19 Replies Latest reply on Aug 12, 2019 11:40 AM by foonly

    NTA 4.4.0 flow data from unmanaged interfaces on ASA

    foonly

      Last 200 Unknown Traffic Events is showing many, many events from ASAs with somewhat random numeric interface numbers:

       

      11/5/2018 8:33 AM    EventImg    NetFlow Receiver Service [RedactedServerName] is receiving flow data from unmanaged interface '#-420822234' on RedactedASA-Context  and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data.

       

      The interface number appears to be interpreted as a signed integer, and of course, do not exist elsewhere in Orion. If I scrape the page into Excel and sort, the numbers are somewhat sequential around a few different root numbers.Rediscovering the ASA does not change the behavior.

       

      These events are happening many times a second. We see this on multiple Orion servers.

       

      Has anyone already opened a support case on this and solved it?

       

      =Foonly=