Configure Netflow

Can anyone give som short info about how to configure netflow on two 6500? In short I believe this is the way to do:

  1. enable netflow on interfaces I want to collect information from... (eg. interface Gi1/0) ip route-cache flow
  2. configure where to send netflow data: ip flow-export (and som other options)

An example from cisco.com:

configure terminal interface serial 3/0/0 ip route-cache flow exit ip flow-export 1.1.15.1 0 version 5 peer-as exit

This is it?

Br SandStrand

Reply to
Goggen
Loading thread data ...

Yes. It will only work on layer 3 interfaces since it is a layer 3 technology. In short, vlan interfaces work, serials will definitely work. I'm not sure if you can do put it on a g0/1 interface as you have above if its just an access port but have never tried it. Regardless, it has to be on a port that moves packets from one network to another. You can also do a show ip cache flow and see the same information, just not in as nearly good a format, and its not historical without some kind of DB. But if you do a show ip cache flow | include K , it will match flows that are in the hundred thousands and should tell you your big sessions at the moment.

Either way, your config looks fine, although port (on the destination server) will be key based on what software you are using to collect/ listen.

Reply to
Trendkill

Thanks. I'm not shure but I wants to collect netflow data from the trunk ports on the 6500. If not possible I can configure the VLAN's to export netflow.

SandStrand

"Trendkill" skrev i meld>> Can anyone give som short info about how to configure netflow on two >> 6500?

Reply to
Goggen

meldingnews: snipped-for-privacy@y43g2000hsy.googlegroups.com...

Trunks will not work as they are layer 2. You will most likely need to put on the vlan interfaces on the MSFC or native IOS. If its native, try to implement on the access or trunk ports and let us know, but netflow captures when packets are moved between networks (ie routed), so I am fairly certain they will not work, but I have not tried. It probably won't even let you configure ip route-cache flow......but let us know how you fare.

Reply to
Trendkill

meldingnews: snipped-for-privacy@y43g2000hsy.googlegroups.co m...

Netflow V9 does all that L2 stuff as well - but you need recent IOS versions on the Cat 6509 to do it.

info from cisco:

formatting link

You will most likely need

Reply to
stephen

IOS. If its

It can pull some layer 2 fields now, but I still don't see any documentation that says you can configure on an access port or trunk port basis. Perhaps I am just slow this evening and am not seeing it...still looking though. Thanks for the link, had not crossed paths with v9 yet.

Reply to
Trendkill

In 6500 to

!--- Enable netflow on the PFC

Switch(config)#mls netflow

!--- Configure flow mask ON THE pfc

Switch(config)#mls flow ip full

!--- Enable NetFlow for Layer 2-switched traffic on the PFC

Switch(config)#ip flow ingress layer2-switched vlan x,y

!--- Configure NDE in the PFC for the version on your Netflow Collector

Switch(config)#mls nde sender version 5

!--- Configures NDE on the MSFC with the NetFlow collector IP address

Switch(config)#ip flow-export destination 10.10.10.10 xxxx

This should get you going,

Reply to
Y0giBear

jakemichaelwilson had written this in response to

formatting link
: Configuring NetFlow or sFlow on just about anything can be found here:
formatting link

Jake Michael Wils> Can anyone give som short info about how to configure netflow on two > 6500?

Reply to
jakemichaelwilson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.