This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

RSPAN - NETFLOW CONFIG

kamoy over 6 years ago

Is there anyway RSPAN traffic can be exported using netflow and collected by Solarwinds NTA for analysis and presentation?

Here is the situation:

I have Cisco 48port 2960S Switch 15.0(2) configured with VLANs for client access. The intention is to have the traffic from a few VLANs on that switch to be exported to Solarwinds NTA but was told that the Switch doesn't support Netflow.

As an alternative, I was told to configure Port mirroring and have the traffic mirrored to a destination port on a netflow capable switch. In this case, RSPAN was configured on the 48port 2960S Switch 15.0(2) to send the vlan traffic to a destination port on cisco switch 2960x 15.2(2) (this switch supports Netflow).

To this end, I am unable to get the expected results. Kindly see configuration on both switches and NPM with NTA current results attached.

Your assistance is greatly appreciated.

Regards,

Kamoy

attachments.zip

0 darragh.delaney over 6 years ago

Hi kamoy
Two other options. You could connect the SPAN port to an nProbe device which would convert the packet info to flows. More reading here
Orion NTA and nProbe: Analyzing bandwidth hogs without flow-capable network equipment
Another alternative is to use a commercial product we develop called LANGuardian which connects directly to a SPAN port and the flow\user\application we gather can be displayed within your SolarWinds views like this, the elements in the first row are all using data gathered via a SPAN port by LANGuardian
http://demo2.netfort.com/Orion/SummaryView.aspx?ViewKey=Network%20Top%2010&AccountID=guest
Hope this helps
Darragh
Cancel
Vote Up 0 Vote Down

Cancel
0 kamoy over 6 years ago in reply to darragh.delaney

@ darragh.delaney...Thank you for responding and for providing the alternatives. Are you then saying there is NO solution to this problem WITHOUT investing and integrating a third party software?
Cancel
Vote Up 0 Vote Down

Cancel
0 darragh.delaney over 6 years ago

Nprobe is free but you need to invest time. You don't really integrate it, you use it to convert the SPAN traffic to flow. I was never a huge fan of RSPAN because you are potentially sending high volumes of unprocessed packets across a LAN link. Better to deal with the SPAN traffic as close as possible to where it is generated.
Our own tool requires an investment but gives a hybrid approach. Flow and some of the packet payload information.
Cancel
Vote Up 0 Vote Down

Cancel