No network is captured on NTA

[agadayan]

Hello, First I'm so so sorry for my English. I've installed iMC NTA 7.3 (E0506) on the iMC PLAT 7.3 (E0703), but I have not data on the network traffic. No data is captured. Ihave the message : "if no network traffic is captured, see the online help for the troubleshooting procedures." But I Don't where is it. On the server, on the DMA, at the tab "Deploy" the components "Network Behavior Analyzer Server" and "Network Traffic Analyzer" are Undeployed, but I Don't know why, and also I Don't know how to deploy them. Can you help please ! thank you very much in advance !!!

[jguse]

Hello,

The NTA and NBA Server components should both be deployed once at least - and they can also be deployed to subordinate NTA servers that can offload some of the work capturing flows and analyzing the data. That is why there is a second copy of these components in the "Undeployed" state. You could install DMA on a subordinate server and then "Deploy" these components to that system as well. Please ignore these entries when you do not need them.

The respective non-server components (Network Traffic Analyzer and Network Behavior Analyzer) can only be deployed on the master server, and are responsible for storing your NTA/NBA configurations and related information.

In summary, you should have 4 deployed components for NTA/NBA:

• 1x Network Traffic Analyzer, 1x Network Traffic Analyzer Server
• 1x Network Behavior Analyzer, 1x Network Behavior Analyzer Server

IMC installation always has two steps to get a component running - "Install" and "Deploy". Make sure you have one of each of these components in the "Deployed" state in DMA. "Installed" but "Not Deployed" means that the files needed to "Deploy" the component were installed on the master server, but they will not run anything until they have been "Deployed" somewhere.

Components/Modules can be deployed by right-clicking on them in Deploy tab of DMA, and selecting "Deploy" or "Batch Deploy" (for multiple at once)

Please see here for overall NTA documentation. Filter for Configuration Examples and you will find a lot of guides on how to configure NTA and sFlow/NetStream/NetFlow accordingly for NTA.

See for example: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05240898&withFrame

[agadayan]

Thank you very much for your answer.Yes the 4 components are well deployed. The "Network Traffic Analyzer Server" and "Network Behavior Analyzer Server" components were installed 2 times, but only once deployed.

All in the hair well installed but the flows remain at 0 of data.

Could you tell me how did the troubleshooting procedure?

Thank you so much.

[jguse]

Hello,

Can you please describe the devices and configuration in more detail? What flow protocol are you setting up, and what configuration was done to set it up on the device?

Troubleshooting starts by doing a Wireshark packet capture on the server where NTA is deployed, and verifying that the traffic flow packets arrive on the NTA server in the first place. If it's clear that they arrive, the next step is to check the NTA configurations and make sure it was configured in an appropriate way for the protocol you are using.

[agadayan]

I configured 2 traffic analysis tasks.

One on a Procurve switch  with the configuration :
SW-01(config)#sflow 1 destination <ip_server>

Another task on a Comware switch with configuration:
[SW-04] sflow agent ip <ip_sw>
[SW-04] sflow collector 1 ip <ip_server> port <num_port_server> description IMC
[SW-04-GigabitEthernet1 / 0/2] sflow flow collector 1
[SW-04-GigabitEthernet1 / 0/2] sflow sampling-rate 1000
[SW-04-GigabitEthernet1 / 0/2] sflow counter collector 1
[SW-04-GigabitEthernet1 / 0/2] sflow counter interval 120

I launched a Wireshark scan with ip filter destination 2 ip of 2 switches, but only snmp and icmp streams are captured. Not more.

When I look at the configuration on the web interface of the iMC, in the 2 tasks in "Service> Settings> Task Management> Modify Traffic Analysis Task" I do not have the topics "Baseline Threshold Setting" and "Threshold Alarm Setting" "; I only have the sections "Basic Information" and "Interface Information".

Is there a place to specify to have these 2 headings? The problem would come from that?

Thank you so much.

[jguse]

Hello,

Please make sure you apply the proper filtering on Wireshark. It would be best to filter for the port you are using for sFlow, so the filter for sflow on default port would be: udp.port eq 6343

This should show you some sFlow packets arriving. If they are not decoded properly by Wireshark, make sure to right-click one of the packets and select "Decode As", then change the "Current" field to SFLOW and save.

I don't think the Baseline/Threshold settings are causing issues here. These settings and more can be enabled/disabled via NTA Settings > Parameters.

Note that when adding the device to NTA, you do NOT need to specify "sFlow Settings" to Enabled for the device - this is optional to have IMC configure sFlow on various ProCurve/ArubaOS models. It will still recognize sFlow from the device when this setting is Disabled.

Also make sure that your NTA Server configuration has the sFlow port configured and the device selected further down on the page.

(See also https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05240898&withFrame on page 5 & 6)

[agadayan]

I have no stream on port 6343; nor on the other 2 ports (9020 et 9021) configured in the server configuration part at the basic information level.
I reconfigured following the steps you gave me from the support document pages 5 and 6, but I still have no data in the reports.
There would not be another subtly elsewhere, directly on the server where iMC is installed, or from the DMA console?
Sorry for the inconvenience, and again a thousand times thanks for the help you brought!

