At Network Perception, we have combined our vast expertise of critical asset protection with next-gen technology to guide our customers on a path to cyber resiliency.
The journey starts with establishing a clear baseline and verifying that internal risk mitigation controls are followed.
The next step consists of gaining an accurate visibility of network architecture and cybersecurity posture.
Finally, developing a continuous monitoring approach to gain velocity and adapt quickly to disruptions.
NP-View is designed to run on a Windows 10 or Windows 11 with a recommended configuration of a 10th Gen Quad Core Processor and 16GB of RAM. This configuration should be sufficient for processing large data files up to 500,000 lines. Simultaneously loading and analyzing multiple devices with larger configuration files will maximize the use of available system resources and additional RAM may be required.
Installation Process
Sign up on the Portal website to download the latest version of NP-View Desktop and to download a license key. A SHA256 checksum is supplied with each download. You can calculate the checksum on the files you download to verify the integrity of the files:
Windows Powershell: Get-FileHash /the/full/path/to/your/filename.exe | Format-List
Once installed, NP-View will automatically launch.
Allow ports for private/public network if prompted.
NP-View has been designed to run offline, which means that the network connections attempted towards a public NTP server, the local DNS server, and the Network Perception update server are optional and do not affect the system if the internet is unavailable. More information on configuring NP-View can be found here.
NP-View Desktop is a resource intensive application. For best performance, please ensure your system’s Power plan is set to High performance.
If you have administrator access, you can enable Ultimate Performance by opening the command prompt as administrator and copy paste: powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 and press enter.
Windows control panel:
First Login
Upon first login, NP-View Desktop will require you to create an administrator account. Fill in the required information and click the “Create the NP-View administrator account” button. The password can be as simple or as complex as the user desires but needs to be at least 8 characters.
Local authentication is for users who wish to add an additional layer of protection. With this, the user can use whatever e-mail address and password they choose. If the user logs out of the system, the user id and password will be required upon subsequent application launches. Otherwise, the session remains open and authentication is not required.
Read and accept the user agreement.
Next, you will need to enter your license key. Once input, click the “Add license key” button.
Select your preferences for checking for automatic updates (requires internet access) and participation in our voluntary improvement program. Both selections use a slider that is default to off. To opt in, click the button and it will slide to the right. Click the save preferences button to complete.
Next click the get started button
User Menu
Access to the Help Center, License Manager, Update Manager and other administrative functions can be found on the User Menu located in the top-right corner of the Workspaces page.
Getting Started
On the Workspaces Page, NP-View provides a demo workspace as well as the ability to start creating your own workspaces. Click here to learn more about using workspaces.
Software Version
If you contact technical support, they will ask you for the software edition and version you are running. It can be found on the bottom left corner of the home screen.
Software Uninstall
To uninstall NP-View Desktop,
Windows 10/11: use the add or remove programs feature to remove the software
Use the add or remove programs feature to remove the software
Delete folder: ~AppData/Roaming/NP-View
Delete folder: ~AppData/Local/Programs/NP-View
Delete folder: ~AppData/Local/np-view-updater
Password Reset
Remove the file at the location listed below and restart the application to input your credentials.
Windows: Delete the file ~AppData/Roaming/NP-View/db/auth_provider.cfg and then restart NP-View.
License Changes / Upgrades
If you input a new license key from network perception, the user must log out and log back in for the changes to take effect. Note that the license key function is only available from the home screen (not from within a workspace).
Upload File Size Limit
NP-View enforces a maximum file size of 200MB by default. To change it, the config.ini file must be edited and the following row added: MAX_IMPORT_SIZE=<size in bytes>. For example: MAX_IMPORT_SIZE=209715200 which corresponds to 200MB.
Windows: the config.ini file can be found at: ~AppData/Roaming/NP-View/config.ini
Windows Path/File Name Length Limit
Microsoft Windows has a MAX_PATH limit of 256 characters. If the path and filename exceed 256 characters, the file import will fail.
For example: C:\Users\<username>\AppData\Roaming\NP-View\db\workspace\<np-view-user>@<workspace>\devices\<filename>
NP-View Server has been designed to be easily installed by a single person who has moderate Linux skills. This article provides step-by-step instructions on the installation process, which includes:
Provisioning a server
Downloading NP-View server
Installing NP-View server
Installing a SSL Certificate
NP-View is accessed through a web browser (Edge, Chrome, Firefox) running on a modern operating system (Windows 10 or later, macOS 11 Big Sur or later, Ubuntu 20 or later) with a recommended configuration of a 10th Gen Quad Core Processor and 16GB of RAM.
Provisioning a Server
The following table documents the CPU, memory, and disk requirements based on the number of network device configuration files monitored by NP-View server:
Number of network devices monitored
(firewall, router, switch) / concurrent users
Min. CPU
Memory
Disk Space
Up to 50 devices / 3 concurrent users
4-core
16GB
200GB
Up to 100 devices / 5 concurrent users*
8-core
32GB
400GB
Up to 500 devices / 10 concurrent users
16-core
64GB
2TB
Up to 1,000 devices / 20 concurrent users
32-core
128GB
4TB
Greater than 1,000 devices please contact support to discuss requirements.
Recommended as the minimum for most Professional Server users.
Note: loading and analyzing devices utilizes the majority of the CPU and Memory capacity. The higher the server capacity and the faster the CPU, the faster devices will load and be analyzed.
Network ports used by NP-View server
The following ports are used by NP-View server. Please ensure these ports are open on your firewall for proper communication.
