3 Replies Latest reply on Sep 21, 2016 2:13 PM by richardjmcintosh

    NTA - Do you need NetFlow for NBAR to work?

    richardjmcintosh

      I have NTA 4.2 and want to use the NBAR functionality, but I am seeing a few issues.

      Do you need to keep your NetFlow v9 configuration or can you only have the NBAR configuration from Set up NBAR2 on Cisco devices ?

       

      I am also getting errors from SolarWinds saying a virtual interface on my router is sending unknown traffic.  I have no idea what these interfaces and no idea why they would be sending traffic.

      2016-09-01_10-56-27.jpg

       

      Any help is greatly appreciated.

      Thank you!

        • Re: NTA - Do you need NetFlow for NBAR to work?
          jamesatloop1

          As per documentation, you need to have both. Netflow v9 gives you the protocol usage etc... NBAR2 gives you greater detail such if the traffic is udp traffic from you tube. The message is probably to do with netflow being configured on the virtual interface as well as the physical interface. I would double check the device and interface configuration.

          1 of 1 people found this helpful
            • Re: NTA - Do you need NetFlow for NBAR to work?
              richardjmcintosh

              Can you help with this code?  I am sure it's configured correctly, unless i need to have both 'ip flow monitor' and 'ip flow ingress/egress'?

               

               

              #show run | s flow

              ip flow-cache timeout active 1

              ip flow-export source GigabitEthernet0/1.30

              ip flow-export version 9

              ip flow-export destination 10.20.18.198 2055

               

              flow record NTArec

              match ipv4 tos

              match ipv4 protocol

              match ipv4 source address

              match ipv4 destination address

              match transport source-port

              match transport destination-port

              match interface input

              collect interface output

              collect counter bytes

              collect counter packets

              collect application name

               

              flow exporter NTAexp

              destination 1.2.3.4

              source GigabitEthernet0/1.30

              transport udp 2055

              template data timeout 60

              option application-table timeout 60

              option application-attributes timeout 300

               

              flow monitor NTAmon

              description NetFlow nbar

              exporter NTAexp

              cache timeout inactive 30

              cache timeout active 60

              record NTArec

               

              interface gi0/0

              ip flow monitor NTAmon input

              ip flow monitor NTAmon output

            • Re: NTA - Do you need NetFlow for NBAR to work?
              drange

              Think of NetFlow as the "transport" for the NBAR2 information/fields.

              1 of 1 people found this helpful