Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

How can I use NPM or NCM to discover Cisco switch ports connecting to specific starting MAC address ranges?

How can I use NPM or NCM to discover all Cisco switch ports that are attached to devices from a specific printer manufacturer, and display the switch / port information in a list for a remediation task?

I have 300 devices (out of nearly 50,000 devices connected to several hundred Cisco switches across three states) for which I must remove a line of configuration from their switch ports. I'd love to learn how to leverage the capabilities of NPM and NCM to accomplish this.

Is there some functionality I can enable or turn-on in NPM or NCM to track devices' MAC addresses and IP addresses and enable me to list & sort / filter them?

Specifically, these are Zebra bar code printers. I have a spreadsheet of all their MAC addresses and IP addresses, and I'm tentatively resigned to SSH-ing into several hundred routers, manually using the "sho mac add add" command to see which switches the MAC addresses are in, then SSH-ing into the switches and using that same command to discover the switchports involved, and then manually reconfiguring those ports to remove a line of Cisco code.

It seems like NPM and NCM could be configured somehow to report/discover the switch ports. And if a given starting six-digit MAC address was present, then to issue a specific cisco config command to remediate that port's configuration.

What do you think--is this possible? And if so, how can I make it happen using NPM? I know how to build a basic Policy Report and set up remediation on it--it's just discovering the actual switches and ports on which to implement it.

Maybe cvachovecj or DanielleH can provide me a direction to investigate?

Yours,

Rick Schroeder

Find more posts tagged with

Accepted answers

All comments

ctlswadmin

Hey rschroeder, assuming you don't have UDT. The way I would approach this task is to run a query against the config table searching for those specific mac's. Once I had the node ID's I would run the commands you're using against those specific nodes, save the output to a file and query that using either powershell or export to Excel to parse the data.

rschroeder

Thanks for the response, ctlswadmin. Yes, I don't have UDT--I think things would be simpler with it.

I'd love to delve deeper into your suggestion. I don't have some important basics--perhaps you could clue me in on a couple of them?

How do you run your queries against the config tables? I've never done this, and describing in baby steps would be appreciated.
MAC addresses are in config tables? How'd that happen? Is there something I need to turn on or enable to get them into the config tables? If so, what has to be enabled, where is it, and how does one get this coolness flowing?
It sounds like you believe running such queries would find the MAC addresses, but isn't the scale awkward? I have 300 MAC addresses or IP addresses for which individual ports & switches must be found.
1. Does that mean 300 queries have to be run? Or is there a way to dump all 300 MAC addresses into a query, and get the switch ID's and ports/interfaces they're attached to in one output?
2. Please show me an example of such a query so I can test it--I'm liking what you're thinking.
Any kind of example of saving output to a file and running a query against it using powershell, or how to get that data into Excel, would be useful.

Thank you, kind sir, for any input or answers your time allows you to contribute.

Yours,

Rick Schroeder

p.s.: Anyone else with useful ideas or descriptions of experiences they've had with this kind of use of NPM/NCM, please add on to this thread. Don't leave it sit with only one contributor--your ideas might be the ones that work best!

ctlswadmin

Try the query below with one of your mac's. (I'm on an older verision, you might need to modify the query to fit your environment.) If you are using one of the newer NCM installs you can also view this data from the ARP report, to access the report navigate to 'My Dashboard > Configs > Reports > Group by Category and select Inventory'. The last steps mentioned are assuming you have your inventory enabled, if your 'Inventory' reports renders no data, then schedule an inventory for your network.

To enable a network inventory navigate to the 'Jobs' section, create a new job and set the job type to 'Update Inventory'. Configure the steps past that to accommodate your network, you can edit the inventory settings under NCM Settings > Node inventory.

Nodes.NodeCaption,ARPTables.LastDiscovery,ARPTables.MAC,ARPTables.Source,Interfaces.InterfaceName

ARPTables

Join Nodes

ARPTables.NodeID = Nodes.NodeID

Join Interfaces

ArpTables.NodeID = Interfaces.NodeID

ARPTables.LastDiscovery < DATEADD(Month, 1, GETDATE()) AND

.MAC = 'enter mac here. macs are not stored with : so eliminate that value'

rschroeder

I think perhaps one of the root prerequisites here is to turn on NCM to do MAC Address Inventory functionality, isn't it? I've never enabled that, believing it would bog down my SW systems, but maybe it's time to try it.