Required ports:
TCP/22: SSH server to provide secure console access to the NP-Live server
TCP/443: access to NP-View Web UI through HTTPS
TCP/8443: access to NP-View connectors Web UI through HTTPS
Optional ports:
TCP/80: access to NP-View Web UI through HTTP
TCP/389: access to Active Directory / LDAP for LDAPv3 TLS
TCP/445: access to NP-View SMB Connector
TCP/636: access to Active Directory / LDAPS for TLS/SSL
TCP/8080: access to NP-View connectors Web UI through HTTP
Firewall Rules
The source IP should be the client workstation that will access NP-View and the destination IP should be the NP-View Linux server.
Downloading NP-View Server
Sign up on the Portal website to download the latest version of NP-View server and the license key. A SHA256 checksum is supplied with each download by clicking on the “show checksum” link. You can calculate the checksum on the files you download to verify their integrity:
Windows 10/11 using Powershell: Get-FileHash /the/full/path/to/your/file/name/extension | Format-List
MACOS: shasum -a 256 /full/path/to/your/file/name/extension
Installing NP-View Server
NP-View server is a Linux application. It can be installed on a virtual machine or physical hardware. There are 2 package formats available:
NP-View Virtual appliance (~2GB OVF) that works on all major hypervisor with support for the .vmdk disk format (e.g., VMWare ESXi).
NP-View Linux installer (~600MB) that works on all major Linux distributions on which Docker can be installed
The NP-View OVF uses Ubuntu Server 22.04 LTS or later. Root access is provided (see the text file provided with the .OVF) so the operating system can be periodically updated. This option should be used for new installations. The NP-View Linux installer is used to update NP-View on an existing system or for a new install on a Linux server.
Note: Network Perception does not recommend running NP-View in a double virtualized environment (Linux VM encapsulated within a Windows VM) as the operation of connectors, notifications and external interfaces can be unpredictable.
Option 1: Using the NP-View Linux Installer
Once downloaded from the portal, follow the steps below to complete the install:
Move installer to server – This may require ssh or other user account permissions
Place the file in a location you can access from the terminal
/tmp – this is a temp folder available at the root directory
/opt/np-live – this is the default NP View server root directory
You can use the “ls” command to see what is in your current directory
Log into the terminal or use SSH (Putty, PowerShell, etc.) into the Linux server
Set root level permission with the command (this will allow you type commands without adding “sudo” to each command)
sudo -I
Navigate to the directory in which the NP-View Server Linux installer was placed
Use the ls command to verify file is in this directory
Run the installer with the command (Docker must be installed before this step)
Example: sh NP-View_Full_Filename.sh (example: NP-View_Server_Linux_4.0.5-add6)
The installer will begin by checking for a running instance of Docker and internet connection
If Docker is not installed and running the installer will stop and you will have to manually install the latest version of Docker before continuing
If an internet connection is available and Docker isn’t installed, the installer will automatically download and install the latest version of Docker
If an internet connection isn’t available but Docker is installed, the installer will continue offline (Most Common Scenario)
If you are installing NP-View Server on Red Hat Enterprise Linux, use the following commands to install docker:
Prompt for default directory (/opt/np-live) We recommend keeping the default directory but it can be changed if preferred
Note: If the default directory is changed, then it will need to be edited for each new release during the installation
There will be a message once the installation is complete
Launch a browser to navigate to the NP-View User InterfaceExample of transfer with WinSCP:
Load WinSCP – It should default to this screen:
Default “File Protocol:” to SFTP
Fill in Host name, User name, and Password.
Host name would be the same as your NP-View Server IP Address
User name and Password are the same as the sudo credentials you use to log into the NP-View Server terminal.
Find the NP-View Linux Server Installer file in the left window. Then in the right window from the “root” select the “tmp” folder. Once you have completed both steps then click “Upload”.
Click Ok to complete the transfer.
Option 2: Using the NP-View Virtual Appliance
Once the Virtual Appliance OVF file has been downloaded from the portal, follow the steps below to complete set up:
Extract the .zip archive (right click on folder and choose extract all)
Import OVF into hypervisor
Update CPU/Memory/Disk Space to meet requirements stated in KB in the hypervisor settings
Open README.txt from extracted folder for credentials
Launch the appliance and log into terminal using credentials in README.txt
NP-View Server shell script will guide you through updating the NP-Live password, the root password, and to reset encryption keys
Once complete the NP menu will appear indicating the server is ready to use.
Launch a browser to navigate to the NP-View User Interface
Note: A static IP may need to be configured before utilizing the user interface.
Installing a SSL Certificate
NP-View listens on both port TCP/80 (HTTP) and TCP/443 (HTTPS). For HTTPS, it uses a self-signed SSL certificate by default. Users can also provide their own SSL certificate by simply copying a valid .pem file into the NP-View db folder. If using HTTPS, the best practice is to disable HTTP or forward HTTP to HTTPS.
The following command can be used to generate a valid .pem file:
To learn more about generating your own SSL certificate, please visit python documentation.
Please note that .pem file should include both the private key and the full certificate. If you received the private key and the certificate as two or more separate files, you can concatenate them into a single .pem file.
Setting the Virtual Appliance Time Zone
By default, the Virtual Appliance install creates the file `/opt/np-live/local-settings.yml`, set to America/Chicago. This file needs to be updated to reflect your local time zone. To change to a different time zone, log into the server using SSH and become root with the command sudo -i. You can then perform the following updates.
NP-View does not automatically delete log files, the Linux system admin may wish to schedule the above commands in a periodic CRON job to maintain optimal performance.
If server upgrade or restart issues continue to occur, please reach out to the Tech Support team.
Default Disk Encryption
As the NP-View OVF is typically installed within a secure environment, the disk is not encrypted by default for data at rest. The Linux Admin can encrypt the system drive for increased security knowing that system performance will be slightly degraded to accommodate the data decryption and encryption.
