2 Replies Latest reply on Mar 16, 2015 4:49 AM by ederdal

    Setup Cisco 3750 for netflow using Nprobe

    ldeffinbaugh

      Trying to setup a Cisco 3750 for netflow using Nprobe to send the data to NTA

        • Re: Setup Cisco 3750 for netflow using Nprobe
          ederdal

          You need to configure port mirroring on your switch first. You can check here for the steps involved.

           

          With nProbe and NTA you must be managing the machine and interfaces on the machine that you have nProbe on, with NPM. manage all the active nProbe server interfaces in NPM, and set in to 1 and out to 2.

           

          See attached for useful Info, also particularly good thread below:

          http://thwack.com/blogs/orion-product-team-blog/archive/2009/11/10/orion-nta-and-nprobe-analyzing-bandwidth-hogs-without-flow-capable-network-equipment.aspx

           

          Configure nProbe to export flows to Orion NTA

          • Open command prompt on nProbe server and navigate to C:\Program Files\nProbe-Win32>
          • Run nProbe from CLI using the options listed below:

                         nprobe 

                           /c - output to console.  This is the easiest method, especially for a demo situation, because you can review the debug messages.

                           -n <Orion NTA server address>:<port>  - IP address and port that should receive the flow records.  Use 2055 for port.

                           -b 1 - modest level of reporting

                            -i  <interface> - generally 1 on Windows; en0/eth0 on Linux; en0 for Ethernet on OSX, en1 for wireless

                           -u <in-index> - sets the ingress interface for all flows (use 1).

                           -Q <out-index> - sets the egress interface for all flows (use 2).

                    E.g. nprobe /c -i 1 -n 10.199.15.50:2055 -b 1 -u 1 -Q 65539

           

          • NOTE:  It’s important the ingress (-u) and egress (-Q) interface indexes be set to the server interfaces being managed in Orion. NTA will drop flows from interfaces that are not managed in Orion.  You can see the interface index for the server interfaces in Orion by drilling down to their respective interface details view. So, if your nProbe server had two interfaces being monitored in Orion NTA, you would just set the option –u to the index of one of them and the –Q switch to the index of the other.   See nProbe documentation for other command line options.