This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Monitoring devices behind a firewall.

rrrolfs3598 over 7 years ago

Is there a way to poll Devices that reside remotely behind a firewall. Is there a software tool that can be installed on a server in the DMZ that could collect all of the polling information and relay back to the main Solarwinds poller? We already know that we can purchase an extended poller. However the license is expensive and the return on investment would not be there. I am wondering what other companies are doing to address this issue.

Here is some more information on our setup:

We currently have IP based Automation devices that reside within our manufacturing facilities. These manufacturing facilities are located all over the World.
Our Solarwinds server is located in our data center in Denver.
The automation devices reside behind a firewall and are only accessible through the DMZ at the manufacturing facility.

0 d09h over 7 years ago

How agents work
Above link is relevant to Windows devices. Any chance your 'IP based Automation devices' are?
Cancel
Vote Up 0 Vote Down

Cancel
0 rrrolfs3598 over 7 years ago in reply to d09h

Thanks for the update. We are already utilizing the "Agent" to monitor Windows devices. We are looking for a solution to monitor routers and switches that reside behind the firewall.
Cancel
Vote Up 0 Vote Down

Cancel
0 fatset5 over 7 years ago in reply to rrrolfs3598

Hello rrrolfs3598,
If you are trying to poll or monitor devices using SNMP, open up UDP ports 161 and 162 (SNMP) to your DMZ Network (or specific devices if you want to be granular) on the firewall and you should be able to poll the devices. If you only need up/down information, permit ICMP.
Cancel
Vote Up 0 Vote Down

Cancel
0 ken_cohen over 7 years ago in reply to fatset5

I beg to differ on UDP ports 161 / 162. The default, to my knowledge, for SNMP polling is TCP 161 / 162.
Cancel
Vote Up 0 Vote Down

Cancel
0 d09h over 7 years ago in reply to rrrolfs3598

You can monitor syslog and/ or traps, but if firewall changes need to be made for that, then it's not too much of a stretch to ask for SNMP access from your poller. If you must get by on syslogs and traps, NPM can still be useful. You can still use the information for alerts/ reports/ views.
Cancel
Vote Up 0 Vote Down

Cancel
0 rrrolfs3598 over 7 years ago

I agree that we could open up ports TCP ports 161/162 and ICMP. However, because of the nature of our business we are not allowed to do that. We need a solution that allows us to place a appliance in our DMZ that can poll our secure automation devices that are located behind a firewall. We would then have Solarwinds poll the appliance. Has anyone done this? If so what did you do?
Cancel
Vote Up 0 Vote Down

Cancel
0 ken_cohen over 7 years ago in reply to rrrolfs3598

Here’s a link I found that talks about adding additional pollers to NPM: www.solarwinds.com/orion-scalability-engines
Kenneth W. Cohen
Network Analyst
Global Technical Services, IT
Office: 470-448-5870
Mobile: 678-428-9875
kenneth.cohen@hyh.com<mailto:kenneth.cohen@hyh.com>
Halyardhealth.com
- image001.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 ken_cohen over 7 years ago in reply to rrrolfs3598

BTW, here are the ports you would have to open on your firewall:
Addt'l Poller --> Orion Platform: TCP 17777 (SW Information Service)
Orion Platform --> Addt'l Poller: TCP 17777 (SW Information Service)
Addt'l Poller --> Orion Platform: TCP 1801 (MSMQ)
Addt'l Poller --> SQL Server: TCP 1433 (SQL Server Communication)
Kenneth W. Cohen
Network Analyst
Global Technical Services, IT
Office: 470-448-5870
Mobile: 678-428-9875
kenneth.cohen@hyh.com<mailto:kenneth.cohen@hyh.com>
Halyardhealth.com
- image001.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 rrrolfs3598 over 7 years ago in reply to ken_cohen

We researched adding an additional poller. It is my understanding that we would have to purchase an additional polling engine license. The cost of the license is several thousand dollars. The ROI is not there because we are only wanting to monitor approx. 100 devices. Am I missing something here? I am looking for a cost effective way to get this done. I was also wondering if this could be done with a proxy?
Cancel
Vote Up 0 Vote Down

Cancel
0 ecklerwr1 over 7 years ago in reply to rrrolfs3598

One thing you can do is use snmpv3 for security and then even block ICMP because it's not secure and only allow snmp... then when polling select snmp status polling vs. the default ICMP under list resources in manage node.
Cancel
Vote Up 0 Vote Down

Cancel