Personalize the Login Page
To add a custom message to the login page, a NP-View administrator can edit the file /opt/np-live/docker-compose.yml with the following entry in the webserver environment section: “- banner=Welcome to NP-view”
For NP-View, the file ~/Documents/np-live/config.ini can be edited to add: “banner=Welcome to NP-View”
Upload File Size Limit
When users upload a file through the Web user interface, NP-View will enforce a maximum file size which is 200MB by default. To change it, a NP-View Linux administrator can edit the file /opt/np-live/docker-compose.yml with the following entry in the webserver environment section: “- MAX_IMPORT_SIZE=209715200”. The value is in bytes, so 209715200 corresponds to 200MB.
Backing up the NP-View Server Database
Stop the NP-View Server (you can use the script /opt/np-live/stop_nplive.sh)
From the NP-View Server folder (by default: /opt/np-live/, run the command: tar -zcf db_backup_$(date '+%Y_%m_%d').tgz db (this command may take few minutes to complete)
Run the new release installer, which will update the containers and then launch NP-View Server
Complete Removal of NP-View
If you wish to completely remove NP-View from you server to start with a fresh install, perform the following steps:
Stop NP-View using the script /opt/np-live/stop_NP-Live.sh
Remove Docker containers using the command docker system prune -a as root (WARNING: this will completely reset Docker, so if non NP-View containers have been added they will be deleted as well)
Remove the NP-View folder with the command rm -rf /opt/np-live as root (WARNING: the NP-View database will be permanently deleted)
Network mapping provides the Networking Team (Network Engineer, Network Security) with capabilities that allow users to:
Visualize an accurate topology of the network architecture
Identify and label critical cyber assets and critical network zones
Easily review which devices are protecting which network zones
Visualize Topology
NP-View can be used to discover your network topology and the underlying control plane, including layer-2 and layer-3 configurations. Without leaving the topology map, you can review many aspects of the network’s design including Firewalls, Routers, Switches, Gateways, Networks, VPNs, Hosts and more.
Critical Assets and Zones
Each asset can be tagged with categories and criticalities as well as grouped into zones making it easy to review which devices are protecting which network zones.
Details On-demand
Selecting a node in the topology map will interactively display an information panel with detailed data about that node.
Firewall ruleset review provides Network Engineers, Network Security, and Compliance Analysts with functionality for:
Easy review of firewall access rules and object groups using the Access Rules and Object Groups reports.
Automatic identification of configuration risks using the Risks and Warnings report.
Validating recent policy modifications as part of a configuration change review process using the Change Tracking report.
How to Review Access Rules
An independent review of firewall policies has to be periodically conducted to ensure that network access rules are correctly implemented and documented. It is important because lack of access rule review leads to unexpected network access vulnerabilities.
Frequency: each time firewall policies are changed, and at least once a quarter
How to do it:
Step 1: given a workspace populated with network device configurations, open the Access Rule table from the main menu (top left)
Step 2: leverage the “Column Search” feature or the “Compare” feature to show the rules in scope of your verification
For instance, filter the “Device” column to only show rules for a specific device, or filter the “Binding (ACL)” column to only show rules bound to a specific interface, or use the “Compare” feature to only show rules added or removed recently
Step 3: review values for the source, destination, service, binding, risk, and description of each rule in scope
The “Description” column captures comment, description, or justification from the device configuration
The “Risk” and “Risk Criticality” columns are populated by NP-View during the automated risk analysis
Step 4: to identify rules that are not justified, sort the table by “Description”. Empty values will be shown at the bottom.
Step 5: to document your review process, double click on the “Comment” or “Comment Status” cells to add your own comment. The comment status can be either “Verified” or “To Review” or “To Revise”
Step 6: to save an evidence of your review process, export the table to Excel using the export options in the top right corner of the table
Access Rules Table
The Access Rules report provides the users with complete details on each Access Rule with the ability to add justifications and actions.
Object Groups
The Object Groups report provides the users with complete details on each Object Group with the ability to add justifications and actions.
Risks and Warnings
As modifications are made to the network, the Network Perception default Policies and Requirements identify potential risks. The Risks and Warnings report provides the users with a summary of the potential risks and their criticality with the ability to add actions and comments.
Change Tracking
As modifications are made to the network and the updated configuration files are imported, the changes are logged in the Change Tracking table.
Using industry best practices, Network Perception automatically identifies potential risks related to network configurations. Using the Network Perception Connectivity Path analysis, the user can review each of the highlighted risks and make a judgment on action.
Exposure of Vulnerable Assets – Vulnerability Analytics
NP-View provides your security team with a single pane of glass for reviewing network vulnerability exposure. With the addition of scanner data or data from a vulnerability data service, vulnerabilities can be tracked across your network.
Topology Display of Vulnerabilities
When scanned data has been added to a workspace, and a topology view is built that also includes that scan data, nodes on the topology of that view will be marked with a shield indicating the presence of vulnerabilities.
Firewalls, Gateways, and Hosts may contain vulnerability and service information imported from scans. Clicking on any of these nodes in a View that contains vulnerability information, will display it in the info panel that opens over the main menu.
Clicking on the Vulnerabilities link will present a pop out with the vulnerability details.
Performing a regular review of your compliance metrics is important for your organization. Performing the review manually is time consuming and tedious. Audit assistance provides the Compliance Team (Auditor, Compliance Officer, Compliance Analyst, and Consultants) with capabilities that allow users to:
Verify compliance with cybersecurity regulations and best practices through Policy Review.
Seamlessly store evidence for compliance review with Change Tracking.
