Hello All,
I've been trying to get my Cisco 3850's Netflow data into the Extreme Networks Netsight application (Flow Collector).
I've wiresharked the traffic and can confirm the flows are getting to the Netsight server, but it won't show up in the flows in the application.
I've contacted their support and the support rep is asking:
"We only see that the template files from the Cisco are not being digested. We don't support the template and data frames being integrated.
That is why i asked if we are able to get the templates sent only intermittently (not every frame) and if that improves our visibility into the flows."
Can someone help interpret what they might be asking? or if you have any experience with Netsight, I would be greateful.
Also, I've been through this doc a few time, Can't find anything. Maybe im missing something.
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/flexible_netflow/configuration_guide/b_fnf_3se_3850_cg/b_fnf_3se_3850_cg_chapter_010.html#topic_7797BC08B28342CFBE6E06706EF2A6D4
I found this one today and i've been going over it.
https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
My Netflow Config:
flow record NETSIGHT_FLOW_RECORD_IN
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes long
collect counter packets long
!
!
flow record NETSIGHT_FLOW_RECORD_OUT
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
collect interface input
collect counter bytes long
collect counter packets long
!
!
flow exporter NETSIGHT_FLOW_EXPORT
destination Netsight Server.
transport udp 2055
export-protocol netflow-v9
template data timeout 60
!
!
flow monitor NETSIGHT_FLOW_MONITOR_IN
exporter NETSIGHT_FLOW_EXPORT
record NETSIGHT_FLOW_RECORD_IN
flow monitor NETSIGHT_FLOW_MONITOR_OUT
exporter NETSIGHT_FLOW_EXPORT
record NETSIGHT_FLOW_RECORD_OUT
interface GigabitEthernet1/0/4
ip flow monitor NETSIGHT_FLOW_MONITOR_IN input
ip flow monitor NETSIGHT_FLOW_MONITOR_OUT output
no mdix auto
Any help would be appreciated
Thank you
