The time (in seconds) in which a response is expected from the host. The default is one second.

The SNMP version to use. From the SNMP version list, select one of the following: 1, 2c, or 3. The default is Version 2c. If you are setting up credentials for discovering Netware, you must select Version 1 from the SNMP version list.

Security Level

For SNMP V3 credentials only. This field shows the security level selected by using the following authentication and privacy protocols:

• noAuthNoPriv—No authentication and no privacy.
• authNoPriv—Authentication, no privacy.
• authPriv—Authentication and privacy.

No setting exists for privacy without authentication.

Protocol used to encrypt the authentication with the client. This is applicable for SNMP V3 credentials only. Select one of the following options from the list:

• None—No encryption used. Operates in the same way as v1 and v2.
• MD5—The authentication passphrase you enter is MD5 hashed. 
• SHA-1—The authentication passphrase you enter is SHA-1 hashed.
• SHA-224—The authentication passphrase you enter is SHA-224 hashed.
• SHA-256—The authentication passphrase you enter is SHA-256 hashed.
• SHA-384—The authentication passphrase you enter is SHA-384 hashed.
• SHA-512—The authentication passphrase you enter is SHA-512 hashed.

The hashed passphrase is used to access the target system.

Tip

The SHA-2 authentication protocols (SHA-224, SHA-256, SHA-384, and SHA-512) are specified in the proposed standard RFC 7860 .

For SNMP V3 credentials only.

The key (passphrase) that is used to encrypt the credentials. This is applicable for SNMP V3 credentials only, and only if you have selected an authentication protocol. The key must be at least 8 characters.

The protocol that is used to encrypt data retrieved from the target. Encrypting the data retrieved from a discovery target causes performance degradation as compared to not encrypting the data. This is applicable for SNMP V3 credentials only, and only if you have selected an authentication protocol. That is, you cannot have privacy without authentication. Select one of the following options from the list:

• None—No data encryption is used. This operates in the same way as v1 and v2.
• DES—Uses a private key to encrypt data by using the DES algorithm.
• AES 128—Uses a private key to encrypt data by using the AES algorithm.
• AES 192 (draft std)—Uses a private key to encrypt data according to the  AES draft privacy protocol.

• AES 256 (draft std)—Uses a private key to encrypt data according to the AES draft privacy protocol.

  Important

  The AES 192 (draft std) and AES 256 (draft std)  AES draft privacy protocols are drafts and may not be supported by all manufacturers. If you choose to use one of these protocols, you must be sure that the vendor of the device type that you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

• AES 128 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 192 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 256 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

  Important

  The AES 128/192/256 with 3DES key extension (draft std)  AES draft privacy protocol with extensions are drafts and may not be supported by all manufacturers. Examples of manufacturers who have used this draft standard in their equipment are Cisco Systems and Extreme Networks. If you choose to use one of these protocols, you must be sure that the vendor of the device type that you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

One of:

• IBM Db2
• Ingres
• Microsoft SQL Server
• MySQL
• Oracle
• PostgreSQL
• Sybase

Specify the other database properties by using the format, key=value. For example, to encrypt the password, enter ENCRYPT_PASSWORD=true.

In earlier releases, the Encrypt Password check box was available to encrypt the password. This checkbox was removed in August TKU (TKU 2020-Aug-1). 

Tip

Microsoft SQL Server with a domain account

If you are connecting to Microsoft SQL Server with a domain account, you must add the following lines for the credential:
domain=<DomainName>
useNTLMv2=true
authenticationScheme=NTLM
integratedSecurity=true

SSH

Enter a timeout period (in seconds) for a session. This timeout includes the period for a credential handshake (see also the Session Login Timeout). This timeout is used to control sessions. The default is 180 seconds.

In general, timeout is not used to limit the time to scan devices. More than one session can be used m to scan one device. For this reason, a scan can take more time than the specified timeout. A typical consequence of this timeout (for example, when the execution of the platform script for getInterfaceList takes longer than this timeout) is that the scan will fail with a script failure and an error message, Connection timed out.

Telnet

Enter a timeout period (in seconds) for a session. This timeout includes the period for a credential handshake (see also the Session Login Timeout). This timeout is used to control sessions. The default is 180 seconds.