Easily prepare compliance reports using the Audit Assistants listed below:
Workspace Report (Standard)
The Workspace Report assistant is available within each workspace and will generate a report for a specific view that includes detailed information about configuration files that were imported and parsed including:
Configuration assessment report including risk alerts
Ports and Interfaces
Access rules
Object groups
Path analysis
Industry Best Practice (Premium)
The Best Practice assistant requires a license to activate. This report is available within each workspace to generate a report for a specific view that includes the following topics:
Parser Warnings and potential misconfigurations
Unused Object Groups
Access Rules missing a justification
Unnamed nodes
NP Best Practice Policies on access rules and CiS Benchmarks that have identified potential risks
ACL’s with no explicit deny by default rule
NERC CIP Compliance (Premium)
The NERC CIP assistant requires a license to activate this function and guides the user through the steps required to create a report covering CIP-005 requirements. The NERC CIP audit assistant is only available within a NERC-CIP workspace and allows audit teams to classify BES cyber assets as High, Medium, and Low based on the standards. We have added a category for untrusted (Internet, Corp, etc.) to tag non BES assets. NP-View allows compliance teams to collect and report evidence related to the following requirements:
CIP-002 – BES Cyber System Categorization; impact rating and 15-month review
NP-View uses reports to present network information related to the open workspace. These reports are available to all users and can be accessed from the main menu. All of the reports are continuous scroll and can be searched by table or column. Searches can be combined between the table and columns.
Viewing Note: The reports are displayed with alternate rows shaded in a light gray. Also, in some columns (e.g., Risks) we also use a light gray text. We have noticed that some custom calibrations will turn these colors to white. If the gradient rows or text colors are not displaying on your screen try calibrating your monitor to the default settings to make them visible.
Access rules
This report provides a summary of all device rules loaded into the workspace and can be accessed from the main menu (left image) or from the device info panel (right image).
If accessed from the main menu, rules for all devices in the workspace will be displayed. If accessed from the info panel, only the rules for the selected device will be displayed.
Access rules column details
+
Action: (RULE_ACTION) Permit, Allow or Deny.
Application: (RULE_APPLICATION) Filtered application name associated with the rule (only for next-gen firewall).
Bindings (ACL): (RULE_ACL) Name of the access list under which the rule is defined. This is a normalized zone representation of [src zone]:[dst zone] or interfaces if zones are not used [src binding]:[dst binding].
Change Status: used in comparison mode to reflect added, unchanged and removed rules.
Comment (Author, Date Status): User entered comments (or justification) and associated status (verified, to review, to revise).
Description: (RULE_DESCRIPTION) Remarks from configs associated with rules. Typically found in Cisco and SonicWall devices.
Destination: (RULE_DESTINATION) Object group destination for the rule.
Device: (RULE_DEVICE) Device host name as defined in a configuration file.
Dst Binding: (RULE_DST_BINDING) Outbound interface to which the rule is bound.
Dst Criticality: (RULE_DST_CRIT) Criticality of the object group destination (or the parent zone containing the object group destination) as defined by the user on the topology map.
Enabled: (RULE_ENABLED) Rule is enabled (True / False). The enabled column gets its value from the firewall config. The parser then decides if the rule is supported (True) or not (False). Disabled rules (value from firewall config) are displayed in the table as False and may have a green or gray text color.
First Hit: Timestamp of when rule was first accessed (Palo Alto NGFW Only).
Hit Count: (RULE_ACL_HITS) Number of times the ACL was accessed (Palo Alto NGFW Only).
Hit Updated: Timestamp of last hits import. (Palo Alto NGFW Only).
First Hit: Timestamp of when rule was last accessed (Palo Alto NGFW Only).
Line #: Line number(s) in the configuration text file where the rule can be found.
Object ID: Value for linking rules to comments. This column must be displayed when exporting the rule table for enrichment and reimport.
Risk: (RULE_RISK) Highest risk text for associated Risk Criticality.
Risk Criticality: (RULE_RISK_CRIT) Highest criticality assigned by the triggered risk rule.
Rule: (RULE_NAME) Name of the rule found in the configuration. If the rule doesn’t have a name (e.g., Cisco devices), the value is populated by NP-View as RULE_X where X is the rule index.
Rule Tag: Palo Alto Only – rule tags from firewall.
Rule UUID: Palo Alto Only – rule UUID from firewall.
Service: (RULE_SERVICE) Object group service(s) associated with the rule. Alternatively, the field may be represented in a protocol/port-x to port-y format. For example, TCP/any to 53 (meaning TCP protocol, any to port 53), IP/any to 50 (meaning protocol 50). For ICMP we store the ICMP types in those fields. For example: “any to 11” or “any to 3” represent Type 3 — Destination Unreachable, Type 11 — Time Exceeded.
Source: (RULE_SOURCE) Object group source for the rule.
Src Binding: (RULE_SRC_BINDING) Inbound interface to which the rule is bound.
Src Criticality: (RULE_SRC_CRIT) Criticality of the object group source (or the parent zone containing the object group source) as defined by the user on the topology map.
Type: (RULE_TYPE) Type of rule (regular or VPN).
User: (RULE_USER) Filtered user name associated with the rule.
SRC and DST Criticality Calculations
+
Note that this feature was removed from v5.0 and up due to performance issues. It may return in the future.
The source and destination criticalities are calculated based on the higher of the criticalities assigned to the device, network, and zone (aka. binding) that the device is in.
if device A is in network N1 and bound to zone Z1 and A is Low, N1 is Medium, and Z1 is High, then the criticality of A will be High (highest criticality based on zone)
if A is Medium, N1 is Low, and Z1 is Low, then the criticality of A will be Medium (highest criticality based on device)
if A is Low, N1 is High, and Z1 is Medium, then the criticality of A will be High (highest criticality based on network)
Fields with more data than can be shown within the columns with display a + icon which will show the additional data when clicked. The source, destination and service columns will show related object groups and object data within the + popup.
Columns can be displayed or hidden using the Kebab menu in the upper right corner of the report. Changes to the menu are automatically saved. Additionally, the table can be exported as displayed, with comment history or with object groups. Only visible columns will be displayed.
