Feature Module: Network Discovery & Visibility - BlueCat Integrity - 26.1.0

Address Manager Administration Guide
ft:locale
en-US
Product name
BlueCat Integrity
Version
26.1.0

The Network Discovery & Visibility Feature Module is a licensed feature available in Integrity v26.1.0.

Network Discovery & Visibility provides continuous, automated insights into your network infrastructure, enabling accurate IP address management, faster troubleshooting, and improved operational reliability.

Network Discovery discovers and collects detailed inventory and topology information from network infrastructure (such as routers, switches, and servers), networks, and virtual environments (such as vCenter Servers, ESXi hosts, and virtual machines). It uses multiple discovery methods (SNMP, SSH, and VMware APIs) and obtains detailed information from a variety of sources, providing you with complete and up-to-date visibility into your environment. This information is returned to BlueCat Address Manager, where it can be reconciled with existing Address Manager data. This Feature Module integrates with and extends existing network discovery features in Address Manager.

Note: The Network Discovery & Visibility Feature Module is available for use in the Integrity GUI only after you've purchased and activated a valid license for the Feature Module. For more details, refer to Enable Network Discovery & Visibility Feature Module.

Network Discovery components

Network Discovery is built on the BlueCat Gateway platform. It consists of two main components:

  • Network Discovery Management:

    The Management component runs on Address Manager and manages the discovery operations that you choose to run on Address manager Servers and/or BlueCat DNS/DHCP Servers in your environment. This component enables you to configure and manage network discoveries through a user interface and APIs.

    With this component, you can:

    • Configure the behavior and scope of the discovery configuration to be run during discovery by using discovery policies.

    • Run discovery policies (at the current or scheduled time) by using discovery tasks.

    • View the results of discovery.

    • Reconcile the discovered data with the Address Manager IP space by using exclusive reconciliation policies.

  • Network Discovery Probe:

    The Probe component performs discovery by connecting to reachable devices, and returns discovery results and logs to Network Discovery. Network Discovery supports two types of probes; you can determine which one to use based on your reachability requirements:

    • Remote probes: Remote probes can be enabled on any BlueCat DNS/DHCP Server in your environment. Running discovery through a remote probe enabled on BlueCat DNS/DHCP Servers located in different network locations allows discoveries of networks that may not be discoverable when discovery is run locally through a probe on Address Manager.

    • Local probe: A built-in local probe exists on the Address Manager Server. You can choose to perform discoveries from the Address Manager Server even when no BlueCat DNS/DHCP Servers are present in your environment.

    Network Discovery supports data retention during failover and high availability (HA) scenarios.
    Note: MIB dump result files, discovery result files, and log files are not replicated across nodes; therefore, these files are not retained after a failover.

How Network Discovery works

The following diagram illustrates how Network Discovery works. In this diagram, Address Manager manages two BlueCat DNS/DHCP Servers located in different networks: Network 1 and Network 2. You can use Network Discovery to discover these networks by running discoveries from the BlueCat DNS/DHCP Servers. If Address Manager can access Network 1 and/or Network 2, you can also run discovery through the local probe on Address Manager to discover these networks instead of running discovery on the BlueCat DNS/DHCP Servers.

Once discovery is complete, the Network Discovery component running on Address Manager obtains the discovery results from wherever discovery was run. You can view and analyze these results in the Network Discovery GUI. You can also reconcile IP addresses in Address Manager with the discovered IP addresses if required.


Network Discovery components and how they are connected

Supported discoveries

You can use Network Discovery to perform the following types of discovery:
  • SNMP discovery—Network Discovery uses the Simple Network Management Protocol (SNMP) to collect detailed inventory and topology information from SNMP-enabled infrastructure devices such as routers, switches, firewalls, load balancers, and servers. With SNMP discovery, the following device information is collected by querying objects from the devices' Management Information Base (MIB):

    • Device type and vendor

    • Interfaces and MAC addresses

    • IP addresses and subnets

    • ARP and NDP tables

    • Routing tables

    • Neighbor relationships (CDP and LLDP)

    • System metadata ( sysName, sysDescr)

    Discover VRF environments via SNMP discovery:
    Network Discovery supports the SNMP-based discovery of devices and networks within VRF environments, including environments that contain overlapping IP addresses and subnets.
    Note: For discovery within VRF environments, you must configure a separate set of discovery resources (SNMP credentials, discovery policy, discovery probe, discovery task, and reconciliation policy). Additionally, when overlapping IP addresses or subnets exist between VRFs, the corresponding reconciliation policies must belong to different Address Manager configurations. This is required because IP space and device space are isolated between Address Manager configurations.

