Where is the data flow in SDW

interfacedy · ‎07-03-2022

Hi Please see the first below picture. I am trying to see DPI Aplication traffic flow after sending a big ping packet from device behind the vEdge, but it shows "No data to desplay". Did I miss some step? The second picture show some flow that I want to see. Anyone can share some experience? Thank you

svemulap@cisco.com · ‎07-03-2022

Hi Interfacedy -

What is the configuration on the vEdge device ?
You can configure "app=visibility" and "flow-visibility" under the policy section, locally on the device.
You can verify this locally on the device via 'show app {cflowd | dpi}' commands too.

Btw - it does take time show up the data in the vManage dashboard. It depends up on the collection interval.
Too aggressive collection interval for production networks, is not recommended on the vManage.

Also, PING will time out, so the flow won't be there for long. You may want to simulate some other traffic like,
Windows machine, RDP, or anything like that.

Hope it helps.

interfacedy · ‎07-03-2022

Thanks for your reply. The extend PING was used. and it takes some time to show data flow, but I can see data flow in "Interface", Please see the below. cannot see data flow in "DPI Application"

Below is vEdge-1 config:

vEdge-1# show running-config
system
host-name vEdge-1
system-ip 10.0.1.1
site-id 101
admin-tech-on-failure
no route-consistency-check
no vrrp-advt-with-phymac
sp-organization-name xxcvx
organization-name scwl
vbond 10.0.100.62
aaa
auth-order local radius tacacs
usergroup basic
task system read write
task interface read write
!
usergroup netadmin
!
usergroup operator
task system read
task interface read
task policy read
task routing read
task security read
!
user admin
password $6$siwKBQ==$wT2lUa9BSreDPI6gB8sl4E6PAJoVXgMbgv/whJ8F1C6sWdRazdxorYYTLrL6syiG6qnLABTnrE96HJiKF6QRq1
!
ciscotacro-user true
ciscotacrw-user true
!
logging
disk
enable
!
!
ntp
parent
no enable
stratum 5
exit
!
!
omp
no shutdown
graceful-restart
advertise connected
advertise static
!
banner
motd "Welcome to vEdge router"
!
vpn 0
interface ge0/0
ip address 10.0.20.1/24
tunnel-interface
encapsulation ipsec
color biz-internet
allow-service all
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
no allow-service ntp
no allow-service ospf
no allow-service stun
allow-service https
!
no shutdown
!
interface ge0/1
ip address 10.0.30.1/24
tunnel-interface
encapsulation ipsec
color public-internet
allow-service all
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
no allow-service ntp
no allow-service ospf
no allow-service stun
allow-service https
!
no shutdown
!
ip route 0.0.0.0/0 10.0.20.100
ip route 0.0.0.0/0 10.0.30.100
!
vpn 10
router
ospf
router-id 101.1.1.1
timers spf 200 1000 10000
redistribute omp
area 0
interface ge0/2
exit
exit
!
!
interface ge0/2
ip address 10.1.0.254/24
no shutdown
!
ip route 0.0.0.0/0 10.0.20.100
omp
advertise connected
!
!
vpn 512
interface eth0
shutdown
!