NBAR2 Support on 4500X Switches

[davemiddlewick]

Can anybody confirm whether NBAR2 is supported on 4500X switches or not?

I am attempting to send NBAR2 info to a Solarwinds server using Flexible Netflow, Solarwinds recommend the following commands are entered into the switch:-

option application-table timeout 60
option application-attributes timeout 300

Whilst the first option is available the second is not in the IOS being used.  Solarwinds is receiving flows but not getting complete NBAR info.

Also I am unable to issue the following commands:- 

show ip nbar version
show ip nbar protocol-id

Can anyone provide any insight?

Thanks

[Mark Malone · Accepted solution]

I use NBAR for flows through netflow

have you got it enabled under your interfaces too ?

interface GigabitEthernet0/0/3
 description 
 bandwidth 150000
 no ip address
 ip nbar protocol-discovery
 ip flow monitor FLOWMONITOR input
 ip flow monitor FLOWMONITOR output

...............

 option interface-table
 option vrf-table
 option sampler-table
 option application-table
 option c3pl-class-table
 option c3pl-policy-table
 option application-attributes

................

if its not working after that post your full netflow config see  what way its setup

[davemiddlewick]

Thanks Mark

Specifically this relates to a 4500X switch.

The nbar command is not available within int configuration mode, I wasn't aware that you needed to add it.  It's looking more and more like it's not supported.

Can anybody give a definitive answer on this?

[Mark Malone · Accepted solution]

hmm ok we had to enable that to get the nbar statistics through our netflow collector liveaction it was a requirement for that application with netflow  , when I check the feature navigator for 4500x  I don't see it there either

do you even have the global command ip nbar , just checked my 4500s there only access switches so we don't have netflow enabled but there is no nbar available on those either and there running new software too

cat4500e-universalk9.SPA.03.06.06.E.152-2.E6.bin"

to confirm the best thing to do is check the software version your running and go to the specific config guide for that version on the Cisco website you will see if there is any nbar available but the fact you cant configure it I would suspect its not available but that will confirm for definite

[davemiddlewick]

Many thanks for your guidance Mark.

Have come to the conclusion that NBAR isn't supported on the 4500X unless anybody tells me otherwise. Suspect it's only on routers.  None of the software releases for this platform that I looked at had the feature available.

[Joseph W. Doherty]

I don't know for sure, but I would be surprised if the 4500X supported much of the deep packet inspection used by NBAR.

The only hardware switch, that I recall that came close to such, was the discontinued sup32 with PISA (and its FPM).