NFA: Versa showing less than expected.

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

Versa SD-WAN devices summarize netflow differently than most devices which results in Network Flow Analysis displaying much less data than you would expect. 

Environment

NFA 21.2.10+

Cause

Versa duplicates the conversations while it's processing the data netflow and before it exports it. Most other devices don't do deduplication and the NFA Harvester code does it for us. When NFA tries to de-duplicate already de-duplicated data, it results in data loss.

Resolution

1. Firstly make sure you upgrade to NFA 21.2.10 or higher.

2. Keep track of which Versa devices are pointing to the respective harvester and gather a list.

3. Add the IP Addresses of each Versa device to the D:\CA\NFA\Netflow\bin\includeDevices.ini config file. The devices should be comma separated like this:

"deduplicationDevices=1.1.1.1,2.2.2.2,3.3.3.3,4.4.4.4,...."

4. Restart CA MySQL on the Harvester after saving the configuration file.