Tags p0
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties::Tags p0
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::VLANs p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Wireless p100
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::WithNodes p0
[1710551] 2026-07-29 15:35:44 debug //// STORE \\\\ phase
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::NextHopNeighbors p0
[1710551] 2026-07-29 15:35:44 debug //// LATE \\\\ phase
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Hooks p0
[1710551] 2026-07-29 15:35:44 debug ⬅ (info) [192.168.42.220] hooks -
skipping due to incomplete job
[1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Snapshot p0
[1710551] 2026-07-29 15:35:44 debug ⬅ (defer) discover failed: could not
SNMP connect to 192.168.42.220
[1710551] 2026-07-29 15:35:44 info discover: finished at Wed Jul 29
11:35:44 2026
[1710551] 2026-07-29 15:35:44 info discover: status defer: discover
failed: could not SNMP connect to 192.168.42.220
Again, the walk seems to work just fine.
Thanks,
Damian Cleveland
609.279.6265
IDA CCR-P
805 Bunn Drive
Princeton, NJ 08540
------------------------------------------------------------------------
*From:* Christian Ramseyer <[email protected]>
*Sent:* Wednesday, July 29, 2026 11:05:20 AM
*To:* Cleveland, Damian R; Netdisco
*Subject:* [EXT] Re: [Netdisco] SNMPv3 configured Palo Altos no longer
showing up in Netdisco
*** This email originated outside of IDA. Please verify that you
recognize the sender and know the content is safe before proceeding. ***
Hi Damian, I'd try running
netdisco-do -D discover -d <ip>
in a terminal to see exactly what netdisco tries to do with the device.
Cheers
Christian
On 29.07.2026 13:47, Cleveland, Damian R wrote:
Hello,
My Palo Altos are no longer showing up in Netdisco.
They are configured with SNMPv3 and worked at one point.
I can still walk the device from the Netdisco instance, and I've
restarted the services to no avail.
Any advice would be appreciated.
Thank you,
Damian Cleveland
609.279.6265
IDA CCR-P
805 Bunn Drive
Princeton, NJ 08540
--
Christian Ramseyer, netnea ag
Network Management. Security. OpenSource.
https://www.netnea.com
Phone: +41 79 644 77 64
--- End Message ---
--- Begin Message ---
Hello Christian.
Problem solved. Thanks for your guidance!
It turns out I needed to specify the auth proto in deployment.yml, where I
didn't have to before. Once I added it, the discover job went through, and the
devices are on the map again.
Thank you!
Damian Cleveland
609.279.6265
IDA CCR-P
805 Bunn Drive
Princeton, NJ 08540
________________________________
From: Christian Ramseyer <[email protected]>
Sent: Wednesday, July 29, 2026 8:12:43 PM
To: Cleveland, Damian R; Netdisco
Subject: Re: [EXT] Re: [Netdisco] SNMPv3 configured Palo Altos no longer
showing up in Netdisco
ok great, the try_connect stuff shows that some credentials from
deployment.yml device_auth are tried but none of them work. Either you
don't have the same values in there that work with the snmpwalk command
line, or there is a more subtle difference caused by YAML formatting or
defaults picked by one tool but not the other.
You can use
https://github.com/netdisco/netdisco/wiki/Environment-Variables#nd2_show_community
to show the value being sent, and check
https://github.com/netdisco/netdisco/wiki/Configuration#device_auth for
examples with correct v3 parameters.
One common scenario of "it worked once" is upgrades on the Palo side
requiring stronger crypto in the SNMP config now. There is some pointers
to the correct names like AES128 here:
https://github.com/netdisco/netdisco/wiki/Vendor-Tips#snmpv3-on-cisco-with-non-standard-priv-algorithms
Good luck
On 29.07.2026 17:39, Cleveland, Damian R wrote:
> Thanks for responding, Christian
>
> Here's what's happening:
>
> [netdisco@greennetadmin ~]$ netdisco-do -D discover -d 192.168.42.220
> [1710551] 2026-07-29 15:34:49 info App::Netdisco version 2.080003 loaded.
> [1710551] 2026-07-29 15:34:49 info discover: [192.168.42.220] started
> at Wed Jul 29 11:34:49 2026
> [1710551] 2026-07-29 15:34:49 debug discover: running with timeout 600s
> [1710551] 2026-07-29 15:34:49 debug //// CHECK \\\\ phase
> [1710551] 2026-07-29 15:34:49 debug ⮕ worker Internal::BackendFQDN p1000000
> [1710551] 2026-07-29 15:34:49 debug ⮕ worker Internal::SNMPFastDiscover
> p1000000
> [1710551] 2026-07-29 15:34:49 debug running with configured SNMP timeouts
> [1710551] 2026-07-29 15:34:49 debug ⮕ worker Discover p0
> [1710551] 2026-07-29 15:34:49 debug ⬅ (done) Discover is able to run.
