Deployment guide

Netdisco

Overview

Netdisco is an open-source, web-based network management tool for small to very large networks. It polls your switches, routers and access points over SNMP (and CLI or device APIs) and collects IP and MAC address data into a PostgreSQL database. Its web interface lets you inventory every device, browse and search ports and nodes, locate where a given MAC or IP address is connected, and view how devices link together.

The SecureAnyCloud image runs Netdisco 2.101000 on Ubuntu 24.04 on Azure. Netdisco ships by default with an anonymous full-access guest. This image disables that guest and generates a unique admin login on the first boot of every VM.

What you get:

Netdisco 2.101000 (BSD-3-Clause) run from the official netdisco/netdisco Docker images (a web frontend and a backend poller daemon), managed by netdisco-web.service and netdisco-backend.service
Netdisco published on port 80 via an nginx reverse proxy, so the web UI is reachable without exposing the container port
A bundled local PostgreSQL 16 database holding Netdisco's schema plus 33,850 MAC vendor (OUI) reference entries, ready to identify devices out of the box
A required login: the default anonymous guest is disabled (no_auth: false), and a per-VM admin user is seeded, so nothing is open to the network
A unique admin password, a unique PostgreSQL password and a unique SNMP read-only community, generated per VM on first boot and written to a root-only credentials file
postgresql@16-main.service, netdisco-web.service, netdisco-backend.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point.
NSG inbound: allow 22/tcp from your management network and 80/tcp for the Netdisco web UI. Front the web UI with TLS for public exposure (see Enabling HTTPS).
The bundled PostgreSQL listens only on loopback and is never exposed.
Netdisco reaches your network devices over 161/udp (SNMP) outbound, so make sure your devices permit SNMP from this VM.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal. Choose Create a resource, search the Marketplace for Netdisco by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Deploy the image from the Azure CLI. Replace the values in angle brackets with your own:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:netdisco-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name netdisco \
  --image sac1647283583153:netdisco-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name netdisco --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that all four services are active:

systemctl is-active postgresql@16-main.service netdisco-web.service netdisco-backend.service nginx.service

All four report active. On first boot, the image generates a unique admin password, a unique database password and a unique SNMP read-only community. It then starts the web frontend and the backend poller.

Step 5 - Retrieve your admin credentials

The first boot writes a root-only credentials file. Read it with sudo:

sudo cat /root/netdisco-credentials.txt

The file shows the web URL, the admin username (admin) and its unique password, and the per-VM SNMP read-only community. Keep this file safe. It is the only copy of the generated password.

Step 6 - Check the health endpoint

nginx proxies Netdisco's own health endpoint. It needs no authentication, so it suits a load balancer probe. It returns 200 when the database is reachable:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/health

Step 7 - Confirm your login gates the tool

The anonymous guest is disabled. An unauthenticated request to a page such as the inventory therefore gets the login form, not the data. Confirm the tool is not open:

curl -s http://127.0.0.1/inventory | grep -q 'name="password"' && echo "login required - not open"

The login required - not open result confirms that unauthenticated visitors get the login form, so nothing is exposed without signing in.

Step 8 - Open Netdisco in your browser

Browse to http://<vm-public-ip>/. Sign in with the admin username and the password from your credentials file.

After you sign in, you land on the dashboard. It has a Find Anything search box and a Discover box to add your first device.

Step 9 - Add your first device

Netdisco discovers a device over SNMP and then follows its neighbors. In the Discover box on the dashboard, enter the hostname or IP address of a switch or router that permits SNMP from this VM. Select Discover.

By default, Netdisco uses the per-VM read-only community from your credentials file. You can also set a per-device community under Admin.

Discovery and later polling run as background jobs on the backend daemon. Watch them under Admin -> Job Queue.

Step 10 - Manage users

Open Admin -> User Management to see the per-VM admin account. Add further users here. Each user has their own password and optional administrator or port control rights.

The bundled database and MAC vendor data

The image ships PostgreSQL 16 with Netdisco's schema already deployed and the MAC vendor (OUI) reference data loaded. Device and node vendors are identified from the moment your first device is discovered.

Inspect the bundled database directly on the VM:

sudo -u postgres psql -d netdisco -c "SELECT count(*) AS mac_vendor_ouis FROM oui;"
sudo -u postgres psql -d netdisco -c "SELECT username, admin, port_control FROM users ORDER BY username;"

Security notes

The default Netdisco anonymous guest with full admin rights is disabled in this image (no_auth: false). A real login is always required.
The admin password, the PostgreSQL application role password and the SNMP read-only community are generated uniquely on the first boot of every VM. They are written to /root/netdisco-credentials.txt (mode 0600). No usable login ships inside the image.
The bundled PostgreSQL listens only on 127.0.0.1:5432 and is never exposed to the network.
Change or add web users under Admin -> User Management. To rotate the admin password later, edit the user there.
Only ports 22, 80 and 443 need to be open to the VM. Netdisco reaches your devices outbound over SNMP.

Enabling HTTPS

For public exposure, put the VM behind a certificate. Point a DNS name at the VM and open 443/tcp. Install a certificate with your preferred tool, for example Certbot with the nginx plugin. Let nginx terminate TLS in front of the reverse proxy.

For example, with Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot edits the existing nginx site to serve HTTPS and sets up automatic renewal.

