NTA does not receive the netflow information from our router

Hi,

I´ve got two Cisco 2801 with a software version 12.4(3e) and the have the same configuration, so that the send the netflow traps to the NTA but one is working and the other one not.

Configuration on the router Global properties:

IP flow-cache timeout active 1

IP flow-export source Loopback 0

ip flow-export version 5

ip flow-export destination (NTA Server address) 2055

Configuration on the router Interface properties:

IP flow ingress

IP flow egress

Any ideas?

NTA Version 3.7

NPM Version 10.1.2

Find more posts tagged with

netflow_error

netflow_nta

netflow

netflow_v5

egress

Accepted answers

All comments

mdriskell

Any firewalls or ACLs between the server and router? Can you ping the SW server from the router?

davzak

Check if:

- Interface in managed by NPM

- "Allow monitoring of flows from unmanaged interfaces" on Netflow settings page is checked.

If it doesn't help, try capture traffic coming to Netflow Receiver port (2055 by default) by Wireshark and check whether there are any flows from both interfaces. If not, then it is sign that interface doesn't export flows properly, most probably because of its configuration.

mcbridea

This paper may be helpful. http://www.solarwinds.com/documentation/Netflow/docs/NetFlowTroubleshooting.pdf

FormerMember

This may sound silly - Can your router reach the NTA server in the first place?

Skilldibop

It's worth noting that if the IP address the flows come from on the router doesn't match the IP address attributed to the node in NPM then the flows are rejected. Often on devices such as router with multiple interface addresses you need to specify an agent address from which the flows are sent (Which in your case looks like it'll be the IP address of the loopback interface).

Check your NTA logs to see if any flows are being discarded, and check that the node info in NPM matches the IP assigned to Lo0.

Also to avoid the obvious, make sure Lo0 is not in a shutdown state and is reachable from the collector.

netlogix

Along the lines skilldibop was going, on the router do "sh ip int brief" and adjust/ensure "ip flow-export source _______" is what is the ip in orion