Fortigate F200D and F300D class firewalls no longer displaying Netflow data in NTA after 4.2.0 upgrade

Overview

After upgrading from a previous version of NTA to NTA 4.2.0, you will find that any Fortigate F200D or F300D devices no longer show Netflow Last Received at a current date/time.

Investigating the NTA.BusinessLayer.log file reveals the a large number of instances of the following error:

ERROR Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow - error processing packet  System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.

Parameter name:  destoffset

at Solarwinds.Netflow.Processing.Core.PacketParsers.FlowBuffer.CopyTo(Byte[] dest, Int32 SrcOffset, Int32 length, Int32 destoffset, Int32 variableLenghtsFields)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9Template.GetField(FlowBuffer buffer, Int32 fieldId)

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets.V9FlowPDU.get_NbarApplicationId()

at Solarwinds.Netflow.Processing.Core.PacketParsers.Packets. V9FlowPDU.get_ ApplicationOption()

at Solarwinds.Netflow.Processing.Fastbit.ApplicationResolverFb.ResolveAdvancedApplication(IFlowPDUForAdvancedAppResolve flow)

at Solarwinds.Netflow.Processing.PacketProcessor.ProcessFlowPDU(IFlow packet, Inode node, IFlowPDU PDU, IPAddress nodeIPAddress, DateTime currentTime, List`1 interfaceIds, List`1 rows, Int32& unmonitoredPortCount, Int32& unmonitoredPortDroppedCount, Int32& monitoredPortCount, Boolean& hasAARData)

at SolarWinds.Netflow.Processing.Core.PacketProcessing.PacketProcessor.GetDetailRowsFromPacket(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.NetflowPacketProcessor.ProcessPacket_Internal(IFlowPacket packet, INode node)

at Solarwinds.Netflow.Processing.Workflow.PacketProcessingWorkflow.ProcessPacket(Object state)

Environment

• All NTA 4.2.0 environments

Cause 

This is a known, documented bug to be fixed in a future release.

Resolution

1. This is fixed in NTA 4.2.1 (Upgrade to NTA 4.2.1)