Discovery: Palo Alto Firewall Device CI IP Address Flips Between Two Values After Each Discovery RunIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } A Palo Alto Firewall Device CI's IP address alternates between two different IP addresses after each Discovery run. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } .kb-wrapper ul { margin: 8px 0 8px 24px; padding: 0; } .kb-wrapper li { margin-bottom: 4px; } The CI's IP address flips between two different values after each Discovery run. Other CI attributes besides the IP address are also affected.Analysis of the SNMP Classification probe payload for each IP address shows both devices returning the same sysName.Analysis of the Palo Alto Firewall Device pattern payload shows these are distinct devices — they have different serial numbers and different DNS names — but the Name field in both payloads is identical. Facts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } .kb-wrapper ul { margin: 8px 0 8px 24px; padding: 0; } .kb-wrapper li { margin-bottom: 4px; } The Palo Alto Firewall Device Discovery pattern sets the Name field on the CI using the SNMP sysName returned by the device.Although the two devices are physically distinct, both are returning the same SNMP sysName to Discovery.Name is an identifying attribute for this CI class. Because both devices present the same name, the Identification and Reconciliation Engine (IRE) matches them to the same CI record, causing each subsequent Discovery run to overwrite the CI with data from whichever device was scanned most recently. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Releases Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } Two distinct Palo Alto Firewall devices have been configured with the same SNMP sysName. Because the Palo Alto Firewall Device pattern uses sysName to set the CI Name — an identifying attribute — the IRE treats both devices as the same CI and overwrites it alternately with each device's data on successive Discovery runs. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } .kb-wrapper ul { margin: 8px 0 8px 24px; padding: 0; } .kb-wrapper li { margin-bottom: 4px; } .kb-wrapper .steps-list { list-style: none; counter-reset: step-counter; margin-left: 0; padding: 0; } .kb-wrapper .steps-list > li { counter-increment: step-counter; display: flex; align-items: flex-start; gap: 12px; margin-bottom: 10px; } .kb-wrapper .steps-list > li::before { content: counter(step-counter); display: inline-flex; align-items: center; justify-content: center; min-width: 26px; height: 26px; border-radius: 50%; background-color: #032D42; color: #63DF4E; font-weight: 900; font-size: 11pt; flex-shrink: 0; margin-top: 2px; } .kb-wrapper .steps-list .step-content { flex: 1; } .kb-wrapper .callout-info { border-left: 4px solid #52B8FF; background-color: #e6f4ff; padding: 10px 14px; margin: 14px 0; border-radius: 0 4px 4px 0; } Each Palo Alto Firewall device must have a unique SNMP sysName so that Discovery and the IRE can distinguish between them and maintain separate CI records. Confirm which devices are affected by reviewing the SNMP Classification probe payloads for each IP address and identifying those returning the same sysName. Work with the device administrators to update the SNMP sysName on each affected Palo Alto Firewall device to a unique, accurate hostname that aligns with its DNS name. Once the sysName values have been corrected on the devices, run Discovery again. The IRE will now identify each device as a distinct CI and maintain them separately. Note: If a duplicate CI was created during the flipping behavior, review the CMDB after re-running Discovery and retire or merge any stale CI records as appropriate. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .kb-wrapper { font-family: Lato, sans-serif; font-size: 12pt; line-height: 1.7; color: #000000; max-width: 100%; } .kb-wrapper p { margin: 8px 0; } .kb-wrapper .related-links a { color: #032D42; text-decoration: underline; } .kb-wrapper .link-disclaimer { font-size: 10pt; font-style: italic; margin: 2px 0 10px 0; color: #444; } SNMP support for Discovery — ServiceNow Documentation Identification and Reconciliation — ServiceNow Documentation