IT Gateway Discovery - No Device Found

[CSelf]

We are currently upgrading from DCE, during my initial testing of EcoStruxure IT I installed the Gateway on my laptop and had no issues discovering our current APC devices.  Since we are a 100% cloud based environment, I created a Windows Server 2019 Azure VM to host the Gateway.  I understand this is not recommended but have seen posts from folks with similar setups. 

The Gateway has been installed with the same settings I used during testing but no devices are found when running a discovery.  I can ping each of the IP's of the devices and even access their web pages from the VM and I've verified the necessary ports are open on the server as well as the firewall. 

Are there any specific settings on the devices that would block a discovery?

Anywhere I could specify the IP of the Gateway?

[Cory_McDonald]

Hello @CSelf,

I always recommend by starting with the NMC Event log to see if there are unauthorized attempts from your computers (gateway's) IP address.  The event log can be accessed from the NMC interface by going to: Logs > Events > Log.

Since these devices were already configured and communicating to DCE, most of the SNMP settings on the device should be correct.  In most APC SNMP interfaces this should be under: Configuration > Network > SNMPv1 > Access Control

If there is an NMS IP/Hostname you will need to update that value to be the Gateway IP Address (communication will be lost to DCE) or update it to be a more broad entry such as 0.0.0.0 or 10.10.10.0 depending on what DCE's IP address is and the Gateway's IP Address is.

If SNMPv3 is being used the menu option would be under: Configuration > Network > SNMPv3 > Access Control

As long as the same protocol is being used to Discover in the gateway that was configured to be used in DCE, the devices should discover.

The usual other culprit would be network.  You can attempt to do an SNMPwalk from your computer (where the gateway is installed) using the following utility: https://community.se.com/t5/Troubleshooting/How-to-create-a-device-walk-file-for-EcoStruxure-IT-Gate...

If the walk is successful then the communication channel is open and the discovery issue would fall to a configuration within ITE for the discovery.  Double-check your discovery settings or run another discovery using the same settings you used within the utility.

Kind Regards,

Cory

[CSelf]

Hi Cory,

Thanks for your response. 

There are a few "Detected an unauthorized user attempting to access the SNMP interface from.." with the IP of my endpoint, not the server running the discovery, is this normal?  Occasionally when I tweak the SNMP settings on one of the devices I'm testing with I'll see the same SNMP error in the logs with the IP of the DCE, it resolves itself when I revert the changes, the error with my endpoint IP is consistent.  I've verified all of the SNMP settings are the same on the devices as well as the gateway.

I downloaded and ran the device walker utility on the server, each device IP times out, I've tried multiple command variations including adding the read and write strings and specifying the port.

I've also checked our Palo firewall logs, traffic is getting out to the APC device but no packets are being sent back.  Other APC traffic (SMTP, SSL) passes through the FW with no issues. 

Thanks again for the great response.

[Cory_McDonald · Accepted solution]

Hi @CSelf,

If no traffic is coming back through the firewall, you will need to look and see what is occurring either on the device (should be processing the request) or on the network between the firewall and the device.  If this is happening to more than 1 device, the issue is likely something on the network that is blocking traffic, such as a layer 3 switch with ACLs or something that is blocking the outbound traffic (response) from the NMC back to the software.

A way to test if the device is responding to requests would be to connect your computer directly to the network port of the device and create an ad-hoc 1-to-1 connection.  You will need to assign an IP address that is on the same network as the device.  It is recommended to use an IP that is one number off from the IP of the device, the same subnet, and a gateway of the end-device so that traffic will flow correctly.

NOTE: Sometimes a Wi-fi adapter needs to be disabled or Wi-Fi turned off to get the communication to work properly.

You can then run the SNMPwalk software to see if you get a response from the device.  If you do, the issue is network related.  If you don't, either it is with the 1-to-1 network setup, polling software, or the device itself (not likely if it is affecting multiple devices).

Kind Regards,

Cory