【Cyber Command】Cyber Command Asset are duplicated, but Asset groups are different

Problem Description

Cyber Command Asset are duplicated, IP and MAC addresses are the same, but different Asset groups are found

Warning Very-Low Risk

None

Effective troubleshooting steps

This Asset originally belonged to the parent group, here called [Asset_old] ,
Later, when a new subgroup is created, the asset will be re-identified based on the IP range of the newly created group, which is called [Asset_new]
Since ① there are no assets with IP conflicts in the parent group, and ② there is no delisting policy, [Asset_old] will continue to be retained

Root cause

1. When Cyber Command identifies Asset Move to Active, it will not detect whether there is an IP conflict in the entire root directory, but only match the ./ directory at this level.

2. Cyber Command does not configure Asset return policy

solution

1. If you disassemble and reorganize the Asset group, you can clean up duplicate assets by configuring the asset withdrawal policy – selecting the withdrawal time – 1 day
2. It is recommended to configure the decommissioning time according to the DHCP lease time.
   

Operation Impact Scope

Assets will be returned to the warehouse

Is this a temporary solution?

Yes, it is recommended to configure the decommissioning time according to the DHCP lease time.

Original Link

https://support.sangfor.com.cn/cases/list?product_id=24&type=1&category_id=10261&isOpen=true