Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Fortigate F200D and F300D class firewalls no longer displaying Netflow data in NTA after 4.2.0 upgrade

Fortigate F200D and F300D class firewalls no longer displaying Netflow data in NTA after 4.2.0 upgrade

Created by Daniel Polaske, last modified by Brian O'Donovan on Apr 10, 2017

Views: 13 Votes: 0 Revisions: 9

Updated: July  4, 2016

Overview

After upgrading from a previous version of NTA to NTA 4.2.0, you will find that any Fortigate F200D or F300D devices no longer show Netflow Last Received at a current date/time.

Investigating the NTA.BusinessLayer.log file reveals the a large number of instances of the following error:

 

ERROR Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow - error processing packet  System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.

Parameter name:  destoffset

at Solarwinds.Netflow.Processing.Core.PacketParsers.FlowBuffer.CopyTo(Byte[] dest, Int32 SrcOffset, Int32 length, Int32 destoffset, Int32 variableLenghtsFields)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9Template.GetField(FlowBuffer buffer, Int32 fieldId)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9FlowPDU.get_NbarApplicationId()

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets. V9FlowPDU.get_ ApplicationOption()

at Solarwinds.Netflow.Processing.Fastbit.ApplicationResolverFb.ResolveAdvancedApplication(IFlowPDUForAdvancedAppResolve flow)

at Solarwinds.Netflow.Processing.PacketProcessor.ProcessFlowPDU(IFlow packet, Inode node, IFlowPDU PDU, IPAddress nodeIPAddress, DateTime currentTime, List`1 interfaceIds, List`1 rows, Int32& unmonitoredPortCount, Int32& unmonitoredPortDroppedCount, Int32& monitoredPortCount, Boolean& hasAARData)

at SolarWinds.Netflow.Processing.Core.PacketProcessing.PacketProcessor.GetDetailRowsFromPacket(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.NetflowPacketProcessor.ProcessPacket_Internal(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow.ProcessPacket(Object state)

 

Environment

  • All NTA 4.2.0 environments

 

Cause 

This is a known, documented bug to be fixed in a future release.

 

Resolution

  1. This is fixed in NTA 4.2.1 (Upgrade to NTA 4.2.1)

 

 

 

 

Last modified
04:22, 10 Apr 2017

Tags

Classifications

Public