Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

NetPath "Internal Unmonitored Device"

I am working on setting up dedicated SolarWinds agents on surplus PCs in some of our network closets to collect Span Port data for QoE as well as NetPath to some of our services.

I have noticed that some of our routed hops in NetPath are being picked up as strictly IPs and listed as "internal unmonitored device". Most of these are Cisco 4500x and Cisco Nexus 9Ks which are connected by transit networks. All of these interfaces are being monitored by NPM and configs being pulled by NCM. I have noticed the devices with less than 20 or so IPs issues on the VLAN Interfaces are working fine. If there are more than 20 say close to 100 like on our core Nexus 9Ks, it does not work.

I googled the problem and read a few of the Thwack posts to see what people say and its been a mix with not much of a solution.

I have tried:

1. Tried adding the device with hopes that it will realize that device already exists and update its list of IPs. Some times it adds it as a new and duplicate device. Other times to states that device already exists.

2. Reverse DNS

3. Monitoring not only the Layer 1 interface but the Layer 3 VLAN Interface.

4. Double checking the config and the IP address in the hope is showing up in the config that is being backed up.

5. The Knowledge Base it links to does not really help because there is no firewall between nor ACLs.

6. Thinking nasty words and threats.

Any ideas?

Find more posts tagged with

Accepted answers

All comments

Terryn123

BUMP

rjrothwell

It’s been over a year since I posted this and wanted to do a follow up of what I found out. It did not solve my problem 100%, but it will help others banging their head on this issue if they are using a mix of vendors and getting an understanding of how SolarWinds NetPath gets its data for the devices in the Path. I also created a support case with SolarWinds, Cisco, and Palo Alto, which brought a better explanation over this as well.

The unmonitored devices, which is already being monitored, must support the following OIDS.

1.3.6.1.2.1.4.20.1.1

1.3.6.1.2.1.4.20.1.2

1.3.6.1.2.1.55.1.8.1.1

1.3.6.1.2.1.55.1.8.1.5

NetPath does not match the IP to the device through the Config, but pulled by SNMP. The device must support these OIDs. It may also be a SNMP permissions issue if the device supports some SNMP security.

One quick way to confirm is do an SNMP walk and search for the oid 1.3.6.1.2.1.4.20.

Cisco Nexus configured with VRFs only deliver the ipAddrTable (1.3.6.1.2.1.4.20) based on VRF, not all IPs configured on the device. You must configure a SNMP string per VRF or setup the SNMP string as SNMPString@VRFName.

Here is some samples to work off, to point you in the right direction. (VRF1Name-context, VRF1Name, SNMPString, etc. are user changeable)

Nexus config:

snmp-server context VRF1Name-context vrf VRF1Name

snmp-server context VRF2Name-context vrf VRF2Name

snmp-server community SNMPString group network-operator

From SolarWinds setup with two different Devices using two different IPs to manage the device. I named them manually as DeviceName-VRFName to keep it simple for us.

SNMPString@VRF1Name-context

SNMPString@VRF2Name-context

Palo Alto does not support ipAddrTable (1.3.6.1.2.1.4.20). Please rattle your Palo Alto Sales Rep’s cage and tell them to vote for feature request, “FR ID: 1696 - Support of specific OID for IP addresses on the interfaces such as ipAddrTable (1.3.6.1.2.1.4.20)”
Cisco FirePower will need to be configured to respond to ICMP type 11. Also I found that our FirePowers running 6.4.0.x Code will only respond to 2 out of the 3 in the traceroute so every 2 or 3 probes in NetPath will not show up the firewall in the path or show some known device.

Miss response on the Cisco FirePower.

When it hits one of those missed responses.

When it works:

Not sure how to fix it or even if a different release has a fix or not.

What SolarWinds could do is to allow manual matching between “unmanaged devices” and devices. This is more of a feature request.