cnorborg · Network Professional IV · ✭✭✭✭✭

Maybe one of these might help? https://documentation.solarwinds.com/en/success_center/whd/content/helpdeskconfigureoutgoingemailaccounoffice365.htm

I don't think we're having that issue? So you have configured the Netflow on the device to send to the VIP and not the primary poller, right? Do you have firewall rules that might prevent it? Are both of your HA pair on the same subnet?

Well, unless you have the HA device managed via an OOB interface, its probably not going to be managed well. That does depend on the brand and how they implement it though. If you do manage it through an OOB interface, you can always add the connections manually if they don't show up? Not sure how useful it is though.

Is SAML an option? Much easier to work with if so…

Configure the firepower device to ignore traffic like that from the SW server. Just pass it through.

Try reading through this article. Odds are that Solarwinds hasn't seen the devices to add them. https://solarwindscore.my.site.com/SuccessCenter/s/article/Add-MIBs-to-the-SolarWinds-MIB-database?language=en_US

It does, but not in the NPM part of Solarwinds. That uses simple SNMP polling to download very simple bandwidth usage. For getting QoS based information, you need to be configuring and using the NTA module, or "Network Traffic Analysis" and configure up Netflow or something similar on your devices. You should be able to…

Yes, there is absolutely no easy way to take a DISA STIG file and import it into Solarwinds, neither now or in the past. @CourtesyIT did a ton of work to get the STIGS into Solarwinds Compliance rules for us. That being said, you really don't want simple DISA STIGs imported anyways. ie: a DISA STIG rule says you should…

Hmm… Do you mean one physical device that is split into multiple virtual devices? Or something like a firewall redundancy HA setup where you have two physical devices where only one is active at any given time? No idea on either, but a bit confused as to what you're really asking about?

Solarwinds is very browser oriented, and for some auditors who want to just be able to click on a link and have it open their preferred SSH tool rather than some funky HTML5 SSH client like Solarwinds uses, I created a simple resource that is just a simple link that a browser can open. It goes to "ssh://<IP ADDRESS>" and…

Here is an update for you! You can no longer say that the last post was from 2023, there is now a post from May 2026 entitled "Any Updates - ANYBODY????". 😁😜

It also depends on what you do with each service? ie: We send the vast majority of our syslogs to a Splunk instance, which is really beefed up, we only send config logs to SW so it can do RTCD. So, putting our logs on a separate database doesn't make a lot of sense. Same with Netflow, if you only have a few things going to…

Doing direct CAC authentication, or leveraging SAML to get you in? We use SAML, so far haven't had any issues, but I haven't upgraded all of our environments yet.

I don't envy you! Just a quick FYI - agents are MUCH easier and probably even safer…

But, don't forget to go to the http and error logs on the destination system also. I think the odds are the error is there from the error message you're getting. It should give you guidance as to what you need to solve…

Ok, so here is the fixed query with that change… SELECT n.Caption AS [Node], i.InterfaceName AS [Interface], i.InterfaceTypeName, i.PortStatus AS [Port Status], m.PortType AS [PortMode_Code], 'Access' AS [PortMode_Interpretation] FROM NCM.Interfaces i JOIN Orion.Nodes n ON n.NodeID = i.node.CoreNodeID JOIN…

Oops, used a bad field to use for "Interface". I used "InterfaceAlias". Try changing that to "InterfaceName" and it should work better!!

Yea, I think this one is more accurate, converted to using the NCM.Interfaces table, and had to use the implicit join to the NCM.Nodes to get to the "CoreNodeID" which is the name as Orion.Nodes.NodeID. Looks to be a bit more accurate for me, but as I said, will have to test some things!! SELECT n.Caption AS [Node],…

Oh, I think I already see the glaring issue. You're starting with your base table as Orion.NPM.Interfaces, which only has interfaces that are monitored by NPM, and we don't monitor hardly any access ports as we don't want to be bothered by them? UDT of course doesn't have all of them either, just the ones its monitoring.…

Interesting, I gave the query a try and either I'm much better about monitoring ports in UDT than I think I am, or there might be an issue with it on our network at least! Hopefully its the former, but I'll give feedback if it isn't…

Just run the configuration wizard, should fix it right up!! 😀😁

Well, remember that the devices only know since their last reboot. Solarwinds tends to remember most things for a year however. On my Arista devices, Solarwinds looks like it will say "never" for ports that are currently in use. 😮😟 So that's not good. On at least one Cisco box that's been up for a little over a year, I can…

So, I think what you really want is to alert again if they haven't taken action? That's actually part of the "Send Email" action. You can have it send another email after a period of time if the alert is not acknowledged. That way if the alert just sits there and nobody does anything, it sends out another email. But,…

Guessing they'll bring back the monthly missions a couple months before they decide to change the platform again? 😁

Web poller? Do you mean a "Additional Web Server", or an "Additional Poller". I don't think there are any web servers that poll, beyond the main poller/server that is? Either way, why move it, just create another one there? Ideally, either should be near the database and/or main poller, but not required…

So, the whole firmware process is rather confusing. First, you have to set up a firmware repository, which should be a network drive. This is under "Firmware Upgrade Settings" and "Path to firmware upgrade network share". You have to use a username and password that works. Be sure to validate this. This should NOT be the…

Take the classes, read the forums, their youtube videos are great! Play with it and learn how it works. https://www.youtube.com/solarwindsinc https://support.solarwinds.com/solarwinds-academy

Hmm… Interesting, I always thought something like this would be a good idea, had no idea that it existed. Always though Solarwinds should do it. That being said though, does the telemetry broker forward the information as itself? That would be rather useless I would think? In Kiwi Syslog for instance, when forwarding logs…

Huh, and here I thought it was kill the user, not the process. Guess I have some apologizing to do!! 😯🇩🇪🇦🇩 😵

Personally I find the additional verification to be very annoying!!!