Any recommendations or suggestions before I do?

I assume it's a matter of selecting ARP and Bridge Table options in the Inventory Job within NCM--is this right?

Finally, how does the MAC address format play into the inventory or search? xx.xx.xx.xx.xx.xx versus xxxx.xxxx.xxxx versus with colons (xx:xx:xx:xx:xx:xx), and lower case versus upper case, etc.? Don't you just get frustrated when different products--even within the same manufacturer's lines--are incompatible with these three formats? Whatever happened to "standards" and "backwards compatibility" and products being "universally compatible?"

rschroeder

My noobishness with SQL and SWQL is revealed here. I pasted your query into the SDK SWQL tool and ran it against a MAC address from which I'd removed the decimals. SWQL is searching for a 'SELECT' command that's missing:

What is the right place to use this query, if not in the SDK Studio? Or, what's the actual query I should try, that includes a 'SELECT' input, ctlswadmin?

rschroeder

The good thing is that I have a spreadsheet of all the devices' IP addresses and MAC addresses.

I'm hoping to find a way to use NCM & NPM to find the switch ports connected to all these devices, so I can apply a config change on just those 300 ports. Digging through 140,000 ports manually can be done, but there's got to be an easier way.

I don't see anything in the ARP / MAC Inventory report that shows the access switch port on which a MAC address is found.

How to accomplish that--THAT is the question!

Any and all ideas a welcome!

sja

I quite sure that feature is not enable by default Cause it's a DB killer in big scale networks.

try that workaround job from NCM ,it's push that data output to a Linux box in that example..

sh mac address-table | redirect tftp://myserver10/myuser/${caption}.mac

sh ip arp | redirect tftp://myserver.10/myuser/${caption}.arp

sh int description | redirect tftp://myserver10/myuser/${caption}.desc

cahunt

Rick, do a 'show arp' and see if your are collecting that data from your access layer. Might you need to consider vrf or any other setup?

show arp (cisco)

To display the Address Resolution Protocol (ARP), enter the show arp command in EXEC mode.

show arp vrf vrf-name [traffic] [ ip-address | hardware-address | interface-path-id ] [traffic] location node-id

Other than that, I would say a straight script from NCM may do your trick.

I've been able to remove the need/option for Interface Selection by using interfacetype in the template, and configuring those in a certain case. I know you can also do this by Description or Caption.

There might be a way to use/include the MAC Address as well.

*In my mind early this morning it seems viable, but I am not sure how quick I can get to digging into this for you. I will try, or let you know if any other ideas come to mind.

** The idea here is to use NCM to do the job, but setup an auto selection for the most part, so you are not going through and checking all these node and interface boxes. You might have to select the nodes in the end (but if all of a certain model need this - that will be easy)

ref : Configure Physical Interfaces without interface selection - Cisco IOS.ncm-template (this uses interface type, but might have options to manipulate and make it work for you)

bobmarley

@rschroeder, these devices are hardwired and not wireless correct?

I would follow sja's advice and create an NCM job that would go collect the information from each switch and push it out to a tftp server or pipe it to a directory somewhere.

Assuming your switches are Cisco you will need one set of commands for IOS type and another set for Catalyst type since they differ.

You will only need this line if you already know your macs and IP's - sh mac address-table | redirect tftp://myserver10/myuser/${caption}.mac

This will create a file for each switch with a list of all MAC's attached to each port.

I think that would be your easiest approach, and if it's a once in awhile thing it will be sufficient.

Once you have the files collected there are many ways to scour through the directory and look for matches.

-the only gotcha is if these are wireless, in that case this isn't going to be as easy.

rschroeder

These are all wired devices.

The job will be interesting to build/run. New to me.

Syntax is no problem, whether IOS or Catlyst.

I do know all the devices' MACs & IP addresses.

