NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working

wakhan, can you show the Huawei documentation on configuring? Also, are you managing the interfaces in NPM? If possible, we would like to get a copy of a packet capture from you so we can make sure there isn't a problem.

Since this is a sales case you can't open a support ticket, but we'll help you out.

Mav

Hello Mav,

Thanks for your reply.

Below is the Huawei netstream configuration for NE20e Router Seires. I have  also check netstream on Huawei Ne80e routers with solarwinds and its working. But we want to run netstream on NE20e as well.

-----------------------------------------------------------------------

NE20E Configuration

------------------------------------------------------------------------

Global commands:

[RouterA] ip netstream export host 10.1.1.1 2055

[RouterA] ip netstream export source 11.110.2.1

[RouterA] ip netstream sampler inbound 100

[RouterA] ip netstream sampler outbound 100

[RouterA] interface gigabitethernet 1/0/0

[RouterA-GigabitEthernet1/0/0] ip address 11.110.2.1 255.255.0.0

[RouterA-GigabitEthernet1/0/0] quit

[RouterA-GigabitEthernet1/0/0] ip netstream inbound

[RouterA-GigabitEthernet1/0/0] ip netstream outbound

---------------------------------------------------------------------------------------------

And yes i am managing the interfaces on NPM. In EVENTS , it is showing, receiving netflow from NE20e but it never show anything in graphs and LAST FLOW SEEN  always remain = NEVER.

But on free Netflow Analyzer application it is showing graphs and data properly.

How i can capture packets and send you ?

Regards,

Hi wakhan,
How to capture packets:
 Download WireShark from: http://www.wireshark.org/download.html
 Run it and in Capture option configure:
    Select network interface on the server thru which NTA receives the flows
    In 'Capture filter' put: 'udp port 2055 and src 11.110.2.1'
    Select file into which you want to capture the traffic
    Press start and let capture data for 15 minutes

I would like also to ask for diagnostics:
   Open Orion Diagnostics tool (in start menu -> SolarWinds Orion -> Documentation and Support -> Orion Diagnostics)
   Click on Start button and select file into which you want to save the diagnostics

Then please upload zip both files (wireshark+diags) into one file: NTA-Huawei-wakhan.zip and upload to the LeapFile:
 Open:  http://solarwinds.leapfile.com 
 Click on "Secure upload" Enter "support@solarwinds.net" as the "Receiver Email" (Don't forget, it's .NET) 
 Fill the form and attach the zip file you've created and send it.

Please let me know if you have any questions.

Thanks!
Ondrej 

wakhan, any update here? Can I help with something?

I have upload both files as requested by you.

Now waiting for your reply.

Regards,

Hi wakhan,

I've analyzed files uploaded by you. Flows exported by Huawei NE20E have different interface indexes than SNMP indexes. This is expected for Huawei's NetStream, but it seems that the device doesn't publish table which maps between those two interface identifiers. This table is vital to properly analyze incoming flows.

To confirm this theory, please do the following:

1. Locate and run SolarWinds SnmpWalk tool: SnmpWalk.exe in 'C:\Program Files (x86)\SolarWinds\Orion\' folder
2. Enter IP address of NE20E device (172.31.64.5) and it's community string into corresponding fields
   
3. Put following OID into 'Root OID' field: 1.3.6.1.4.1.2011.5.25.110.1.2.1.2 and press Scan. Save the file as 'ifIndex.txt'
4. Repeat step 3, but put 1 into 'Root OID' field. Save the file as 'fullWalk.txt'
5. Zip both files and upload them to LeapFile - using same steps as Ondrej posted before.

Please let me know once this is done and I will continue my investigation.

Regards,

Martin

Hi Martin,

I have upload the file as requested by you.

Root OID filed '1.3.6.1.4.1.2011.5.25.110.1.2.1.2' is giving no output and file (ifIndex) is saved empty.

1 into 'Root OID' field is giving output and file is saved as fullWalk.txt.

Regards,

Hi,

that OID which gave empty file confirmed my theory outlined in my previous post. Huawei exports in flows different interface indexes than those in MIB interfaces table. To translate flow interface index to real SNMP interface index, there should be translation table (on that OID which returned no result). If the translation is not possible, NTA has no way to match flows to correct interfaces. There is probably some issue with the device, I would try following:

• try to restart the device
• check whether there is new firmware (it may contain some NetStream-related fixes)
• open support case with Huawei

I will send you private e-mail with attached image explaining the case. Let me know if you need more information.

Regards,

Martin

Thanks Martin for your help. I would try to do following steps:

• try to restart the device
• check whether there is new firmware (it may contain some NetStream-related fixes)
• open support case with Huawei

So right now NE80e is working properly with NTA , I have not checked NE40e yet, and NE20e has some OID translation problem.

Regards,

Dear Martin,

I have the same problem that our friend. Although my router is AR160

I did the instructions posted like Put following OID into 'Root OID' field: 1.3.6.1.4.1.2011.5.25.110.1.2.1.2 but I didn´t have any information from that. The file was empty.

Please, could you help me?

Have a good time!