Knowledge Base

Getting Started

Once NP-View Server is installed, the application will start automatically. Note that NP-Live has been Rebranded to NP-View Server.  Several of the instructions still correctly refer to NP-Live as we migrate the installation services to the new product names.

If the Linux Administrator wishes to start and stop the application, two helper scripts have been included to aid in these tasks:

• Stop : sudo /opt/np-live/stop_NP-Live.sh
• Start : sudo /opt/np-live/start_NP-Live.sh

‍

Upon initial start, the Welcome screen shows the configuration wizard to guide the Administrator through the remaining configuration steps which include:

1. Authentication
2. Licensing
3. Users

Configure Authentication

The following authentication options are available to configure in NP-View Server.

• Active Directory / LDAP
• Radius
• Local

Active Directory or LDAP

For Active Directory or LDAP authentication we use LDAPv3 TLS over port 389.  If the communication returns an exception, we attempt unencrypted communication. We do not support LDAPS.  Before starting, note that setup requires a dedicated Credential Binding Account (LDAP Administrator). The Credentials Binding Account must be included in at least one of the system groups for NP-View Server to query and link the users.

An example of a properly configured LDAP screen on NP-View is below:

The setup page will allow for the definition of three system groups using a Distinguished Name.  A Distinguished Name (often referred to as a DN or FDN) is a string that uniquely identifies an entry in the Directory Information Tree. The format of a DN is: CN=groupname,OU=grouptype,DC=subdomain,DC=example,DC=com.  Your domain needs to match the DC specified in your DN. For an example DN like above, the domain would be: ‘subdomain.example.com’.

For example:

ldap_group_admin = 'CN=NP-Live Admin, OU=Permissions, DC=ad, DC=np, DC=test'
ldap_group_write = 'CN=NP-Live WorkspaceAdmin, OU=Permissions, DC=ad, DC=np, DC=test'
ldap_group_read = 'CN=NP-Live Viewer, OU=Permissions, DC=ad, DC=np, DC=test'

group_translation = {'Administrator' : ldap_group_admin,
'WorkspaceAdmin' : ldap_group_write,
'Viewer' : ldap_group_read}

Reminder:   The three CN names must be unique or roles will be overlapped in NP-View resulting in features being disabled.

To find the DN on Windows, open a Windows command prompt on your Active Directory server and type the command: dsquery group -name "known group name".

Users assigned to NP-View must login once to get setup within the NP-View database for sharing and transferring of workspaces.  No users exist until after the first login.

Troubleshooting Active Directory Setup

If an error is returned when configuring Active Directory, the steps to troubleshoot are:

Step 1: From your Active Directory server, type the command below in a terminal after replacing the “CN=…” portion with the Distinguished Name of the group you’d like to check:

dsget group "CN=groupname,OU=grouptype,DC=subdomain,DC=example,DC=com" -members

Verify that the output shows the expected list of user(s) in that group. If it doesn’t, check your Active Directory group and user configuration.

Step 2: From your Active Directory server, type the command below in a terminal after replacing the “CN=…” portion with the Distinguished Name of the group you’d like to check, and also replacing USERNAME with your actual username:

dsquery * -Filter "(&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=groupname,OU=grouptype,DC=subdomain,DC=example,DC=com)(sAMAccountName=USERNAME))"

If the output is empty, verify that your user in Active Directory has the attribute sAMAccountName set. If not, set it and try the command again. Verify also that the sAMAccountName value matches your AD username value. You can also try to enter the username in the NP-View Active Directory configuration form with the format USERNAME@DOMAIN.

If the output shows the expected list of groups for that user, but NP-View still generates an error, then contact the NP support team.

Radius

Radius authentication requires your server address and secret. Once input, the user can test their connection using their personal login credentials for verification.  Note that for Radius authentication, all users are assigned to the Administrator group.

Local Authentication

NP-View Server provides an internal mechanism for the administration of users.  During setup, the screen will require the user to setup the Administration account by inputting a user ID and password.  This account will be assigned to the Administrator role and will have access to all system features. An example of a properly configured Local Auth screen on NP-View is below:

User Management

NP-View Server provides a User Management function for users assigned to the the Administrator role. It can be accessed in the user menu at the top right of the screen either on the workspace page or from within a workspace.

User Management – Active Directory or LDAP

Clicking User Management will open a window that shows the LDAP setup information. The left half of the screen allows the user to change the NP-View LDAP settings.  LDAP Auth credentials are required to update the information.  The optional email field override is used as the default email address for the Notification Manager if no email address is provided as part of the LDAP credentials.

The right half of the user management screen allows for the testing of each LDAP user and will retrieve their LDAP settings for review.

User Management – Local Authentication

Clicking User Management will open a window that shows the user related information associated with this account, their account details, and their account permissions.

From this window Administrators can edit (pencil icon), delete (x icon) or add user accounts (create new user button).

A user’s ID should be the user’s email address (this will be used for notifications) and an administrator-defined password.  Each user will need to be assigned to a role which will provide the user with system wide access.

1. Administrator – Has access to all users, workspace and system administration functions including managing users and license functions.
2. WorkspaceAdmin – Has access to all workspace administration functions.
3. Viewer – Has read only access to the system.

Reset Authentication

The Administrator can also reset the authentication method entirely by selecting the “Reset authentication system” link. “Reset authentication” only resets the authentication and does not remove any workspaces or data.  Note that workspaces are assigned to user id’s.  If the authentication method (or user id format) is changed, the workspaces will no longer be available to users.  The administrator or workspace admin must utilize the transfer workspace function to assign the legacy workspace to the new user id’s.

