Infoblox Deployment Guide Network Insight Deployment Guide
Infoblox Deployment Guide Network Insight Deployment Guide
Port Scanning 7
NetBIOS Scanning 10
Discovery Procedure: 10
Prerequisite 10
Conversion Procedures 18
Continue through the wizard to resolve the last conflict associated with the IP address 36
SNMP Collection - Network Insight uses SNMP to collect traceroute/path information, vendor
and model, SNMP credential collection, routing and ARP tables, switch port data, and VLAN
configuration data.
CLI Collection - Network Insight uses SSH or telnet to connect to devices to collect IP
configuration, port configuration, and routing tables.
Automatic ARP Refresh before Switch Port Polling - refreshes ARP caches on switches and
switch-routers in the managed network before NIOS performs polling of switch ports. Enabling
this feature applies only to switched Ethernet devices. This feature enables more accurate
detection of all endpoint devices on L2 switches. Without ARP refresh, some endpoint devices
may not be detected.
Switch Port Data Collection- this enables the probe to poll l2 enterprise switches. The
recommendation is to poll every hour.
Use the most minimal amount of network containers as possible. For example, use network
containers that use the IP address’s natural mask such as 10.0.0/8 to contain your 10 subnets.
For sub containers and/or networks, override discovery settings as little as possible. Every time
an override is set extra resources are created and used under the covers and could impact
performance over time.
Use as few Seed Routers as possible. Using one as close to the core as possible is
recommended.
Click on Seed.
Click on the selected IP subnet and the list of IP addresses will appear.
Click on the check box for the IP address you wish to exclude from discovery.
The IP address will be highlighted in an aqua color to indicate the IP address is excluded from
discovery.
Click on the check box for Port Scanning to enable and click on Save & Close.
Click on the check box for Port Scanning and Profile Device to enable. Click Save & Close.
Note: Disable Use DHCP routers as seed routers. This feature creates a seed router entry for
every DHCP range, which can lead to performance issues.
Note: The duration can be set for X amount of minutes, hours, or days. Click OK when done
If you are using Network Insight in a VRF environment, you’ll need to map VRFs to Network
Views. This can be done manually or you can configure rules to do the mapping automatically.
Enable the automatic VRF mapping rules and system mapping extensions: Select this to
enable the VRF Mapping Rules table so you can define mapping rules that Network Insight uses
to map network views to unassigned VRFs that match the criteria of the rules; and in cases
where none of the rules match a VRF name, Network Insight maps the VRF to the network view
from which one of the interfaces the unassigned VRF is reached.
Disable automatic VRF mapping and only use manually defined VRF mapping: Select this
to disable the VRF Mapping Rules table. When you select this, Network Insight does not
perform any evaluation of the VRF mapping rules. You can manually assign or unassign
network views to the discovered VRFs.
When you enable automatic VRF mapping, you can add mapping rules to the VRF Mapping
Rules table, as follows:
Click the Add icon, and the appliance adds a row to the table.
In the table, click each of the following fields and enter the values accordingly:
Order: The order and priority in which Network Insight evaluates the mapping rules. Each time
you add a new rule, the appliance automatically appends the rule to the end of the list and
assigns the next incremental number to the rule. To reorder the list, you can select a rule and
use the up and down arrows next to the table to move the rules to its desired position so you
can set the priority for the rule evaluation. Network Insight evaluates the rules based on the
order, starting with 1 as the highest priority.
Criteria: The criteria that Network Insight uses to match the VRF name of an unassigned VRF.
You can use POSIX regular expressions to define the mapping criteria. The appliance validates
the rule when you save the configuration, and it returns an error message if the criteria is
invalid. For more information about regular expressions,
Comment: Enter a comment about the VRF mapping rule. Click the Add icon again to define
another mapping rule. 4. Save the configuration
An important item in network discovery is adding a seed router. Network Insight will use the
seed router to access the routing table to discover the network. The recommendation is to use
a seed router that is in the core of the network or closest to the core of the network.
