Juniper switches have two interfaces for each port as standard.
The physical interface, for example port ge-0/0/0 and the logical interface ge-0/0/0.0. The bandwidth is shown on the physical interface but the FLOW data comes from the logical. This causes issues in NPM where the top flow interfaces don't show any traffic even when the interface is very busy. Strangely the flow analysis works fine but it affects all kinds of things:
For instance an alert setup to send you interface utilisation with top talkers doesn't work because the physical interface doesn't support FLOW and the logical interface isn't busy.
Physical interface: ge-0/0/0, Enabled, Physical link is Up
Interface index: 147, SNMP ifIndex: 551
Logical interface ge-0/0/0.0 (Index 109) (SNMP ifIndex 552) (Generation 174)
The logical interface is always one more than the physical interfaces SNMP ifindex.
On the juniper you can't slect the physical port as the SFLOW port only the logical (See below)
cron1@TEST-SWITCH# show protocols sflow
agent-id 10.100.1.19;
polling-interval 20;
sample-rate {
ingress 1000;
egress 1000;
}
source-ip 10.100.1.19;
collector 10.23.0.7;
interfaces ge-0/0/0.0;
interfaces ge-0/0/1.0;
interfaces ge-0/0/2.0;
interfaces ge-0/0/3.0;
interfaces ge-0/0/4.0;
interfaces ge-0/0/5.0;
The traffic on the two ports doesn't match:
Traffic statistics of physical interface:
Traffic statistics:
Input bytes : 1267437914015
Output bytes : 2814325772642
Input packets: 3121623434
Output packets: 3981205701
Traffic statistics of logical interface:
Traffic statistics:
Input bytes : 363358849
Output bytes : 1252148903
Input packets: 3055784
Output packets: 11089297
I would love for Solarwinds to integrate these two interfaces into one or apply another fix somehow.