Password Reset

• Workspace Admin or Viewer user groups:  Contact your Administrator who can manually reset your password through the User Management function on the system menu (upper right corner).
• Admins: connect through SSH to the NP-View server and remove the file db/auth_provider.cfg inside the NP-View application folder (by default: /opt/np-live).
• Refresh the NP-View web page to show the Welcome screen and reconfigure the authentication.

License and Terms

The Administrator can Show, Upgrade or Renew their license. Licensing terms and legal disclosures are available from the system menu where user management is found.

Configure License Key

After the authentication, the Welcome screen will guide the Administrator through reviewing the EULA and adding the license key. The license key should have been sent to you by email and also posted on the Network Perception portal. If you haven’t received a key, please send a request to support@network-perception.com. Renewed or upgraded license keys can only be installed from the home screen (not from within a workspace) by members of the Administrator group.

Additional Configuration Features

Configure Automatic Updates

NP-View Server can automatically download new releases and update itself if you select “Automatically check for updates”.  Alternatively, you can select “Update NP-View” from the upper right menu or update offline using the following steps:

1. Download the latest release from the Network Perception portal.
2. Copy the release file to the NP-View Server using SCP or WinSCP
3. Connect to the NP-View Server shell using SSH and execute the release file with the command sudo sh NP-View_server_installer.sh

Configure Shutdown and Startup Options

To speed performance on startup, NP-View terminates background processes that are running when the system is gracefully shutdown and clears out all tasks and jobs.  If any processes remain upon startup, they are also terminated. To change the configuration,

• stop the NP-View Server application.
• in the docker-compose.yml file for the manager change cancelTasksStartup=True to cancelTasksStartup=False
• in the docker-compose.yml file for the manager change clearRqStartup=True to clearRqStartup=False Note that the previous setting must also be set to True for this operation to work.
• start the NP-View Server application.

Configure User Timeout

The system can be configured automatically time out a user after a period of idle days.  The default is set to 30 days. To change the configuration,

• stop the NP-View Server application.
• in the docker-compose.yml file for the webserver\environment service, change sessionLengthDays=30 to any positive floating point number representing elapsed days. For Example:
  • 0.5 = 12 hrs
  • 1.5 = 36 hours
  • 30 = 720 hrs.
  • If set to 0, user timeout will default to 30 minutes.
• start the NP-View Server application.

Timeout for connectors is 1 day and cannot be changed. Also, the timeout value is not static and will be overwritten by the next software update. Prior to restarting after an update, the timeout needs to be reset to the value of choice.

Configure Devices within a Custom View

The system can be configured to allow for more devices within a custom view.  The default is set to 25 devices. To change the configuration:

• stop the NP-View Server application.
• in the docker-compose.yml file for the
  • services : manager : environment, change devCountLimit=25 to a positive integer.
  • services : bgmanager : environment, change devCountLimit=25 to a positive integer.
  • services : webserver : environment, change devCountLimit=25 to a positive integer.
• start the NP-View Server application.

Note: The limit is not static and will be overwritten by the next software update. Prior to restarting after an update, the limit needs to be reset to the value of choice. Note: NP has only tested the system to the default limit. Raising the limit is at the user’s risk as unintended consequences including data loss and the system exhausting system resources may occur.

Configure A Static IP Address on your Linux Server

To set a static IP address for your NP-View Server, follow the instructions in this document.

‍

This section describes how to update the NP-View Server application and the underlying components if the OVF was used for the initial installation.

Updating the NP-View Server Application

To update an existing NP-View Application, the steps are:

1. Download the latest release Linux Installer Release (not the .OVF) from the Dragos Portal and copy it onto your NP-view server using SCP (or WinSCP from a Windows client)
2. Login onto the NP-View server using SSH (or Putty from a Windows client)
3. Get root permissions using the command: sudo -i
4. Prior to installing the new version, it is recommended to make a backup of your database (see below)
5. Execute the new NP-View release file using the command: sh NP-View_installer.sh  (where NP-View_installer.sh is the name of the new release file downloaded in step 1).
6. Follow the guided steps of the installer, which will automatically start NP-View once the update is complete.
7. Connect to the user interface of NP-View using your web browser and check in the bottom-left corner of the home page that the version number matches the new release

Updating the NP-View Application to version 5 and above

Prerequisites

• Please update your current version of NP-View to version 4.3.5. Both Server and Desktop must be on this version before starting your upgrade.

For NP-View Server:

• Verify there is sufficient disk space for the upgrade (3x size of Redis db).
• If not follow log cleanup procedure listed in KB (~250MB possible).
• If still insufficient space, disk space will need to be added before upgrade.
• Verify all users are logged out of the system to not lose data during update.

Back-Up NP-View database

NP-View Desktop

1. Copy the 4.3.5 database folder to a safe location. This will allow you to keep a back up 4.3.5 in the case you would want to revert back to 4.3.5some text
   • C:\Users\<name>\AppData\Roaming\NP-View\db
2. Download NP-View from the portal and install.
3. Starting the application may take longer than usual as a one-time database maintenance operation is being performed.

NP-View Server

Option 1:

1. SSH as the root user to Terminal of NP-View server
   • ssh root@<ip-of-guest-os>
   • If needed sudo -i or sudo su will give you admin privileges once you are logged in.
2. Move to the NP-View (np-live) app directory
   • cd /opt/np-live
3. Stop NP-View
   • sh ./stop_NP-Live.sh
4. The db directory contains all of the NP-View data. Create a tarball of the directory
   • tar -czf np-view-v4.3.5-db-backup.tar.gz db
5. Move the file to a safe location.
   • Note: This file will allow you to revert back to 4.3.5.

