Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Netflow Top Applications only showing "IPsec Nat-Traversal"

Hello

We have configured Flexible Netflow on a Cisco 871 router running version 12.4(20)T. The traffic is visible in the Orion Netflow tab, however the top conversations/applications show the following:

Ingress...99.43% of traffic is "IPsec Nat-Traversal", with the top conversation being between the static WAN IP address of our router and an IP address in the PTT network.

Egress...100% of traffic is "IPsec Nat-Traversal" between the same endpoints.

Any idea why we cannot see the real conversations?

Thanks

Amy

Find more posts tagged with

Accepted answers

All comments

jswan

I am pretty sure that encryption/decryption is implemented after NetFlow accounting in the interface order of operations; hence all you should expect to see on VPN interfaces is the statistics for the encrypted traffic. Thus you probably just need to configure your "ip flow ingress/egress" statements on the internal routed interfaces where the unencrypted traffic enters or leaves the routers.

bunny

I added the following to VLAN1 but the traffic output is the same as we were seeing on the WAN interface:

ip flow monitor FlowMonitor1 input

ip flow monitor FlowMonitor1 output

There are no other internal routed interfaces on the router. Any suggestions?

Thanks

jswan

Do you see the traffic correctly in the CLI with "show flow monitor FlowMonitor1 cache"?

If not, the problem is most likely with your NetFlow config on the router. If you do see it correctly in the CLI but not in NTA, probably something is going wrong in NTA.

bunny

Yes the flows are showing up correctly on the router itself. I'll open a support case for our NTA to be looked at. Thanks

syedhaq

We have 700 ipsec tunnels on one router which we want to monitor,we are unable to see the ipsec tunnels in NMP .

Help Please