OT SCAN - Modbus + SNMP

[JoeJoeJoe]

The OT Discovery scan struggles to detect SNMP-enabled Schneider Modicon PLCs, as it fails to retrieve SNMP data. To work around this, I have to manually change the asset type from OT to another category, scan it using Lansweeper on-prem to capture the SNMP information, and then revert it back to OT. I also manually select Modbus and SNMP protocol in the scan. I didn't test it on device with SNMP v3 as there is no place for me to enter the credentials information. In the Network Discovery Hub website, there is also a location where I can enter the manual SNMP v3 credentials in the Discovery section, however it is a onetime scan and doesn't retain the information. It also doesn't work. 

Additionally, the scan does not retrieve details about the backplane or its attached modules. 

OT Network Discovery version 4.2.5

[ErikT]

@JoeJoeJoe you don't need SNMP to scan Schneider Modicon PLC's. To successfully scan them the OT sensor needs to be installed in the same VLAN/subnet as the PLC is in. (see screenshots below)

Successfull scan of Schneider Modicon PLC

OT network diagram

[JoeJoeJoe]

@ErikT 

Thank you for getting back to me. I have all of those information that you have provided in the screen shot with the exception of the MAC address and that is because I didn't scan it on the L2 (same subnet). Scanning from a different subnet through L3 works.

I was hopping to get backplane information and modules as well, I didn't see it. Are you able to get those information for Modicon m580, m340 and Quantum? 

However, I would like to point out that using SNMP OT scan doesn't work because it doesn't pick up SNMP information. Furthermore, for newer PLC that support SNMP v3, I am unable to find a place to enter credentials.

Thank you

[FilipVanHoutte]

@JoeJoeJoe First at all thanks for the feedback!

Currently we are not able to retrieve the backplane and module configuration from a Modicon PLC. But we take the feedback into account in our OT protocol research for the future.

Regarding the SNMP v3 point, it is possible to give us the Vendors/Types you would like to scan with SNMP v3? Then we can certainly take this into account.

[JoeJoeJoe]

@FilipVanHoutte 

For SNMP v3,

Newer Modicon PLC

For SNMP v1/v2

Older Modicon PLC (Currently OT Network Discovery doesn't pick up SNMP v1/v2 information)