Option 2 (This option is only available if your server is a VM):

• Your server admin can take a snapshot image of the server as a restore instance. This tends to be easier and quicker for most of the customers that we have worked with.

Once you have a back up and have updated to 4.3.5, please download version 5+ and follow the instructions listed in the above section "Updating the NP-View Server Application".

NP-View Server Migration

Prerequisites

• Follow the instructions above to update the NP-View CentOS server to the latest NP-View version.
• Create a VM using the latest version of the NP-View Server OVF.
• Both Servers need to be running to perform the migration.
• Users should be logged out of NP-View and close any active session before restoring.

CentOS Migration to Ubuntu for NP-View Server

1. Use backup and restore script.
   • sudo -i (This should take you to the root folder)
     • Enter credentials if prompted.
   • To run shell script: /opt/NP-Live/NP-View_backupand_restore.sh
     • There will be 3 options when using the script.
       • Backup
       • Restore
       • Exit
   • The script will check disk space when creating the backup.
   • The script will notify you if the storage is full and stop running.
2. Move the CentOS tar file to the Ubuntu server’s root directory.
   • sudo -i (This should take you to the root folder)
   • Enter credentials if prompted.
   • To run shell script: /opt/NP-Live/NP-View_backupand_restore.sh
     • Select restore
     • The script gives a final warning before running.
     • The script checks if the docker containers are running.
3. Once the script is completed it will notify you.
   • Connect to the web interface and verify data is transferred.
   • If you are unable to connect to the web interface restart NP-View service once the upgrade is complete.

Get Version API call

To check the version update your server URL to the following

https://<np-view_server_address>/version

Backing up the NP-View Server Database Manually

1. Stop the NP-View Server (you can use the script /opt/np-live/stop_nplive.sh)
2. From the NP-View Server folder (by default: /opt/np-live/, run the command: tar -zcf db_backup_$(date '+%Y_%m_%d').tgz db (this command may take few minutes to complete)
3. Run the new release installer, which will update the containers and then launch NP-View Server

‍

Updating Linux Ubuntu and Docker

(Version 5 and up installation with the OVF)

We will be providing update packages for Ubuntu and Docker. Please go to the following page for more information:

https://www.network-perception.com/kb/ubuntu-and-docker-update-packages

Updating Linux CentOS Ubuntu and Docker

‍CentOS is now EOL as of June 30, 2024. We highly recommend customers to transition to Ubuntu.

‍

If the OVF was used for the initial installation, that package included the CentOS 7 operating system and Docker. These applications must be updated separately from the NP-View Server Application using the below instructions. The instructions cover NP-View Servers that have internet access and those that do not have internet access.

Updating when the NP-View server has internet access:

– stop NP-View
cd /opt/np-live/
./stop_NP-Live.sh

– run all updates
yum update -y

– reboot server
reboot

Updating when the NP-View server does not have internet access:

If NP-View server is installed in an environment that does not have internet access, a separate Centos 7 server with Docker that has internet access is required to create the update package. All commands below are case sensitive.

Network-Perception uses this mirror for CentOS updates and this mirror for Docker updates

Centos 7 that is online:

– make sure you are root
sudo su -

– create packages directory
cd /root/
mkdir packages
cd packages

– download all packages
yum list installed | awk {'print $1; }' | tail -n +3 | xargs yumdownloader

– you should see docker included in the output list.

– compress archive (capital -C is important)
tar czf /root/packages.tar.gz *.rpm -C /root/packages/

– Copy packages.tar.gz to the offline server. The user can use the below command to scp:
scp packages.tar.gz root@ipAddress:/root/

Centos 7 that is offline running NP-View:

– make sure you are root
sudo su -
– stop NP-View
cd /opt/np-live/
./stop_NP-Live.sh

– create directory and extract the archive
cd /root/
mkdir packages/
mv packages.tar.gz packages/
cd packages/
tar -xf packages.tar.gz

– install all updates:
yum -y localinstall *.rpm

– reboot server
reboot

– now everything is up to date on the offline server.

If you get any docker swarm errors:

– make sure you are root
sudo su -

– leave and join swarm cluster
docker swarm leave --force && docker swarm init

‍

Network mapping provides the Networking Team (Network Engineer, Network Security) with capabilities that allow users to:

• Visualize an accurate topology of the network architecture
• Identify and label critical cyber assets and critical network zones
• Easily review which devices are protecting which network zones

Visualize Topology

NP-View can be used to discover your network topology and the underlying control plane, including layer-2 and layer-3 configurations. Without leaving the topology map, you can review many aspects of the network’s design including Firewalls, Routers, Switches, Gateways, Networks, VPNs, Hosts and more.

Critical Assets and Zones

Each asset can be tagged with categories and criticalities as well as grouped into zones making it easy to review which devices are protecting which network zones.

Details On-demand

Selecting a node in the topology map will interactively display an information panel with detailed data about that node.

Firewall ruleset review provides Network Engineers, Network Security, and Compliance Analysts with functionality for:

• Easy review of firewall access rules and object groups using the Access Rules and Object Groups reports.
• Automatic identification of configuration risks using the Risks and Warnings report.
• Validating recent policy modifications as part of a configuration change review process using the Change Tracking report.

How to Review Access Rules

An independent review of firewall policies has to be periodically conducted to ensure that network access rules are correctly implemented and documented. It is important because lack of access rule review leads to unexpected network access vulnerabilities.

