EWC is not sending packets to the mirror L2 port

[Steve_Ballantyn]

I initially had some trouble getting my EWC to talk to my Purview box. That has been resolved, and now my Purview box is receiving flow statistics. However, it's not receiving the actual flow data.

On my controller, I am using esa0 as lag1 which (at present) contains all of my WLAN's. esa1 is defined as a mirror. I have esa1 connected directly to a NIC on my VMWare server, which is then attached via VMWare to my Purview host. Initially I thought this might be related to Purview or the VMWare server.

However - if I ssh' into my controller and run a 'shell', then do a 'tcpdump -i eth1', I am seeing nothing flowing through that NIC.

I have gone over and over my settings on the controller, and just about everywhere I can look I have mirroring "allowed in both directions" and Netflow set to enabled.

Anyone how an idea on where I can look?

Thanks!!

[Bill_Stritzinge]

I just ran across this article too... How many cores does the EWC have configured, if 2 or less it looks like things wont work... https://gtacknowledge.extremenetworks.com/articles/Solution/Netflow-is-not-being-sent-to-the-PurView...

[Steve_Ballantyn]

Yes, my mirror is connected to port "E", esa1 which does show a connection ...

[email protected]:~# ethtool eth1Settings for eth1:
Supported ports: [ TP ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised auto-negotiation: Yes
Speed: 1000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD: 1
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: pumbg
Wake-on: d
Current message level: 0x00000007 (7)
Link detected: yes


I am going to work on getting a TAC case opened.

[Bill_Stritzinge]

I hate to ask, but we have the correct port for esa1, correct?

[Bill_Stritzinge]

Well at least that is good... Now we just have to troubleshoot the C5200 - Have you already started a case on this with TAC?

[Steve_Ballantyn]

Well, I ran a Wireshark capture on that port. Got the same thing ... nothing! 