When NFA detects that a router has rebooted, it will be placed into a state of RebootRefresh until it can be SNMP polled.
When its in this state all flows are dropped until a successful polling takes place.
This is done to ensure that after a router reboot, the ifindex values have not shifted, and thus causing data to be mapped to a wrong interface.
Usually the process of polling the device will happen quickly and the device will return to a Mapped poll state, and data will start being collected again, and you will not even notice much of a gap in data.
In some cases when there is an issue with SNMP polling a specific device, the device may stay in RebootRefresh and data will not be collected.
In order to get data flowing again, you will need to troubleshoot why SNMP polling is failing.
You can manually force the SNMP polling by going to the Admin->Enable Interfaces screen and clicking the binoculars icon for each device, then click the circular arrow for a refresh.
If polling fails, some common causes of SNMP polling failure and troubleshooting steps are:
- Not having the correct community string in NFA or assigned to the device in NFA
- Polling is done from the Harvester, not the console, so you must ensure there is nothing blocking snmp traffic between the Harvester and the Device.
- The device must be configured to allow snmp polling from the Harvester IP address.
- Ensure that all CA NFA* services are up and running on the Harvester.
- Check the \NFA\Netflow\logs\poller-wrapper.log file for errors related to that device.
- Use Wireshark on the Harvester and filter to port 161 and the device IP and force the SNMP poll and see what the SNMP response is.