NTA netflow on palo alto and silverpeak

[denstjames]

I have netflow configured on my cisco devices with no issues but on my palo alto firewalls and my silverpeak wan accelerators I get the message that NetFlow Receiver Service [Poller] detected long flow with duration 90s on <link>Node</link>.

The article with the link points to says:

To resolve this error, the following lines must appear in the Flow Monitor section of the Configuration file for Flow Records on Cisco devices:

cache timeout inact 10

cache timeout act 5

I look on my palo alto firewall and the active timeout is set to 5 (there is no field for inactive timeout). Anyone else out there with a palo alto or silverpeak that uses NTA having the same issue?

[derik.pfeffer]

denstjames​,

Did you ever get the Silverpeak devices to show up with flow information in NTA? If so, what did you need to change on the Silverpeak configuration to make this successful?

Best Regards,

Derik Pfeffer

Loop1

[derik.pfeffer]

All,

We found that we needed to monitor different Interfaces for SilverPeaks than expected. We also changed the timeouts. Once this was done we could see flows from the SilverPeak devices.

Best Regards,

Derik Pfeffer

Loop1

[saw10]

This is how we have our SilverPeaks configed for flow

For our environment the flow "comes from" the sp_lan interface.  Make sure you are monitoring that interface.

[dramsey1]

We found we can get data on LAN or WAN, but those interfaces have to be check for resource monitoring before NTA will collect on them.

In this case Netflow was turned on for the Silverpeak, but sp_wan and sp_lan was not checked, so nothing collected.

[chayden18]

Just to add to this... on the SolarWinds side you will get 2 options of netflow interfaces: sp lan and sp wan. For our config, and most others I'm assuming as well, the sp_lan is the internal interfaces combined into 1 logical, and the sp_wan is the external interface (since we only have one on each silver peak, I can't confirm this to be a sum of all of them but would assume it's the same.)

[ferrashoo]

Any update for Silverpeak from the community?