topic asr1000 flow-export to vrf Mgmt-intf in Routing and SD-WAN

asr1000 flow-export to vrf Mgmt-intf

jayshihlin — Mon, 04 Mar 2019 18:12:06 GMT

Hi All,

Got a question about flow-export to to vrf Mgmt-intf.

asr1000 version: 02.06.02.122-33.XNF2

ip flow ingress on both inbound and outbound gig interface.

additional commands:

ip flow-cache timeout active 1

ip flow-export version 9
ip flow-export destination 10.0.0.1 9801 vrf Mgmt-intf

However, I don't see any netflow data and here is show ip flow export output

ASR1000#show ip flow export
Flow export v9 is enabled for main cache
Export source and destination details :
VRF ID : 4085
    Source(1)       10.0.0.254 (GigabitEthernet0)
    Destination(1) 10.0.0.1 (9801)
Version 9 flow records
0 flows exported in 0 udp datagrams
206 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
0 export packets were dropped due to Card not being able to export

Wondering why flow is failed....

But it works without go to vrf:

ip flow-export destination 10.0.0.1 9801

ASR1000#show ip flow export
Flow export v9 is enabled for main cache
Export source and destination details :
VRF ID : Default
Destination(1) 10.0.0.1 (9801)
Version 9 flow records
21 flows exported in 18 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
0 export packets were dropped due to Card not being able to export

Any suggestions are appericated...

Best Regards,

=J=

Re: asr1000 flow-export to vrf Mgmt-intf

Giuseppe Larosa — Fri, 22 Oct 2010 11:00:00 GMT

Hello Jay,

>> 206 flows failed due to lack of export packet

exporting netflow packets using an interface mapped in a VRF is a feature that was not supported untl recent times

This is a problem that happens also on other platforms like C7600.

the feature may be in the roadmap, there have been other threads about this issue in the forums

see

https://supportforums.cisco.com/message/3040853#3040853

https://supportforums.cisco.com/message/1331662#1331662

another colleague opened a thread for the same issue

https://supportforums.cisco.com/message/3201480#3201480

as I wrote before open a service request

Edit:

in feature navigator the feature is named:

Netflow Data Export to a collector in a VRF

but it is supported only on C6500

again open a service request

Hope to help

Giuseppe

Re: asr1000 flow-export to vrf Mgmt-intf

gephelps — Fri, 22 Oct 2010 19:52:19 GMT

12.2(33)XNF brought support for Netflow Export to a destination in a VRF

for the ASR1000, but it is not supported on the Gig0 interface.

If you try to configure the source as Gig0 there was a check put in which informs you this is not supported:

Router(config)#ip flow-export source gig0
%Interface GigabitEthernet0 cannot be used as an exporter source!

Netflow collection and export happens directly on the ESP and does not require the RP to function. The ESP has no way to interact with the Gig0 interface directly since the management interface is part of the RP.

Re: asr1000 flow-export to vrf Mgmt-intf

Giuseppe Larosa — Fri, 22 Oct 2010 20:36:54 GMT

Hello George,

thanks for your platform specific information

but how netflow export packets prepared by ESP go out to the external world?

it can use any interface on a SPA instead of an interface on the RP?

Hope to help

Giuseppe

Re: asr1000 flow-export to vrf Mgmt-intf

gephelps — Fri, 22 Oct 2010 21:08:16 GMT

Giuseppe,

What you said is correct. Any SPA interface can be used for Netflow Export for the ASR1000. The Gig0 interface being referred to is built into the RP and while its purpose is for Management it cannot be used for Netflow Export. This is platform specific as you noted.

Hi

kokkengng9 — Tue, 10 May 2016 06:03:36 GMT

We have an ASR1001 running version 15.1(2)S2. Instead of using interface Gi0, we used another interface Gi0/0/3 to export the flow. From the "sh ip flow export" command, we can see that the flow is already exported. However, when we tried sniffing at the next hop (10.1.1.1), which is a firewall, we cannot see the udp packets coming into the interface. So, the udp packets is not leaving the router. Any idea what is missing?

interface GigabitEthernet0/0/3
ip vrf forwarding mgmt-ip
ip address 10.1.1.2 255.255.255.0
no ip redirects
no ip proxy-arp
negotiation auto
cdp enable
!
ip route vrf mgmt-ip 0.0.0.0 0.0.0.0 GigabitEthernet0/0/3 10.1.1.1
!
ip flow-export source GigabitEthernet0/0/3
ip flow-export version 9
ip flow-export destination 10.10.10.253 5100 vrf mgmt-ip
!