[jguse]

Hello,

If you don't see any traffic arriving on 6343 or otherwise from the devices, please check if Windows Firewall/other Firewall on the IMC Server or in between IMC and Device permits the port.

You should also verify the device is configured properly with show/display sflow commands.

Here is an example from ProCurve output along with my comments behind //

show sflow agent

SFlow Agent Information

Version : 1.3;HP;A.15.16.0021
Agent Address : 192.168.0.15 // this is the IP configured for the sFlow agent, it should match the management IP for IMC
Source IP Selection : Outgoing Interface // source-IP selected here based on routing table, could be set manually, it should end up using the interface of the Agent Address above to reach IMC

show sflow 1 destination

 SFlow Destination Information

  Destination Instance      : 1
  sflow                     : Disabled // sFlow is disabled on my switch, it should show 'Enabled' for you
  Datagrams Sent            : 0  // Some datagrams should be sent if it is working on the device
  Destination Address       : 0.0.0.0 // This should match the IP address of the IMC server
  Receiver Port             : 6343 // This should be 6343, or IMC NTA Server settings need to be reconfigured
  Owner                     :
  Timeout (seconds)         : 0
  Max Datagram Size         : 1400
  Datagram Version Support  : 5

If it still doesn't work, can you share this output from your ProCurve/ArubaOS switch?

[agadayan]

Hello,

Below the configurations on the 2 switches:

• Procurve switch :

SW-01# sh sflow agent

SFlow Agent Information

Version : 1.3;Aruba;WC.16.06.0006
Agent Address : 192.168.X.X // IP of the switch on which I want to perform the analysis with the sFlow
Source IP Selection : Outgoing Interface

SW-FESTIV-01# sh sflow 1 destination

SFlow Destination Information

Destination Instance : 1
sflow : Enabled
Datagrams Sent : 0
Destination Address : 10.X.X.X
Receiver Port : 6343
Owner : Administrator, CLI-Owned, Instance 1
Timeout (seconds) : 2147403717
Max Datagram Size : 1400
Datagram Version Support : 5
OOBM Support : Disabled

• Comware switch :

[SW-HDV-04]dis sflow
sFlow datagram version: 5
Global information:
Agent IP: 10.80.Y.Y(CLI) // IP of the switch on which I want to perform the analysis with the sFlow
Source address: 10.80.Y.Y // IP of the switch on which I want to perform the analysis with the sFlow
Collector information:
ID IP Port Aging Size VPN-instance Description
1 10.X.X.X 9020 N/A 1400 imc
Port information:
Interface CID Interval(s) FID MaxHLen Rate Mode Status
GE1/0/2 1 120 1 128 20000 Random Active

I have a question, when I configure the traffic analysis on the web page of the iMC server, as stated on the support pages 5 and 6, why when you configure the device (in "Service> Settings> Device Management> Add Device") the field "sFlow Setting" is disabled?

Moreover, in "FTP Username" and "FTP Password", are the loggins used to connect to the switch, or those to connect to iMC?

Thanks you

[jguse]

Hello,

NTA "Add Device" with the sFlow Setting Disabled generally means that you do not need NTA to configure sFlow for you on the devices. Enabled implies that when you deploy the server (on the Server Settings, checking the box for the device and clicking Deploy) with the device, it will attempt to use SNMP SET to configure an sFlow instance on the device. This only works on some device models that support it and is normally not required to get sFlow working.

Please ignore FTP Username and Password. This is not necessary here, and would require that you install and configure a third-party FTP Server (such as FileZilla) on the IMC server, then configure a folder and username + password, that you will enter here. FTP is only needed when you are using the NTA Probes, which are essentially a software that can be used to capture mirrored traffic on a network where it is not possible to use sFlow or NetFlow/NetStream. Otherwise it can be left blank.

Your sFlow configuration looks fine based on your output. Although you are using the NetStream port 9020 instead of 6343 for sFlow on Comware and that is unusual. As for the ProCurve, could it be that sFlow is not enabled with the correct IP to reach IMC? Datagrams sent = 0

Here are sample CLI Scripts for sFlow configuration on ProCurve and Comware 5 switches that could be used in IMC (Configuration Center > Configuration Templates > Add CLI Script). Variables added where appropriate. If running the commands manually, please manually replace all variables like ${agent-ip} below.

Comware 5:

sflow agent ip ${agent-ip}

sflow collector ${collector-id (1-3)} ip ${nta-ip} description imcserver

interface ${interface (like G1/0/3 or Ten2/0/4)}

sflow flow collector ${collector-id (1-3)}

sflow sampling-rate ${sampling-rate (1000-5000)}

sflow counter collector ${collector-id (1-3)}

sflow counter interval ${counter-interval (in seconds, 2-86400)}

quit

ProCurve/ArubaOS:

configure

sflow ${collector-id (1-3)} destination ${nta-ip} 6343

sflow ${collector-id (1-3)} sampling ${sample-interfaces (enter the port range or 'all')} ${sampling-rate (50-16441700)}

sflow ${collector-id (1-3)} polling ${polling-interfaces (enter the port range or 'all')} ${polling-interval (in seconds, 20-2147483647)}

You could try deploying these on your switches as needed and see if that helps. The Comware template only includes a single interface but could be edited and expanded with more interfaces or interface-range as needed.