Columns can be sorted, rearranged or resized and changes will be automatically saved. Column filters can be displayed. Filters applied to the table or column will automatically be saved. Filters can be reset from the kebab menu. The default sort order for the table is ‘Device’ then ‘Line #’. To reset to the default sort order, open the Kebab menu and click “Clear all filters”.
Note that when filters are applied, a filters active indicator will be displayed.
When switching devices or views, the filters remain until cleared which may provide the user with unexpected results until the filters are changed or cleared.
Access rule commenting
Comments can be added to a row by double-clicking on the cell in the column “Comment”. Comment text and status can be added and then saved with the save button.
Once the comment is saved, the author and time stamp are automatically added.
Additional comments can be added and the history of comments can be displayed. Comments can only be added to the history, editing and deleting is not supported.
The history of comment changes can be viewed by clicking the clock icon in the left most column. If there is no comment history the clock icon will be disabled.
Access Rules Hash
+
Access rules are uniquely tagged (Object ID) within NP-View for linkage to comments and risks. The tag (hash) is calculated based on a hex converted combination of the following data fields. Available data varies based on manufacturer so, some fields may not apply to specific manufacturers. Most of the fields are defined above. For the fields unique to the hash, they are documented below.
If any of the data in these fields changes, the tag will change and previously linked comments and risks will no longer be associated with this rule.
Destination: (group contents excluding group names*)
Service: (group contents excluding group names)
Source: (group contents excluding group names)
Application: (group contents excluding group names*)
Vendor-specific Variables:
Action
Direction: is used to set some rules to isolate guests from LAN so that rules in the VLAN section of the firewall be set. Each specific network is going to have a set of rules. Depending on the rules created, each traffic will be labeled in, or out, or both.
Enabled
Scope: is for the traffic zones used in their networks. Rules can be created based on the parameters of interzone, intrazone, and universal.
Type
*If the group name changes but the contents stay the same, the object_id will not change.
Additional Features
The Compare button invokes a time series comparison function for the report. Additional details on this function can be found here.
Comments can be imported from an Excel file. Additional details on this function can be found here.
Default Table Highlights are applied to this table report. Additional details on this function can be found here.
Asset Inventory
This report provides a summary of all assets loaded into the workspace including: Firewalls, Routers, Switches, Gateways and Hosts.
If an IP address is displayed as 0.0.0.0 this device has an IP address assigned by DHCP and while the device was detected, an IP address could not be extracted.
Unmapped hosts have enough information for inferring but not for mapping purposes on the topology. For some devices there may be a large number of hosts defined in Asset Inventory but less are showing on the topology map. These ‘invisible’ hosts are located behind mapped gateways and can be seen in the gateway’s peer list.
Asset Inventory Columns
+
Alias: List of alternative names identified in configuration(s) or auxiliary data, separated by “:”.
Category: User assigned category from the topology map.
Created At: Time and date when the device was added to the workspace.
Created By: Files used to create the device or host.
Criticality: User assigned criticality from the topology map.
Description: Description from the configuration file if available.
ID: Internal asset ID used for table display purposes.
IP address: IP address of the device, gateway, or host.
Label: Initially mirroring the Name field but can be changed by the user on the topology map and represented in this field.
MAC Address: The MAC addresses assigned to the devices, typically from auxiliary data.
Name: Device host name as defined in a configuration file.
OS: Host operating system derived from third-party data files.
Security Zone: The security zone assigned from the configuration file.
Services: Host services derived from third-party data files.
Updated At: Time and date when the device was last updated (configuration change).
Updated By: Type of file used to update the device.
Zone: The zone assigned from the topology map.
Object Groups
This report provides a summary of network ACL object groups including: Host IP addresses, network address of group members, and nested object groups. Object Groups classify users, devices, or protocols into “groups” and apply those groups to Access Control Lists (ACLs) to create access control policies for those groups. This report can be accessed from the main menu (left image) of from the device info panel (right image).
If accessed from the main menu, objects for all devices in the workspace including globals will be displayed. If accessed from the info panel, only the objects for the selected device will be displayed. When data is loaded from a firewall vs Network Management system, the listing of object groups for addresses may vary.
When viewing data from a network management system, globally defined groups may be available.
When the data is loaded from the firewall, the global addresses may be presented as local addresses.
Objects consist of several types including Address, Service, Binding, Interface, and Zone.
Object Groups Columns
+
Change Status: used in comparison mode to reflect added, unchanged and removed objects.
Comment: (Author, Criticality, Date) User entered comments (or justification) and criticality levels (low, medium, high).
ID: NP object identifier
Internal: NP object identifier
Luid: NP object identifier
Name: (OBJECT_NAME) Name of the object group which may include:
Any IP address–includes a range from 0.0.0.0 to 255.255.255.255
Host IP addresses
Hostnames
Other network object groups
Ranges of IP addresses
Subnets
Object ID: Value for linking rules to comments. This column must be displayed when exporting the object table for enrichment and reimport.
Origin: (OBJECT_ORIGIN) Name of the device containing the object definition
Type: (OBJECT_TYPE) Address, Service, Zone or Protocol
Unused Status: (OBJECT_STATUS) Cisco, Juniper and Fortinet status column which defines if the object is not used. True = Unused.
Value: (OBJECT_VALUE) Content of the object group
Fields with more data than can be shown within the columns with display a + icon which will show the additional data when clicked. The name column will show related object data details within the + popup.
Columns can be displayed or hidden using the Kebab menu in the upper right corner of the report. Changes to the menu are automatically saved. Additionally, the table can be exported as displayed, with comment history or with object groups. Only visible columns will be displayed.