    To discover both the global network and individual VRFs without IP overlap, configure a separate discovery scope for the global network and for each VRF. Each scope should use its own SNMP credentials, discovery task, discovery policy, and probe.

    With this configuration, each discovery task produces an independent discovery result, irrespective of overlapping networks with other VRFs or global networks. Each discovery result must be associated with a different reconciliation policy and Address Manager configuration, allowing overlapping networks to be managed separately.

    For each VRF:

    • Deploy a probe inside the VRF.
    • The probe must have:
      • One interface within the VRF to reach devices in that VRF.
      • One interface on the management network to communicate with Network Discovery.
    • Use SNMP credentials that are different from the credentials used for the global network. This prevents the probe from querying the PE router through its VRF-facing interface and unintentionally including global network data in the VRF discovery results.

Example: Recommended VRF configuration

The following table shows an example of the recommended configuration in Network Discovery, per task, for a successful VRF discovery, and is illustrated by the diagram that follows.

Network Probe Seed Device SNMP Credentials
Global Global probe (Local probe in this example) Global router IP address (PE router IP address in this example) Global credentials (userGlobal in this example)
VRF-A VRF-A probe (Remote probe in this example) VRF-A router IP address (C router IP address in this example) VRF-A credentials (userA in this example)
VRF-B VRF-B probe (Remote probe in this example) VRF-B router IP address (C router IP address in this example) VRF-B credentials (userB in this example)
Note: In the above example, note that the PE router uses SNMP credentials that are different from those used by routers inside the VRF. A probe deployed inside a VRF can reach the PE through its VRF-facing interface and attempts SNMP; SNMP fails because the SNMP credentials differ. If the PE uses the same SNMP credentials as routers within the VRF, Network Discovery can collect the PE's global interfaces and unintentionally include global network data in the VRF discovery results. Therefore, using unique SNMP credentials is mandatory to prevent this behavior.

Recommended configuration for successful VRF discovery

  • VMware discovery—Network Discovery uses VMware APIs to collect detailed information from virtual and supporting infrastructure components, including ESXi hosts, virtual machines, and vCenter Servers, within VMware environments.

  • SSH discovery—Network Discovery uses the secure shell protocol (SSH) to perform per-device interrogation to retrieve system and configuration details. The interrogation is performed by executing commands on Cisco ASA. As SSH discovery is limited to the individual device, any neighboring devices on the network will not be discovered.

    SSH discovery collects the following information:

    • OS metadata

    • Interface details

    • Routing or neighbor tables

    The following devices are supported for SSH discovery:

    • Cisco ASA devices (using SSH v2.0)

    For SSH discovery to be successful, the following conditions must be met:

    • Cisco ASA devices should be able to execute the following commands:

      • show version

      • show interface

      • show arp

    Note: The SSH discovery utility depends on the output of the listed commands. If the output format is different, the discovery script might not execute as required. In such cases, contact BlueCat Customer Care for assistance.
    SSH discovery has the following limitations:
    Limitation Type Limitations
    Environmental
    • Discovery of devices in a VRF environment is not supported.
    • IPv6 discovery is not supported. However, IPv4 discovery on IPv6-enabled devices is supported.
    Functional Network Discovery will discover only the layer 3 information found in IP addresses, MAC addresses, networks, and subnets. Layer 2 discovery is not supported.

Key resources involved in discovery

The following table describes the significance of the key resources involved in network discovery:
Note: For a discovery, you can create one or more resources for each resource type (that is, credentials, policies, probes, tasks, and reconciliation policies), depending on your requirements.
Resource Significance
Credentials To authenticate to the devices present on the network you want to discover.
Discovery policies To define what Network Discovery should discover and how (that is, the discovery scope and behavior).
Discovery probes To perform the SSH, SNMP, and VMware discovery scans from a BlueCat Server (BlueCat Address Manager Server or BlueCat DNS/DHCP Server) at specific network locations.
Discovery tasks To combine discovery policy, probe, and scheduling information (that is, specifying what Network Discovery should discover, the location where discovery should run, and when). After a task completes, it generates discovery results that are sent back to Network Discovery through probes.
Reconciliation policies To compare discovered data with existing data in Address Manager, and determine which Address Manager data should be reconciled.