IoT Security
Integrate IoT Security with Switches for Network Discovery
Table of Contents
Expand All
|
Collapse All
IoT Security Docs
-
-
- Firewall Deployment Options for IoT Security
- Use a Tap Interface for DHCP Visibility
- Use a Virtual Wire Interface for DHCP Visibility
- Use SNMP Network Discovery to Learn about Devices from Switches
- Use Network Discovery Polling to Discover Devices
- Use ERSPAN to Send Mirrored Traffic through GRE Tunnels
- Use DHCP Server Logs to Increase Device Visibility
- Control Allowed Traffic for Onboarding Devices
- Support Isolated Network Segments
-
Integrate IoT Security with Switches for Network Discovery
IoT Security and Cortex XSOAR use SNMP to discover network
topology from switches.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of the following Cortex XSOAR setups:
|
IoT Security can work through Cortex XSOAR and an on-premises
XSOAR engine to retrieve information about the network from network
devices like switches and routers. To do this, XSOAR uses SNMP.
The engine begins by establishing trust with an entry switch by
sending it an SNMP community string for read-only access. A good
choice for an entry switch is one at the L2-to-L3 conversion point,
which is usually at the core or aggregation layer, because its position
allows it to get information from downstream switches. After making a
connection, the engine queries the switch for information about
the network to which it’s connected:
- Status of switch interfaces
- L2 VLANs and L3 subnets
- Network infrastructure devices like switches, routers, WLAN controllers, and access points
- IP addresses of network service devices like DHCP and DNS servers per subnet
- IP addresses of subnet gateways
- Endpoint devices
IoT Security also works with Cortex XSOAR to fetch the following information about
switches on the network learned through Cisco Discovery Protocol (CDP) and Link Layer
Discovery Protocol (LLDP):
- Switch MAC address, IP address, hostname, and serial number
- Switch vendor, model, and firmware version
- Switch location and description
As the XSOAR engine learns the IP addresses of neighboring switches
from the entry switch, it next collects network information from
them, including a list of their neighboring switches as well. XSOAR
continues collecting network information and learning about other
switches until it has queried them all.
After collecting information through SNMP, IoT Security adds newly discovered details about the
network to the Networks page and details about devices to the Devices and Device Details
pages.
Cortex XSOAR runs a recurring job to query switches. Running
the job on a daily basis is recommended although you can set the
interval between jobs to occur more or less frequently as you want.
SNMPv2c and SNMPv3 are supported.
Using SNMP to collect information from network switches requires either a full-featured Cortex XSOAR server or the purchase
and activation of an IoT Security
third-party integration add-on license, which comes with a free cohosted Cortex XSOAR instance. The basic plan
includes a license for three integration add-ons, one of which can be used for network
discovery. The advanced plan includes a license for all supported third-party
integrations.