This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 57.00000000000001%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Hi,
I have a problem with SCOM 2019 UR4 where we try to run a network discovery on Palo Alto Firewalls. We configure the network discovery in Explicit mode and put in the IP-addresses and SNMP account. The discovery runs as expected and everything looks OK. It founds the 2 devices correctly as you can see on this picture:
But the problems starts when the discovery is run a second time. When it has completed I have a duplicate device with the same IP as you can see on this picture:
And the 2 devices with the same IP has different MAC adresses on them.
What is the problem here and what can I do to get rid of this duplicate device?
We have tried to remove the devices and the discovery and do it all over again with the same result.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 61%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
Hi, sorry I know this is an old post now, but just wanted to add another possibility to the mix here.
We have a case open with MS at the moment as we are getting this as well for a couple of different device types.
The analysis so far (and what MS has told us) is that if this is not a CERTIFIED device (one reason being it is unable to find the MAC address where it expects), the network discovery polls the device for all MAC addresses. It then sorts this list in to order and picks the first MAC on the list.
Although we are still trying to get good and bad logs for this (very difficult when you need to run traces but cannot as you cannot predict when it is going to happen), MS believe that the discovery must be returning a different set of MAC addresses the second (or nth time) and therefore the MAC at position 1 is different.
Apparently this is by design and so far we have been advised the PG will not change it.
I have raised a feedback request and so if you think this could be the reason, you may want to consider up voting this so that MS change the way devices are discovered. Found here: https://feedback.azure.com/d365community/idea/b4fea0a5-d292-ee11-a81c-6045bd7fe045
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 31%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
The key property of a network device is it's MAC address. If for some reason that MAC address changes, you will get duplicates, so you need to find out why your device mac is changing. That can happen for example with virtual appliances