Neurons for Service MappingDiscovery Requirements
Ver. 3.2.0

Technical Document

Table of ContentsIntroduction

3

Discovery Architecture Overview

3

Discovery App Sizing Considerations

4

Discovery App Scan Capabilities

5

Discovery App Server Requirements

5

Firewall Rules

6

Port Requirements

7

Authentication Requirements

7

AWS IAM Policy

9Azure Role Setup

9

User Role Types for Credentials

10

Additional Considerations

11

This document is provided strictly as a guide. No guarantees can be provided or expected. This document contains the confidential information
and/or proprietary property of Ivanti, Inc. and its affiliates (referred to collectively as “Ivanti”) and may not be disclosed or copied without priorwritten consent of Ivanti.
Ivanti retains the right to make changes to this document or related product specifications and descriptions, at any time, without notice. Ivanti
makes no warranty for the use of this document and assumes no responsibility for any errors that can appear in the document, nor does itmake a commitment to update the information contained herein. For the most current product information, please visit www.ivanti.com.
Copyright © 2024, Ivanti. All rights reserved. IVI_2024_05_09

Ivanti Neurons for Discovery & Service Mapping Requirements | 2Introduction

About This Document
This document provides much of the information needed to properly prepare the discovery portion of Ivanti
Neurons for Service Mapping. It also provides a check list of the system requirements to run the Discovery
Application (“Discovery App”) on customer-hosted servers, the firewall rules and ports to allow
communication between the Discovery App and cloud instance, and the credentials needed to accurately
identify infrastructure assets, gather configurations, and detect application dependencies and interrelationships. It is not a how-to-guide for implementing, configuring, or troubleshooting Ivanti Neurons forService Mapping.
About Neurons for Service Mapping
Ivanti Neurons for Service Mapping provides Ivanti and Cherwell CMDB customers with automatic inventory
and configuration cataloging of on-premise and cloud compute, network and storage assets. The discovery
process also detects physical and logical dependencies between applications and their host systems. From
there, enterprise services are easily mapped across all supporting infrastructure components and viewablefrom within the Ivanti CMDB. Neurons for Service Mapping offers the ease of SaaS deployment andaccessibility combined with the security and performance of on-premise discovery. Leveraging over 140 (andgrowing) agentless and extendable probes.

Discovery Architecture Overview
Figure 1 provides a visual representation of the methods Neurons for Service Mapping employs to perform
agentless asset, configuration, software and relationship/dependency discovery.
Customers also have the option of deploying agents to Windows servers in lieu of agentless scanningmethods (not depicted in Figure 1). There are two options for agent delivery to Windows servers:▪ Via the Discovery App leveraging the same requirements for agentless scanning (see Figures 5 and 6)▪ Via customer’s software distribution tools using an Ivanti provided MSI build of the agent(development fees apply)

Ivanti Neurons for Discovery & Service Mapping Requirements | 3

Figure 1: Agentless Discovery Overview

Discovery App Sizing Considerations
The number and locations of Discovery Apps depend on several factors. These include size of network toscan, number of discoverable assets, time required to complete all scans, and number of logically or
physically separated networks. Here are some questions to consider:▪

How many data centers or cloud environments to be scanned?

▪

What is the connectivity/bandwidth between each data center?

▪ Would any firewall rules/router settings prevent scanning between data centers? (see authentication
requirements for necessary ports)▪

How many IP subnets per DC/cloud environment?

▪

How many devices/virtual servers in total?

Ivanti Neurons for Discovery & Service Mapping Requirements | 4▪

Roughly how many devices/virtual servers per subnet?

▪ What is the desired scan frequency (i.e. daily, weekly, alternating)? Any exceptions or special
considerations?

Discovery App Scan Capabilities
Each Discovery App is capable of simultaneously scanning subnets of four /24, two /23 or one /22. Scantimes can vary based on the number and types of connected devices. Generally, a scan of a /24 subnet withthe maximum number of 256 devices will take 20-40 minutes to complete. This means four /24 subnets canbe simultaneously scanned in an average time of 30 minutes. Figure 2 shows the estimated scan times forvarious amounts of /24 subnets and Discovery Apps.
Figure 2: Estimated Scan Times
Number of /24 Subnets

Number of IPs

Number of Discovery

Hours to complete scanApps(assumes 4 simultaneoussubnets)

4

1,024

1.5

25

6,400

1

3

100

25,60011320052,2002

13400

102,400

4

13

As you can see, a single Discovery App can easily scan over 20,000 IPs in a single day. If daily scans for each IP
are not required, subnet scans can be configured to run on alternating days so even more IP’s can be scanned
from a single Discovery App each week. If, however, the desired scan frequency is greater than once a week
per IP, and the subnet count is higher than 100, more than one Discovery App may be required.

