Troubleshooting
Problem
VN-Tags are an additional extension to VLAN tagging to identify virtual interfaces. While existing VLAN tags are supported by QFlow collectors when monitoring packet traffic, VN-Tags are currently not supported. QRadar QFlow collectors ignore and drop packets marked as VN-Tags.
Symptom
Packet data sent to span ports or taps that are being monitored by IBM QFlow collectors are not recognized and the packet data is simply dropped by QRadar.
Note: The packet data is still likely to show up properly in tcpdump.
Cause
The QRadar Qflow collectors are designed to process normal or VLAN tagged packet data. The VN-Tag adds additional information that is not expected, and thus, the packet data is not recognized or parsed by the QFlow collectors. This effectively causes the packet data to be dropped.
Resolving The Problem
The VN-Tag extension must be disabled on traffic sent to span ports or taps that are being monitored by IBM QFlow collectors.
Where do you find more information?
Related Information
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21666276