Re: DNAC Assurance does not show Application info

alberx · ‎09-19-2022

DNAC version 2.2.3.5

DNAC as Netflow collector server and Monitor Wired Cliets active (Network settings). Applicaton Telemetry enabled on switches (Provision). Application visibility with CBAR enabled on switches and synced (Application visibility).

But still Assurance --> Application does not show anything. DNAC is getting all the information about network devices correctly, only info about application is missing.

Does anyone knows what could be the reason?

Thanks.

Dan Rowe · ‎09-27-2022

Hey Alberx,

The most common scenarios I have ran into which could cause this type of behavior is the following:

1. The network devices are not configured correctly, thus not sending application telemetry data to Cisco DNA Center.

-- Since Cisco DNA Center automated this portion of the configured through the application telemetry automation workflow, this is likely not the cause here.

2. The network device is sending application telemetry data to Cisco DNA Center however that data never makes it to its destination.

-- By default, Cisco DNA Center will send the application telemetry data to Cisco DNA Center on port 6007. You can perform an embedded packet capture on the uplink switch where Cisco DNA Center is connected or even perform a tcpdump from the Cisco DNA Center CLI to confirm whether or not you see traffic on port 6007 with a source IP of the network device in question. You can also use Grafana in Cisco DNA Center to check whether the network device is listed as an active netflow exporter. You can navigate to Grafana from Menu -> system -> System 360 -> Monitoring.

3. Network device is sending App Telemetry data to Cisco DNA Center. Cisco DNA Center receives that application data however pipelines have trouble processing that data

-- This would a more uncommon scenario but could be caused by devices not running on minimum code for application visibility / experience support.

I would advise with starting with an embedded packet capture or tcpdump from the DNA Center CLI to validate whether or not you see packets coming in from the IP of the network device on port 6007.

HTH!

BR,

alberx · ‎10-05-2022

Hello Dan, thanks for your reply.

My DNAC is receiving traffic to the 6007 UDP port from switches:

[Wed Oct 05 12:54:51 UTC] maglev@10.101.40.12 (maglev-master-10-101-40-12) ~
$ sudo tcpdump -vv port 6007 -n
[sudo] password for maglev:
tcpdump: listening on enp94s0f0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:55:07.897826 IP (tos 0x0, ttl 250, id 7123, offset 0, flags [none], proto UDP (17), length 376)
10.101.25.7.51386 > 172.17.19.10.6007: [udp sum ok] UDP, length 348
12:55:07.992275 IP (tos 0x0, ttl 250, id 6495, offset 0, flags [none], proto UDP (17), length 920)
10.101.25.6.53578 > 172.17.19.10.6007: [udp sum ok] UDP, length 892
12:55:08.842139 IP (tos 0x0, ttl 249, id 7088, offset 0, flags [none], proto UDP (17), length 376)
10.101.25.13.52036 > 172.17.19.10.6007: [udp sum ok] UDP, length 348
12:55:10.905133 IP (tos 0x0, ttl 250, id 7124, offset 0, flags [none], proto UDP (17), length 220)
10.101.25.7.51386 > 172.17.19.10.6007: [udp sum ok] UDP, length 192
12:55:10.999471 IP (tos 0x0, ttl 250, id 6496, offset 0, flags [none], proto UDP (17), length 532)
10.101.25.6.53578 > 172.17.19.10.6007: [udp sum ok] UDP, length 504
12:55:11.863843 IP (tos 0x0, ttl 249, id 7089, offset 0, flags [none], proto UDP (17), length 376)
10.101.25.13.52036 > 172.17.19.10.6007: [udp sum ok] UDP, length 348
12:55:12.118028 IP (tos 0x0, ttl 249, id 7119, offset 0, flags [none], proto UDP (17), length 764)
10.101.25.12.51550 > 172.17.19.10.6007: [udp sum ok] UDP, length 736
12:55:13.911935 IP (tos 0x0, ttl 250, id 7125, offset 0, flags [none], proto UDP (17), length 376)
10.101.25.7.51386 > 172.17.19.10.6007: [udp sum ok] UDP, length 348
12:55:14.008118 IP (tos 0x0, ttl 250, id 6497, offset 0, flags [none], proto UDP (17), length 532)
10.101.25.6.53578 > 172.17.19.10.6007: [udp sum ok] UDP, length 504

Checking Grafana switches appear in "Base Analytics - Netflow" as Active Exporters, but they don't appear in "Assurance - Netflow" (attached screenshots).

About version, switches have Protocol pack version 56.0.0.

Any idea?

Thanks.