EWC Integration into Analytics PurView dont work .. need Assistance

  • 0
  • 1
  • Problem
  • Updated 11 months ago
  • Solved
I try to test the new 8.X Netsight / Analytics System I have have this configuration:

EWC 09.21.11 
Netsight 08.15
Purview 08.15   
NMS Advanced Lizenz ( Test ) 

I have configured on my EWC the Netflow / Mirror N, with the eth0 Target IP from Purview and
the esa 1 from EWC as Mirror Port.

On the Purview Side i have configured the EWC as source of Flow with his MGMT IP.

With a tcdump -i eth1 on the Purview,  i can see that all traffic from EWC is mirrored to the analytics appliance.

But this traffic will not processed, under the tab "Appliaction Flows" there is noting to see into the analytics section of netsight. 

My Questions: 

can the purview appliance work with the mirror N Raw Data from EWC or does it only work with netflow exports from EWC ? 

What could i check or where to look for my error, if the purview appliance "should" also process the raw data from mirror port of the ewc. 


Regards 
Christian



With a : 
Photo of info@systemhaus-genthin.de

Posted 11 months ago

  • 0
  • 1
Photo of Steve Ballantyne

Steve Ballantyne

  • 5,806 Points 5k badge 2x thumb
I ran into this same issue and called into support. They had me move from a physical port to a Netflow configuration on my wireless controller. That was fine for me - because I recently added a second redundant controller to my environment and the physical port was no longer an option.

I am not sure if the physical port mirror still works? But I can tell you that the Netflow configuration works just fine and the bandwidth is very minimal.
many thx ... can you remember what support did during "move" 
there is only one point in EWC to configure Netflow / N Mirror .. 
I think the EWC should do both things .. sending netflow to the primary address of analytics and mirror the traffice to esa 1

I can not find a point to configure only using netflow... 
Photo of Steve Ballantyne

Steve Ballantyne

  • 5,806 Points 5k badge 2x thumb
Sorry - I have forgotten to reply back to you on this. Support had me change my L2 mirror port to "None" and then configure the destination IP of my Purview appliance.

It looks like this ...