Columns can be sorted, rearranged or resized and changes will be automatically saved. Column filters can be displayed. Filters applied to the table or column will automatically be saved. Filters can be reset from the Kebab menu. The default sort order for the table is ‘Origin’. To reset to the default sort order, open the Kebab menu and click “Clear all filters”.
Note that when filters are applied, a filters active indicator will be displayed.
When switching devices or views, the filters remain until cleared which may provide the user with unexpected results until the filters are changed or cleared.
Object group commenting
Comments can be added to a row by double-clicking on the cell in the column “Comment”. Comment text and status can be added and then saved with the save button.
Once the comment is saved, the author and time stamp are automatically added.
Additional comments can be added and the history of comments can be displayed. Comments can only be added to the history, editing and deleting is not supported.
The history of comment changes can be viewed by clicking the clock icon in the left most column. If there is no comment history the clock icon will be disabled.
Object Group Hash
+
Object groups are uniquely tagged (Object ID) within NP-View for linkage to comments. The tag (hash) is calculated based on a combination of the following data fields. Available data varies based on manufacturer so, some fields may not apply to specific manufacturers. Most of the below fields are defined above. For the fields unique to the hash, they are documented below.
If any of the data in these fields changes, the tag will change and previously linked comments and metadata will no longer be associated with this object.
OBJECT_NAME
OBJECT_TYPE
OBJECT_ORIGIN
OBJECT_VALUE
OBJECT_STATUS
OBJECT_TAG
Additional Features
The Compare button invokes a time series comparison function for the report. Additional details on this function can be found here.
Comments can be imported from an Excel file. Additional details on this function can be found here.
Table highlighting can be applied to this table report. There are no default highlights for Object Groups. Additional details on this function can be found here.
Risks & Warnings
When a potential risk or warning is identified, it is logged in the “Risks and Warnings” table with a time and date stamp. Each potential risk is assigned a “type” (Risk or Warning) and a Criticality (High, Medium, Low) based on the active policies in the Policy manager. Additionally, the device name and a description of the infraction is listed with the status (New, Confirmed, Resolved, False Positive, Will Not Fix or Fixed).
Risk & Warning Status and Life Cycle
For new risks or warnings, the expectation is that the user will review each item, determine if the issue needs to be addressed and they can manually change the action status accordingly.
new
confirmed: new risks or warnings that are acknowledged by the user as a valid problem to address
resolved: risks or warnings that are closed because the problem has been addressed
false positive: risks or warnings that are closed because they are not a valid problem to address
will not fix: risks or warnings that are closed because it was decided to not address them
Upon subsequent network updates, the system will adjust the status if required. For example:
If the user marks a risk as Resolved and upon the next network update the risk is still identified, the status will automatically be changed to Confirmed.
If upon the next network update the risk is no longer identified, the status will be changed to Fixed. Fixed items are removed from the list after a period of 7 days.
Note that if no risks or warnings are displaying in the Risks and Warnings report, please check the Policy Manager and verify that at least one policy and requirement is enabled and that at least one device is selected to run the risks report.
Risks & Warnings Columns
+
Time: (RISKWARNING_TIMESTAMP) Date and Time the potential risk was identified and logged.
Type: (RISKWARNING_TYPE) Risk or Warning.
Criticality: (RISKWARNING_CRITICALITY) High, Medium, or Low as defined by the identifying policy and requirements.
Workspace: (RISKWARNING_WORKSPACE) Name of the workspace containing the potential risk or warning.
Device: (RISKWARNING_DEVICE) Name of the device containing the potential risk or warning.
Description: (RISKWARNING_DESCRIPTION) Description of the potential risk or warning from the policy manager.
Status: (RISKWARNING_STATUS) Current status as defined above.
Comparison Report – Show History
Access Rules and Object Groups have a Compare function to show historical differences in data that has been added or removed. The function can be engaged by clicking the “Compare” button located at the top of the page. This function is used to display changes over a period of days.
The user can select a time frame (7, 30, 90 or 356 days or a custom date range). The user can select one or more devices to include in the report and then show the history over the range. Once the parameters are selected, the “Show Comparison” button should be selected.
The comparison function will display all changes (Rule Adds, Rule Removal and Unchanged Rules) for the selected days. The data will be displayed using the column format of the selected table. The user can filter on added, removed or unchanged rules by clicking the jelly bean. Added rules will be highlighted in green, removed rules will be highlighted in red and unchanged rules will be highlighted in light blue.
Clicking the “Compare” button will revert to the normal table but will not clear the selections.
Clicking the “Reset” button will clear the selections and reset the table.
Table Highlighting
NP-View reports use highlighting to help the user quickly identify important information. The highlighting is controlled by the Table Highlight tab under the Policy manager function.
To learn more about Table Highlighting and the Policy Manager refer to the Policy Manager article.
Column Sorting
Individual columns can be sorted ascending or descending as well as hidden from the table by using the Kebab menu on each column.
The report can also be personalized by adding or removing columns. By clicking the Kebab menu in the upper right, a list of columns will be displayed. The user can enable and disable specific columns for viewing. Selections are automatically saved.
Displayed columns can also be personalized. The user can change the column size (drag between columns) and order of the columns (drag from header).
The updated configuration will apply to all reports of the same type across workspaces. Each user can personalize the reports to meet their needs.
Note: Select reports have data export and import capabilities. Details on these features can be found here.
Change Tracking
As modifications are made to the network and the updated configuration files are imported, the NP-View automatically detects the changes and logs them in the Change Tracking table. For each change, the timestamp, action, device, and description are recorded.