• Frequency: each time firewall policies are changed, and at least once a quarter
• How to do it:
  • Step 1: given a workspace populated with network device configurations, open the Access Rule table from the main menu (top left)
  • Step 2: leverage the “Column Search” feature or the “Compare” feature to show the rules in scope of your verification
    • For instance, filter the “Device” column to only show rules for a specific device, or filter the “Binding (ACL)” column to only show rules bound to a specific interface, or use the “Compare” feature to only show rules added or removed recently
  • Step 3: review values for the source, destination, service, binding, risk, and description of each rule in scope
    • The “Description” column captures comment, description, or justification from the device configuration
    • The “Risk” and “Risk Criticality” columns are populated by NP-View during the automated risk analysis
  • Step 4: to identify rules that are not justified, sort the table by “Description”. Empty values will be shown at the bottom.
  • Step 5: to document your review process, double click on the “Comment” or “Comment Status” cells to add your own comment. The comment status can be either “Verified” or “To Review” or “To Revise”
  • Step 6: to save an evidence of your review process, export the table to Excel using the export options in the top right corner of the table

Access Rules Table

The Access Rules report provides the users with complete details on each Access Rule with the ability to add justifications and actions.

Object Groups

The Object Groups report provides the users with complete details on each Object Group with the ability to add justifications and actions.

Risks and Warnings

As modifications are made to the network, the Network Perception default Policies and Requirements identify potential risks.  The Risks and Warnings report provides the users with a summary of the potential risks and their criticality with the ability to add actions and comments.

Change Tracking

As modifications are made to the network and the updated configuration files are imported, the changes are logged in the Change Tracking table.

Segmentation verification provides the Networking Team and Audit Team with capabilities that allows users to:

• Assess correctness of network segmentation
• Identify risky network connectivity paths
• Understand exposure of vulnerable assets

Network Segmentation Accuracy

NP-View be used to verify the accuracy of your network segmentation.

The connectivity matrix which is available from the device info panel can be used to verify open ports between devices.

Inbound and outbound connections can be verified for each network using the highlight paths function.

Identifying Risky Connectivity Paths

Using industry best practices, Network Perception automatically identifies potential risks related to network configurations. Using the Network Perception  Connectivity Path analysis, the user can review each of the highlighted risks and make a judgment on action.

Exposure of Vulnerable Assets – Vulnerability Analytics

NP-View provides your security team with a single pane of glass for reviewing network vulnerability exposure. With the addition of scanner data or data from a vulnerability data service, vulnerabilities can be tracked across your network.

Topology Display of Vulnerabilities

When scanned data has been added to a workspace, and a topology view is built that also includes that scan data, nodes on the topology of that view will be marked with a shield indicating the presence of vulnerabilities.

These shields can be toggled on and off using the topology settings menu.

Device Panel Display of Vulnerabilities

Firewalls, Gateways, and Hosts may contain vulnerability and service information imported from scans. Clicking on any of these nodes in a View that contains vulnerability information, will display it in the info panel that opens over the main menu.

Clicking on the Vulnerabilities link will present a pop out with the vulnerability details.

‍

Performing a regular review of your compliance metrics is important for your organization.  Performing the review manually is time consuming and tedious. Audit assistance provides the Compliance Team (Auditor, Compliance Officer, Compliance Analyst, and Consultants) with capabilities that allow users to:

• Verify compliance with cybersecurity regulations and best practices through Policy Review.
• Seamlessly store evidence for compliance review with Change Tracking.
• Easily prepare compliance reports using the Audit Assistants listed below:

Workspace Report (Standard)

The Workspace Report assistant is available within each workspace and will generate a report for a specific view that includes detailed information about configuration files that were imported and parsed including:

• Configuration assessment report including risk alerts
• Ports and Interfaces
• Access rules
• Object groups
• Path analysis

Industry Best Practice (Premium)

The Best Practice assistant requires a license to activate. This report is available within each workspace to generate a report for a specific view that includes the following topics:

• Parser Warnings and potential misconfigurations
• Unused Object Groups
• Access Rules missing a justification
• Unnamed nodes
• NP Best Practice Policies on access rules and CiS Benchmarks that have identified potential risks
• ACL’s with no explicit deny by default rule

NERC CIP Compliance (Premium)

The NERC CIP assistant requires a license to activate this function and guides the user through the steps required to create a report covering CIP-005 requirements. The NERC CIP audit assistant is only available within a NERC-CIP workspace and allows audit teams to classify BES cyber assets as High, Medium, and Low based on the standards. We have added a category for untrusted (Internet, Corp, etc.) to tag non BES assets. NP-View allows compliance teams to collect and report evidence related to the following requirements:

• CIP-002 – BES Cyber System Categorization; impact rating and 15-month review
• CIP-003 – Security Management Control; cyber security policy
• CIP-005 – Electronic Security Perimeter; remote access management
• CIP-007 – System Security Management; ports and services
• CIP-010 – Change Management and Vulnerability; configuration change management, configuration monitoring, vulnerability assessment

A demo workspace for the NERC CIP audit assistant is included with the software.  To see the audit assistant in action, follow these steps:

1. Click on the demo workspace to build the topology.
2. Create a custom view by selecting all of the firewalls, right click, Create View from Selection and give it a name.
3. Once the view is generated, select Manage Zones from the left manu and click on the Auto Generate Zones button.
   • Red zones represent your high criticality assets.
   • Orange zones represent your medium criticality assets.
   • Yellow zones represent your low criticality assets.
   • Gray zones represent your untrusted assets.
4. On the left menu, select Summary Reports and the NERC-CIP Compliance Report
5. Click through the wizard, the defaults will represent the selections suggested by the auto group function.
6. Click Generate Report to view the report in a new tab.

