NFA 9.1.3 Setup Flow Cloner

[Christopher Walsh]

Flow Cloner now needs to be installed separately on your NFA Harvester.

The installation file is in "<install_path>\setup\FlowClonerSetup.exe" which will add a new CA NFA Flow Cloner service

You will also need to setup the <install_path>\Netflow\FlowCloner\flowclonedef.ini file before the service will work.

This file is setup like the old flowclonedef.ini file from RA 9.0.

Once the file is setup properly you will need to start the new "CA NFA Flow Cloner" service.

The full instructions for setting up the new Flow Cloner service is located in the NFA 9.1.3 Admin guide on pages 52-57

The NFA 9.1.3 Admin Guide can be found at the link below:
https://support.ca.com/cadocs/1/CA%20Network%20Flow%20Analysis%209%201%203-ENU/Bookshelf_Files/PDF/NFA_Administrator_Guide_en_US.pdf

[Justin_Kulikowski]

Thanks Chris.

Does the Flow Cloner exist for the Linux Harvester as well?

[Christopher Walsh]

No, it is only available on the Windows Harvesters right now.

You can submit an Idea on the Idea wall to add support for this as I am not sure its in the immediate roadmap.

https://caideation.secure.force.com/ideation/ideaList?c=09a30000000I83eAAC&category=+ReporterAnalyzer&sort=popular

[Justin_Kulikowski]

Thanks Chris.

Idea Submission has been created:

https://caideation.secure.force.com/ideation/ideaView?id=087a0000000ilKuAAI

I've also added it as a Comment to this existing Idea Submission:

https://caideation.secure.force.com/ideation/ideaView?id=087a0000000ig7R

Thanks.

[Christopher Walsh]

Thanks, I up voted it.

[Christopher Walsh]

Note that after installing the Flow Cloner service it will not start until you modify the '\CA\NFA\Netflow\FlowCloner\flowclonedef.ini'

You must at minimum specify the port and the destination IP address.

Each argument you pass must be on its own line.

If you are using port 9995 to forward to you can use the first link which says "/use defaults"

Semi colon's are use to comment out lines.

Below is a working example of forwarding flows to port 9995 to a host with IP 10.0.2.151

/use defaults ; use first available NIC and port 9995 to listen and send flows on the first available NIC
/dest ip=10.0.2.151 ; send cloned packets to 10.0.2.151

Once you save the file you should now be able to start the "CA NFA Flow Cloner" service.