The actions recorded are as follows:
File import – for each file uploaded, of the following statuses will be displayed
“failed import” – file failed to import, review help center for reason
Topology map – for each file uploaded, of the following statuses will be displayed for the topology map
“device path information” – triggered if the connectivity matrix changes
Path can be added or removed
Assets refers to destination IP addresses
Services refers to the unique ports (or any) associated with the imported device
Details on the above can be viewed in the Connectivity paths
“topology updated” – indicates the topology map has been successfully updated
“topology failure” – indicates the topology map has failed, review help center for reason
Connectivity Paths – for each file uploaded, of the following statuses will be displayed for the workspace
“workspace analysis updated” – all other tables have been successfully updated
Changes are displayed by calendar day. At the top of the table is a drop down that allows the user to select which day to review. The default is the current day.
The change tracking table can be searched, sorted by any column, switched to a list view, exported, and configured with alternate columns if required. These functions are available in the upper right corner of the table.
Connectivity Paths
This report provides a summary of network paths and their analysis results. By clicking on a specific rule sequence, the associated access rule can be displayed for review and comment. This report is only available from within a view.
This interactive report provides a network path comparison between two points in time. When a configuration file is added to the system and is different from the previously imported file, a new “Version” is created. The user can select two versions to compare. The resulting table will display the changes between the two files. Removals in the left column and adds in the right column.
This interactive report is available from the main menu when two or more zones have been created. This report can be used to verify open ports between zones. This report is only available from within a view.
This interactive report is available from the main menu and from the device info panel to show all interfaces identified on the device. If opened from the main menu, all devices and interfaces will be displayed. If opened from a single device, only devices and interfaces from the selected devices will be displayed.
This interactive report is available from the device info panel and can be used to verify open ports between devices. This report is only available from within a view.
The system logs features shows a detailed sequence of tasks attempted and completed. This log is primarily used for system debugging and contains information, errors and warnings derived during system operation. The system log feature has three views, Workspace, User, and System. The System view is accessible only by the Administrator and shows the overall operation of system across users and workspaces. The workspace and user views are available to the Administrator and Workspace Admin. The user view shows the actions taken by the current user on the open workspace. The Workspace view shows system actions for the open workspace. The views can be filtered to show only information, errors, warnings or all. Errors are generated when a system operation fails to complete. Warnings are generated during data parsing and when policy / requirement infractions are identified.
Background Tasks
The background task functions shows the status of each task spawned by a data import, merge, analysis or running policy. A parsing task indicates the imported file is being normalized and hosts inferred. Merge tasks combine the blueprints into the topology map. Analysis defines all of the paths and open ports. Policies review the active requirements to identify potential risks for review or to provide cell / text highlighting for reports.
The report displays the task name, its progress, the workspace the task is running, the user who owns the task and the time it started or ended. The check box allows the user to filter on the tasks pertinent to the current workspace. The X allows the user to cancel a task that may be running too long or be stuck for some reason.
The user can also cancel all tasks within a workspace using the “Cancel All for this Workspace” button.
Tip: Click on the active spinner on the topology map to invoke the Background Task report.
Beginning with NP-View Version 5.0 (release notes) users will now have access to a new feature called The Zone Matrix.
What does it do?
The Zone Matrix leverages the visual zones that users create on the topology map to create a matrix that illustrates access between these visual zones. This allows users to analyze and confirm segmentation and access.
Where is it located?
The Zone Matrix is accessible from both the Main Menu and the Manage Zones panel
On every view that contains Zones
Except for the Home View (there is no path analysis on the Home View)
Saving the Matrix
Two paths to save and document The Zone Matrix for your organization to use as an artifact:
NP-View can import auxiliary data from third party systems to enrich and augment analysis. The data files listed below are supported and can be manually imported using drag and drop or through a shared network drive connector. We recommend importing configuration files first or at the same time as the auxiliary data files or a system error may occur. If auxiliary data is input after configuration files are processed, the auxiliary data will need to be added to a new or existing custom view(s) to be displayed
Host Files
Hosts can be identified from multiple sources including configuration files, network scan files, ARP tables, and hostname files. Once network device configuration files have been imported, one can import additional files to add metadata to the workspace. A hostname file is a simple text file with two columns: IP address and hostname separate by a tab.
Aux Data Loading Example
Note: This example applies to the loading of any Aux data file but is specific to creating and loading a host file.
First, load a firewall into a workspace and create a custom view with the firewall.
Notice that four hosts are not named. To fix this, create a host file, named hosts.txt, to enrich the information.
The host file will add a name tied to each of the hosts and also includes hosts not currently displayed.
Let's use 172.30.90.50 Alice 172.30.90.51 Bob 172.30.90.42 Wendy 172.30.91.80 Sam 172.30.91.81 Carl Note: Make sure any hosts added to the file do not conflict with firewall interfaces or they will be merged into the firewall.
Save the host file, and import it into the workspace.
The Manage Views function displaying a user adding both devices and multiple Auxiliary data files to a single view.
Once processed, proceed to the “Manage Views” menu and select a new or existing view to add Auxiliary data to.
Below the Select Devices box, is the Auxiliary Data box.
Choose any of the Auxiliary Data files you've added previously. (This image is not reflective of the example but to illustrate that users may select several Aux files).
For our example a user would see a single file called hosts.txt that would contain the names we've added.
Once the the view is created the updated assets will be displayed on the topology and in the Asset Inventory (on the main menu).
The view, seen here regenerated. Note the new hostnames applied to the endpoints.
To see how the previous example can be used as a repeatable process let's update those names again, with corrections.
First, update the Host file again. In this scenario, we rename “Carl” to “Carly” and “Sam” to “Sammy”. The updated file is as follows:
172.30.90.50 Alice 172.30.90.51 Bob 172.30.90.42 Wendy 172.30.91.80 Sammy 172.30.91.81 Carly
Load the file into the workspace and the custom views where auxiliary data has been applied. This will update the workspace.
The workspace, updated a second time
Note: Host data can come from multiple sources, also hosts can appear and disappear from the network. Host data is treated as replacement data for adding and deleting hosts over time.