> [1710551] 2026-07-29 15:34:49 debug //// EARLY \\\\ phase
> [1710551] 2026-07-29 15:34:49 debug ⮕ worker Discover::Properties p100
> [1710551] 2026-07-29 15:34:49 debug snmp reader cache warm: [192.168.42.220]
> [1710551] 2026-07-29 15:34:49 debug [192.168.42.220:161] try_connect
> with v: 3, t: 0.2, r: 0, class: SNMP::Info, comm: <hidden>
> [1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
> with v: 2, t: 0.2, r: 0, class: SNMP::Info, comm: <hidden>
> [1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
> with v: 3, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
> [1710551] 2026-07-29 15:34:50 debug [192.168.42.220:161] try_connect
> with v: 2, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
> [1710551] 2026-07-29 15:35:17 debug [192.168.42.220:161] try_connect
> with v: 1, t: 3, r: 2, class: SNMP::Info, comm: <hidden>
> [1710551] 2026-07-29 15:35:44 debug ⬅ (defer) discover failed: could not
> SNMP connect to 192.168.42.220
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties p100
> [1710551] 2026-07-29 15:35:44 debug //// MAIN \\\\ phase
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::CanonicalIP p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Entities p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Neighbors p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Neighbors::DOCSIS
> p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker PythonShim
> netdisco.worklet.discover.nexthopneighbors.main.cli.juniper_junos p200
> [1710551] 2026-07-29 15:35:44 debug ⬅ (info) skip: acls restricted
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::NextHopNeighbors p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::PortPower p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::PortProperties p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties::Tags p0
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Properties::Tags p0
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::VLANs p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Wireless p100
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::WithNodes p0
> [1710551] 2026-07-29 15:35:44 debug //// STORE \\\\ phase
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::NextHopNeighbors p0
> [1710551] 2026-07-29 15:35:44 debug //// LATE \\\\ phase
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Hooks p0
> [1710551] 2026-07-29 15:35:44 debug ⬅ (info) [192.168.42.220] hooks -
> skipping due to incomplete job
> [1710551] 2026-07-29 15:35:44 debug ⮕ worker Discover::Snapshot p0
> [1710551] 2026-07-29 15:35:44 debug ⬅ (defer) discover failed: could not
> SNMP connect to 192.168.42.220
> [1710551] 2026-07-29 15:35:44 info discover: finished at Wed Jul 29
> 11:35:44 2026
> [1710551] 2026-07-29 15:35:44 info discover: status defer: discover
> failed: could not SNMP connect to 192.168.42.220
>
> Again, the walk seems to work just fine.
>
> Thanks,
>
>
> Damian Cleveland
>
> 609.279.6265
>
> IDA CCR-P
>
> 805 Bunn Drive
>
> Princeton, NJ 08540
>
> ------------------------------------------------------------------------
> *From:* Christian Ramseyer <[email protected]>
> *Sent:* Wednesday, July 29, 2026 11:05:20 AM
> *To:* Cleveland, Damian R; Netdisco
> *Subject:* [EXT] Re: [Netdisco] SNMPv3 configured Palo Altos no longer
> showing up in Netdisco
> *** This email originated outside of IDA. Please verify that you
> recognize the sender and know the content is safe before proceeding. ***
>
>
> Hi Damian, I'd try running
> netdisco-do -D discover -d <ip>
> in a terminal to see exactly what netdisco tries to do with the device.
>
> Cheers
> Christian
>
>
> On 29.07.2026 13:47, Cleveland, Damian R wrote:
>> Hello,
>>
>>
>> My Palo Altos are no longer showing up in Netdisco.
>>
>> They are configured with SNMPv3 and worked at one point.
>>
>> I can still walk the device from the Netdisco instance, and I've
>> restarted the services to no avail.
>>
>> Any advice would be appreciated.
>>
>>
>> Thank you,
>>
>>
>> Damian Cleveland
>>
>> 609.279.6265
>>
>> IDA CCR-P
>>
>> 805 Bunn Drive
>>
>> Princeton, NJ 08540
>>
--
Christian Ramseyer, netnea ag
Network Management. Security. OpenSource.
https://www.netnea.com
Phone: +41 79 644 77 64
--- End Message ---
_______________________________________________
Netdisco mailing list - Digest Mode
[email protected]
https://lists.sourceforge.net/lists/listinfo/netdisco-users
