0 Replies Latest reply on Sep 30, 2011 4:16 AM by Pixellated

    BGP AS Information No Longer Working (NTA3.8)

    Pixellated

      Hi all,

      I'm currently exporting Netflow from my Cisco 6504-e switches, and am using NTA 3.8. Recently, I seem to have completely lost all of my BGP AS information.

      When I first installed my NPM and NTA trials, it automatically installed SQL Compact for me. For a while, everything was absolutely fine - I could see all of my Netflow information, including full BGP AS information in the BGP tab. Top Autonomous Systems and Top Autonomous System Conversations both worked perfectly and gave me the info I expected to see.

      However, I soon hit the 4GB database size limit for SQL Compact, so I installed a new SQL server (SQL Server 2008 R2) on a seperate machine. I deleted the old database, and pointed NPM/NTA to the new one (meaning that it deleted the old data, of course).

      Since using the new database, almost everything seems fine. I'm still seeing the same Netflow information I'm used to seeing (ie Top Apps, Top Endpoints, Top Countries etc... all of these are fine), but I've completely lost all BGP AS information. No matter what summary view I select or which interface I check, all I see when I look for BGP AS information is "No Data for Selected Time Period".

      I'm really confused because I haven't changed anything other than the database - the config on the switches is exactly the same (I'll paste it below for reference). Also, if I run a "show ip cache verbose flow", I can see that the BGP AS information is being cached on the switches (and therefore, presumably, exported also). I'm really stumped and can't figure out why it's not working.

      Here's my config:

      mls nde interface
      mls nde sender version 5
      mls flow ip interface-full
      !
      ip flow-export source loopback 0
      ip flow-export version 5 origin-as
      ip flow-export destination [collector ip] 2055
      !
      ip flow ingress layer2-switched vlan 1-4094
      ip flow-cache timeout active 1
      !
      mls aging long 64
      mls aging normal 64
      !
      mls sampling packet-based 1024 8192
      !
      interface [interface name]
       mls netflow sampling

      Here's a snippet of the output from "show ip cache verbose flow". Some of the ASs that are being recorded are AS20940, AS19795 and AS28271:

      SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts
      Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

      -------------------------------------------------------------------------------

      Displaying hardware-switched flow entries in the PFC (Active) Module 1:
       SrcIf            SrcIPaddress     DstIf            DstIPaddress    Pr TOS Flgs  Pkts
      Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

       Vl51             [snipped]    Vl183            [snipped]  06 00  00       5
      0050 /24 20940                 3615 /0  0     [snipped]          0     0.0

       Vl115            [snipped]    Vl51             [snipped]  06 00  00       1
      0019 /28 0                     C7FA /24 19795 [snipped]           0     0.0

       Vl115            [snipped]     Vl51             [snipped]    06 00  00       1
      0019 /28 0                     D95C /24 28271 [snipped]           0     0.0



      I'd really appreciate any suggestions that anyone might have, since I'm completely out of ideas!!

      Cheers :)