This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Nexus 7K and NetFlow unmanaged interface 'does not support SNMP'

FormerMember
FormerMember

NetFlow Receiver Service [SOLARWINDS ] is receiving flow data from unmanaged interface '#334' on NEXUS7K and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data.

Receiving these alerts after implementing Netflow config on our Nexus devices. The Nexus are already monitored in SolarWinds orion, it knows about the interfaces already and polls them via the Mgmt0 interfaces.

I can "Add this interface" but 1) it's hard to determine which "NTA Virtual Interface #333" is which actual interface and 2) If I change it to Ethernet 1/1, but thats already monitored now I have 2 instances of e1/1, one that has the NetFlow data but is in a constant "unknown" state and then one who's Tx/Rx, etc is properly reported.

Is there either 1) a way to tie these interfaces together. or b) and more ideally, have NTA properly and automatically determine which interface is which.

I'm not sure why it's saying it does not support SNMP.

Using Ver5 Netflow on the exporters.

Thanks. ,

  • Is it a case of interface indexes changing and then the new interface index being discovered with NetFlow data? Make sure you have ifindex persistence enabled on the Nexus.Reguar IOS devices uses "snmp-server ifindex persist" for ifindex persistance.

    R,

    Don

  • NTA shows this message if interface indexes in flows doesn't match any interface indexes on the device (queried by SNMP). In your case NTA received flow with interface index 334, but no such interface existed in your NPM installation. Thus SNMP query was issued to check for that interface on the device - no such was found and that's why the message was generated. Anyway, I'd try advice from Don first and see if that helps.

    Regards,

    Martin

  • I read that NX-OS has ifindex persistence enabled by default. But I also happened to read about a possible Cisco bug on the Nexus which causes the ifindex can change.

    https://supportforums.cisco.com/thread/2187129

    Could it be that you have an older OS on the device with this bug? And then, can you check the interface name for the newly discovered ifindex on the Nexus. I believe the command for NX-OS is "show interface snmp-ifindex". You can check the interface name for ifindex and then check if NPM is managing it or not.

  • Change your exporter on the Nexus 7k to use version 9.

    I had the same problem on my 7010's and changing my flow exporter from version 5 to version 9 resolved the issue. Most of my other Cisco gear is running version 5 so that is I had picked by default but the 7ks do not map the interfaces correctly when using version 5 changing nothing on my configuration expect the exporter version resolved the issue.

    For reference my relevant configuration sections are below:

    flow record Basic-Netflow-Record

    description Generate Basic Netflow

    match ipv4 source address

    match ipv4 destination address

    match transport destination-port

    collect counter bytes

    collect counter packets

    flow exporter Netflow-To-Orion

    description Solarwinds Orion Server

    destination 10.10.10.10 use-vrf management

    source mgmt0

    version 9

    transport udp 2055

    flow timeout active 120
    flow timeout inactive 32
    flow timeout fast 32 threshold 100
    flow timeout session
    flow timeout aggressive threshold 75

    flow monitor Netflow-Monitor-1
    description Use Predefined Original-Netflow-Record
    record netflow-original
    exporter Netflow-To-Orion

    interface VLAN100

    ip flow monitor Netflow-Monitor-1 input

    ip flow monitor Netflow-Monitor-1 output

  • This is a problem with IOS routers as well. It's driving me insane seeing this on the event log for the last year or so. It seems to temporarily go away with a reboot, but it always comes back after a couple of months. I cannot keep rebooting 250 plus routers and the four 6509 national hubs as you can imagine...

    I have the aforementioned
    snmp-server ifindex persist

    command, as well as the always suggested

    ip flow-export source FastEthernet0/0

    ip flow-export version 9

    commands as well. As an example on a box such as this:

    Cisco 2811 (revision 53.51), 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T13

    Messages like:

    NetFlow Receiver Service [COLLECTOR] is receiving flow data from unmanaged interface '#710193670' on "ROUTERNAME" and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data.

    YET, there is no such interface in the snmp ifindex:

    ROUTERNAME#show snmp mib ifmib ifindex detail
    Description                     ifIndex  Active  Persistent
    ----------------------------------------------------------------

    FastEthernet0/0                  1      yes      enabled  
    Null0                            4      yes      enabled  
    Serial0/0/0:0                    7      yes      enabled  
    VoIP-Null0                       3      yes      enabled  
    T1 0/0/0                         5      yes      enabled  
    FastEthernet0/1                  2      yes      enabled  
    Serial0/0/1:0                    8      yes      enabled  
    T1 0/0/1                         6      no       enabled

    See how annoying this is?

    I suspect it is related to CPU usage on the collector. ">scope2013, how is your cpu usage during these messages looking like on your end?