Note: If for some reason a device has multiple names retrieved from multiple different file types, the additional names will be displayed in the Alias column of the Asset Inventory.
Network and Vulnerability Scanner Files
The output from network and vulnerability scanners can be imported into a workspace to add CVE information, hosts, attributes, and port information to the topology map. We support version 1.0 <?xml version=”1.0″ ?> of the below scanners:
When exporting the report, it should be saved using the XML format to properly import into NP-View. The data extracted and imported depends on the scanner used and the data available on the network. Below is a list of data NP-View attempts to import.
hostnames
addresses
interfaces
local interface IP’s
local interface names
mac
domains
parent
operating systems
vlan
Multi-Home Host Files
Multi-Home hosts are endpoints that have multiple network interfaces. If NP-View identifies hosts with multiple interfaces, the host will be duplicated on the topology with each IP address. For example, the host called 'dual-homed' can be seen three times on the map below.
The host named 'dual-homed' repeated 3 times on the map
To resolve this, a 'multi_home_host.txt' file can be manually generated and loaded into NP-View as auxiliary data.
The file must be named 'multi_home_host.txt' and be of the following format:
192.168.135.115 dual-homed
192.168.135.114 dual-homed
192.168.135.113 dual-homed
Where the first field is the IP address and the second field is the name of the host.
When importing the 'multi_home_host.txt' and adding it to a view, the hosts will be connected as follows:
The hosts named 'dual-homed' have been consolidated
Note: The file can be named as *_multi_home_host.txt -where-*_ is anything preceding multi_home_host.txt.
For example:
tuesday_multi_home_host.txt
web_server_multi_home_host.txt
the_big_kahuna_multi_home_host.txt
Address Resolution Protocol (ARP)
ARP files can be used to add hosts as well as MAC addresses for the hosts. The following formats are supported:
Cisco
Use commashow arp to export the ARP table. The file format will be as follows:
<hostname># show arp
outside 10.0.0.100 d867.da11.00c1 2
inside 192.168.1.10 000c.295b.5aa2 21
inside 192.168.1.12 000c.2933.561c 36
inside 192.168.1.14 000c.2ee0.2b81 97
Cisco ARP Example
Using the data set from the Hosts example, a simple ARP table has been created in the Cisco format.
Distribution# show arp
inside 172.30.90.50 d867.da11.00c1 2
inside 172.30.90.51 000c.295b.5aa2 21
inside 172.30.90.42 000c.2933.561c 36
inside 172.30.91.80 000c.2ee0.2b81 97
inside 172.30.91.81 000c.2ecc.2b82 95
Distribution#
Loading this data into NP-View will add the MAC addresses to each host which is visible in Asset inventory.
Windows
Use arp -a > arp_table.txt to export the ARP table. The file format will be:
Interface: 192.168.86.29 --- 0x6
Internet Address Physical Address Type
192.168.86.1 88-3d-24-76-49-f2 dynamic
192.168.86.25 50-dc-e7-4b-13-40 dynamic
192.168.86.31 1c-fe-2b-30-78-e5 dynamic
192.168.86.33 8c-04-ba-8c-dc-4d dynamic
Linux
Use arp -a > arp_table.txt to export the ARP table. The file format will be:
? (172.18.0.3) at 02:42:ac:12:00:03 [ether] on br-d497989bc64d
? (192.168.135.200) at 00:0c:29:f6:47:bb [ether] on ens160
? (172.17.0.2) at <incomplete> on docker0
? (192.168.135.178) at 00:0c:29:f3:e2:6b [ether] on ens160
Palo Alto
Use show arp all to export the ARP table. The file format will be:
maximum of entries supported : 2500
default timeout: 1800 seconds
total ARP entries in table : 3
total ARP entries shown : 3
status: s - static, c - complete, e - expiring, i - incomplete
ethernet1/1 192.0.2.10 00:0c:29:ac:30:19 ethernet1/1 c 295
ethernet1/2 198.51.100.10 00:0c:29:d7:67:09 ethernet1/2 c 1776
ethernet1/3 203.0.113.10 00:0c:29:b9:19:c9 ethernet1/3 c 1791
Route Tables
Route files are a special case in that they provide ruleset-specific enrichment data whereas the other auxiliary files listed above provide topology-specific enrichment data.
Route table – Cisco
The output of the command show route on Cisco devices can be imported into NP-View with associated configuration files. For VRF’s, use the command show ip route vrf *. Cisco route files are handled a bit differently than the rest of the aux data as they are integrated upon import and are not considered as aux data when creating a view. Naming of the route files are not important as long as they are unique. The first row of the route file contains the <device name># command to link the route table with the correct device.
PCAP
IN V6.0 and later, PCAP and PCAPng files can be used to enrich the topology map. NP-View will add endpoints with IP's, MAC addresses and services to the topology map within a view. The max PCAP size is 200 MB per file.
The Help Center can be found on the system menu on the upper right corner of the topology.
The Help Center will display warnings or errors identified during the import of device files.
The information in the help center is designed to provide information for the tech support team to help diagnose the issues.
There are many types of possible errors including:
Invalid file formats (e.g., .gif or .png)
Improperly formatted files (files exported as text but loaded into a word processors where extra characters are added before saving).
Incomplete set of files (many devices require more than one file for import this includes Palo Alto and IP tables)
Misconfigured files where rules or objects are undefined.
As every customer has a different environment and possible device configurations are endless. We sometimes run into a situation where the parser cannot handle the device as configured. When this happens, we request the customer to sanitize the config file on the NP Poral and upload the file for debug purposes. Support from our customers is important for us to quickly remediate parsing issues unique to a device or specific file.
The Help Center provides a download for the error log which can be submitted to technical support through the support portal.
.svg)
