9 Replies Latest reply on Mar 26, 2012 1:04 PM by wakhan

    NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working

    wakhan

      Hello All,

      I am evaluating NetFlow Analyzer 3.8 with NPM 10.2 on Huawei NE20E Router.   Router is properly configured as per Huawei documentation but Netflow webconsole is not showing traffic and graphs. Though the events are showing that  NetFlow Receiver Service [NMS-TESTING] is receiving a NetFlow data stream from Huawei NE20E.  But still Netflow sources  selected interfaces is showing LAST RECEIVED NETFLOW = NEVER

      So i installed Realtime Netflow Analyzer (Free Application) on my server and selected the Ne20e Router and it start showing all the traffic flow properly.

      So the problem is in NTA webconsole which is not showing traffic.

      Please help , so we can finish evaluation successfully.

       

      Regards,

        • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
          mavturner

          wakhan, can you show the Huawei documentation on configuring? Also, are you managing the interfaces in NPM? If possible, we would like to get a copy of a packet capture from you so we can make sure there isn't a problem.

          Since this is a sales case you can't open a support ticket, but we'll help you out.

          Mav

            • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
              wakhan

              Hello Mav,

              Thanks for your reply.

              Below is the Huawei netstream configuration for NE20e Router Seires. I have  also check netstream on Huawei Ne80e routers with solarwinds and its working. But we want to run netstream on NE20e as well.

              -----------------------------------------------------------------------

              NE20E Configuration

              ------------------------------------------------------------------------

              Global commands:

              [RouterA] ip netstream  export host 10.1.1.1 2055

              [RouterA] ip netstream  export source 11.110.2.1

              # Configure global sampling.

              [RouterA] ip netstream sampler inbound 100

              [RouterA] ip netstream sampler outbound 100

               

              [RouterA] interface gigabitethernet  1/0/0

              [RouterA-GigabitEthernet1/0/0] ip  address 11.110.2.1 255.255.0.0

              [RouterA-GigabitEthernet1/0/0] quit

              # Enable NetStream  statistics on the inbound and outbound interfaces.

              [RouterA-GigabitEthernet1/0/0] ip netstream inbound

              [RouterA-GigabitEthernet1/0/0] ip netstream outbound

              ---------------------------------------------------------------------------------------------

              And yes i am managing the interfaces on NPM. In EVENTS , it is showing, receiving netflow from NE20e but it never show anything in graphs and LAST FLOW SEEN  always remain = NEVER.

              But on free Netflow Analyzer application it is showing graphs and data properly.

              How i can capture packets and send you ?

              Regards,

                • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                  ondrej.salplachta

                  Hi wakhan,
                  How to capture packets:
                   Download WireShark from: http://www.wireshark.org/download.html
                   Run it and in Capture option configure:
                      Select network interface on the server thru which NTA receives the flows
                      In 'Capture filter' put: 'udp port 2055 and src 11.110.2.1'
                      Select file into which you want to capture the traffic
                      Press start and let capture data for 15 minutes

                  I would like also to ask for diagnostics:
                     Open Orion Diagnostics tool (in start menu -> SolarWinds Orion -> Documentation and Support -> Orion Diagnostics)
                     Click on Start button and select file into which you want to save the diagnostics


                  Then please upload zip both files (wireshark+diags) into one file: NTA-Huawei-wakhan.zip and upload to the LeapFile:
                   Open:  http://solarwinds.leapfile.com 
                   Click on "Secure upload" Enter "support@solarwinds.net" as 
                  the "Receiver Email" (Don't forget, it's .NET) 
                   Fill the form and attach the zip file you've created and send it.

                   

                  Please let me know if you have any questions.

                  Thanks!
                  Ondrej 

                    • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                      ondrej.salplachta

                      wakhan, any update here? Can I help with something?

                        • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                          wakhan

                          I have upload both files as requested by you.

                          Now waiting for your reply.

                          Regards,

                            • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                              Martin.Krivanek

                              Hi wakhan,

                              I've analyzed files uploaded by you. Flows exported by Huawei NE20E have different interface indexes than SNMP indexes. This is expected for Huawei's NetStream, but it seems that the device doesn't publish table which maps between those two interface identifiers. This table is vital to properly analyze incoming flows.

                              To confirm this theory, please do the following:

                              1. Locate and run SolarWinds SnmpWalk tool: SnmpWalk.exe in 'C:\Program Files (x86)\SolarWinds\Orion\' folder
                              2. Enter IP address of NE20E device (172.31.64.5) and it's community string into corresponding fields
                              3. Put following OID into 'Root OID' field: 1.3.6.1.4.1.2011.5.25.110.1.2.1.2 and press Scan. Save the file as 'ifIndex.txt'
                              4. Repeat step 3, but put 1 into 'Root OID' field. Save the file as 'fullWalk.txt'
                              5. Zip both files and upload them to LeapFile - using same steps as Ondrej posted before.

                              Please let me know once this is done and I will continue my investigation.

                              Regards,

                              Martin

                                • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                                  wakhan

                                  Hi Martin,

                                  I have upload the file as requested by you.

                                  Root OID filed '1.3.6.1.4.1.2011.5.25.110.1.2.1.2' is giving no output and file (ifIndex) is saved empty.

                                  1 into 'Root OID' field is giving output and file is saved as fullWalk.txt.

                                  Regards,

                                    • Re: NetFlow Traffic Analyzer 3.8 on Huawei NE20E not working
                                      Martin.Krivanek

                                      Hi,

                                      that OID which gave empty file confirmed my theory outlined in my previous post. Huawei exports in flows different interface indexes than those in MIB interfaces table. To translate flow interface index to real SNMP interface index, there should be translation table (on that OID which returned no result). If the translation is not possible, NTA has no way to match flows to correct interfaces. There is probably some issue with the device, I would try following:

                                      • try to restart the device
                                      • check whether there is new firmware (it may contain some NetStream-related fixes)
                                      • open support case with Huawei

                                      I will send you private e-mail with attached image explaining the case. Let me know if you need more information.

                                      Regards,

                                      Martin