In general, timeout is not used to limit the time to scan devices. More than one session can be used to scan one device. For this reason, a scan can take more time than the specified timeout. A typical consequence of this timeout (for example, when the execution of the platform script for getInterfaceList takes longer than this timeout) is that the scan will fail with a script failure and an error message, Connection timed out.

Enter a timeout period (in seconds) for a session. This timeout includes the period for a credential handshake (see also the Session Login Timeout). This timeout is used to control sessions. The default is 180 seconds.

In general, timeout is not used to limit the time to scan devices. More than one session can be used to scan one device. For this reason, a scan can take more time than the specified timeout. A typical consequence of this timeout (for example, when the execution of the platform script for getInterfaceList takes longer than this timeout) is that the scan will fail with a script failure and an error message, Connection timed out.

Important

The rlogin access method used to connect to an endpoint is not a secure protocol as communication is not encrypted. Rlogin is not available in the BMC Discovery Outpost UI. If required, you can use rlogin in the appliance UI.

UNIX Settings

To use the su command to change to the root or any other user, select Switch User.

In the following two fields, enter the user to be changed to, and the corresponding password. The password text is not displayed on the screen.

Enter the password for the SU username. The password text is not displayed on the screen.

Tip

On the Edit Login Credential page, this field is displayed as Set Password. The existing password is displayed as a series of asterisks that cannot be edited. To enter a new password, select the check box. The password field is cleared, enabling you to enter the new password.

Only applicable when using a BMC Discovery Outpost.

A Windows Active Directory credential. This cannot be specified with a local Windows user credential.

No additional Active Directory parameters are required unless the BMC Discovery Outpost is running on a Windows host with a Group Managed Service Account (gMSA) configured. For information about configuring a gMSA, see Running the Windows proxy or Outpost under a gMSA.

See Adding Windows proxies.

Select a custom HTTPS port from the list. The list is populated with custom HTTPS ports that you have configured in Administration > Discovery Configuration.

Enter a timeout period (in seconds) for a session. This timeout includes the period for a credential handshake (see also the Session Login Timeout). This timeout is used to control sessions. The default is 180 seconds.

In general, timeout is not used to limit the time to scan devices. More than one session can be used to scan one device. For this reason, a scan can take more time than the specified timeout. A typical consequence of this timeout (for example, when the execution of the platform script for getInterfaceList takes longer than this timeout) is that the scan will fail with a script failure and an error message, Connection timed out.

Select a custom HTTPS port from the list. The list is populated with custom HTTPS ports that you have configured in Administration > Discovery Configuration.

Port to use to connect to the Mainframe z/OS Agent. The default is 3940. To use a different port, select a port number from the list. The list is populated with port numbers specified in Administration > Discovery Configuration.

Enter a timeout period (in seconds) for a session. This timeout includes the period for a credential handshake (see also the Session Login Timeout) and is used to control sessions. The default is 180 seconds.

In general, timeout is not used to limit the time to scan devices. More than one session can be used to scan one device. For this reason, a scan can take more time than the specified timeout. A typical consequence of this timeout (for example, when the execution of the platform script for getInterfaceList takes longer than this timeout) is that the scan will fail with a script failure and an error message, Connection timed out.

Access Key ID

The equivalent to a user name, and refers to the initial account.

Use the AWS IAM console to download the Access Key ID and Access Secret Key as a CSV file. You can import the CSV files downloaded from the IAM console, reducing the scope for cut and paste errors when creating AWS credentials in BMC Discovery.

To upload a CSV file containing the Key ID and Secret, click Upload CSV, select the file, and click Open.

Tip

If the BMC Discovery appliance is running in an EC2 instance and that instance is associated with an instance profile, you can use that profile rather than an Access Key ID and Access Secret Key. If you leave those fields blank, AWS discovery uses the EC2 instance profile to perform the discovery. In the credential list, the AWS credential is labeled, AWS Access Key ID: From EC2 Instance Profile.

The connection timeout and the read timeout (in seconds). The default is 60 seconds.

The value specified here is for two separate timeouts. Consequently, the time before receiving data back on an initial connection could be up to almost twice the timeout value. That is if the connection time was almost the maximum and the time to read the content was almost the maximum.

