FirewallBuilder

Another powerful way to find addresses of subnets and hosts on the network is to use the SNMP crawler.

Figure 6.8. Initial Parameters for the Network Discovery Program

The Network Discovery program (sometimes referred to as the "Network Crawler") needs a host from which to start. This host is called the "seed host"; you enter it in the first page of the Druid ( Figure 6.8). The crawler implements the following algorithm (this is a somewhat simplified explanation):

First, it runs several SNMP queries against the seed host trying to collect the list of its interfaces and its ARP and routing tables. This host is then added to the table of discovered network objects, together with the host's interfaces, their addresses and netmasks, and the host's "sysinfo" parameters. Then the crawler analyses the routing table of that host; this allows it to discover the networks and subnets, which in turn are also added to the list of discovered objects. Then it analyses the ARP table, which holds MAC and IP addresses of neighboring hosts. It takes one host at a time from this table and repeats the same algorithm, using the new host as a seed host. When it pulls an ARP table from the next host, it discards entries that describe objects it already knows about. However, if it finds new entries, it tries them as well and thus travels further down the network. Eventually, it will visit every host on all subnets on the network.

This algorithm relies on hosts answering SNMP queries. If the very first host (the "seed" host) does not run an SNMP agent, the crawler will stop on the first run of its algorithm and won't find anything. Therefore, it is important to use a host which does run an SNMP agent as a "seed" host. Even if most of the hosts on the network do not run SNMP agents, but a few do, the crawler will most likely find all of them. This happens because it discovers objects when it reads the ARP tables from the host which answers; so even if discovered hosts do not answer to SNMP queries, the crawler can discover them.

One of the ways to limit the scope of the network that the crawler visits is to use the "Confine scan to the network" parameter. You need to enter both a network address and a netmask; the crawler will then check if the hosts it discovers belong to this network and if they do not, discard them.

Figure 6.9. Parameters for Network Discovery: Page 1

Figure 6.10. Parameters for Network Discovery: Page 2

There are a few settings that affect the crawler's algorithm (see Figure 6.9 and Figure 6.10). Here is the list:

Once all parameters are entered, the crawler actually gets to work, which may take a while. Depending on the size of the network and such parameters as the SNMP timeout value, scanning may take minutes or even hours. The progress of the scanner can be monitored on the page in the Druid (Figure 6.11) and (Figure 6.12). You can always stop the crawler using the "Stop network scan" button. Data does not get lost if you do this as the Druid will use whatever objects the crawler discovered before you stopped it.

Figure 6.11. The SNMP Crawler Status

Figure 6.12. The SNMP Crawler Status (More)

The "Save scan log to file" button saves the content of the progress window to a text file and is mostly used for troubleshooting and bug reports related to the crawler.

If the crawler succeeded and was able to collect information it needed to create objects, you can switch to the next page where you choose and create objects.

Figure 6.13. Creating Networks Using Gathered Information

This part of the Druid is the same for all discovery methods.

The left column shows the networks that were discovered. The right column shows the network objects that will be created. To start with, the right column is empty.

This page of the Druid also has the following buttons:

The Druid can filter records in the table either by their address, by their name, or by both. To filter by address enter part of it in the "Address" field. The program compares the text entered in the filter dialog with an address in the table and shows only those records whose address starts with the text of the filter. For example, to only filter out hosts with addresses on the net 10.3.14.0 we could use the filter "10.3.14". Likewise, to remove hosts "bear" and "beaver" (addresses 10.3.14.50 and 10.3.14.74) we could use the filter "10.3.14.6". Note that the filter string does not contain any wildcard symbols like "*". The filter shows only records that have addresses which literally match the filter string.

Filtering by the object name uses the POSIX regular expressions syntax described in the manual page regex(7). For example, to find all records whose names start with "f" we could use the regular expression "^f". The "^" symbol matches the beginning of the string, so this regular expression matches any name that starts with "f". To find all names that end with "somedomain.com", we could use the regular expression ".*somedomain.com$"

Once you have reviewed the discovered networks, decide which ones you want to turn into Network objects. Then, copy those networks to the right column.

To populate the right column with objects, select the networks you want, then click the right arrow (-->) to put them in the right column.

Figure 6.14. Creating Networks Using Gathered Information (more)

Click Next. The discovered hosts list displays:

Figure 6.15. Creating Hosts Using Gathered Information

Again, populate the right column with the objects you want to create:

Figure 6.16. Creating Hosts Using Gathered Information (More)

Click Next. The final object list displays:

Figure 6.17. List of Objects

Here you can specify which type of object will be created for each discovered item: address, host, or firewall. Here, we are changing the object "sveasoft (10.3.14.202)" from a host to a firewall:

Figure 6.18. Specify Type of Object

Click Next. The target library control appears:

Figure 6.19. Target Library

Here you can specify which library the objects will appear in. Normally this would be User, unless you have created a user-defined library. Click Next.

The wizard finishes processing, and your new objects appear in your library:

Figure 6.20. Target Library