Discovery App Server Requirements

The Discovery App must be installed on a Windows server (see Figure 3 for recommended specs) regardlessof the types of devices or operating systems to be discovered. The Windows server must be located within

Ivanti Neurons for Discovery & Service Mapping Requirements | 5the domain to be discovered or trust across domains must be enabled. The Discovery App Windows servermust also have a persistent outbound connection to the URLs shown in Figure 4.
The Discovery App will be downloaded from a link inside the Virima UI that points to an AWS S3 bucket.
Please be sure to have Chrome browser installed and download ability from an AWS S3 bucket on theDiscovery App server or be able to download and copy the installer to the Discovery App server.
Figure 3: Discovery App System Requirements
Operating System

Server TypeCPURAMHDBrowser

Windows Server 2012 or

Dedicate Physical orHigh performance

16 GB50 GBChromenewer

Virtual(12-16 cores)

Firewall Rules
Discovery is performed when the Discovery App launches selective probes to the target systems. These scans
are configured via the cloud-based UI which in turn commands the Discovery App to launch the probes. The
data collected by the probes is then returned to the Discovery App which is then securely transmitted to theIvanti cloud for processing and staging for synch into the Ivanti or Cherwell CMDB. Figure 4 shows thenecessary communication that must be allowed between the Discovery App(s) located in the customer’s onpremise and/or cloud environments and the Ivanti cloud.
Figure 4: Firewall Rule Requirements
Discovery App communication to INSM cloud requires 443 to the following region-specific URLs
U.S. HostingEU (Frankfurt) Hosting•

https://discoveryselector-usw2.ivanticloud.com•

https://discoveryserver1-euc1.ivanticloud.com•

https://discoveryserver1-usw2.ivanticloud.com•

https://discoveryselector-euc1.ivanticloud.com•

https://servicemapping-usw2.ivanticloud.com

Australia Hosting•

https://discoveryserver1-apse2.ivanticloud.com/•

https://discoveryselector-apse2.ivanticloud.com/

Proxy Server
Proxy server is supported for outbound communication from Discovery App to INSM cloud with thefollowing properties in Discovery Application common.properties file:#ProxyHost=#ProxyPort=#ProxyUserName=#ProxyPassWord=

ICMP Ping

Ivanti Neurons for Discovery & Service Mapping Requirements | 6

ICMP Ping is required to perform host up/down check to target devices.

Port Requirements

Figure 5 details the ports required for the Discovery App to conduct agentless scanning, receive data from theWindows agents, and transfer the discovery data to the Neurons for Service Mapping cloud (depicted as“Discovery Server”).
Figure 5: Port Requirements

Authentication Requirements
As part of the Discovery App installation, customers enter the appropriate credentials for thetypes of systems to be scanned. These credentials are stored and encrypted locally within theDA Windows server and never go to the cloud. Figure 6 lists the most common types ofcredentials and communication methods required for the probes to successfully scan each
asset type. Note the list may not be inclusive of requirements and is subject to change.
Notes on scanning Windows OS: The Discovery App will copy a few files to the Windows
admin$ share and then launch a local service with the credentials provided. It will then scanthe system with all the probe details. Once the scan is complete it will then stop and remove
the service and files from the admin$ share folder. In order for this to work, the account being
used must have remote file access to the admin$ share, must have admin rights on the box
being scanned, and must have logon as a service rights on the local Windows box.

Ivanti Neurons for Discovery & Service Mapping Requirements | 7

Figure 6: Discovery App Credential Requirements
Asset TypeMethod

Port/Protocol

Authentication Method

Notes

WindowsWMI and either
PAExec orPowerShell

TCP: 135, 139(WMI) and 445(File and Printsharing) UDP:
137,138

Windows admin credentials
with elevated privileges

Elevated privileges required forrelationship discovery

Unix, Linux,Mac, Solaris

SSH

22 (SSH)

SSH username/ password
or private keys

Cisco

CDP

22 (SSH)

SSH User ID/password

Network/Storage SNMP
Devices161 (SNMP)

Community String (v1, v2)
or User ID/password (v3)

