Are you managing both devices in NPM? Do you see any relevants messages in the events resource? For example, receiving flows from un-managed interface.
You may want to to open a case so support can look at your configurations and make sure there really isn't something missing.
The best way to troubleshoot this issue is to perform a Wireshark capture to investigate the flow packets. Also noticing some commands that are missing. They might not be preventing data from being collected but will give you more accurate data collection. Below are commands:
mls ip multicast flow-stat-timer 9
mls aging long 64
mls aging normal 32
mls flow ip interface-full
mls nde sender version 5
ip flow ingress layer2-switched vlan xxxx (separate each VLAN with a comma)
ip flow-export source (Port with the IP address that is being monitored in Orion)
ip flow-export version 5
ip flow-export destination IP_Address(Orion NPM server) 2055
***NOTE*** CEF must be enable on some devices in order for Netflow to work properly
Layer 3 interfaces
Ip route-cache flow
Ip flow ingress
Ip flow Egress
Hope this helps
Hi, a follow up question regarding this: On which side it is required to perform and Wireshark capture? Is it on the SolarWinds server side or on the Cisco device side?
On the Orion server itself so we can see if the flows from that device are getting to us or not.
Hi, I ran wireshark on the device and it is polling from it ok. NSTH is the device name which NTA is currently polling the netflow properly and NSTL is the device name for the one NTA is unable to detect.
I solved the problem... Just need to remove and re-add the device, then NTA successfully detect the Netflow packets.
However, this is done at a very hefty price... all previous data on the device is now gone and start from 0. Now the monthly report for June is gone.