The hope was that there'd be a relatively easy way to get the switch port information using NCM, but I'm not seeing it yet. So far all I've got is a list of all 50,000 IP addresses & MAC addresses in one spreadsheet, and another spreadsheet with the 300 IP addresses & MACs of the problem devices. Discovering which switch ports they attached to is the end goal. Once I have that, the remediation is easy.

I'd like to learn if UDT can provide the switch port information through some discovery / inventory process.

My in-house CMDB will eventually have this data, but not until it is rolled out to the Access switches; for now it's only active in the data center ports. Sigh. It's only time & money . . .

Thanks, @bobmarley.

bobmarley

I don't have NCM any longer at my new job but you should be able to set up a job to do the 'sh mac address-table' command against a single switch and then pipe the output of the command to files on your NCM server,

you should then be able to search for MAC addresses within that directory with Windows explorer.

If you strictly want to use Solarwinds and can't get a different work around another option would be to use NCM to run the 'sh mac address-table' command and then pipe that command to a syslogger program like klog.exe

then send the syslogs back into Solarwinds. Then you can use the Syslog search functions in Solarwinds to go find your mac/port information. I would test this in the lab first as this will cause your DB to grow some depending

on how many switches you are running.

Klog is a Solarwinds/Kiwi product you should be able to find it here http://www.kiwi-enterprises.com/downloads/Kiwi_Logger.exe

rschroeder

That's an interesting idea--using Klog, @bobmarley.

Yes, I do know the process for getting the MAC address per port information from single switches. And I could run that command against all switches via NCM. It's just getting that info into a place where I can search all the results for a specific set of 300 MAC addresses and find their switches & switch ports--that's the interesting challenge.

When using Klog, what kind of command goes into the switch so that the output of the command goes to Klog? "show mac address-table | redirect ?" Redirect to https? Redirect scp? Or perhaps you don't use the redirect command at all?

bobmarley

rshroeder

It's been awhile since I used NCM so you may need to investigate what variable to use for ${message}. That one is the one I used to use to pass Solarwinds text out from NPM, but I never did it in this fashion.

Maybe the -M isn't even needed? give it a try.

(where -H is your Solarwinds Syslog receiver)

sh mac address-table |Klog –H 1.1.1.1 –M “${message}”

********************************************************************************

Below is info on how to get Klog working. You will need to copy the klog.exe file to the Solarwinds NCM server to test it.

This software will allow you to send test Syslog messages from the Windows command line on your PC or it can be installed on

The Solarwinds server to create external Syslog messages also.

Download and install the executable (this is a Solarwinds product)

http://www.kiwi-enterprises.com/downloads/Kiwi_Logger

By default Klog installs in C:\Program Files (x86)\KLOG\

I’m using the DOS or command line version in my example so navigate further in to:

C:\Program Files (x86)\KLOG\KLOG Command-line Tools\klog\Command-line Tools and then copy this executable - klog.exe

Paste klog.exe into your C:\windows folder. This allows you to run the command from the DOS prompt regardless of what directory

You are running it from (Ie… puts it in your DOS PATH)

Open a CMD prompt and type klog -?

If the output looks like this then you have copied it (klog.exe) correctly to you Windows Directory

Below are also the options available to create your test message.

Usage: klog -u <port> -h <host> -p <priority> -f <facility no> -l <level no> -F

<facility name> -L <level name> -r <process name> -t -w -s -m "Message to send"

<port> Target port to send to (default is 514)

<host> Host (or IP) to send to (default is localhost)

<priority> Priority to use

<facility no> Facility to use (as a value)

<level no> Level to use (as a value)

<facility name> Facility to use (as a name)

<level name> Level to use (as a name)

<process name> Process name to use (RFC3164)

To send a test trap, at a minimum you will need a destination Host (-H 1.1.1.1) and a Message (-M "my test message")

The destination host should be your Solarwinds server that is your syslog trap receiver.

From the CMD prompt type as shown below

Klog –H 1.1.1.1 –M “this is my test message”

A message will be sent.

*****************************************************************

Hope this helps.