Search 85,815 posts and 653 resources contributed by 43,487 members or post a topic.

Already Joined? Sign in
Orion NPM and Netflow on Cisco 2811

Page 1 of 1 (3 items) | RSS

rated by 0 users
Not Answered This post has 0 verified answers | 2 Replies | 0 Followers | 530 Views


8 Posts
Points 20
dsmith posted on Wed, Jun 17 2009 2:22 PM
rated by 0 users

We have quite a few Cisco 2811 routers. We enabled netflow on one of the routers using the loopback as the source and only enabling the flow on fa0/0. However, Orion is receiving flow from multiple interfaces on the router. Has anyone had this occur? I thought it would only pass information on the interface on which it was enabled.

Here are the commands:

ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination <"Orion NPM server IP"> 2055

int fa0/0
ip route-cache flow

 Thanks for any input you can provide.

  • | Post Points: 3

All Replies


321 Posts
Points 3,574
Thwack MVP
r0berth1 replied on Fri, Jun 19 2009 8:51 AM
rated by 0 users

it does the same thing on my 6509s, 2811s, and 1841s. I have a post asking about this and the answer from SW was to just not add the ports that i didnt want to NPM and it will not monitor them. They you just have to filter out the event messages saying that there is an unmonitored NTA port that is not added to NPM. :-)

Hancock Bank

Network Engineer

  • | Post Points: 3

278 Posts
Points 2,466
SolarWinds Certified Professional
Thwack MVP
kweise replied on Fri, Jun 19 2009 8:59 AM
rated by 0 users

I see the same thing in our implementation.  I think its the lesser of two evils.  When we first implemented the NTA module, once you configured Netflow on your device, you had to go into the Orion admin site and actively select the interfaces on the nodes you had configured for Netflow.  It does that automagically for you now, but you also get emails about interfaces not monitored.  It's really only a pain after the Netflow service restarts and we get an event or two from all of the Netflow enabled devices we have (we've got a couple hundred we're receiving Netflow from.)  At that point, I just go into system manager, select Events | Event Monitor and delete all of the Netflow missing whatever events.  Or, if I'm feeling lazy I just ignore the events. :)

  • | Post Points: 1
Page 1 of 1 (3 items) | RSS

© 2003 - 2010 SolarWinds, Inc. All Rights Reserved.

Who is SolarWinds?

SolarWinds is rewriting the rules for how companies manage their networks. Guided by a global community of network engineers, SolarWinds develops simple and powerful network management software and network monitoring software for networks of all sizes. SolarWinds also offers a network certification program to become a SolarWinds Certified Professional (SCP).

What is thwack?

thwack, SolarWinds online community site, was designed by network engineers, for network engineers. thwack is a vibrant, growing community of more than 30,000 IT pros who share a passion for technology.

Explore Resources, Answers, Templates, and Advice

Download Free Networking Tools

Learn More About SolarWinds Products