Netdisco on Ubuntu 24.04 on Azure User Guide

Overview

Netdisco is an open source, web based network management tool for small to very large networks. It polls your switches, routers and access points over SNMP (and CLI or device APIs), collects IP and MAC address data into a PostgreSQL database, and presents a web interface to inventory every device, browse and search ports and nodes, locate where a given MAC or IP address is connected, and view how devices link together. The cloudimg image runs Netdisco 2.101000 from the official netdisco/netdisco Docker images (a web frontend and a backend poller daemon) behind an nginx reverse proxy on port 80, bundles its own local PostgreSQL 16 database preloaded with the MAC vendor (OUI) reference data, and, because Netdisco ships by default with an anonymous full access guest, disables that guest and generates a unique admin login on the first boot of every VM. A fresh database password and a fresh SNMP read only community are also generated per VM. Backed by 24/7 cloudimg support.

What is included:

• Netdisco 2.101000 (BSD-3-Clause) run from the official netdisco/netdisco Docker images, managed by netdisco-web.service and netdisco-backend.service
• Netdisco published on port 80 via nginx, so the web UI is reachable without exposing the container port
• A bundled local PostgreSQL 16 database holding Netdisco's schema plus 33,850 MAC vendor (OUI) reference entries, ready to identify devices out of the box
• A required login: the default anonymous guest is disabled (no_auth: false), and a per-VM admin user is seeded so nothing is open to the network
• A unique admin password, a unique PostgreSQL password and a unique SNMP read only community generated on first boot, written to a root only credentials file
• postgresql@16-main.service, netdisco-web.service, netdisco-backend.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp for the Netdisco web UI (front with TLS for public exposure - see Enabling HTTPS). The bundled PostgreSQL listens only on loopback and is never exposed. Netdisco reaches your network devices over 161/udp (SNMP) outbound, so make sure your devices permit SNMP from this VM.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Netdisco by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name netdisco \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name netdisco --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql@16-main.service netdisco-web.service netdisco-backend.service nginx.service

All four report active. On first boot the image generates a unique admin password, a unique database password and a unique SNMP read only community, then starts the web frontend and the backend poller.

Step 5 - Retrieve your admin credentials

The first boot writes a root only credentials file. Read it with sudo:

sudo cat /root/netdisco-credentials.txt

You will see the web URL, the admin username (admin) and its unique password, and the per-VM SNMP read only community. Keep this file safe - it is the only copy of the generated password.

Step 6 - Check the health endpoint

nginx proxies Netdisco's own health endpoint, which needs no authentication and is ideal for a load balancer probe. It returns 200 when the database is reachable:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/health

Step 7 - Confirm your login gates the tool

Because the anonymous guest is disabled, an unauthenticated request to a page such as the inventory is answered with the login form rather than the data. Confirm the tool is not open:

curl -s http://127.0.0.1/inventory | grep -q 'name="password"' && echo "login required - not open"

The login required - not open result confirms the login form is served to unauthenticated visitors, so nothing is exposed without signing in.

Step 8 - Open Netdisco in your browser

Browse to http://<vm-public-ip>/ and sign in with the admin username and the password from your credentials file.

After signing in you land on the dashboard, with a Find Anything search box and a Discover box to add your first device.

Step 9 - Add your first device

Netdisco discovers a device over SNMP and then follows its neighbours. In the Discover box on the dashboard, enter the hostname or IP address of a switch or router that permits SNMP from this VM, and select Discover. Netdisco uses the per-VM read only community from your credentials file by default; you can also set a per-device community under Admin. Discovery and later polling run as background jobs on the backend daemon, which you can watch under Admin -> Job Queue.

Step 10 - Manage users

Under Admin -> User Management you can see the per-VM admin account and add further users, each with their own password and optional administrator or port control rights.

The bundled database and MAC vendor data

The image ships PostgreSQL 16 with Netdisco's schema already deployed and the MAC vendor (OUI) reference data loaded, so device and node vendors are identified from the moment your first device is discovered. You can inspect the bundled database directly on the VM:

sudo -u postgres psql -d netdisco -c "SELECT count(*) AS mac_vendor_ouis FROM oui;"
sudo -u postgres psql -d netdisco -c "SELECT username, admin, port_control FROM users ORDER BY username;"

Security notes

• The default Netdisco anonymous guest with full admin rights is disabled in this image (no_auth: false). A real login is always required.
• The admin password, the PostgreSQL application role password and the SNMP read only community are generated uniquely on the first boot of every VM and written to /root/netdisco-credentials.txt (mode 0600). No usable login ships inside the image.
• The bundled PostgreSQL listens only on 127.0.0.1:5432 and is never exposed to the network.
• Change or add web users under Admin -> User Management. To rotate the admin password later, edit the user there.
• Only ports 22, 80 and 443 need to be open to the VM. Netdisco reaches your devices outbound over SNMP.

Enabling HTTPS

For public exposure, put the VM behind a certificate. Point a DNS name at the VM, open 443/tcp, install a certificate with your preferred tool (for example Certbot with the nginx plugin), and let nginx terminate TLS in front of the reverse proxy:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot edits the existing nginx site to serve HTTPS and set up automatic renewal.

Maintenance

• Service status: systemctl status netdisco-web.service netdisco-backend.service
• Logs: journalctl -u netdisco-web.service and journalctl -u netdisco-backend.service, plus sudo ls /var/lib/netdisco/logs
• Configuration: static policy lives in /var/lib/netdisco/config/deployment.yml; per-VM secrets are in /var/lib/netdisco/netdisco.env
• Database backups: sudo -u postgres pg_dump netdisco > netdisco-backup.sql
• OS updates: unattended security upgrades are enabled; the base is fully patched at build time

Support

Every cloudimg image is backed by 24/7 support. If you have a question about this image or need help with a deployment, contact the cloudimg team.