This article will focus on the Access Rules Report.

NP-View uses reports to present network information related to the open workspace.  These reports are available to all users and can be accessed from the main menu. For more information visit the Workspace Reports Overview article.

Access Rules – Defined

The Access Rules Report can be accessed in two ways. Each way presents a different filtered data set.

1. From the main menu, the table will populate the table with all rules for all devices in the workspace.
2. From the topology, when clicking a Firewall/ Router/ Switch – its info panel will open – and the user can select Access Rules from the Data for this Device section. Only the rules for the selected device will be displayed in this case.

*main menu

       *info panel

What Data is Present?

The list below the image details the data types available in the Access Rules Report.

Table Actions

There are a number of actions that can be taken in the Access Rules report, some are specific to Access Rules, others are universal to all Reports.

1. Cells with more data then can be shown within the width of the column will display a + icon, which will show the additional data when clicked.
2. The source, destination and service columns will show related object groups and object data within the + popup.
3. Columns can be displayed or hidden using the hamburger menu in the upper right corner of the report.
4. Changes to the menu are automatically saved.
5. Additionally, the table can be exported as displayed, with comment history or with object groups.
6. Only visible columns will be displayed.
7. Columns can be sorted, rearranged or resized and changes will be automatically saved.
8. Column filters can be displayed.
9. Filters applied to the table or column will automatically be saved.
10. Filters can be reset from the hamburger menu.

*the Access Rules Report Menu

Comments

+

NP-View provides a simple and easy way for users to add comments and other metadata to rows in Access Rules, and to track the historical lineage of these comments in a workspace. Comments can be added, or viewed, for integrity purposes they cannot be edited or deleted.

Adding a Comment: Comments can be added to a row by double-clicking on the cell in the column “Comment”.  Comment text and status can be added and then saved with the save button. Once the comment is saved, the author and time stamp are automatically inserted.

*applying comment

*applying comment – closeup

Comment History: Additional comments can be added to a row to begin creating a lineage or history of comments. This history will be automatically available when more than one comment exists on a row and can be expanded by clicking the blue clock icon on the leftmost column of the table. If there is no history the icon will be disabled.

When viewing history, changes between lines are highlighted in blue.

Example: If Comment 1 is: “rule comment 1” – ‘verified’ and Comment 2 is “rule comment 1a” – ‘to revise’ the status cell would be highlighted because there was a change – the comment text would not be highlighted if the text remained the same.

*Viewing comment history

Access Rules Hash

Access Rules are uniquely tagged (Object ID) within NP-View for linkage to comments and risks.

Additional Features

• The Compare button invokes a time series comparison function for the report.   Additional details on this function can be found here.
• Comments can be imported from an Excel file.  Additional details on this function can be found here.
• Conditional formatting can be applied to this table report.  Additional details on this function can be found here.

Comparison Report

+

Access Rules and Object Groups have a Compare function to show historical differences in data that has been added or removed. The function can be engaged by clicking the “Compare” button located at the top of the page. This function is used to display changes over a period of days.

The user can select a time frame (7, 30, 90 or 356 days or a custom date range). The user can select one or more devices to include in the report and then show the history over the range. Once the parameters are selected, the “Show Comparison” button should be selected.

The comparison function will display all changes (Rule Adds, Rule Removal and Unchanged Rules) for the selected days. The data will be displayed using the column format of the selected table. The user can filter on added, removed or unchanged rules by clicking the jelly bean. Added rules will be highlighted in green, removed rules will be highlighted in red and unchanged rules will be highlighted in light blue.

Clicking the “Compare” button will revert to the normal table but will not clear the selections.

Clicking the “Reset” button will clear the selections and reset the table.

This article will focus on the Asset Inventory Report.

NP-View uses reports to present network information related to the open workspace.  These reports are available to all users and can be accessed from the main menu. For more information visit the Workspace Reports Overview article.

Asset Inventory

This report provides a summary of all assets loaded into the workspace including: Firewalls, Routers, Switches, Gateways and Hosts.

Unmapped – What is it?

For some devices there may be a large number of hosts defined in the Asset Inventory but less shown on the Topology Map. These “missing hosts” are not actually missing on the map, they are hidden in a Gateway node titled ‘Unmapped’.

If an IP address is displayed as 0.0.0.0 this device has an IP address assigned by DHCP and while the device was detected, an IP address could not be extracted, and it would be said to be an Unmapped Host. Unmapped hosts have enough information for identification but not for mapping purposes on the topology map.  These ‘invisible’ hosts are located behind the Unmapped, or other, gateways and can be seen in a given gateway’s peer list.

‍

NP-View uses reports to present network information related to the open workspace.  These reports are available to all users and can be accessed from the main menu.

This article is focused on the Background Tasks Table.

Background Tasks

This table displays the active and completed processes both for the current workspace, and for all workspaces. When in a workspace you have the ability to filter and view the active processes for the current workspace and to clear or cancel completed or active processes for the current workspace.

Access: Background Tasks can be accessed in three ways.

1. From the main menu
2. Using the hotkey ‘T’
3. Clicking on the active spinner on the topology map

*main menu

     *active background tasks spinner

Overview

The Background Tasks table shows the status of each task spawned by a data import, merge, analysis, or by run policies.

• Parsing tasks indicate the imported file is being normalized and hosts inferred.
• Merge tasks combine the normalized data into the topology map.
• Analysis tasks define all of the paths and open ports.
• Policies review the active requirements to identify potential risks for review.

An example of the background tasks table is in the image below.

