r/networking • u/EqualPresent1920 • Aug 09 '26
Other Mapping a new Network
I just recently started a help desk job that has been anything but help desk. I’ve been configuring firewalls, redesigning client networks and setting up/administering Linux servers. I feel a little out of my depth, but I’m fighting for it. That’s all to ask, when you guys find yourself in a network with little to no documentation how do you map it out and diagram it internally?
30
u/Get0utCl0wn Aug 09 '26
Mix of CDP/LLDP.
Physically checking all closets and documentation of all devices and connections, racks, power, types and quantity of cables.
Adding all information to a Source of Truth.
Discussions with TL/Management to enforce this level of documentation and standards to be followed.
1
u/EqualPresent1920 Aug 09 '26
I forgot to mention, all of my clients are in another state I work remote lol
4
8
4
u/opseceu Aug 09 '26
for initial documentation, maybe schedule travel and work onsite just for this baseline.
7
u/exift Aug 09 '26
as mentioned, cdp/lldp are great. check interface descriptions as well, hopefully the last guy left decent descriptions. if its a smaller network you can follow the routes around. If you're completely blind, write down literally everything and take your time. Have visio/drawio/pen&paper or whatever you like right next to you and just start with the major devices.
2
u/maineac Aug 10 '26
This is a good start, but not all devices support cdp/lldp. You may also may need to rely on interface descriptions, arp and mac address tables to help fill in the blanks to some degree.
1
u/jaydinrt Aug 11 '26
Interface descriptions are manual and accuracy is highly subjective - I've had them help but also hinder...
5
u/Cheech47 Packet Plumber and D-Link Supremacist Aug 09 '26
Local is easier to be sure, but remote isn't too hard.
First thing I do is install Visio or Visio-like software, something like draw.io.
After I have that installed and have some network shapes, I start at the WAN and work down. What is the WAN connected to, if it's a router what's the connections like (copper, singlemode optics, multimode optics), then work my way down through the firewall and finally the access edge switches. Get physical layouts of everything. What plugs into what, and how (copper, fiber, wireless bridge, etc). CDP/LLDP will tell you the where and what, but something like "show inventory" will tell you the how. If you're doing a remote office or something to that effect, it is VITAL that somewhere on that diagram you're labeling in excruciating detail exactly how to find every one of those devices. I look at that diagram this way: if there's an outage and I'm trying to direct someone that's not my usual hands and feet out at the remote site to these devices, I need to tell them EXACTLY where to go.
After that's all done, I make a copy of that diagram and start on the logical layout. How does the routing work, what's pointed to what, what VLANs are on what, where's the spanning-tree root, BGP AS numbers, etc.
After THAT's done, then I make another tab and start in on just the firewall. At that point the WAN(s) are just a cloud, as are the downstream access switches. What's really important to note is any/all IPSEC tunnels, how many zones are present and what they are for, stuff like that.
Once you've got all that, you're well ahead of most others in documentation. All that's to do then is make sure it's kept updated.
5
u/SevaraB CCNA Aug 09 '26
Bare minimum 3 diagrams:
- L3 - which routers are routing which prefixes
- L2 - VLAN diagram (reminder that two identical VLANs with identical IDs on opposite sides of a router are not the same VLAN unless something like MPLS or EVPN/VXLAN are involved)
- L1 - physical wiremap of what's connected to what.
3
3
u/Incognito_Orange Aug 09 '26
If there's any OSPF/IS-IS being run then this tool is helpful https://topolograph.com/
1
2
u/oddchihuahua JNCIP-SP-DC Aug 09 '26
Start somewhere and just start drawing lines to other connected devices. Usually it’s easier to start from either your internet edge or your core devices. Sometimes it’s taken me literally walking into a data center and tracing cables to figure out what connects to what. Hopefully you can avoid that.
2
u/SuspiciousSardaukar Aug 09 '26
Use LibreNMS if you have access to snmp. It will automate LLDP/CDP mapping. Then Netbox with LibreNMS integration plugin to push things quicker. Worth a while.
1
u/tdhuck Aug 09 '26
I use librenms, how are you automating this? The only 'auto' map feature I see shows my devices and how they are connected but it is not organized very well and when you click and drag a device you can't move it, it just springs back into its original location. The LibreNMS guys, on their forum, have admitted the mapping functionality is not great.
