cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 8

Netflow

Hello everybody,

i'm new in this forum and to solarwinds, and needs your help...

i've just installed demo version of the netflow and setup the cisco asa5510 to send netflow,

i see the data is receving in solarwinds

LAST RECEIVED NETFLOW' : 21/01/14 13:01

but still all the graphs are empty and the graph says 'data is not available'

i don't know in what stage it happens but i have the following events

21/01/2014 11:51   NetFlow Receiver Service [---] received NetFlow V9 flows without any template for decoding them. Configure the device 10.x.x.x to export an appropriate NetFlow V9 template at 1-minute intervals. See help for details.

  21/01/2014 11:36   Resetting unknown traffic notification events.

  21/01/2014 11:31   NetFlow Receiver Service [---] started - listening on port(s) [2055]

  21/01/2014 01:30   NetFlow Database Maintenance : Deleted 0 expired endpoints in 0.01 seconds.

  21/01/2014 00:02   NetFlow Receiver Service [---] is receiving flow data from unmanaged interface '#65535' on asa5510.---and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data.

  21/01/2014 00:02   NetFlow Receiver Service [---]SERVERS' on asa5510.---. Click "Add this interface" or "Edit this device" to manage interface and process its flow data.

  20/01/2014 23:07   Removing interface index mapping for node asa5510.---.

  20/01/2014 17:38   Resetting unknown traffic notification events.

please advice and help,

thank you guys

0 Kudos
3 Replies
Level 12

Make sure you have the template timeout to 1 minute. The command for setting flow timeout is "flow-export template timeout-rate".And maybe you could refer here:
https://supportforums.cisco.com/docs/DOC-6114

As for errors from ifindex 65535 - I have seen this when exporting NSEL from Cisco ASA. that is a dummy interface and has no flow information.

0 Kudos
Level 13

The ASA uses a proprietary version of NetFlow v9 called "NSEL", or NetFlow Security Event Logging.

I have never set this up with Solarwinds NTA, but I found this document that might help you:

SolarWinds Knowledge Base :: Configuring Cisco ASA devices for use with Orion NTA

Thanks jswan,, checking it...

more replys will be welcome

thanks

0 Kudos