The report contains the following data and has the following functionality:

Report Data:

• Task name
• Progress
• Workspace where the task is running
• User who owns the task
• The time it started or ended

Report Functions:

• The check box allows the user to filter on the tasks pertinent to the current workspace.
• The X allows the user to cancel a task that may be running too long or be stuck for some reason.
• The user can also cancel all tasks within a workspace using the “Cancel All for this Workspace” button

Change Tracking

Overview

• The Change Tracking Report logs modifications that are made to the network and the updated configuration files that are imported.
• It can be accessed from the main menu
• For every change, the timestamp, action, device, and description are recorded.
• Changes are displayed and can be filtered by calendar day.
• At the top of the table is a drop down that allows the user to select which day to review.
  • The default is the current day.

Functionality

The Change Tracking Report can be:

• searched
• sorted by any column
• switched to a list view
• exported
• and configured with alternate columns if required

These functions are available in the upper right corner of the table.

Change Types

The types of change actions that are logged are:

1. File import – for each file uploaded, of the following statuses will be displayed:
   • “successful import” – file imported successfully”
   • ignored file: <filename> – unknown file type, ignored
   • “failed import” – file failed to import, review help center for reason
2. Topology map – for each file uploaded, of the following statuses will be displayed for the topology map
   • “device path information” – triggered if the connectivity matrix changes
     • Paths can be added or removed
     • Assets refers to destination IP addresses
     • Services refers to the unique ports (or any) associated with the imported device
     • Details on the above can be viewed in the Connectivity paths
   • “topology updated” – indicates the topology map has been successfully updated
   • “topology failure” – indicates the topology map has failed, review help center for reason
3. Connectivity Paths – for each file uploaded, of the following statuses will be displayed for the workspace
   • “workspace analysis updated” – all other tables have been successfully updated

NP-View can import auxiliary data from third party systems to enrich and augment analysis.  The data files listed below are supported and can be manually imported using drag and drop or through a shared network drive connector. We recommend importing configuration files first or at the same time as the auxiliary data files or a system error may occur. If auxiliary data is input after configuration files are processed, the auxiliary data will need to be added to a new or existing custom view(s) to be displayed

Host Files

Hosts can be identified from multiple sources including configuration files, network scan files, ARP tables, and hostname files. Once network device configuration files have been imported, one can import additional files to add metadata to the workspace. A hostname file is a simple text file with two columns: IP address and hostname separate by a tab.

Aux Data Loading Example

Note: This example applies to the loading of any Aux data file but is specific to creating and loading a host file.

First, load a firewall into a workspace and create a custom view with the firewall.

Notice that four hosts are not named.  To fix this, create a host file, named hosts.txt, to enrich the information.

The host file will add a name tied to each of the hosts and also includes hosts not currently displayed.

Let's use
172.30.90.50 Alice
172.30.90.51 Bob
172.30.90.42 Wendy
172.30.91.80 Sam
172.30.91.81 Carl
Note: Make sure any hosts added to the file do not conflict with firewall interfaces or they will be merged into the firewall.

Save the host file, and import it into the workspace.

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

Once processed, proceed to the “Manage Views” menu and select a new or existing view to add Auxiliary data to.

‍

‍

Below the Select Devices box, is the Auxiliary Data box.

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

Choose any of the Auxiliary Data files you've added previously. (This image is not reflective of the example but to illustrate that users may select several Aux files).

For our example a user would see a single file called hosts.txt that would contain the names we've added.

Once the the view is created the updated assets will be displayed on the topology and in the Asset Inventory (on the main menu).

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

‍

To see how the previous example can be used as a repeatable process let's update those names again, with corrections.

‍

First, update the Host file again. In this scenario, we rename “Carl” to “Carly” and “Sam” to “Sammy”. The updated file is as follows:

‍
172.30.90.50 Alice
172.30.90.51 Bob
172.30.90.42 Wendy
172.30.91.80 Sammy
172.30.91.81 Carly

Load the file into the workspace and the custom views where auxiliary data has been applied. This will update the workspace.

‍

‍

Note: Host data can come from multiple sources, also hosts can appear and disappear from the network. Host data is treated as replacement data for adding and deleting hosts over time.

Note: If for some reason a device has multiple names retrieved from multiple different file types, the additional names will be displayed in the Alias column of the Asset Inventory.

‍

Network and Vulnerability Scanner Files

‍

The output from network and vulnerability scanners can be imported into a workspace to add CVE information, hosts, attributes, and port information to the topology map. We support version 1.0 <?xml version=”1.0″ ?> of the below scanners:

• Nmap – Use command nmap -oX
• Rapid 7 Nexpose,
• Tenable Nessus – Export the .nessus scan in XML format.

‍

When exporting the report, it should be saved using the XML format to properly import into NP-View. The data extracted and imported depends on the scanner used and the data available on the network.  Below is a list of data NP-View attempts to import.

• hostnames
• addresses
• interfaces
• local interface IP’s
• local interface names
• mac
• domains
• parent
• operating systems
• vlan

‍

Multi-Home Host Files

Multi-Home hosts are endpoints that have multiple network interfaces. If NP-View identifies hosts with multiple interfaces, the host will be duplicated on the topology with each IP address. For example, the host called 'dual-homed' can be seen three times on the map below.

‍

‍

‍

To resolve this, a 'multi_home_host.txt' file can be manually generated and loaded into NP-View as auxiliary data.

The file must be named 'multi_home_host.txt' and be of the following format:

‍

192.168.135.115 dual-homed

192.168.135.114 dual-homed

192.168.135.113 dual-homed

‍

Where the first field is the IP address and the second field is the name of the host.

