Cisco Network Assistant

[bhhouston]

I have a number of Catalyst 2950 switches that I manage with the Cisco Network Assistant (v 2.0). I can see all the switches inside the LAN but can't see any switches inside my DMZ or my point of entry switch outside the firewall.

Is there a way to configure my firewall so that I can see these switches with the Network Assistant?

Thanks, Ben

[paddyxdoyle]

Hi,

Is your firewall a PIX??

CNA uses CDP to discover devices and CDP is not supported on the PIX.

Here is an excert from the release notes:

"PIX Firewalls do not support the Cisco Discovery Protocol, so they are not automatically shown as neighbors in the Topology view. They are shown only after you add them to a community by using a Create Community or Modify Community window. To see a PIX Firewall link to another community member, you must add the link manually by selecting Add Link in a Topology popup menu."

So the PIX won't pass CDP traffic through hence your switches aren't being discovered, try manually adding them:

Manually Adding Members

Network Assistant provides two ways to manually add devices to a community.

1. In the Create Community window, enter the IP address for the device that you want to add.

2. Click Add to Community.

The second way to manually add a device uses the Topology view:

1. If the Topology view does not appear, choose View > Topology from the feature bar.

2. Right-click a candidate icon, and select Add to Community.

Candidate device labels are cyan; member labels are green.

Rgds

Paddy

[bhhouston]

Thanks Paddy.

Yes, I have a PIX 515E.

I can see the PIX and add it to my community but I can't see or add the the switches in my DMZ or outside the PIX.

I've even tried creating a new community with the DMZ switches but had no luck.

I suspect thats because the PIX won't pass CDP traffic and the workstation I'm using is inside the PIX but outside the DMZ.

I think I'll try installing CNA on a workstation in the DMZ and give that a shot.

Thanks for the help.

Ben

[paddyxdoyle]

One more thing, are you allow HTTP from your internal network to your DMZ as CNA uses HTTP once its discovered a device?

HTH

Paddy

[bhhouston]

Not specifically to the DMZ but I have several servers with both http and https access.

Ben