300-710 · Question #114
An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events filing the database and overloading the Cisco FMC. A monitored…
The correct answer is D. Exclude load balancers and NAT devices. NAT devices and load balancers present a unique problem for network discovery: because many hosts share a single NATted IP, the FMC may interpret each new host or OS change behind the NAT as a new or modified endpoint, generating floods of misleading discovery events. The…
Question
An engineer configures a network discovery policy on Cisco FMC. Upon configuration, it is noticed that excessive and misleading events filing the database and overloading the Cisco FMC. A monitored NAT device is executing multiple updates of its operating system in a short period of time. What configuration change must be made to alleviate this issue?
Options
- ALeave default networks.
- BChange the method to TCP/SYN.
- CIncrease the number of entries on the NAT device.
- DExclude load balancers and NAT devices.
How the community answered
(44 responses)- A5% (2)
- B2% (1)
- C11% (5)
- D82% (36)
Explanation
NAT devices and load balancers present a unique problem for network discovery: because many hosts share a single NATted IP, the FMC may interpret each new host or OS change behind the NAT as a new or modified endpoint, generating floods of misleading discovery events. The correct fix is to exclude NAT devices and load balancers from the network discovery policy. This stops the FMC from trying to profile these IP addresses as individual hosts, eliminating the false events. Leaving default networks or changing to TCP/SYN does not address the root cause.
Topics
Community Discussion
No community discussion yet for this question.