When importing the 'multi_home_host.txt' and adding it to a view, the hosts will be connected as follows:

‍

‍

Note: The file can be named as *_multi_home_host.txt -where- *_ is anything preceding multi_home_host.txt.

For example:

tuesday_multi_home_host.txt

web_server_multi_home_host.txt

the_big_kahuna_multi_home_host.txt

‍

‍

Address Resolution Protocol (ARP)

ARP files can be used to add hosts as well as MAC addresses for the hosts.  The following formats are supported:

‍

Cisco

Use commashow arp to export the ARP table.  The file format will be as follows:

<hostname># show arp  

outside 10.0.0.100 d867.da11.00c1 2  

inside 192.168.1.10 000c.295b.5aa2 21  

inside 192.168.1.12 000c.2933.561c 36  

inside 192.168.1.14 000c.2ee0.2b81 97

‍

Cisco ARP Example

Using the data set from the Hosts example, a simple ARP table has been created in the Cisco format.

‍

Distribution# show arp    

inside 172.30.90.50 d867.da11.00c1 2    

inside 172.30.90.51 000c.295b.5aa2 21    

inside 172.30.90.42 000c.2933.561c 36    

inside 172.30.91.80 000c.2ee0.2b81 97  

inside 172.30.91.81 000c.2ecc.2b82 95

Distribution#

‍

Loading this data into NP-View will add the MAC addresses to each host which is visible in Asset inventory.

‍

Windows

Use arp -a > arp_table.txt to export the ARP table.  The file format will be:

Interface: 192.168.86.29 --- 0x6  

Internet Address      Physical Address      Type  

192.168.86.1          88-3d-24-76-49-f2     dynamic    

192.168.86.25         50-dc-e7-4b-13-40     dynamic    

192.168.86.31         1c-fe-2b-30-78-e5     dynamic    

192.168.86.33         8c-04-ba-8c-dc-4d     dynamic

‍

Linux

Use arp -a > arp_table.txt to export the ARP table.  The file format will be:

? (172.18.0.3) at 02:42:ac:12:00:03 [ether] on br-d497989bc64d

? (192.168.135.200) at 00:0c:29:f6:47:bb [ether] on ens160

? (172.17.0.2) at <incomplete> on docker0

? (192.168.135.178) at 00:0c:29:f3:e2:6b [ether] on ens160

‍

Palo Alto

Use show arp all to export the ARP table.  The file format will be:

maximum of entries supported : 2500

default timeout: 1800 seconds

total ARP entries in table : 3

total ARP entries shown : 3

status: s - static, c - complete, e - expiring, i - incomplete

interface ip address hw address port status ttl

--------------------------------------------------------------------------------

ethernet1/1 192.0.2.10 00:0c:29:ac:30:19 ethernet1/1 c 295

ethernet1/2 198.51.100.10 00:0c:29:d7:67:09 ethernet1/2 c 1776

ethernet1/3 203.0.113.10 00:0c:29:b9:19:c9 ethernet1/3 c 1791

‍

‍

‍

Route Tables

Route files are a special case in that they provide ruleset-specific enrichment data whereas the other auxiliary files listed above provide topology-specific enrichment data.

‍

Route table – Cisco

The output of the command show route on Cisco devices can be imported into NP-View with associated configuration files.  For VRF’s, use the command show ip route vrf *. Cisco route files are handled a bit differently than the rest of the aux data as they are integrated upon import and are not considered as aux data when creating a view. Naming of the route files are not important as long as they are unique. The first row of the route file contains the <device name># command to link the route table with the correct device.

‍

PCAP

IN V6.0 and later, PCAP and PCAPng files can be used to enrich the topology map. NP-View will add endpoints with IP's, MAC addresses and services to the topology map within a view. The max PCAP size is 200 MB per file.

‍

‍

The linked .html file runs a self contained config file sanitizer in a standard web browser. The configuration sanitizer will change IP addresses within the file to mask them. This sanitizer will maintain integrity across the masked IP addresses so that we can properly test the file in the test lab. Please do not manually change the file after running through the sanitizer. To use the sanitizer file, click the link below to run in your browser.

Run from here

Below are the currently known issues in NP-View along with the available workarounds. These issues will be addressed as part of the upcoming release. If you are experiencing an issue not covered in this document, please contact Technical Support at: support@network-perception.com.

1. Typing into a field in NP-View Desktop doesn’t register any text

Reset window focus (This may not always work)

• Alt+Tab out of the application
• Alt+Tab back into the application

Login to NP-View Desktop via web browser

• Open a web browser (Chrome/Edge) with NP-View still running
• Type “localhost:8080” in the address bar to load NP-View in a browser window

NP-View is licensed on an annual basis. The cost of the license depends on the number of configuration files imported from primary network devices (firewalls, routers, and switches).

How Licensing Works

When importing devices (manual or automated), a reminder notice is provided stating: “Importing new devices requires available licenses. Devices are activated in the order they are imported. If the total license count is exceeded, importing of additional unlicensed devices will be prohibited.

To determine the available number of devices licenses, see the summary at the bottom of Licenses and Terms.

Supported Devices and Connectors

The knowledge base contains a list of actively supported devices (link) and connectors (link). These lists change over time as manufacturer end of life support and as we add support for new devices. These lists are referred to in our terms of service and used to define what is in scope of the NP-View license agreement.    Network Perception reserves the right to alter this list at any time without customer notice.

‍

When Device Licenses are Activated

Device licenses are activated when a device is first imported.  When the device limit is reached, import of additional devices (manual or automated) will be prohibited and a message will be issued in the help center and system logs.

