Submit a ticketCall us

Announcing NPM 12.2
With NPM 12.2 you can monitor your Cisco ASA firewalls, to monitor VPN tunnels for basic visibility and troubleshooting tunnels. NPM 12.2 also uses the SolarWinds Orion Installer so you can easily install and upgrade one or more Orion Platform products simultaneously.
See new features and improvements.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Fortigate F200D and F300D class firewalls no longer displaying Netflow data in NTA after 4.2.0 upgrade

Fortigate F200D and F300D class firewalls no longer displaying Netflow data in NTA after 4.2.0 upgrade

Created by Daniel Polaske, last modified by Brian O'Donovan on Apr 10, 2017

Views: 22 Votes: 0 Revisions: 9

Updated: July  4, 2016

Overview

After upgrading from a previous version of NTA to NTA 4.2.0, you will find that any Fortigate F200D or F300D devices no longer show Netflow Last Received at a current date/time.

Investigating the NTA.BusinessLayer.log file reveals the a large number of instances of the following error:

 

ERROR Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow - error processing packet  System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.

Parameter name:  destoffset

at Solarwinds.Netflow.Processing.Core.PacketParsers.FlowBuffer.CopyTo(Byte[] dest, Int32 SrcOffset, Int32 length, Int32 destoffset, Int32 variableLenghtsFields)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9Template.GetField(FlowBuffer buffer, Int32 fieldId)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9FlowPDU.get_NbarApplicationId()

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets. V9FlowPDU.get_ ApplicationOption()

at Solarwinds.Netflow.Processing.Fastbit.ApplicationResolverFb.ResolveAdvancedApplication(IFlowPDUForAdvancedAppResolve flow)

at Solarwinds.Netflow.Processing.PacketProcessor.ProcessFlowPDU(IFlow packet, Inode node, IFlowPDU PDU, IPAddress nodeIPAddress, DateTime currentTime, List`1 interfaceIds, List`1 rows, Int32& unmonitoredPortCount, Int32& unmonitoredPortDroppedCount, Int32& monitoredPortCount, Boolean& hasAARData)

at SolarWinds.Netflow.Processing.Core.PacketProcessing.PacketProcessor.GetDetailRowsFromPacket(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.NetflowPacketProcessor.ProcessPacket_Internal(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow.ProcessPacket(Object state)

 

Environment

  • All NTA 4.2.0 environments

 

Cause 

This is a known, documented bug to be fixed in a future release.

 

Resolution

  1. This is fixed in NTA 4.2.1 (Upgrade to NTA 4.2.1)

 

 

 

 

Last modified
04:22, 10 Apr 2017

Tags

Classifications

Public