9 Replies Latest reply: Jul 16, 2013 3:58 PM by jacob_beucler RSS

F5 BIG-IP v11. sFlow NTA

bmazzotti

So we just upgraded to NPM version 10.4, and NTA 3.10. Now this big question request that has been handed down to me is getting NetFlow to start showing sFlow for F5. However, I would like to get netflow data to start populating for our F5 units. Has anyone been able to get F5 units to start sending netflow data to Orion? If so, then how?

 

Thank you!

-Bobby

 
  • Re: F5 BIG-IP v11. sFlow NTA
    Choly

    Hi Bobby,

    unfortunately F5 sFlow is currently not supported by NTA. Would you mind sending us a WireShark pcap with couple of minutes of sFlow from F5 device?

    You can use leapfile for that purpose, see Leapfile Instructions

     

    Thanks in advance!

    • Re: F5 BIG-IP v11. sFlow NTA
      bmazzotti

      Unfortunately a WS capture compromises our security protocol and is unable to be provided. I appreciate the quick response though.

       

      Thanks,

      -Bobby

    • Re: F5 BIG-IP v11. sFlow NTA
      JonnyG

      Hi Choly,

       

      are you still looking for sFlow data from and F5 or has this been resolved?

       

      Jon

      • Re: F5 BIG-IP v11. sFlow NTA
        Choly

        Hi Jon,

        definitely still looking for them!

        If you would be so kind, please create a short (5-15 minutes) pcap using wireshark, showing just udp packets heading your flows collector and with source IP belonging to the F5 device, so wireshark filter will look similar to this: udp.port==2055 && ip.src==10.114.75.24.

         

        Then please upload the pcap file to solarwinds leapfile:

        1. Navigate to http://solarwinds.leapfile.com
        2. Select the Secure Upload option
        3. Enter support@solarwinds.net as the recipient email address
        4. Fill out the form and provide some information about your issue in the subject line.
        5. Select the Select Files To Send (Regular Upload) option
        6. Browse to the compressed capture file
        7. Select the Upload & Send button
        • Re: F5 BIG-IP v11. sFlow NTA
          JonnyG

          Hi Choly,

           

          Capture uploaded as requested

           

          Jon

          • Re: F5 BIG-IP v11. sFlow NTA
            Choly

            Jon,

            thanks for prompt reaction, however in provided pcap unfortunately aren't any sflow data usable by NTA :-( It seems that device is exporting only counter samples (statistics about amounts of packets traversing  through device interfaces, pretty much the same information you get by monitoring using strandard snmp).

             

            According to this article: sFlow: Configuring F5 BIG-IP it seems that F5 released newer TMOS 11.4.0 in June, that should bring full sFlow support including packet sampling - the type of info that NTA collects.

            If you plan to upgrade to the TMOS 11.4.0, I would be pleased if you could then provide a packet capture once again.

             

            Thanks!

            • Re: F5 BIG-IP v11. sFlow NTA
              Choly

              Anyone tried to update to newest TMOS? Are you able to receive sFlow from that device in NTA since that?

              • Re: F5 BIG-IP v11. sFlow NTA
                JonnyG

                Hi Choly,

                 

                I meant to get back to you on this i spoke to our network team and at the moment F5 have recommended we don't go to this release as soon as we can I'll let you have the feedback you need.

                 

                Jon

                • Re: F5 BIG-IP v11. sFlow NTA
                  jacob_beucler

                  In the interim, we are upgrading our BIG-IP VE here and I will post back with the results of our testing shortly. I will also be doing a blog post in the near future to raise the awareness that F5 flow's are working in NTA now .

                   

                  Thanks for the post.