This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

F5 BIG-IP v11. sFlow NTA

bmazzotti over 11 years ago

So we just upgraded to NPM version 10.4, and NTA 3.10. Now this big question request that has been handed down to me is getting NetFlow to start showing sFlow for F5. However, I would like to get netflow data to start populating for our F5 units. Has anyone been able to get F5 units to start sending netflow data to Orion? If so, then how?

Thank you!

-Bobby

0 choly over 9 years ago
Hi Bobby,
unfortunately F5 sFlow is currently not supported by NTA. Would you mind sending us a WireShark pcap with couple of minutes of sFlow from F5 device?
You can use leapfile for that purpose, see Leapfile Instructions
Thanks in advance!
Re: F5 BIG-IP v11. sFlow NTA
bmazzotti Nov 29, 2012 3:02 PM (in response to Choly)
Unfortunately a WS capture compromises our security protocol and is unable to be provided. I appreciate the quick response though.
Thanks,
-Bobby
Re: F5 BIG-IP v11. sFlow NTA
JonnyG Jun 26, 2013 8:45 AM (in response to Choly)
Hi Choly, are you still looking for sFlow data from and F5 or has this been resolved? Jon

Re: F5 BIG-IP v11. sFlow NTA
Choly Jun 28, 2013 6:09 AM (in response to JonnyG)
Hi Jon,definitely still looking for them!If you would be so kind, please create a short (5-15 minutes) pcap using wireshark, showing just udp packets heading your flows collector and with source IP belonging to the F5 device, so wireshark filter will look similar to this: udp.port==2055 && ip.src==10.114.75.24. Then please upload the pcap file to solarwinds leapfile:
Navigate to http://solarwinds.leapfile.com
Select the Secure Upload option
Enter support@solarwinds.net as the recipient email address
Fill out the form and provide some information about your issue in the subject line.
Select the Select Files To Send (Regular Upload) option
Browse to the compressed capture file
Select the Upload & Send button
Re: F5 BIG-IP v11. sFlow NTA
JonnyG Jun 28, 2013 9:56 AM (in response to Choly)
Hi Choly, Capture uploaded as requested Jon
Re: F5 BIG-IP v11. sFlow NTA
Choly Jun 29, 2013 4:21 PM (in response to JonnyG)
Jon,thanks for prompt reaction, however in provided pcap unfortunately aren't any sflow data usable by NTA :-( It seems that device is exporting only counter samples (statistics about amounts of packets traversing through device interfaces, pretty much the same information you get by monitoring using strandard snmp). According to this article: sFlow: Configuring F5 BIG-IP it seems that F5 released newer TMOS 11.4.0 in June, that should bring full sFlow support including packet sampling - the type of info that NTA collects.If you plan to upgrade to the TMOS 11.4.0, I would be pleased if you could then provide a packet capture once again. Thanks!

Re: F5 BIG-IP v11. sFlow NTA
Choly Jul 9, 2013 10:09 AM (in response to Choly)
Anyone tried to update to newest TMOS? Are you able to receive sFlow from that device in NTA since that?

Re: F5 BIG-IP v11. sFlow NTA
JonnyG Jul 11, 2013 10:30 AM (in response to Choly)
Hi Choly, I meant to get back to you on this i spoke to our network team and at the moment F5 have recommended we don't go to this release as soon as we can I'll let you have the feedback you need. Jon

Re: F5 BIG-IP v11. sFlow NTA
Jacob Beucler Jul 16, 2013 3:58 PM (in response to JonnyG)
In the interim, we are upgrading our BIG-IP VE here and I will post back with the results of our testing shortly. I will also be doing a blog post in the near future to raise the awareness that F5 flow's are working in NTA now . Thanks for the post.
https://thwack-staging.solarwinds.com/thread/53066
Cancel
Vote Up 0 Vote Down

Cancel