AWS resourcesAPI

443/80Account ID, AWS accesskey, secret key, account ID

Azure resources API

443/80Account ID, client ID, tenant See Azure Role Setup below,Virtual machine details requireID, secret key
server discovery scan

VMWarevCenter/ESXi

API443/80

User ID, Password

Active Directory

WMI/API135, 88

AD host, Domain, Base DN,
Bind DN, Password

MS SQL
Database

WMI

1433, 1434

Windows or SQL Server
account

MMC
Certificates

WMI and PowerShell 135, 137, 138, 139(WMI) and 445(file/print sharing)

Windows admin credentials
with elevated privileges

TLS/SSL
Certificates

WMI443

Windows admin credentials
with elevated privileges

Certs that reside on a server can bediscovered. E.g. if port 443 is openon a server, it is assumed itcontains a SSL cert which Virima
tries to retrieve from the port query

IIS Websites

WMI

135, 137, 138, 139(WMI) and 445(file/print sharing)

Webserver credentials

Requires IIS Management Tools
installed with IIS Management
Scripts and Tools selectedCisco MerakiAPI

The same requirements apply for
the Discovery App to deploy theWindows Server Agent.

Preferred over SNMP

See AWS IAM Policy below, EC2
OS details require server discovery
scanRequires SQL server credential
profile with user read rights on thesys.databases table

API key

Ivanti Neurons for Discovery & Service Mapping Requirements | 8

AWS IAM Policy
To allow the importing of AWS objects into the CMDB the following must be done within theAWS account. Note: EC2 operating system discovery is performed via the Discovery App per
the Windows/Linux/Unix methods listed in the Credential Requirements Table above.
{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["ecr:Describe*","ec2:Describe*","rds:Describe*","elasticloadbalancing:Describe*","autoscaling:Describe*","iam:GetUser","dynamodb:Describe*","s3:ListAllMyBuckets"],"Resource": "*"}]}

Azure Role Setup
To allow the importing of Azure objects into the CMDB the following Azure Role Setup must be
performed. Note: Azure Virtual Machine operating system discovery is performed via theDiscovery App per the Windows/Linux/Unix methods listed in the Credential Requirements
Table above.
1. Go to https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade and create a
new App Registration and note down the below details from Overview
a. Client ID (Required in Virima to add Azure Credentials)b. Tenant ID (Required in Virima to add Azure Credentials)c. Secret Key-Value (Needs to be created from Certificates & Secrets ) (Required in Virima toadd Azure Credentials)

Ivanti Neurons for Discovery & Service Mapping Requirements | 9

2. Go to https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBladea. Note down the Subscription ID (Required in Virima to add Azure Credentials)
b. Go inside subscription details and click on Access Control (IAM)c. Click Add and then select Add Role Assignmentd. Select Reader Role and click nextc. Click on 'Select Members' and search for the newly added App Registration and select it andclick Select.
e. Review and Assign the role.

User Role Types for Credentials
User Role Types

HostScans
No

Pattern
Scans
No

IP
Connections
No

Process
Scans
No

Local Administrator user with no elevatedprivileges

Yes

Yes

No

Yes

Local Administrator user with elevatedprivileges

Yes

Yes

Yes

Yes

System Administrator user

Yes

Yes

Yes

Yes

System Domain Administrator user (Onlyapplicable to domain machines)

Yes

Yes

Yes

Yes

Standard user (No administrator access)Notes:
1. Enabled Domain File sharing profile is a mandatory requirement.
2. Ivanti Neurons for Service Mapping requires admin share folder access to perform even abasic scan. This access is default with elevated privileges. Users without elevated privileges canbe manually given admin share privileges by adding an entry into the registry.
3. The Discovery App need not be running on a domain machine, but if it is, the service logon
credentials are required to scan that domain machine.
4. The above applies to both Windows domain and workgroup machines.

Ivanti Neurons for Discovery & Service Mapping Requirements | 10

5. Credentials are stored locally within the on premise Discovery App and never shared withIvanti Neurons for Service Mapping web services. They are encrypted and not viewable toanyone.

Additional Considerations
This document is intended to help ensure the proper scoping and sizing of Ivanti Neurons for Service
Mapping as well as prepare Ivanti Professional Services and customers for initial deployment. The
information provided covers the majority of customer environments and will help identify any possible
exceptions that should be addressed early in the sales or professional services engagement.

Learn Moreivanti.com
1 801 308 8047 (Americas Support)
support@ivanti.com

Ivanti Neurons for Discovery & Service Mapping Requirements | 11