No data found - Cisco 2811 router
No data found - Cisco 2811 router
We have an older Cisco 2811 router that I am trying to gather information on. The router has a public IP address and the NNA server has a private IP address.
I set up NetFlow on the router and see that it is collecting data. I created a source through my NNA web interface assigning it a port number. I opened that port on the CentOS 7 server running NagiosNA. I then added the router/port to the NNA rule on my main firewall.
I am not seeing any data results showing in the NNA web interface or in the nfcapd files on the CentOS 7 server. I don’t see that any traffic from the router hitting the firewall. Folder and file permissions have been verified.
Any thoughts on what I might have missed?
Thanks -
Steve
I set up NetFlow on the router and see that it is collecting data. I created a source through my NNA web interface assigning it a port number. I opened that port on the CentOS 7 server running NagiosNA. I then added the router/port to the NNA rule on my main firewall.
I am not seeing any data results showing in the NNA web interface or in the nfcapd files on the CentOS 7 server. I don’t see that any traffic from the router hitting the firewall. Folder and file permissions have been verified.
Any thoughts on what I might have missed?
Thanks -
Steve
Re: No data found - Cisco 2811 router
Can the router ping the NNA server and vice versa?
If they are in different networks and the routing is not setup correctly, that could be the issue.
One thing you can try is to run a tcpdump on the NNA server and see if the router's flow data is getting there.
Run this on the NNA server, replace the <interface> option with the ethernet interface name and the xxxx with the port you are sending the flow data on.
Also, make sure the time on the NNA server and the router are in sync, if they are out of sync, the NNA server may not collect the flow data.
If they are in different networks and the routing is not setup correctly, that could be the issue.
One thing you can try is to run a tcpdump on the NNA server and see if the router's flow data is getting there.
Run this on the NNA server, replace the <interface> option with the ethernet interface name and the xxxx with the port you are sending the flow data on.
Code: Select all
tcpdump -i <interface> -s 65535 port xxxx
Be sure to check out our Knowledgebase for helpful articles and solutions!
Re: No data found - Cisco 2811 router
Thanks for the reply -tgriep wrote:Can the router ping the NNA server and vice versa?
If they are in different networks and the routing is not setup correctly, that could be the issue.
One thing you can try is to run a tcpdump on the NNA server and see if the router's flow data is getting there.
Run this on the NNA server, replace the <interface> option with the ethernet interface name and the xxxx with the port you are sending the flow data on.Also, make sure the time on the NNA server and the router are in sync, if they are out of sync, the NNA server may not collect the flow data.Code: Select all
tcpdump -i <interface> -s 65535 port xxxx
The NNA server can ping the router with no problem. The router though can't ping the server. I'll look into that first.
I notice that the time on the router and server are about 10 milliseconds different. Is that enough of a discrepancy to worry about?
Thanks -
Steve
Re: No data found - Cisco 2811 router
10 miliseconds wouldn't stop the capture. I am talking more like 5 to 10 minutes.
Try stopping the firewall completely on the NNA server and see if it starts to receive the flow data.
Try stopping the firewall completely on the NNA server and see if it starts to receive the flow data.
Be sure to check out our Knowledgebase for helpful articles and solutions!
Re: No data found - Cisco 2811 router
Still not seeing data. I'm thinking the problem is between my router and my firewall which sits in front of the NNA server.tgriep wrote:10 miliseconds wouldn't stop the capture. I am talking more like 5 to 10 minutes.
Try stopping the firewall completely on the NNA server and see if it starts to receive the flow data.
Re: No data found - Cisco 2811 router
That would be my guess as well.
Verify that the setting in the router are correct for the NNA server's IP address and the port.
Post the config so we can view the settings as well as the output from this command run on the NNA server.
Verify that the setting in the router are correct for the NNA server's IP address and the port.
Post the config so we can view the settings as well as the output from this command run on the NNA server.
Code: Select all
ps -ef --cols=300
Be sure to check out our Knowledgebase for helpful articles and solutions!
Re: No data found - Cisco 2811 router
Here's what I used to configure the router:tgriep wrote:That would be my guess as well.
Verify that the setting in the router are correct for the NNA server's IP address and the port.
Post the config so we can view the settings as well as the output from this command run on the NNA server.Code: Select all
ps -ef --cols=300
configure terminal
interface FastEthernet0/0
ip route-cache flow
exit
ip flow-export destination 192.168.13.80 9947
version 5
exit
clear ip flow stats
Tee output from
#show ip flow export
Flow export v5 is enabled for main cache
Exporting flows to 192.168.13.80 (9947)
Exporting using source IP address 199.127.134.70
Version 5 flow records
23785 flows exported in 793 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
#show ip flow interface
FastEthernet0/0
ip route-cache flow
The firewall that lives between the router and the internal NNA server is configured to let the IP address for FastEthernet0/0 (97.107.76.253) through to 192.168.13.80 udp/9947
The ps -ef output for NNA related processes running on .80 are:
(this flow is working fine)
nna 24997 1 0 13:49 ? 00:00:00 /usr/local/bin/nfcapd -I 3 -l /usr/local/nagiosna/var/grcompare/flows -p 9946 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/grcompare/9946.pid -D -e -w -z
nna 24998 24997 0 13:49 ? 00:00:00 /usr/local/bin/nfcapd -I 3 -l /usr/local/nagiosna/var/grcompare/flows -p 9946 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/grcompare/9946.pid -D -e -w -z
(this is the router flow)
nna 25005 1 0 13:49 ? 00:00:00 /usr/local/bin/nfcapd -I 4 -l /usr/local/nagiosna/var/Cisco2811Router/flows -p 9947 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/Cisco2811Router/9947.pid -D -e -w -z
nna 25006 25005 0 13:49 ? 00:00:00 /usr/local/bin/nfcapd -I 4 -l /usr/local/nagiosna/var/Cisco2811Router/flows -p 9947 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/Cisco2811Router/9947.pid -D -e -w -z
Thanks -
Steve
- tacolover101
- Posts: 432
- Joined: Mon Apr 10, 2017 11:55 am
Re: No data found - Cisco 2811 router
using a tcpdump, are you able to see the data either sending or receiving at the firewall or NNA level?
Re: No data found - Cisco 2811 router
No. I've discovered a problem with the configuration of the router that I'm addressing now to see if that helps.tacolover101 wrote:using a tcpdump, are you able to see the data either sending or receiving at the firewall or NNA level?
Thanks -
Steve
Re: No data found - Cisco 2811 router
Thanks for the update. Keep us posted and let us know if there's anything on our end we can help with.
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.