DX Unified Infrastructure Management

Hi All,

I have NFA 9.3.3 configured in a 3 tiered architecture in my environment.

For few of the interfaces I am just seeing One way data. 

Is there something we control from NFA end ?

Usually this indicates a mis-configuration on the router. If V5, ensure "ip flow ingress" is on all active interfaces.  If V9/Flexible Netflow only the desired interface(s) get the relevant "in/out" commands.

Hi ,

A wireshark trace from the harvester will be helpfull to check what is in the sent netflow data .

  JF LAJUGIE

You definitely want to verify the Netflow is configured correctly to send both in and out traffic for the interface, which can be verified via a pcap as stated above.  That is usually the cause of this behavior.

In some cases, where the netflow data is correct, we have seen that rebooting the Harvester can resolve this, although this is rare as its usually due to router configuration.

Hi,

I'm having this same issue with V9. How were you able to solve it?

Hello M Zab, this thread was closed already, I would recommend starting a new questions and provide some more details about your problem with Netflow v9.

First thing to check is wireshark to see if the harvester is receiving flows from the device and the required fields are seen withing the flows.  The KB article below describes how to do this.

https://comm.support.ca.com/kb/how-can-i-determine-if-a-netflow-enabled-device-is-sending-the-correct-fields-and-data-using-wireshark/kb000011095

If you need help analyzing the pcap, please open a support case and provide the pcap in the case so we could review it further.