Hi, I've configured netflow on a 6500 with vrf lite enabled, but can't seem to get the 6500 to export to the destination.
router>sh ip flow export Flow export v5 is enabled for main cache Exporting flows to x.x.x.x (9800) x.x.x.x (9800) Exporting using source interface Vlan Version 5 flow records 474136 flows exported in 147459 udp datagrams 0 flows failed due to lack of export packet 1 export packets were sent up to process level 147457 export packets were dropped due to no fib
route-map vrf-magic permit 10 match ip address vrf-magic set interface loopback1
ip local policy route-map vrf-magic
! Note that this route is in the global vrf ip route 188.8.131.52 255.255.255.255 loopback1
! And, of course, you have your regular route in the production vrf ip route your-production-vrf 184.108.40.206 255.255.255.0 VLAN mumble
The traffic starts in the global VRF and routed out through an interface that's in your production VRF. All things being equal, this wouldn't help much since the outbound interface is in the one vrf and the traffic being directed through it is in another. But the local policy route fixes that up and you end up routing the traffic out through your production vrf. Note that this technique works with unidirectional outbound flows such as syslog or SNMP traps. Or Netflow. It doesn't neccessarily do the job for bidirectional flows like TACACS where the reply traffic from the authentication server has to get back into the global vrf in order to be properly recognized.
Failing this, you may be stuck running an actual cable between vrfs and seeing if you can get this past your security folks.