This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Monitoring NetFlow from a PPP interface...

I've found a bit of an issue when using NPM and NetFlow Analyzer together.

Keep in mind, I would like to monitor as few interfaces as possible to keep licensing down.

 

First, I set up NPM.  I have 50 routers, and I added ONLY their T1 interfaces.  I did this instead of PPP interfaces so that I could also get things like error stats, MAC address, etc.

I then set up NetFlow Analyzer.  Obviously, I need to source the NetFlow traffic from somewhere, but I can't do it from the T1 interface.  I can do it from the internal VLAN, or the PPP interface.  When I source it from the PPP interface, it works fine, but now I have effectively doubled the amount of interfaces I'm monitoring.  This is annoying because the PPP interface doesn't show me any of the SNMP stats.

 

Anyone find a good way to get around this?

  • I'm  having a little trouble following your set up. Can you give me an idea of the topology and what you want to see?

  • Yeah, sorry about that.  Here is a quick image of the setup (the important part, at least).  All I'm trying to monitor is the T1 at the remote site.

    http://grab.by/3Lqv

     

    So, originally when adding nodes to NPM, I would select the router, and told it to monitor the T1 1/1 interface.  Doing this allowed me to see stats like error counters, etc, thanks to SNMP.  

    The problem with that, though, is that the T1 1/1 interface doesn't have an IP address - the logical PPP1 interface has the IP.  

    When I configure NetFlow on the router, I have to tell it where to source the NetFlow traffic from.  I can only source the traffic from an interface with an IP address (ie: must be a layer3 interface).  So I tell it to source from the PPP1 interface.

     

    Now I am monitoring 2 interfaces, although they are really one in the same.  Within NPM, I need the T1 1/1 interface because it holds SNMP statistics.  Within NetFlow, I need PPP1 since it sends NetFlow traffic.

     

    Does that make more sense?

     

    Edit: As a side note - the reason this is annoying is because I am now effectively doubling the total amount of interfaces being monitored.  Also, it's a little more cluttered since I don't have one interface with ALL information.

  • can you give me a config snippet I can test? I'll make up the Ip Addresses

  • Config snippet from what? The router?

  • Yep - for the PPP and T-1 IF's

  • interface t1 1/1

      description MPLS-T1

      fdl none

      tdm-group 1 timeslots 1-24 speed 64

      no shutdown

    interface ppp 1

      ip address  X.X.X.X  255.255.255.252

      ip flow ingress

      ip flow egress

      media-gateway ip primary

      max-reserved-bandwidth 100

      qos-policy out QOS_MAP

      no shutdown

      cross-connect 1 t1 1/1 1 ppp 1

    ip flow export destination 10.10.1.45 2055 source ppp 1

  • Is that an Adtran box? It's so close to Cisco-speak it took me a second to realize it's not...

  • Can't you just put a loopback address on the router and add the device to NPM to be monitored from the looback ip.  You then want to export netflow data from the loopback address also.  You need to have config with some lines like these:

    ip flow-export source Loopback0
    ip flow-export version 9
    ip flow-export destination <put your NPM IP here> 2055

    logging trap debugging
    logging facility syslog
    logging source-interface Loopback0

    logging <put your NPM IP here>

    snmp-server ifindex persist
    snmp-server location
    snmp-server contact
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps tty
    snmp-server enable traps bgp
    snmp-server enable traps config
    snmp-server enable traps syslog
    snmp ifmib ifindex persist

    this way you monitor thought the loopback and get syslog, traps, and netflow from the same IP.

  • Haha good catch! 

     

    It is, and yes it's nearly identical :)

     

    Thanks for the replies - I will experiment with loopback and see if that does the trick!

  • If I understand the question correctly, I don't think the loopback configuration is going to help. It sounds like the problem is that Tyler doesn't want to view the physical interface and the logical interface on separate pages.

    This doesn't seem to me like a NTA issue per se; it's more the consequence of the fact that the physical and logical interfaces have different SNMP ifIndexes, so Orion puts them on different pages.

    I'll be interested to see if Solarwinds can come up with a way to combine multiple interfaces onto a single page; this would be useful not only in a case like this but in cases like Multilink PPP interfaces, dialer interfaces, or SVIs (aka VLAN interfaces) and their associated physical members.