nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

F5 sflow setup in Solarwinds NTA

aqupahobia

I am unable to get Solarwinds Netflow Traffic Analyzer to collect the F5 sflow statistics.

I have packet captures that show the flows are getting to the Solarwinds server, but they never show up in the UI. Any ideas?

Find more posts tagged with

Accepted answers

All comments

Deltona

Hi there,

Is the flow being sent to port 2055? Is port 2055 added to the server firewall?

aqupahobia

Yes, I have changed the F5 to use port 2055. Below is some of the traffic captured on the firewall. 1.1.1.1 is the F5 device and 2.2.2.2 is the Solarwinds NTA server.

1: 16:55:16.348706 802.1Q vlan#92 P0 1.1.1.1.58065 > 2.2.2.2.2055: udp 1328

2: 16:55:16.348736 802.1Q vlan#92 P0 1.1.1.1.58065 > 2.2.2.2.2055: udp 432

3: 16:55:26.353695 802.1Q vlan#92 P0 1.1.1.1.58065 > 2.2.2.2.2055: udp 1328

4: 16:55:26.353726 802.1Q vlan#92 P0 1.1.1.1.58065 > 2.2.2.2.2055: udp 432

Deltona

Could you confirm with the documentation of the software version running, whether it generates sFlow counters?

F5, even though it creates sFlow isn't on the supported list of vendors for NTA at the moment. However, if it creates sFlow counters then you may be in luck.

aqupahobia

I believe so, here is a chart from their support site. AskF5 | Manual Chapter: Monitoring BIG-IP System Traffic with sFlow

ifInOctets (interface)	interface_stat.counters.bytes_in	9501109483
ifInUcastPkts (interface)	interface_stat.counters.pkts_in - interface_stat.counters.mcast_in	14373120
ifInMulticastPkts (interface)	interface_stat.counters.mcast_in	72
ifInBroadcastPkts (interface)	interface_stat.rx_broadcast	211
ifInDiscards (interface)	interface_stat.counters.drops_in	13
ifInErrors (interface)	interface_stat.counters.errors_in	0
ifInUnknownProtos (interface)	Not implemented	0
ifOutOctets (interface)	interface_stat.counters.bytes_out	9655448619
ifOutUcastPkts (interface)	interface_stat.counters.pkts_out - interface_stat.counters.mcast_out	10838396
ifOutMulticastPkts (interface)	interface_stat.counters.mcast_out	72
ifOutBroadcastPkts (interface)	interface_stat.tx_broadcast	211
ifOutDiscards (interface)	interface_stat.counters.drops_out	8
ifOutErrors (interface)	interface_stat.counters.errors_out	0

Deltona

Those look like interface counters (if), not flow...

choly

Unfortunately NTA does not currently support sFlow from F5 devices.

Simple reason is that F5 devices do not put correct interface indexes into flows (both input and ouptu are 0), so it cannot be paired with interfaces in Orion.

I would recoomend to create a poll for F5 support on Ideas & feature requests page.

Re: F5 sflow setup in Solarwinds NTA

Level 1

jeffreyc Jun 20, 2013 3:08 PM (in response to Choly)

I would be intrested in sFlow support for F5 also.