NPM polls for IP addresses as part of Node Rediscovery process. So content in NodeIPAddresses table should be updated every 30 minutes, by default (rediscovery interval for nodes). You can also force update by clicking on "Rediscover" on Node Details page or for multiple nodes in Web Node Management (More Actions -> Rediscover).
My Orion Rediscover process is also set to update every 30 minutes. So why are there 2 IPs linked to device Cisco model WS-C6509-E (core) that I cannot ping? When I look at this same system name in IPAM, it shows 3 additional IPs that are not showing in NPM. And I have 2 IPs in NPM that are not in IPAM. So I have the following IPs showing in both modules as:
.9 (ping fails) missing
.186 (ping fails) listed under system name SW01
NPM is able to populate list of IP addresses using DNS server and SNMP or WMI. IP address poll for SNMP node executes these steps:
- Perform reverse DNS lookup on Node's IPAddress (from Nodes table) to get fresh DNS name
- Perform forward DNS lookup on DNS name from step 1
- Query ipAdEntIfIndex OID (126.96.36.199.188.8.131.52.1.2) and ipv6AddrStatus OID (184.108.40.206.220.127.116.11.8.1.5) to get all IP addresses assigned to Node via SNMP
- Merge those two lists together, store result into NodeIpAddresses
Please be aware that NPM does not perform "pings" on these IP addresses to validate them. SNMP may provide addresses which are not reachable from Orion polling engine. Orion uses ping to primary IP address only, that's the one stored as IP_Address in Nodes table.
As it is hard to troubleshoot such issue offline, maybe better open a support ticket and provide output of nslookup <dns>, executed on polling engine, and a MIB walk of the affected node + Orion Diagnostics. You can use snmpwalk.exe tool, which is shipped with Orion (in C:\Program Files (x86)\SolarWinds\Orion).
Thanks zizi for your help thus far. I'm not sure if I'm allowed to provide specific names/ip's, so I'll do my best.
I ran nslookup for the node from the polling machine, using the polling ip, and I'm getting "*** (domain controller name) can't find (ip): Non-existent domain"
The full name of the node is core.****-llc.com, whereas **** is our internal website name.
I also ran snmpwalk.exe for the ip, and I found several ip's for OID(18.104.22.168.22.214.171.124.1.2) which don't agree 100% with NPM. I assume it's because of the nslookup error, right? I'll check with our DNS administrator to see if he has any ideas.
Per DNS admin, this node is not in DNS. Below are the IPs found in SNMPWalk.exe. It appears NPM does match the SNMP info.
NPM IPAM SNMP subnet
.4 .4 found B
missing .7 B
.9 (ping fails) missing found B
.10 missing/fixed found A - IP now shows up in IPAM after adding the subnet
.17 .17 found B - primary polling ip in NPM
missing .24 B
.25 .25 found B
missing .31 B
.186 (ping fails) listed under system name SW01 found C
n/a n/a .51 (on first line; from a subnet not in either module) D
Thanks for the quick reply. It is expected that NPM data should match list provided by SNMP agent. You can try to review IP address binding settings on the device itself and compare the list to the output from SNMP agent. As Orion relies on provided SNMP data, I'm afraid there is not much we can do, if those are corrupted. Polling via DNS may add more IPs into the list, when DNS server is not configured properly, for instance (obsolete static entries,etc).
Btw. you may not be able to reach all mentioned IP addresses from Orion Polling machine box via ICMP ping. It is expected, as device may report private addresses.
Thanks. I'm not sure I fully understand your reply (yet). Now that you explained where NPM is getting its information, the piece I seem to be missing is how IPAM is gather its information which could cause the discrepancies?
NPM and IPAM polls are not in sync (for IPAM it typically takes longer than 10 minutes to scan for all statistics data - you may see your IPAM subnet scan scheduler.) However both NPM and IPAM are using the same technique how to obtain node details. You may try to prioritize your IPAM subent scan in order to re-fresh IPAM data. If they are still not consistent. I would try to use packet capture tool - like Wireshark on end-station and filter requests from NPM and IPAM IP address in order to validate that both are polling the same node. (if you have duplicate subents, IPAM can poll data from one subnet only).
let us know if you tried above.
Hi! (fyi. I've been working with Network Topology Manager and its IP's agree with NPM.) I added a subnet to IPAM that wasn't there, and now one of the missing IP addresses is showing up (.10). However, another one (.9) is still not showing up. The settings for this subnet are 'No DNS server', "update but not erase manually entered data", and 'disable neighborhood scanning". Would the 'manually entered' cause extra IPs (.7, .24, and .31) for this device to show up in IPAM that are not in NPM? How do I know if they were manually added?
Since this device spans multiple subnets, would that have an impact? I'll added the subnet info to the chart above.
fyi. I deleted the SNMP data from IPAM's .7 IP address (since it probably shouldn't be there) and rescanned the subnet. The SNMP information re-populated.
I have a similar problem where some ICMP-only monitored devices are in the Nodes table, but do not show up in the NodeIPAddresses table.
When I merge the 2 tables together to have a full inventory view of IPs seen by my nodes, I get multiple NULL values on the join. Is there a way to trigger an update of the NodeIPAddresses table?