Router#sh ip flow export
Flow export v9 is enabled for main cache
Export source and destination details :
VRF ID : 2
Source(1) 10.1.1.2 (GigabitEthernet0/0/3)
Destination(1) 10.10.10.253 (5100)
Version 9 flow records
238115493 flows exported in 10970087 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
0 export packets were dropped due to Card not being able to export
Router#

hi,

Ruslan Moldaliev — Wed, 03 Aug 2016 13:40:17 GMT

hi,

you can try

show flow exporter [yourexporter] statistics

it will show you a little bit more than command in your example. and you must see whether it sending any traffic or no. I had similair issues and this command helped me to solve my issue. also I noted "Flow export v9 is enabled for main cache" in your last command output, maybe it's something with cache?

You might want to try FNF

kimarumansour — Fri, 16 Sep 2016 07:51:22 GMT

You might want to try FNF based flow config. I am not sure if this is available in your IOS version. Here's an example which I am using for IOS 15.6:

flow record demo
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport destination-port
match transport source-port
match routing vrf input
match routing vrf output
match mpls label 1 details
match mpls label 2 details
match mpls label 3 details
collect counter bytes long
collect counter packets long
flow exporter demo
destination 10.10.10.10
transport udp 9996
flow monitor demo
exporter demo
cache timeout inactive 30
cache timeout active 60
record demo

And this is how I attach to interface for which I want to collect flows:

!
interface GigabitEthernet1
ip flow monitor demo input
ip flow monitor demo output

Re: asr1000 flow-export to vrf Mgmt-intf

CiscoBrownBelt — Thu, 23 Apr 2020 12:27:49 GMT

I know this old but what is ESP? Are there any workarounds so we can export netflow to not use mgmt vrf such as use loopback and make sure connectivity to ExportCollector is reachable via loopback and not just mgmt interface?

Re: asr1000 flow-export to vrf Mgmt-intf

arnert — Wed, 17 Mar 2021 19:55:11 GMT

Is it true for a ISR4400 ? We have created a vrf for management traffic. From a long ago post --- In the past netflow, was not supported on GI0 -- from a another thread -> "Netflow can't be exported from the main data plane out through the management interface (Gig0)" ----- We are running 17.0.x.x.x - its seems that this is still the case? You can not or, can we input the flow in another monitor and export out another? Please advise thanks in advance?

Re: asr1000 flow-export to vrf Mgmt-intf

Giuseppe Larosa — Wed, 17 Mar 2021 21:22:10 GMT

Hello @arnert .

the thread is referred to ASR 1000 platform and to the fact that the built in management interface gi0 that is for out of band management cannot be used for sending out flow records collected by Netflow.

In your router ISR 4400 you can export using a standard interface even if it is mapped to a VRF that you have configured adding the vrf <vrf-name> keywords where it is necessary in the flow exporter I suppose in flexible netflow.

Hope to help

Giuseppe

Re: asr1000 flow-export to vrf Mgmt-intf

Giuseppe Larosa — Wed, 17 Mar 2021 21:25:14 GMT

Hello @CiscoBrownBelt ,

I know this answer is a late one the ESP is a specific HW component of ASR 1000 that provides data plane switching and can performs encryption / decryption and so on.

>> o we can export netflow to not use mgmt vrf such as use loopback and make sure connectivity to ExportCollector is reachable via loopback and not just mgmt interface?

short answer is yes

Hope to help

Giuseppe

Re: asr1000 flow-export to vrf Mgmt-intf

baygray — Mon, 05 Dec 2022 21:11:25 GMT

As others have alluded to, for ASR1Ks, Netflow traffic is not allowed over Gig0. The BU determined that 1G would not be big enough, especially since this port is responsible for management purposes. For some reason, Gig0 can still be configured as the exporter interface, but it will not work. You must configure a SPA interface for Netflow to work on ASR1Ks.

Hope This Helps,

Baylor