Define a top-level Network Container to consolidate IP subnets. For example, create a network
container like 10.0.0.0/8 to contain all of the subnets under the 10 networks.
Conversion Procedures
After a discovery, key information is collected and displayed in the following tabs:
Data Management, Devices, Interfaces, Networks, IP Addresses, and Assets tabs of Grid
Manager. You can view information about each discovered entity in one of these tabs.
Grid Manager allows you to convert certain unmanaged devices, interfaces, networks, and
assets to the following IPAM object types:
When converting unmanaged entities to managed objects in NIOS, you can choose to convert
them one at a time or as a group.
To convert a single entity, just select a specific entity and perform the conversion. To convert
multiple entities to the same IPAM object type, you can select the entities you want to manage
and then perform a bulk conversion.
Converting Unmanaged Devices to Managed Devices
Click on the corresponding wheel for switch ‘stack2.acme.com’. Select Convert and this
expands to another menu. Select either To Host, To A Record, To PTR Record or To Fixed
Address.
An editor for each of the selections will appear like the following:
Click the Next Page and Last Page icons to locate the device through which you want to locate
the interfaces to convert.
Click the Interfaces tab for the chosen device. This tab lists all ports discovered on the device.
select Convert → To Host, To A Record, To PTR Record, or To Fixed Address from the
menu.
From the Toolbar, select Convert → To Host, To A & PTR Record, or To Fixed Address.
For a single interface: The respective object editor appears based on the conversion type you
have selected. For example, if you select To Host, the Host editor appears.
Unmanaged networks listed under discovered devices present the same conversion features as
networks listed under IPAM.
Click a discovered device name’s wheel icon and click the device name hotlink.
Open the Networks tab. The Managed column shows one of three possible states for all
discovered networks on each device:
Blank value–indicates that the network is not known to IPAM, because insufficient information
is available to identify and catalog the network at the present time, or because the network listed
at the device level is for a loopback interface, a disconnected network, or a network prefix that is
overlapped by a larger network encompassing that prefix and defined in IPAM. These are also
called non-NIOS networks. At the device level, non-NIOS networks are highlighted in light grey;
No–indicates that the network is not managed under IPAM/Grid Manager, but enough
information is catalogued that the network can be converted to Managed state. This state is
required before a network can be converted to managed status. Networks in this state are
highlighted in yellow.
Yes–The network is currently managed under IPAM, converted to an IPAM network. At the
device level, managed networks are highlighted in white.
Click Convert.
The IPAM tab lists all discovered networks as unmanaged, highlighted in yellow. Administrators
cannot apply services or IPAM objects to IP addresses in unmanaged networks until the
networks are converted to managed status. You can explore unmanaged networks through the
IP Map and IP List views, but many operations cannot be carried out on unmanaged networks,
including editing, splitting, resizing, permissions changes and other tasks.
Unmanaged networks can be converted at the IPAM main page and at the device level under
Data Management –> Devices, selecting a device and opening the Networks page.
Under IPAM, the Managed column for the Network tables can show one of two possible states
for all discovered IPAM networks:
● No–Shows that the network is not managed under IPAM/Grid Manager, but enough
information is catalogued that the device can be converted to Managed state. This state
is required before a network can be converted to Managed status.
Note that corresponding DNS zones in a selected network view must already exist in order for
Network Insight to add DNS records during the conversion. Otherwise, Network Insight does not
add any DNS records and it logs a message to the syslog.
Network Insight automatically adds DNS records based on the following conditions:
Note: Network Insight updates only records that are created by the Network Insight process. It
does not create or update DNS records that are originally created by other admin users.
