Changing from MirrorN to IPFIX in ExtremeWireless

[James_A]

I have an existing integration of EWC and Purview, however I went to use it today and it seems to have stopped working after I upgraded the analytics appliances to 8.0.2.42 a month ago. Some quick debugging hinted that while Netflix and mirrorN traffic was coming through, the appid process wasn't listening on the correct ports for some reason.

I figured it was then a good time to try and migrate to the new IPFIX-based method that doesn't need an L2 port any more. I followed https://extremeportal.force.com/ExtrArticleDetail?an=000090154 and set the Traffic Mirror L2 Port to None, and set traffic mirror to prohibited in all the VNS/Role configuration, but it's still not working. Anyone know what other configuration I need to set to make it use IPFIX?

[James_A]

Yeah, I did an enforce before, and just ran "Enforce all engines" now. The overview does say "Connectivity Issues: cannot establish client connection" on both engines, I don't really know what that means though.

[Ostrovsky__Yury]

Did you enable app visibility on WLAN? Usually it's all you need , plus the management IP of Purview appliance on global netflow setting, which I believe you already have configured

[James_A]

Yeah, I already have Application Visibility enabled. I did try adding the flow source from EMC, but that still expects a mirror port to be set. Removing the EWCs as flow sources and then re-adding the Purview management IP in the Netflow configuration made them re-appear, but still no data. AFAICT the java process isn't listening on the right ports:
$ lsof -ni|grep java
java 1188 root 182u IPv6 588 0t0 TCP *:45627 (LISTEN)
java 1188 root 256u IPv6 12469 0t0 TCP 10.20.20.74:http-alt (LISTEN)
java 1188 root 257u IPv6 12472 0t0 TCP 10.20.20.74:8443 (LISTEN)I would have expected ports 9191 (for IPFIX) and 2095 (for EWC Netflow) to be open at least. tcpdump shows data coming in from the EWC on UDP port 2095 but a ICMP port unreachable message being sent in reply.