(Optional) Use the Amazon Resource Name (ARN) only if you want to apply role-based authentication for a user, an application, or a service. You must have defined the role earlier in AWS Identify and Access Management (IAM). For information about defining roles, see Creating IAM roles .

Example for a single role: arn:aws:iam::123456789012:role/Discovery

To enable role-switching (multiple roles), enter each role as a new-line separated list. For more information about AWS roles and role-switching, see Discovering Amazon Web Services.

From the December 2021 TKU, the ARN field supports expansions by using *. You must have defined an organization structure to use the expansion as it depends on the AWS Organizations API. For example, you might specify one of:

• arn:aws:iam::123456789012:role/Discovery  
• arn:aws:iam::*:role/Discovery, where * expands to the access key (123456789012).

If you do not specify the ARN, you will discover AWS resources associated with the Access Key ID credentials.

By default, BMC Discovery uses an external ID with the "BMCDiscovery" value, which does not impact accounts without an AWS external ID. If a user account does have an AWS external ID, update this field with a valid value. AWS recommends to use one external ID per one AWS account. For more information, see How to use an external ID when granting access to your AWS resources to a third party .

If you need to connect to AWS through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• Hostname–Name of the proxy host.
• Port–Port on which to connect to the proxy. The default is 3128.

If you need to connect to AWS through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• User–Username for the proxy.
• Password–Corresponding password.

The key used to access the Google Cloud Platform services. Download the key from the Google Cloud Console as a JSON formatted file. Upload the JSON file to BMC Discovery. Click Choose File, select the JSON file in the file browser, and then click Open.

The connection timeout and the read timeout (in seconds). The default is 60 seconds.

The value specified here is for two separate timeouts. Consequently, the time before receiving data back on an initial connection could be up to almost twice the timeout value. That is if the connection time was almost the maximum and the time to read the content was almost the maximum.

If you need to connect to Google Cloud through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• Hostname–Name of the proxy host.
• Port–Port on which to connect to the proxy. The default is 3128.

If you need to connect to Google Cloud through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• User–Username for the proxy.
• Password–Corresponding password.

The connection timeout and the read timeout (in seconds). The default is 60 seconds.

The value specified here is for two separate timeouts. Consequently, the time before receiving data back on an initial connection could be up to almost twice the timeout value. That is if the connection time was almost the maximum and the time to read the content was almost the maximum.

If you need to connect to Microsoft Azure through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• Hostname–Name of the proxy host.
• Port–Port on which to connect to the proxy. The default is 3128.

If you need to connect to Microsoft Azure through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• User–Username for the proxy.
• Password–Corresponding password.

The connection timeout and the read timeout (in seconds). The default is 60 seconds.

The value specified here is for two separate timeouts. Consequently, the time before receiving data back on an initial connection could be up to almost twice the timeout value. That is if the connection time was almost the maximum and the time to read the content was almost the maximum.

If you need to connect to OpenStack through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• Hostname–Name of the proxy host.
• Port–Port on which to connect to the proxy. The default is 3128.

If you need to connect to OpenStack through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• User–username for the proxy.
• Password–corresponding password.

API Key:
Key name

The API key name. You can download the key as a JSON file from the  IBM Cloud API keys console when you create it. You can upload this to BMC Discovery by using the Upload JSON button.

API Key:
Key value

The API key name.

The connection timeout and the read timeout (in seconds). The default is 60 seconds.

The value specified here is for two separate timeouts. Consequently, the time before receiving data back on an initial connection could be up to almost twice the timeout value. That is if the connection time was almost the maximum and the time to read the content was almost the maximum.

If you need to connect to IBM Cloud through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• Hostname–Name of the proxy host.
• Port–Port on which to connect to the proxy. The default is 3128.

If you need to connect to IBM Cloud through an HTTP Proxy, enter the details here. This is an authenticating HTTP Proxy rather than a BMC Discovery Windows proxy.

• User–Username for the proxy.
• Password–Corresponding password.

The time (in seconds) in which a response is expected from the host. The default is one second.

Select the check box and then select an SNMP port from the list. The list is populated with SNMP ports that you have configured in the Discovery Configuration window.

