topic Re: Netflow in Network Security

Netflow

robin.disla — Fri, 17 May 2019 20:58:48 GMT

I need help with the following error I'm configuring netflow in my network and when I assigned the configuration in the interface it shows me the following % Flow Monitor: Failed to add monitor to interface: internal error: field information missing

Re: Netflow

johnd2310 — Sat, 18 May 2019 07:29:11 GMT

Hi,

What is your netflow config and what device are you configuring?

Thanks

John

Re: Netflow

balaji.bandi — Sat, 18 May 2019 06:26:27 GMT

We have not have enough information to give you suggestion here, the error show something configured wrong here.

Please can you post below information ;

1. what is the device model

2. IOS/NXOS code version

3. your netflow configuration.

here is latest same config guide for referenence in case you like to refer :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-6/configuration_guide/sys_mgmt/b_166_sys_mgmt_9300_cg/b_166_sys_mgmt_9300_cg_chapter_0100.html#task_lq1_hwl_j1b

Re: Netflow

robin.disla — Sun, 19 May 2019 01:07:47 GMT

Hello,

I have the next information.

1. what is the device model

Cisco Catalyst 9500-40X

2. IOS/NXOS code version

ios-xe version 16.09.02

3. your netflow configuration.

flow record HIT-NET-IN
match flow direct
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes long
collect counter packets long
collect interface output
collect application dns domain-name

flow record HIT-NET-OUT
match flow direction
match interface output
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes long
collect counter packets long
collect interface input
collect application dns domain-name

*****************************************

flow exporter HIT-NET
source vlan X
destination X.X.X.X
transport udp 2055
export-protocol netflow-v9

***************************************

flow monitor Netflow-Monitor-In
exporter HIT-NET
cache timeout inactive 10
cache timeout active 60
record HIT-NET-IN

flow monitor Netflow-Monitor-Out
exporter HIT-NET
cache timeout inactive 10
cache timeout active 60
record HIT-NET-OUT

*********************************

The error is in this part.

interface ten1/0/5

ip flow monitor Netflow-Monitor-In input

% Flow Monitor: Failed to add monitor to interface: internal error: field information missing
ip flow monitor Netflow-Monitor-Out output

Re: Netflow

robin.disla — Sun, 19 May 2019 01:08:50 GMT

flow record HIT-NET-IN
match flow direct
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes long
collect counter packets long
collect interface output
collect application dns domain-name

flow record HIT-NET-OUT
match flow direction
match interface output
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes long
collect counter packets long
collect interface input
collect application dns domain-name

*****************************************

flow exporter HIT-NET
source vlan X
destination X.X.X.X
transport udp 2055
export-protocol netflow-v9

***************************************

flow monitor Netflow-Monitor-In
exporter HIT-NET
cache timeout inactive 10
cache timeout active 60
record HIT-NET-IN

flow monitor Netflow-Monitor-Out
exporter HIT-NET
cache timeout inactive 10
cache timeout active 60
record HIT-NET-OUT

*********************************

The error is in this part.

interface ten1/0/5

ip flow monitor Netflow-Monitor-In input

% Flow Monitor: Failed to add monitor to interface: internal error: field information missing
ip flow monitor Netflow-Monitor-Out output

Re: Netflow

Mark Malone — Tue, 21 May 2019 15:54:52 GMT

Hi it must be applied to a LAYER 3 interface with Ip enabled,is that ten gig interface layer 2 or 3 ?

its an l3 command your applying

Re: Netflow

robin.disla — Tue, 21 May 2019 15:59:10 GMT

Is a interface asociated to specific SVI interface. for example:
Vlan X
int Vlan X
ip address x.x.x.x/x
the error is present in this part
int ten1/0/1
ip flow monitor Netflow-Monitor-In input
% Flow Monitor: Failed to add monitor to interface: internal error: field information missing

Re: Netflow

balaji.bandi — Tue, 21 May 2019 16:01:45 GMT

int ten1/0/1 < is the L3 interface ?

show you post show run int ten1/0/1

Re: Netflow

Mark Malone — Tue, 21 May 2019 16:36:29 GMT

Hi
It needs to be under the vlan interface any interface with an IP enabled

Re: Netflow

robin.disla — Tue, 21 May 2019 17:04:02 GMT

the configuration is as follows:

interface Vlan 100
ip address X.X.X.X X.X.X.X.X
end

interface TenGigabitEthernet1/0/1
switchport access vlan 100
end

Re: Netflow

robin.disla — Tue, 21 May 2019 17:07:48 GMT

interface Vlan 100
ip address X.X.X.X X.X.X.X.X
end

interface TenGigabitEthernet1/0/1
switchport access vlan 100
end

Re: Netflow

balaji.bandi — Tue, 21 May 2019 18:01:07 GMT

Try below config and let us know

interface Vlan 100

ip flow monitor Netflow-Monitor-In input

ip flow monitor Netflow-Monitor-Out output

Re: Netflow

robin.disla — Tue, 21 May 2019 18:26:44 GMT

I treat the recommended and shows the following error:

% Flow Monitor: Failed to add monitor to interface: flexible netflow not supported on vlan interfaces

Re: Netflow

Mark Malone — Tue, 21 May 2019 19:35:03 GMT

Hi
looks like thats a limitation your hitting on the switches
, has to be on a physical IP interface same as the 3k series

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-8/configuration_guide/nmgmt/b_168_nmgmt_9400_cg/b_168_nmgmt_9400_cg_chapter_0111.html

Layer 2, VLAN and Layer 3 interfaces are supported, but the device does not support SVI and tunnels.

Re: Netflow

balaji.bandi — Tue, 21 May 2019 23:27:19 GMT

Look at a good example of netflow from solarwinds it woriks and tested as expected.

https://support.solarwinds.com/SuccessCenter/s/article/Examples-of-Flexible-NetFlow-Configuration

also look at the limitation as suggested.