The Update discovered data for managed objects is enabled by default. Enter the following:
Template - Define a naming template that Network Insight uses to automatically create DNS
records for the unmanaged IP addresses in the network view. You can use the following syntax:
${substitution}, where substitution can be a supported variable or function. Note that each
IPv6 address substitution is unwrapped into dotted presentation. For example, when you enter
${discovered_name}.corp100.com and the discovered_name for the asset is XYZ, the DNS
name for this IP becomes XYZ.corp100.com. When you enter
$dev-{ip_address_octet3}.corp100.com and the IP for the asset is2dba::db8::1, the DNS
name for this IP becomes dev-3.corp100.com. When you enter
${ip_address[7]}.corp100.com for an IPv6 address and if the IP for the asset is
2001:db8:acad::1, the DNS name becomes b.corp100.com. You can also use the following
functions in the naming template: dashed, reversed, and underscored. For example, when
you enter ${dashed(${ip_address})}-corp100.com and the IP is 1.2.3.4, the DNS name
becomes 1-2-3-4-corp100.com. When you enter ${reversed(${ip_address})}-corp100.com
and the IP is 1.2.3.4, the DNS name becomes 4.3.2.1-corp100.com.
Conditions - Enter the matching conditions for the conversion rule. You can use magic
variables, supported variables, operators, and functions in the condition. When Network Insight
finds IP addresses that match this condition, it will convert the IP addresses into DNS records
(Hosts, A/PTR records, or fixed addresses) based on your selected conversion type. For
example, if you want to match IP addresses that do not have an FQDN in the
discovered_name, you can enter this condition: ${isFQDN(${discovered_name})} == false
AND ${discovered_name} == ‘unknown’. If you want to match devices from the network
137.65.75.0/24 with the name starting with "Serial0", you can enter this condition:
${ip_belongs_to("137.65.75.0/24")} == true AND ${discovered_name} like "Serial0".
Conversion Type - From the drop-down list, select the DNS record type that you want Network
insight to convert the unmanaged IP addresses into. You can convert an unmanaged IP into
Host, A/PTR, or Fixed Address. When you select A/PTR, Network Insight converts each IP into
A and PTR records simultaneously.
Comment (optional) - Enter description about this policy to distinguish it from others. For
example, if the policy is used to identify and convert IP addresses with discovered_name that
does not contain an FQDN, you can enter “No FQDN in discovered_name.” as the comment to
remind yourself about this conversion rule.
The Conflict Resolution wizard automatically recognizes the object associated with the conflict
and ensures that changes you make during resolution are applied correctly to the object. An
example appears below.
Another category of conflicts involves incorrectly defined device information for the object:
In virtually all cases, replacing the configured information with the discovered information
successfully clears the conflict; click OK to commit changes or to temporarily clear the conflict.
Resolving Multiple Conflicts
You can define objects for IP addresses, attempt to apply a port reservation, or incorrectly
specify a value such as a MAC address or a vendor name, and accidentally cause multiple
conflicts after creating the new object.
When multiple conflicts need to be resolved for a particular IP address, you use a Resolve
Multiple Conflicts wizard:
To quickly locate any conflicts, open the Smart Folders panel and open the Conflicts list.
Click the IP address for any entry in the Conflicts list. The IPAM page opens for the selected IP
address, with the top panel highlighted in pink to indicate the conflict.
In this case, the MAC address specified in the last fixed address object configuration, for that
object, conflicts with the discovered MAC address associated with the IP. (You can verify this by
checking the Related Objects tab in the IPAM page for the IP address.) Choose from one out of
two options:
● Change the configured MAC address to be the same as the discovered MAC
address;
● Keep fixed address and ignore this conflict for the next 1 day(s).
In this example, the Discovered information for the MAC address associated with the Fixed
Address object is one digit off from the Existing MAC information, which was entered incorrectly
by the administrator. The discovered MAC, shown in red, is the correct value and should be
used to overwrite the record for the conflict.
Select the ‘Update... with discovered data’ option and click Resolve. The wizard updates with a
return to the first step, in which you select the next conflict to resolve. A banner shows the result
of the first resolution.
Select the next conflict to resolve and click Next. As an example, screen shot below shows a
device configuration conflict.