Hi all, first time poster, long time reader. I am in the trial phase of implementing Solarwinds for our university extension campus network and I am running into some trouble regarding NTA. Since we are an extension campus, we have a bit of a unique setup as far as infrastructure goes so, let's see if I can explain it clearly.
We have a single campus VLAN which houses 90% of our traffic (I know, I know, we are in the process of segmenting this). This VLAN, we'll call it VLAN 1, is sent to a Cisco ASA 5520. VLAN 1 and it's internal IP range are translated to our external IP range in the ASA and is sent out VLAN 2. We have a router at the edge of our network that handles routing for VLAN 2 as well as many other VLANs controlled by "main campus" (VLANs 3-10). All VLANs beside VLAN 1 bypass our ASA and are trunked directly to the edge router. For all intents and purposes, the edge router has no clue what VLAN 1 even is. The edge router is directly connected to an Arista distribution switch. Since we don't have configuration access to the edge router, we have setup sFlow from the port on the Arista which uplinks the edge router. In theory, this should capture all campus traffic.
We have setup two sFlow destinations in the Arista. One is our Solarwinds server and the other is a PRTG server. The PRTG is seeing VLAN 1's traffic, as well as main campuses traffic, where as the Solarwinds server is seeing all of main campuses traffic but NOT any of VLAN 1 (which is 90% of our campus).
The following is "altered" commands from the Arista:
sflow polling-interval 120
sflow destination 1.1.1.1 2055 (this is prtg)
sflow destination 1.1.1.2 2055 (this is solarwinds)
sflow source 10.1.1.254 (this is the interface VLAN IP address for VLAN 1)
sflow run
I was hoping someone out there could be of assistance or at least nudge me in the right direction! I'm banging my head against a brick wall trying to figure out what's going on!
---ANSWER BELOW---
I discovered that we were not trunking VLAN 1 out of the interface I was monitoring using SFLOW. I did not want to trunk an internal vlan to a router that doesn't handle VLAN 1 routing, but it turned on the light bulb above my head... I set SFLOW forwarding on all other ports handling VLAN 1 routing and I suddenly saw the traffic I needed to! Thanks for the ideas everyone.
