>
    Strata Copilot
    Test and Debug the Network Discovery Plugin
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Getting Started
    4. Firewall Deployment for Device Visibility
    5. Test and Debug the Network Discovery Plugin
    Download PDF
    Device Security

    Test and Debug the Network Discovery Plugin

    Table of Contents

    Test and Debug the Network Discovery Plugin

    Diagnose Network Discovery issues directly from the firewall CLI so you can resolve problems faster and reduce the back-and-forth required to open a support case.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    One of the following subscriptions:
    • Device Security subscription
    • Precision AI bundle subscription
    • Device Security X subscription
    Starting with Network Discovery 2.4.0 and later 2.x versions, as well as Network Discovery 3.2.0 and later 3.x versions, the Network Discovery plugin includes CLI commands on the firewall that you can use to investigate discovery and polling problems. Use these commands when devices are missing from your inventory, when SNMP or OT polling is not returning the data you expect, when neighbor or topology information looks incomplete, or when you want to confirm that the plugin daemons and scheduled jobs are running as expected. If you need to reach out to support, you must run these commands first to capture their output in your Technical Support File (TSF).
    You can run a single end-to-end discovery playbook against a target IP address, start discovery and polling jobs on demand instead of waiting for the next scheduled run, adjust debug verbosity per plugin component, run targeted SNMP and OT polling connection probes, check the health of the plugin daemons, and inspect the operational files the plugin generates. These commands are available with the Network Discovery plugin 2.4.0 and later, and 3.2.0 and later.
    Use the set-debug-level commands only when you are troubleshooting an issue. Leaving debug logging enabled during normal operation can impact the performance of the Network Discovery plugin and the firewall it runs on. Set the level back to off after you finish collecting diagnostic data.
    CommandDescription
    request plugins network_discovery set-debug-level component <component> level <level>
    Sets the debug verbosity for a single plugin component. The running daemons pick up the new level on the next tick.
    component scopes the level to one of eal, neighbor, ot, or snmp. level sets the verbosity to one of high, medium, low, or off.
    request plugins network_discovery run-playbook ip-address <ip-address> [depth <depth>]
    Runs the end-to-end discovery playbook against a single target IP address and returns a per-stage verdict that covers CDP and LLDP neighbor discovery, L2 and L3 topology, VLAN and subnet lists, and endpoint discovery.
    ip-address is required and specifies the target IP address. depth is optional and sets the neighbor expansion depth, where 1 limits the run to just the target. The default depth is 1.
    debug plugins network_discovery snmp-walk [oid <oid>] [retries <retries>] [timeout <timeout>] [use-config] [use-service-route] [version <version>] ip-address <ip-address>
    Runs a diagnostic SNMP walk probe against a single target and returns a seven-step chain (input, config, route, L3, L4, auth, get) so that you can pinpoint exactly where an SNMP failure occurs.
    ip-address is required and specifies the target IP address. oid optionally overrides the default OID (sysName). retries sets the number of retries on timeout, and timeout sets the per-attempt timeout in milliseconds. Include use-config to reuse the matching SNMP profile from the running config instead of supplying credentials on the command line. Include use-service-route to apply the configured service routes for the source IP. version selects the SNMP version to use.
    debug plugins network_discovery connection
    Tests the SNMP connection to a single target IP address.
    debug plugins network_discovery asset_connection
    Tests the OT polling protocol connection to a single target IP address.
    request plugins network_discovery start-neighbor-discovery
    Starts a neighbor discovery job immediately instead of waiting for the next scheduled run.
    request plugins network_discovery start-data-refreshment
    Starts a data refreshment job immediately instead of waiting for the next scheduled run.
    request plugins network_discovery start-asset-attribute-polling
    Starts an asset attribute polling job immediately instead of waiting for the next scheduled run.
    show plugins network_discovery op-files list
    Lists each operational file the plugin has generated, with a one-line summary that includes whether the file exists, its size, its modification time, and its freshness.
    show plugins network_discovery op-files details file-type <file-type>
    Shows the detailed contents of one or all operational files. The plugin also copies the listed files into the plugin root directory so that a generated TSF (Technical Support File) includes them.
    file-type selects which file to show: all, node-details, node-endpoints, node-list-levels, node-topology, or node-topology-internal.
    show plugins network_discovery health-status
    Runs a health probe across the three plugin daemons (neighbor discovery, data refreshment, and asset attribute polling) and reports whether all daemons are healthy. For each daemon, the output includes the last heartbeat, the consecutive error count, resident memory, restart count, and the time the last job completed. The output also includes the plugin log path and a correlation ID that you can share with Palo Alto Networks support.

    © 2026 Palo Alto Networks, Inc. All rights reserved.