Do you see any events that might indicate a problem? Sometimes the ip address that the flows are coming from is different than the IP being managed by NPM. This needs to be the same. You can either configure the device to source the traffic from a specific IP / interface or you can manage the node from the other address in NPM. Also, you need to be managing the interface in NPM for NTA to be able to work. If you are not, you should see an Event that says something to the effect of, "you are receiving flows from an unmanaged interface".