cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2777
Views
0
Helpful
3
Replies

netflow export on Cisco 2821

bastianbrachner
Level 1
Level 1

Hello,

a question or more a problem with netflow exports on Cisco 2821's.
I configured netflow export on a Cisco 2821 with IOS Version 12.4(24)T

ip cef
...
interface FastEthernet0/0/0
description to XXX
ip address XXX
ip flow ingress
ip flow egress
duplex full
speed 10
...
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination XXX XXX
!
...

The netflow collector shows "only ingoing traffic" on interface FastEthernet0/0/0 and
"only outgoing traffic" on interface GigabitEthernet0/0.
Same problem with an IOS Version 12.4(20)T1 on other Cisco 2821's.
But same configuration on other Cisco 2821's with IOS Version 12.4(11)XJ4 work well.

Any references/suggestions or explanations?

3 Replies 3

yjdabear
VIP Alumni
VIP Alumni

It's surprising to me that it's even possible to configure both directions on a single interface. I thought it's generally not a good idea to configure both directions among interfaces on a single router.

How's g0/0 configured "ip flow" wise? Maybe you're seeing "only outgoing traffic" on interface GigabitEthernet0/0, because those are incoming through fa0/0/0 (where IOS ignores the "ip flow egress" part) and going out through g0/0?

#It's surprising to me that it's even possible to configure both directions on a single interface.
#It's generally not a good idea to configure both directions among interfaces on a single router.
--> It is possible. ;-) I need QoS (DSCP information) for ingoing traffic and
--> and for outgoing traffic of this interface FastEthernet0/0/0.

#How's g0/0 configured "ip flow" wise?
--> There's no netfow configuration on this interface, only on Fa0/0/0.
-->#sh ip flow interface
--> FastEthernet0/0/0
-->  ip flow ingress
-->  ip flow egress

#Maybe you're seeing "only outgoing traffic" on
#interface GigabitEthernet0/0, because those are incoming traffic through fa0/0/0
#(where IOS ignores the "ip flow egress" part) and flowing out through g0/0?
--> You're right. The outgoing traffic at Gi0/0 is the ingoing traffic at Fa0/0/0.
--> But I don't think thath the configuration is wrong and I think that the
--> "ip flow egress" command on an single interface is not so special.
--> I really looks like that the command "ip flow egress" on interface Fa0/0/0
--> is being ignored. But why?
--> May be I should start an other discussion with a link to this posting in the
--> router forum.

Same with this configuration.

Cisco 2821 (revision 53.51)
c2800nm-ipbasek9-mz.151-3.T.bin

ip cef
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination xxx.xxx.xxx.xxx xxxx


#sh ip flow interface
GigabitEthernet0/0
  ip flow ingress
  ip flow egress

I only see ingoing traffic, no outgoing traffic at my netflow colector.