The SNMP version to use. From the SNMP version list, select one of the following: 1, 2c, or 3. The default is Version 2c. If you are setting up credentials for discovering Netware, you must select Version 1 from the SNMP version list.

Use GETBULK requests instead of GETNEXT requests. GETBULK improves discovery performance. However, some devices do not support it correctly, which occasionally may lead to scanning issues. If you experience scanning issues, clear this option to revert to GETNEXT.
GETBULK is supported only by SNMP v2c and v3.

For SNMP V3 credentials only. This field shows the security level selected by using the following authentication and privacy protocols:

• noAuthNoPriv—No authentication and no privacy.
• authNoPriv—Authentication, no privacy.
• authPriv—Authentication and privacy.

No setting exists for privacy without authentication.

Protocol used to encrypt the authentication with the client. This is applicable for SNMP V3 credentials only. Select one of the following options from the list:

• None—No encryption used. Operates in the same way as v1 and v2.
• MD5—The authentication passphrase you enter is MD5 hashed. 
• SHA-1—The authentication passphrase you enter is SHA-1 hashed.
• SHA-224—The authentication passphrase you enter is SHA-224 hashed.
• SHA-256—The authentication passphrase you enter is SHA-256 hashed.
• SHA-384—The authentication passphrase you enter is SHA-384 hashed.
• SHA-512—The authentication passphrase you enter is SHA-512 hashed.

The hashed passphrase is used to access the target system.

Tip

The SHA-2 authentication protocols (SHA-224, SHA-256, SHA-384, and SHA-512) are specified in the proposed standard  RFC 7860 .

For SNMP V3 credentials only.

The protocol used to encrypt data retrieved from the target. Encrypting the data retrieved from a discovery target causes performance degradation as compared to not encrypting the data. This is for SNMP V3 credentials only, and only if you have selected an authentication protocol. That is, you cannot have privacy without authentication. Select one of the following options from the list:

• None—No data encryption is used. Operates in the same way as v1 and v2.
• DES—Uses a private key to encrypt data by using the DES algorithm.
• AES 128—Uses a private key to encrypt data by using the AES algorithm.
• AES 192 (draft std)—Uses a private key to encrypt data according to the  AES draft privacy protocol.

• AES 256 (draft std)—Uses a private key to encrypt data according to the AES draft privacy protocol.

  Important

  The AES 192 (draft std) and AES 256 (draft std)  AES draft privacy protocols are drafts and may not be supported by all manufacturers. If you choose to use one of these protocols, you must be sure that the vendor of the device type that you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

• AES 128 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 192 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 256 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

  Important

  The AES 128/192/256 with 3DES key extension (draft std)  AES draft privacy protocol with extensions are drafts and may not be supported by all manufacturers. Examples of manufacturers who have used this draft standard in their equipment are Cisco Systems and Extreme Networks. If you choose to use one of these protocols, you must be sure that the vendor of the device type you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

Select a custom HTTPS port from the list. The list is populated with custom WBEM HTTPS ports that you have configured in Administration > Discovery Configuration.

Select a custom HTTP port from the list. The list is populated with custom WBEM HTTP ports that you have configured in Administration > Discovery Configuration.

Select an HTTPS port from the list. The list is populated with HTTPS ports that you have configured in Administration > Discovery Configuration.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

The login path is the path to a token resource (to obtain a token for Rest API Authentication) on the Nimble storage API. The path is configurable on some versions of Nimble storage. You must use the default path for your Nimble storage device version. Contact your Nimble Storage vendor if the default path does not work and update the credential to match.

The default value in the UI is /v1/tokens.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

The time (in seconds) in which a response is expected from the host. The default is one second.

Select the check box and then select an SNMP port from the list. The list is populated with SNMP ports that you have configured in the Discovery Configuration window.

The SNMP version to use. From the SNMP version list, select one of the following: 1, 2c, or 3. The default is Version 2c. If you are setting up credentials for discovering Netware, you must select Version 1 from the SNMP version list.

Use GETBULK requests instead of GETNEXT requests. GETBULK improves discovery performance. However, some devices do not support it correctly, which occasionally may lead to scanning issues. If you experience scanning issues, clear this option to revert to GETNEXT.
GETBULK is supported only by SNMP v2c and v3.