Device licensing is permanent.  Once a license is allocated to a device it cannot be re-assigned to another device.

Palo Alto NGFW and Virtual Systems (VSYS)

Virtual systems are separate, logical firewall instances within a single physical Palo Alto Networks firewall. Rather than using multiple physical firewalls, IT departments can use a single firewall and enable virtual systems on them to independently separate traffic.

The default is vsys1. You cannot delete vsys1 because it is relevant to the internal hierarchy on the firewall; vsys1 appears even on firewall models that don’t support multiple virtual systems.

When using multiple virtual systems, if a configured vsys has an interface with access rules, NP-View will represent the vsys as a separate firewall and a device license is allocated. If a vsys has no interfaces or access rules and is used only for object management then NP-View does not display the firewall and it requires no license.

FortiGate and Virtual Domains (VDOM)

Virtual Domains (VDOMs) are used to divide a FortiGate into two or more virtual units that function independently. VDOMs can provide separate security policies and, in NAT mode, completely separate configurations for routing and VPN services for each connected network. If a VDOM has no interfaces or access rules and is used only for object management then NP-View does not display the firewall and it requires no license.

Hiding Devices

If a device is no longer required in any workspace, the Administrator can hide the device from all workspaces by unchecking the “Visible in Workspace” check box and selecting the “Submit” button.

The licensed device will remain in “license and Terms” and displayed as follows:

The data is not deleted from the workspaces. If the Administrator wishes to restore the device to all workspaces, they can by importing new data for the device or by rechecking the checkbox and clicking “Submit”.

Note: NP provided demo devices in the demo workspace are excluded from display in the license manager and device counts.

User Deleted Devices

If the user deletes a device from all workspaces, the device still remains licensed but as it has no system association will not be displayed in License and Terms.  The device can be restored in the future by importing new data for the device into any workspace.

Expired Licenses

When the license expires, workspaces for all users will be disabled along with manual data imports. A message will be displayed stating that the license has expired and to contact sales to renew. Connectors will continue to collect data and deliver the updates to workspaces and demo workspaces will continue to function.

License Downgrade

If a customer downgrades their device count, the Administrator will need to select the devices to remain active after inputting the new license key. If the Administrator does not select the devices to remain, the system will allocate the devices in the order they are used. All remaining unlicensed devices will be removed from all workspaces.

Compliance Module Downgrade

If a customer downgrades their compliance module license, all workspaces associated with that module will be disabled. The user can manually delete these workspaces.

Existing Customer Upgrades

For existing customers upgrading from a previous version of software to version 3.1.0 or later, devices that are imported and active in the license manager (check box marked) will remain licensed.  Devices that are unlicensed (check box unmarked) will be removed from all existing workspaces. If a customer needs to replace one or more devices, please contact support.

Auditors and NP Certification

Auditors and NP Certification members working project style engagements using NP-View Desktop are provided with a special feature to reset the system to its original state after an engagement so that no customer data is retained.

Adding a license to NP-View Desktop and NP-View Server

• Step 1: Create an account on the Portal website
• Step 2: If you don’t see an active license in the Portal home page, select “Request License” or contact support@network-perception.com
• Step 3: Once a license key has been generated for you, make sure the format is correct. It should be a JSON structure similar to:

{
"email": "email address",
"type": "License type",
"expiration": "date",
"max_rulesets": "purchased device",
"max_users": "purchased user",
"module_np": if purchased,
"module_nerccip": if purchased,
"key": "secret key"
}


• Step 4a: For New Installations, upon system installation, the Administrator will input the NP license key into the setup screen which will set the maximum limit on the number of devices that can be imported (manually or automated) into the system.
• Step 4b: For existing customers, launch NP-View and select “License & terms” from the user menu (top right corner).

• Then scroll down and select “Upgrade or renew your license” followed by “Input license manually”. You can then copy/paste the license JSON structure (including opening and closing curly brackets) into the text field area.

• Note: the licensing function is available only to the Administrator role in NP-View Server and the must logout and re-login for the license to take affect.

HA Device Licensing

NP-View Professional server support the licensing of active / passive high availability (HA) groups for firewalls. HA Group definitions are only required if the device name of the primary and secondary devices are different. Once the active firewalls are loaded into NP-View, the HA definition file can be exported using postman or a tool of your choice using:

GET /license/ha-groups?file-export=true and a file will be downloaded.

The file export will be a text file. Column 1 will be the HA Group name and will be initially empty. Column 2 will be the firewall name.

HA Group Name, Device Name
, asaDMZ-fw1
, asaUCCtoBA1
, asaUCCtoSub-A
, asaBA
, firewallSub

The administrator will then update the text file to add unique group names as well as the name of the passive firewall. The updated file can look as follows. Devices without group names will remain as individual firewalls.

HA Group Name, Device Name
A-Group, asaDMZ-fw1
A-Group, asaDMZ-fw2
B-Group, asaUCCtoBA1
B-Group, asaUCCtoBA2
C-Group, asaUCCtoSub-A
C-Group, asaUCCtoSub-B
, asaBA
, firewallSub

Once the file is updated, the file can be posted using postman or the tool of your choice:

POST /license/ha-groups

When new firewalls are added or groups need to be redefined, the above GET / POST process can be repeated.

HA Groups will share one device license. If firewalls are ungrouped and there are not enough free device licenses, the user will be asked to remove firewalls from NP-View that are to be unlicensed and deleted from the system.

‍

NP-View has a series of shortcut keys to quickly access commonly used functions.  This section describes some of the frequently used shortcut keys. Note the the list of shortcut keys is available from the upper right menu or by using the “K” key

‍