WatchGuard Firewalls Being Removed From LANSweeper

[Intheory87]

I have 3 WatchGuard XTM25 Firewall Devices I use in small remote offices to connect back to my main site. I've noticed that LANSweeper only keeps one of the three in its inventory at a time. This one in the inventory is always the latest XTM25 that was scanned. If I scan one of the other XTM25 devices (Manually scan Via IP) it over writes the current XTM in our inventory. IT doesn't matter which one is currently in the inventory, no matter which device is scanned last that one shows up in the inventory and the other two are missing. All three devices show different MACs in LANSweeper, are on different subnets and I have tried specifying "Not Affected by Cleanup Options" but still no difference in behavior. Anyone run into this or have any suggestions?

I also have to other Watchguard Devices (non XTM25) and these assets are not removed from LANSweeper.

[Susan_A · Accepted solution]

We received the requested information via email. Below is a copy of the answer we sent via email.

The firewalls share the following MAC addresses: 00:C0:02:12:35:88 and 00:C0:02:12:35:89. Could you run the script below in the Lansweeper web console under Configuration\Database Scripts. Copy and paste the code and hit the Execute SQL Code button. This will blacklist the MAC addresses, so they are no longer used to uniquely identify assets. This will prevent your firewalls from overwriting each other. Just to be safe, we do recommend backing up your database prior to running any scripts, by following these instructions.

Don't forget to rescan your firewalls afterwards, by hitting the Scan All Enabled IP Ranges Now button in the IP Address Range Scanning section of Configuration\Scanning Methods.


INSERT INTO tsysMacBlacklist (Mac, Comment) VALUES ('00:C0:02:12:35:88', 'firewall exclusion 1')
GO
INSERT INTO tsysMacBlacklist (Mac, Comment) VALUES ('00:C0:02:12:35:89', 'firewall exclusion 2')
GO
UPDATE tsysupdate SET MacBlacklist = GETDATE()

[Jeremy_D]

Assets overwriting one another usually occurs because those assets share one or more MAC addresses. You mentioned the devices' MAC addresses are not the same but a list of MAC addresses can be much longer than first thought. There is a workaround to get assets with shared MACs in your database, but we would need to identify the shared MAC addresses first. Could you contact support@lansweeper.com and provide us with the information below. We will follow up via email.

• Description of the problem.
  
• Output of the Interface Scan Debugger tool for all three devices.
  
• Copy of the Errorlog.txt file, as present in Program Files (x86)\Lansweeper\Service on the machine hosting your Lansweeper service.
  
• Screenshot of the Summary tab of the one asset page that is generated.