2 Identical Cisco Catalyst 6509 devices, both using same configuration but NTA unable to poll Netflow from 1 of the devices

vccy118

Hi, I have 2 identical Cisco Catalyst 6509 devices, running on 12.2(18)SXD7b and with PFC.

However, NTA failed to detect one of the devices. I checked on the device configuration and it is correct.

Any possible solution for this?

Thanks!

Find more posts tagged with

6509

netflow_catalyst_6509

netflow_cisco_7606

cisco

cisco_netflow

Accepted answers

vccy118

I solved the problem... Just need to remove and re-add the device, then NTA successfully detect the Netflow packets.

However, this is done at a very hefty price... all previous data on the device is now gone and start from 0. Now the monthly report for June is gone.

All comments

mavturner

Are you managing both devices in NPM? Do you see any relevants messages in the events resource? For example, receiving flows from un-managed interface.

You may want to to open a case so support can look at your configurations and make sure there really isn't something missing.

Mav

vccy118

Yes, it is been monitored in NPM and no, there's no such message from NTA...

NSTH and NSTL is both using loopback1 as the IP in NPM. As you can see the global configuration for both is the same. However NTA is only able to poll from NSTH but not from NSTH.

Any possible fix? Thanks!

Jesquitin

The best way to troubleshoot this issue is to perform a Wireshark capture to investigate the flow packets. Also noticing some commands that are missing. They might not be preventing data from being collected but will give you more accurate data collection. Below are commands:

Global Configurations

mls ip multicast flow-stat-timer 9
mls aging long 64

mls aging normal 32
mls flow ip interface-full
mls nde sender version 5

ip flow ingress layer2-switched vlan xxxx (separate each VLAN with a comma)
ip flow-export source (Port with the IP address that is being monitored in Orion)
ip flow-export version 5
ip flow-export destination IP_Address(Orion NPM server) 2055

***NOTE*** CEF must be enable on some devices in order for Netflow to work properly

Layer 3 interfaces

Ip route-cache flow

VLANS

Ip flow ingress

Ip flow Egress

Hope this helps

vccy118

Hi, a follow up question regarding this: On which side it is required to perform and Wireshark capture? Is it on the SolarWinds server side or on the Cisco device side?

Thank you.