Configuring Network Settings

Use the Network settings page to manage your general network configurations.

Manage General Network Configurations

Subnet Parsing

The Insert all possible Subnets on Device Network Interface setting is enabled by default. When enabled, Axonius calculates and inserts all possible common subnets based on the device's IP addresses.

To reduce noise in subnet data, disable this setting. When disabled, Axonius checks which subnets the device is actually inserted into and receiving traffic from (as determined by the authoritative source), and fetches only these subnets.

Internal CIDRs List

Listing all the internal CIDRs in your organization affects how Axonius classifies the access status of your Network assets - whether they are public or private (internal). This helps Axonius avoid false positives when considering a network as public.

For example, a certain block of IPs might include a public IP address. However, this block was purchased by your organization long ago, and since it's owned by the organization, all traffic within this block should be considered private.

In the Internal CIDRs field, enter a list of CIDR masks in X.X.X.X/X format. Note that if you don't stick to this format, you won't be able to save your changes.

Managing CIDRs using API V2 Endpoints

If you want to add or remove a bulk of CIDRs (for example, 1000+) in a direct, scalable way, you can do it using Axonius V2 API instead of manually handling them from the Network Settings page.

Use the following API endpoints:

GET /api/v2/internal_cidrs - Retrieve the current list of configured internal CIDRs. PATCH /api/v2/internal_cidrs - Add and/or remove CIDRs in a single request (supports bulk operations). DELETE /api/v2/internal_cidrs - Remove all configured CIDRs at once.

Internal Network Labels

Provide an array of strings to label prefixes that select Network assets whose adapter-reported CIDR blocks are treated as Internal CIDRs. Matching is NOT case-sensitive. Use this setting when CIDR blocks that are publicly routable but internal to your organization are reported by Network assets. Tag the applicable adapter data with a value that starts with a configured prefix.

Example use case 1: Identify internal Cisco network ranges

Scenario: Network assets reported by an adapter have adapter tag values such as internal_cisco_dc and internal_cisco_lab.

Configuration: Under Internal Network Labels, enter the following prefix: internal_cisco

Result: Axonius treats non-private IPv4 CIDR blocks reported by adapter entries with either matching tag value as Internal CIDRs.

Example use case 2: Hide corporate IP range from asset data

Scenario: A company owns a public range that it uses behind a NAT pool. Its network adapter sets the Adapter Tag value corp-internal-nat on that network.

Configuration: Under Internal Network Labels enter the followng prefix: corp-internal

Result: IP addresses in that range no longer show unde the Public IPs field.

Network Routes Enrichment Configurations

The Network Routes Enrichment Configurations section on the Network settings page allows you to exclude specific components from the Network enrichment process and control the enrichment schedule and workload.

To access the settings in this section, enable Enable Network Routes Enrichment (enabled by default).

• When enabled, the Network Routes enrichment pipeline runs during every discovery cycle and maps internet exposure paths for all devices.
• When disabled, the enrichment is skipped entirely and all sub-settings below are hidden.

Subnets to Exclude

Use this setting to:

• Exclude test/development networks
• Exclude known, internal-only subnets that don't require exposure analysis
• Reduce noise by filtering out specific IP ranges

Enter the required subnets in valid CIDR notation (e.g., 192.168.0.0/16, 10.0.0.0/8)

Zones to Exclude

Enter zone names (an array of strings) whose subnets you want to exclude from Network Routes enrichment. As the enrichment starts, all network assets whose zone matches any entry here are fetched and their CIDR blocks are added to the exclusion list.

Example use case: Exclude AWS Zone from enrichment

• Scenario: You want to exclude all subnets in the AWS us-east-1 zone from Network Routes enrichment.
• Configuration: Under Zones to Exclude, enter us-east-1.
• Result: The system queries Networks assets for any zones matching us-east-1, extracts their CIDR blocks, and adds them to the exclusion list. Devices in those subnets are skipped during enrichment.

Add Outbound Access to Internet Results

This setting is disabled by default. In this state, the system filters out SNAT NAT rules and outbound ACL rule to focus on inbound exposure.

Enable this setting to include assets that have outbound access to the internet in Network enrichment, to understand the complete attack surface.

Enrichment Timeout (Hours)

Set the maximum time (in hours) allowed for the Network Routes enrichment process. This affects the post-correlation phase of the discovery cycle.

The valid timeout range is between 2 (default) and 6 hours. Use high values for environments with a large number of network assets to give Network Routes more time to complete its internet exposure analysis without timing out prematurely.

Custom Parallel Processing

This setting controls the number of tasks running in parallel during Network Routes enrichment. It affects the post-correlation discovery cycle phase for Network Routes enrichment.

• Enable Custom Parallel Processing - Enable this to allow administrators to manually configure parallelism instead of using automatic CPU-based calculation. This is useful in the following use cases:
  • You have a large number of devices and want to speed up Network Routes enrichment by increasing parallelism beyond the automatic calculation
  • You need to limit parallel tasks to reduce resource usage on the Axonius instance
  • You want to fine-tune enrichment performance based on your specific environment's characteristics
• Maximum Parallel Tasks (default: 10) - Set the maximum number of tasks to run in parallel during Network Routes enrichment. Valid values are between 2 and 15 (high values might increase resource usage).