Security

last person joined: 2 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Clearpass Device Insight - Discovery Scan

  • 1.  Clearpass Device Insight - Discovery Scan

    Posted 25 days ago
    I'm trying to run a discovery scan using a seed router.  I have added the SNMP and SSH augmentation and it fails. The collector is on a different subnet as the seed router but I can ping it. The documentation is pretty light when it comes to troubleshooting. It looks like the firewall is blocking an connection as well. Is there a list of ports or web sites that need to opened for CDI? The only one I did open is for Central.



    ------------------------------
    Steve
    ------------------------------


  • 2.  RE: Clearpass Device Insight - Discovery Scan

    Posted 24 days ago
    I'm pretty sure that I have seen that information, but asked our product team where it is supposed to reside at the moment. It should be in the product documentation.

    To get you started, SNMP is port 161/udp and SSH is port 22/tcp both from the collector to your switches and client devices.

    Further for WMI, that uses dynamic ports so you basically need to open all traffic from the collector to your Windows clients that you want to scan.
    The nmap scans do a lot of ports, which are configurable, but in general, having all ports allowed from the collectors to the to-be-scanned devices is what I see being used.

    For DHCP ip-helper, you need to open port 67/udp from your switches/routers to the collector.

    Collector should only need port 443 out to the internet to communicate.

    Do you see in the logs of the routers/switches any information on the SNMP coming in or failing?
    Please note that for SNMPv3 it is important that the collector and your devices (routers/switches) are time-synchronized, preferred via NTP.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
    ------------------------------



  • 3.  RE: Clearpass Device Insight - Discovery Scan

    Posted 22 days ago
    I just found the list that I remembered to have seen:

    Network Requirements

    • Static IP address
    • Outbound Internet Access on TCP port 443
    • Optional: Proxy Server

    Network Services (Internal or External)

    • TCP/UDP 53 (DNS)
    • UDP 123 (NTP)

    Recommended access to network devices

    • SNMP (V1 through 3, but 3 is preferred)

    Recommended access to endpoints

    • TCP, UDP, ICMP - For nmap profiling and WMI profiling
    • TCP:22 - For SSH scans
    • UDP:161 - for SNMP scans


    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
    ------------------------------



  • 4.  RE: Clearpass Device Insight - Discovery Scan

    Posted 17 days ago
    I have exactly the same problem. Anyone got a suggestion? This is quiet a common issue , please suggest me if you find any solution for it AESsuccess

    ------------------------------
    Loomis Loomis
    ------------------------------



  • 5.  RE: Clearpass Device Insight - Discovery Scan

    Posted 17 days ago
    If you are sure there is no traffic blocked, and the logs from your switch don't indicate what is happening, please work with Aruba TAC. They can have a deeper look at what is going on.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
    ------------------------------



  • 6.  RE: Clearpass Device Insight - Discovery Scan

    Posted 15 days ago

    Issue reported by @scromie was resolved after correcting the SNMP configuration on the seed device which was an Aruba 5406R switch.

    @Loomis67 are you still facing the same issue? If so, please open a support ticket as indicated by Herman so we can assist you in addressing your issue.


    ------------------------------
    Rajesh Ramireddy
    ------------------------------



  • 7.  RE: Clearpass Device Insight - Discovery Scan

    Posted 15 days ago
    Thanks for the reply Herman. We did discover some inconsistencies with the configuration on some of the NAD's. The customer uses SNMPv3 and the configuration had to be tweaked a little for it to work with the collectors. For example, in the snmp config, the customer had it configured with "snmpv3 only", and the collector doesn't seem to like that so we had to remove it from the config. Also, once we were sure we had the snmp issue worked out, we actually had to remove and re-add all the NAD's for it to actually work with them.

    ------------------------------
    Steve
    ------------------------------