Hi
I am using Cisco 3850 (with WLC and ios SE) and inspecting one routed inteface using FNF and exporting it to a NFA server but NFA server is unable to display output data and inteface index (Ifname , speed) where as SNMP is enabled in the the device and NFA server collecting device name and ip address and input data of the inspected interface.
Note: I have observed in L3 switch and NFA server using wireshark , l3 switch sending both direction data of flow .
I am attaching FNF configuration along with screenshot of NFA screen shot.
Please share your thoughts
FNF CONFIGURATION
flow record NETFLOW_RECORDER
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
flow exporter SERVER_2.197
destination 192.168.2.197
source GigabitEthernet1/0/24
transport udp 9996
template data timeout 60
flow monitor NETFLOW_MONITOR
exporter SERVER_2.197
cache timeout inactive 60
cache timeout active 60
record NETFLOW_RECORDER
interface GigabitEthernet1/0/24
description "Connected to Cyberoam"
no switchport
ip flow monitor NETFLOW_MONITOR input
ip flow monitor NETFLOW_MONITOR output
ip address 192.168.1.1 255.255.255.0
Regards
Soumaya k Nayek