For SNMP V3 credentials only. This field shows the security level selected by using the following authentication and privacy protocols:

• noAuthNoPriv—No authentication and no privacy.
• authNoPriv—Authentication, no privacy.
• authPriv—Authentication and privacy.

No setting exists for privacy without authentication.

Protocol used to encrypt the authentication with the client. This is applicable for SNMP V3 credentials only. Select one of the following options from the list:

• None—No encryption used. Operates in the same way as v1 and v2.
• MD5—The authentication passphrase you enter is MD5 hashed. 
• SHA-1—The authentication passphrase you enter is SHA-1 hashed.
• SHA-224—The authentication passphrase you enter is SHA-224 hashed.
• SHA-256—The authentication passphrase you enter is SHA-256 hashed.
• SHA-384—The authentication passphrase you enter is SHA-384 hashed.
• SHA-512—The authentication passphrase you enter is SHA-512 hashed.

The hashed passphrase is used to access the target system.

Tip

The SHA-2 authentication protocols (SHA-224, SHA-256, SHA-384, and SHA-512) are specified in the proposed standard  RFC 7860 .

For SNMP V3 credentials only.

The protocol used to encrypt data retrieved from the target. Encrypting the data retrieved from a discovery target causes performance degradation as compared to not encrypting the data. This is for SNMP V3 credentials only, and only if you have selected an authentication protocol. That is, you cannot have privacy without authentication. Select one of the following options from the drop-down list:

• None—No data encryption is used. Operates in the same way as v1 and v2.
• DES—Uses a private key to encrypt data by using the DES algorithm.
• AES 128—Uses a private key to encrypt data by using the AES algorithm.
• AES 192 (draft std)—Uses a private key to encrypt data according to the  AES draft privacy protocol.

• AES 256 (draft std)—Uses a private key to encrypt data according to the  AES draft privacy protocol.

  Important

  The AES 192 (draft std) and AES 256 (draft std) AES draft privacy protocols are drafts and may not be supported by all manufacturers. If you choose to use one of these protocols, you must be sure that the vendor of the device type that you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

• AES 128 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 192 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

• AES 256 with 3DES key extension—Uses a private key to encrypt data according to the  AES draft privacy protocol with extensions .

  Important

  The AES 128/192/256 with 3DES key extension (draft std) AES draft privacy protocol with extensions  are drafts and may not be supported by all manufacturers. Examples of manufacturers who have used this draft standard in their equipment are Cisco Systems and Extreme Networks. If you choose to use one of these protocols, you must be sure that the vendor of the device type that you intend to discover has implemented AES192 or AES256 support according to this draft standard. A message is displayed in the UI if you select one of these privacy protocols.

Select an HTTPS port for the Web API from the list. The list is populated with HTTPS ports that you have configured in Administration > Discovery Configuration.

Tip

Cisco CIMC can be discovered by using XML API or SNMP.
The XML API provides detailed information, facilitating the CIMC to be linked to its contained host, while SNMP provides only basic information.

Select a custom HTTPS port from the list. The list is populated with custom HTTPS ports that you have configured in Administration > Discovery Configuration.

Tip

To fully discover HP iLO Management Controller, valid HP iLO Web API credentials should be set up. However, it is possible to discover HP iLO without valid credentials by using the unauthenticated XMLDATA request (GET request to /xmldata?item=all).
In such a case, the Management Controller can be discovered with some basic information (for example, serial, model, and for some iLO versions MAC addresses). Though, some of the information, such as IP addresses and interfaces will be missing.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

REST API with OAuth2 authentication

You can specify an optional Client ID and the secret to access REST APIs with OAuth2 authentication.

• Client ID–A client ID (if required) to access the API.
• Client secret–The corresponding client secret. To enter a new secret, select the check box. The entry field is cleared and you can enter the new secret.

Select Allow HTTP to enable REST API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.

Select Allow HTTP to enable Web API requests to be made over HTTP.

Warning

HTTP is not a secure protocol as the communication is not encrypted. This is a security risk that allows access credentials to be stolen.