Quantcast
Channel: THWACK: Message List
Viewing all articles
Browse latest Browse all 21097

Re: Netflow doens't work after switch change

$
0
0

This comes very late, but didn't see this before. So you need basics? In old netflow you write command after command as normal configuration. But in flex netflow (if you don't use "emulated netflow" which doesn't work in NTA) you have to create a so called "sub-programs" into router configuration and IOS jumps between these programs to know what to do and when. You need 3 netflow elements: Record (here i use word Settings), monitor and exporter.

 

Looking from interface side of view:

1. Interface has netflow command that points to Monitor sub-program.

2. Monitor tells router what to capture (settings "sub-program") and where to send data (in this case to orion server).

3. Settings tells router what to capture.

 

Sound complicated, but there can be several Monitor and Settings configurations, so the idea is to tell which interface is using which netflow setting. I don't know did that help anything, because of my bad english, but at least I tried.

 

Here is the configuration I use:

 

flow record SETTINGS

match datalink vlan input

match ipv4 version

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

match flow direction

collect counter bytes

collect counter packets

 

flow exporter EXPORTER1

description Netflow exporter 1 to SERVER233

destination 10.10.100.100

source Vlan1

transport udp 9996

template data timeout 60

 

flow monitor MONITOR1

record SETTINGS

exporter EXPORTER1

cache timeout active 1

 

interface vlan NN

ip flow monitor MONITOR1 output


Viewing all articles
Browse latest Browse all 21097

Trending Articles