Maintenance

Service status: systemctl status netdisco-web.service netdisco-backend.service
Logs: journalctl -u netdisco-web.service and journalctl -u netdisco-backend.service, plus sudo ls /var/lib/netdisco/logs
Configuration: static policy lives in /var/lib/netdisco/config/deployment.yml. Per-VM secrets are in /var/lib/netdisco/netdisco.env.
Database backups: sudo -u postgres pg_dump netdisco > netdisco-backup.sql
OS updates: unattended security upgrades are enabled, and the base is fully patched at build time.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have a question about this image or need help with a deployment, contact the SecureAnyCloud team.

Deploy on Azure

Launch Netdisco on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Netdisco is an open-source, web-based network management and discovery tool for small to very large networks. It polls your switches, routers and access points over SNMP (and CLI or device APIs) and collects IP and MAC address data into a PostgreSQL database. Its web interface lets you inventory every device, browse and search ports and nodes, locate where a given MAC or IP address is connected, and view how devices link together.

The SecureAnyCloud image runs Netdisco 2.101000 on AWS. Netdisco ships by default with an anonymous full-access guest. This image disables that guest and generates a unique admin login on the first boot of every instance.

What you get:

Netdisco 2.101000 (BSD-3-Clause) run from the official netdisco/netdisco container images (a web frontend and a backend poller daemon), managed by netdisco-web.service and netdisco-backend.service
Netdisco published on port 80 via an nginx reverse proxy, so the web interface is reachable without exposing the container port
A bundled local PostgreSQL 16 database holding Netdisco's schema plus MAC vendor (OUI) reference data, ready to identify devices out of the box
A required login: the default anonymous guest is disabled (no_auth: false), and a per-instance admin user is seeded, so nothing is open to the network
A unique admin password, a unique PostgreSQL password and a unique SNMP read-only community, generated per instance on first boot and written to a root-only credentials file
The PostgreSQL data tier on its own dedicated EBS volume, which you can resize and snapshot independently
postgresql@16-main.service, netdisco-web.service, netdisco-backend.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Connecting to your instance

Connect over SSH on port 22 as the login user for your operating system variant:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh ubuntu@<instance-ip>

The bundled PostgreSQL listens only on loopback (127.0.0.1:5432) and is never exposed. Netdisco reaches your network devices over 161/udp (SNMP) outbound, so make sure your devices permit SNMP from this instance.

Step 1 - Launch from AWS Marketplace

In the AWS Marketplace console, open the Netdisco listing by SecureAnyCloud. Choose Continue to Subscribe, then Continue to Configuration, then Continue to Launch.

Pick your region, an m5.large instance type (a good starting point), a key pair and a VPC subnet. Choose a security group that allows TCP 22 (SSH) from your management network and TCP 80 (the web interface).

Then choose Launch.

Step 2 - Launch from the AWS CLI

Launch the instance from the AWS CLI:

aws ec2 run-instances \
  --image-id <netdisco-ami-id> \
  --instance-type m5.large \
  --key-name <your-key> \
  --security-group-ids <sg-with-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=netdisco}]'

Replace <netdisco-ami-id> with the AMI ID shown on the Marketplace launch page for your region.

Step 3 - Confirm the services are running

After you connect over SSH, confirm that the stack is up:

systemctl is-active postgresql@16-main.service netdisco-web.service netdisco-backend.service nginx.service

Step 4 - Retrieve your admin credentials

The first boot writes a root-only credentials file. Read it with sudo:

sudo cat /root/netdisco-credentials.txt

The file shows the web URL, the admin username (admin) and its unique password, and the per-instance SNMP read-only community. Keep this file safe. It is the only copy of the generated password.

Step 5 - Check the health endpoint

nginx proxies Netdisco's own health endpoint. It needs no authentication, so it suits a load balancer target group health check. It returns 200 when the database is reachable:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/health

Step 6 - Confirm your login gates the tool

The anonymous guest is disabled. An unauthenticated request to a page such as the inventory therefore gets the login form, not the data. Confirm the tool is not open:

curl -s -m 10 http://127.0.0.1/inventory -o /tmp/nd-inventory.html if grep -q 'name="password"' /tmp/nd-inventory.html; then echo "login required - not open"; else echo "unexpected: login form not served"; fi rm -f /tmp/nd-inventory.html

The login required - not open result confirms that unauthenticated visitors get the login form, so nothing is exposed without signing in.

Step 7 - Open Netdisco in your browser

Browse to http://<instance-ip>/. Sign in with the admin username and the password from your credentials file.

After you sign in, you land on the dashboard. It has a Find Anything search box and a Discover box to add your first device.

Step 8 - Discover your first device

By default, Netdisco uses the per-instance read-only community from your credentials file. You can also set a per-device community under Admin.

Discovery and later polling run as background jobs on the backend daemon. Watch them under Admin -> Job Queue.

Once devices are discovered, they appear under Inventory and in device search, with vendor, model, software version, location and management IP for each:

Select any device to open its detail page. The page shows ports, modules, neighbors, addresses and VLANs, plus per-device admin tasks such as re-discover, arpnip and macsuck:

Step 9 - Locate a MAC or IP address

Open the Node tab of search. It shows which switch port a given MAC or IP address is connected to, when it was first and last seen, and the VLAN it is on. This is the core troubleshooting workflow for "where is this device plugged in?":

Step 10 - Manage users

Open Admin -> User Management to see the per-instance admin account. Add further users here. Each user has their own password, allowed source addresses, and optional administrator or port control rights.