Is there anyway RSPAN traffic can be exported using netflow and collected by Solarwinds NTA for analysis and presentation?
Here is the situation:
I have Cisco 48port 2960S Switch 15.0(2) configured with VLANs for client access. The intention is to have the traffic from a few VLANs on that switch to be exported to Solarwinds NTA but was told that the Switch doesn't support Netflow.
As an alternative, I was told to configure Port mirroring and have the traffic mirrored to a destination port on a netflow capable switch. In this case, RSPAN was configured on the 48port 2960S Switch 15.0(2) to send the vlan traffic to a destination port on cisco switch 2960x 15.2(2) (this switch supports Netflow).
To this end, I am unable to get the expected results. Kindly see configuration on both switches and NPM with NTA current results attached.
Your assistance is greatly appreciated.
Nprobe is free but you need to invest time. You don't really integrate it, you use it to convert the SPAN traffic to flow. I was never a huge fan of RSPAN because you are potentially sending high volumes of unprocessed packets across a LAN link. Better to deal with the SPAN traffic as close as possible to where it is generated.
Our own tool requires an investment but gives a hybrid approach. Flow and some of the packet payload information.
Two other options. You could connect the SPAN port to an nProbe device which would convert the packet info to flows. More reading here
Another alternative is to use a commercial product we develop called LANGuardian which connects directly to a SPAN port and the flow\user\application we gather can be displayed within your SolarWinds views like this, the elements in the first row are all using data gathered via a SPAN port by LANGuardian
Hope this helps
@ darragh.delaney...Thank you for responding and for providing the alternatives. Are you then saying there is NO solution to this problem WITHOUT investing and integrating a third party software?
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.