Find and Monitor Network Devices with Discovery and SNMP

Use Atlas Reach network discovery to find switches, firewalls, printers, UPS units and other devices that cannot run the agent, then monitor them over SNMP.

Before you begin

  • Atlas Reach enabled for the tenant, with at least one approved, online Windows Reach agent on the network you want to scan. This agent is the probe
  • For SNMP monitoring, the probe must run Atlas Reach agent 1.0.134 or later
  • The reach.view permission to see the Discovered and Monitored tabs, reach.control to run scans, manage SNMP credentials and monitor devices, and reach.annotate to add, ignore and link discovered devices

How discovery works

A scan reads the network; it does not change anything, and nothing it finds is added on its own. The probe pings each address, checks whether a few well-known ports are open, reads the device's basic SNMP system information, and looks up its MAC address and name. Every device that answers lands under New with a best-effort vendor and type. A device whose MAC address matches an enrolled Reach device is marked Reach agent installed.

  • Review the New list and choose Add or Ignore for each device. A later scan never moves a device out of Added or Ignored.
  • Remove forgets a device. If a later scan finds it again, it comes back under New.
  • Devices are matched by MAC address where one is known, otherwise by IP address, so rescanning does not create duplicates.

A scan comes from a managed endpoint and is visible to intrusion detection and EDR tools on the network. Tell the network's owner before you run one, and scan only the ranges you need.

Save SNMP credentials

On Atlas Reach → Discovered, choose SNMP credentials and add the credentials discovery and monitoring may use. Without any credential, discovery still finds devices by ping, open ports and the ARP cache, but it cannot read their SNMP details.

  • SNMP v1 and v2c: a community string.
  • SNMP v3: a user with SHA-1 or SHA-256 authentication and AES-128 encryption. MD5 and DES are not supported.
  • Saved credentials are encrypted, are never shown again, and are only sent to the Reach agent running a scan or a poll that uses them.

Use SNMPv3 with authentication and encryption wherever the device supports it. v1 and v2c community strings, and v3 without encryption, cross the network readable, and Atlas flags them when you pick one.

Run a discovery scan

  1. Go to Atlas Reach → Discovered and choose Run discovery.
  2. In Run from, pick the Reach agent that will scan. Only approved Windows agents can run discovery; offline agents and agents in maintenance mode are marked and cannot be picked.
  3. In Addresses to scan, enter one item per line: an address, a range such as 10.0.0.10-10.0.0.50, or a subnet such as 10.0.0.0/24. Leave it empty to scan the agent's own subnet.
  4. Under SNMP credentials to try, choose up to 5 credentials. They are tried in order on each device.
  5. Choose Start scan. Progress appears under Recent scans, and new devices appear under New when the scan finishes.

Scan limits

  • Up to 1,024 addresses per scan (a /22).
  • A scan stops after 20 minutes on the agent.
  • Each probe runs one scan at a time.
  • The agent never scans on its own: only when you start a scan or a schedule you created fires.

To rescan on a schedule, create a schedule on Atlas Reach → Automation with the Run network discovery action. An admin can also turn scanning off for the whole tenant with the Allow network discovery switch at the top of the Discovered tab; devices already found stay listed.

Link a device or deploy the agent to it

Open a device on the Discovered tab to act on it.

  • Link to Reach device: say which enrolled Reach device this is, when the scan could not match it by MAC address (for example a host on another subnet or behind NAT). Later scans keep the link, and Unlink removes it. Linking a New device also moves it to Added.
  • Deploy agent: for a computer that does not run the agent yet. Atlas creates a single-use enrollment token for that one device, valid for 24 hours, and shows the install commands once. When the device enrolls with it, it is linked automatically and waits for approval on the Devices tab like any new enrollment.
  • Monitor with SNMP: start watching the device from the Monitored tab (see below).

Atlas runs nothing on the host when you choose Deploy agent. Run the install command on the device yourself, or push it with your own tools such as Group Policy, Intune or another RMM.

Start monitoring a device with SNMP

Open the device on the Discovered tab, choose Monitor with SNMP, and fill in the dialog. The probe only reads from the device and never changes it. Monitoring a device that is still under New moves it to Added.

  • Checked by: the Reach agent that polls the device. Pick an approved Windows agent that can reach it on the network.
  • SNMP credential: one of your saved credentials, or None (reachability only) to just check that the device answers ping.
  • What to check: a template (below).
  • How often: every minute, every 5 minutes (the default), every 15 minutes or every hour.
  • Custom values: up to 10 extra OIDs, each with a label.

Templates

Every template reads the device's uptime and its interfaces: state, speed, traffic in and out, and errors. A device that does not report a value leaves that reading out.

  • Basic (uptime and interfaces): nothing more.
  • Switch, router or firewall: adds processor and memory use where the device reports them.
  • Printer: adds printer state and toner, ink and drum levels.
  • UPS: adds power source, battery charge, runtime left and load.
  • NAS or server: adds processor and memory use, and how full each volume is.

The Monitored tab

Atlas Reach → Monitored lists every monitored device with its status, the agent polling it, and when it was last checked. Open a device to see availability and response time, traffic, the template's readings, and history for the last 24 hours or 7 days.

  • Up: the device answered SNMP, or answered ping when no credential is assigned.
  • No SNMP answer: the device answers ping but not SNMP with the assigned credential.
  • Down: the device answered nothing.
  • Not checked recently: no result for three polling intervals (at least 15 minutes). Usually the probe is offline.
  • Paused: monitoring is switched off for the device.

Check now, pause or stop

From a monitored device you can:

  • Check now: poll the device straight away instead of waiting for its next interval.
  • Change settings: change the probe, credential, template, interval or custom values.
  • Pause: stop polling for now and keep the history. Resume starts it again.
  • Stop monitoring: stop polling and delete the device's history. The device stays on the Discovered tab.

SNMP monitoring shows readings and status today; it does not raise alerts or run remediation from them yet. A status change is recorded in the audit log.

Limits and billing

  • Up to 500 monitored devices per tenant.
  • History is kept for 7 days.
  • Polling is read-only: the agent never writes to a device.
  • SNMP monitoring needs Atlas Reach agent 1.0.134 or later on the probe.

Devices monitored without the agent are not counted as Atlas Reach devices and are not billed as Reach units.

Permissions

  • reach.view: see the Discovered and Monitored tabs.
  • reach.control: run discovery, manage SNMP credentials, and start, change, pause, check or stop monitoring.
  • reach.annotate: add, ignore, remove and link discovered devices.
  • Administrator: Deploy agent, and the Allow network discovery switch.

Every reach.* permission belongs to the built-in administrator role, and you can add them to a custom role. See Role-Based Access Control.

Next steps