Extreme allows you to configure an sFlow agent IP address. According to the Extreme documentation this address is stored in the payload of the sFlow data. In theory NFA should be able to pull that address from the packets and use it as the source of the sFlow data. However, NFA uses the source address of the sFlow packet it receives as the device it maps the data to. Because of this behavior if the interface the sFlow originates from changes, then NFA treats it a coming from a different device. This caused NFA to duplicate the device and the interfaces which makes it more difficult to properly identify where the flow originated. This also increases the number of managed interfaces and reduces the number of licensed interfaces available.

 

Is there some way to get NFA to us the address that is imbedded in the packet instead of the source address to resolve this problem?

 

Bruce Clough