Any specific suggestions on

Jim Mueller · ‎12-29-2016

We use Solarwinds Orion to accept Netflow and NBAR2 from our Cisco devices... we have ~140 of them in our environment. The product is licensed per interface, and we only bought enough licenses to monitor the 'important' interfaces on the devices, not all interfaces.

The Orion event log is being slammed with messages of this syntax:

NetFlow Receiver Service [Servername] is receiving flow data from unmanaged interface '#xxxxxxx' on [node] and it does not support SNMP. Click the "Add this interface" link to manage interface and process its flow data.

Solarwinds support says: "Another thing to check here is the Netflow Configuration of the device. It should not be sending flows from interfaces that you do not want to receive flows from. Controlling how the device will send flows will also help resolve this event. NTA will only show what the devices is sending.”

So, how do I prevent certain interfaces from sending Netflow data?

Thanks!

Jim

Joseph W. Doherty · ‎12-29-2016

I think setting flow cache on an interface triggers egress flow stats for that interface and/or configuring something like ip flow ingress also may trigger flow stats for that interface.

Jim Mueller · ‎01-11-2017

Any specific suggestions on what to change in the config above to prevent these warnings?

Reza Sharifi · ‎12-29-2016

Hi,

Not sure what type of device you are trying to get Netflow from, but you usually add these commands to the interface you want to get the flow from

ip flow monitor Solarwinds input
ip flow monitor Solarwinds output

In this case "Solarwinds" is a user defined flow exporter. You can name it whatever you want.

After configuring it, you can check the status with "sh flow interface"

HTH

Jim Mueller · ‎01-04-2017

I added a redacted config above and some command outputs. Also, it seems as if the only type of device having this issue is an 1811 which is out of support. I can try to update the firmware on a sample router to the latest to see if that takes care of it. Else I know that the offices with older routers are budgeted for a new router this fiscal year, just not sure when that project will begin.

Jim Mueller · ‎01-11-2017

Any specific suggestions on what to change in the config above to prevent these warnings?

Jim Mueller · ‎12-29-2016

Here's a redacted config from a sample router experiencing the issue. This happens to be an 1811 router, but we also have 1711's and 891/891F's which would have the same setup. I've tried to highlight the netflow/nbar commands I found in red.

---begin---

Current configuration : 7575 bytes

!

! No configuration change since last restart

!

version 12.4

no service pad

service tcp-keepalives-in

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime localtime show-timezone

service password-encryption

service compress-config

!

hostname hostname

!

boot-start-marker

boot system flash c181x-advipservicesk9-mz.124-15.T17.bin

boot-end-marker

!

logging buffered 4096

!

no aaa new-model

clock timezone EST -5

clock summer-time EDT recurring

!

dot11 syslog

!

ip cef

!

no ip bootp server

no ip domain lookup

ip domain name domain.com

!

flow exporter NTAexp

destination 192.168.0.26

source Vlan1

transport udp 2055

template data timeout 60

!

flow record NTArec

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

collect interface output

collect counter bytes

collect counter packets

!

flow monitor NTAmon

description NetFlow nbar

record NTArec

exporter NTAexp

cache timeout inactive 10

cache timeout active 5

!

multilink bundle-name authenticated

!

vtp mode transparent

!

crypto isakmp policy 5

encr aes 256

authentication pre-share

group 5

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 5

crypto isakmp key * address 0.0.0.0 0.0.0.0

crypto isakmp keepalive 600

!

crypto ipsec transform-set esp-3des-sha-trans esp-3des esp-sha-hmac

mode transport

no crypto ipsec nat-transparency udp-encaps

!

crypto ipsec profile DMVPN

set transform-set esp-3des-sha-trans

set pfs group5

!

Netflow: Send data only from certain interfaces?