Flow Cloner now needs to be installed separately on your NFA Harvester. The installation file is in "<install_path>\setup\FlowClonerSetup.exe" which will add a new CA NFA Flow Cloner service You will also need to setup the <install_path>\Netflow\FlowCloner\flowclonedef.ini file before the service will work. This file is setup like the old flowclonedef.ini file from RA 9.0. Once the file is setup properly you will need to start the new "CA NFA Flow Cloner" service. The full instructions for setting up the new Flow Cloner service is located in the NFA 9.1.3 Admin guide on pages 52-57 The NFA 9.1.3 Admin Guide can be found at the link below: https://support.ca.com/cadocs/1/CA%20Network%20Flow%20Analysis%209%201%203-ENU/Bookshelf_Files/PDF/NFA_Administrator_Guide_en_US.pdf
Note that after installing the Flow Cloner service it will not start until you modify the '\CA\NFA\Netflow\FlowCloner\flowclonedef.ini' You must at minimum specify the port and the destination IP address. Each argument you pass must be on its own line. If you are using port 9995 to forward to you can use the first link which says "/use defaults" Semi colon's are use to comment out lines. Below is a working example of forwarding flows to port 9995 to a host with IP 10.0.2.151 /use defaults ; use first available NIC and port 9995 to listen and send flows on the first available NIC /dest ip=10.0.2.151 ; send cloned packets to 10.0.2.151 Once you save the file you should now be able to start the "CA NFA Flow Cloner" service.
Also note starting with NFA 9.2.1 you will be able to change the port that FlowCloner is forwarding data on.
This document was generated from the following discussion: NFA 9.1.3 Setup Flow Cloner