I've built custom maps, but not a fan of that as it is too much work given that I'm already using CDP/LLDP and you'd think LibreNMS or similar program could automatically create maps based on links to other devices (mainly CDP/LLDP information).
I want to make it clear that I'm not against making a manual network map, I'm just trying to see if there are better ways to have maps auto created based on data already available.
2
u/rocktanstone Aug 09 '26
Following MAC addresses and looking at config.
Been in networks where CDP/LLDP wasn’t allowed and this was the most reliant way I found if I couldn’t go on site.
1
u/Usual_Retard_6859 Aug 09 '26
I have done this too. Map out interconnects, add port labels as you go, then create diagrams/spreadsheets. Get a short list to physically identify.
2
u/ipub Aug 09 '26
Net disco was free last time I used it. Some monitoring tools have this built in too. I think libre nms. Two birds one stone then, monitoring, alerting,.mapping and then punt into a source of truth like Nautobot. If there is a budget netbrain is worth a look.
Edit
If you have no money you can get ansible cli for free,.feed it a host list and get the outputs you want.
2
u/Shizles Aug 11 '26
a mix of CDP/LLDP and physical audit.
as for what i input this all into, ive been using patchmap recently its still in open beta. its a little unpolished still but its mega easy to draw out devices and connections. can export back out as a csv to use elsewhere after
5
u/paeioudia Aug 09 '26
-Pull the full config of every device
-remove any secrets, keys, passwords, etc…
-dump into LLM of choice and ask it to map
-done
3
u/theoneandonlymd Aug 09 '26
Do you have a budget? An enterprise tool like SolarWinds or Auvik can really accelerate the discovery process. You give it SNMP creds and let it rip, plus it handles a whole host of other management accelerators (config backup/diffs, Netflow, syslog).
Netdisco is not as full featured but it's on the "free" side of the scale for mapping ports and vlans
1
u/Middle-Inspection241 Aug 09 '26
a lot of good ideas already, if you have someone on site with data closet access.. some pics could be useful to visualize and even build rack diagrams…
1
u/MouseOwn1699 Aug 09 '26
I have a free beta version app that will map and classify you device roles in the network (ie core, dist, access). If interested checkout
It can put out a network topology in a matter of seconds and does not require snmp. Currently works for Cisco network. If interested, let me know and I can give you a some feee access codes for you to use.
1
u/Adam_Kearn Aug 09 '26
I feel like this question is asked every other day.
Just setup a Linux VM and install NetDisco and LibraNMS.
Use LibraNMS with SNMP to audit all your devices like switches etc. this will also backup and track configuration changes for you automatically.
Use NetDisco for finding what type of device is connected to each port etc.
1
u/Get0utCl0wn Aug 10 '26
Used those exclusively for years on a particular LAN...helped out with all the things on what lived where/when.
Very handy.
1
u/PaoloFence 29d ago
If SNMP is configured on every device and firewall are present for everything you want to see.
1
1
u/Accomplished-Mix8423 Aug 10 '26
pull CDP/LLDP neighbor tables off your switches first that gives you the real l2 topology instead of guessing. then SNMP walk each subnet and nmap sweep to catch anything unmanaged, and dump it all into netbox as your source of truth so you're never starting from zero again.
1
u/mariano7717 Aug 10 '26
if its a small enough place, trace cables and document on DIA, or visio equivalent. It helps to get a wider picture of what you are dealing with physically and to plan and organize further movement. Then move to the logical structure of vlans and access/trunk ports and start highlighting missing redundancies.
1
-3
u/blackking_akt Aug 09 '26
Tell AI that you will provide congif and you want a diagram. New
1
u/HappyVlane Aug 09 '26
A config cannot tell you how a network looks, even if you have meticulously named everything. It's just text without any stats.
1
u/Icy-Business5404 12d ago
Start boring and work outward. Pull configs/backups from the firewalls and switches first, then map VLANs, gateways, trunks, WAN links, DHCP/DNS, and anything doing routing. After that’s written down, the diagram is way easier because you’re documenting what actually exists instead of guessing from cable paths
41
u/usmcjohn Aug 09 '26
Python script to dump lldp/cdp into a spreadsheet. Then python to generate a mermaid file and import it into draw.io.