netflow exporter fails on ISR 4431

[jehanproc]

Hello,

my ISR4431 (Cisco IOS XE Software, Version 03.16.07.S) can collect netflows, but nothing is exported

I tried different sources interfaces, port numbers, no way .

I think my problem is similar to https://community.cisco.com/t5/network-management/no-netflow-export-on-management-interface-gig0-of-isr-4431/td-p/2992691

but there is no solution .

Is there a particular thing to do in this plateforme (netflows export works fine on my 6500 and ADR1001)

Regards .

tech details

flow exporter disiFEflowmon
destination 157.149.10.80
source Loopback0
transport udp 2055
template data timeout 300

flow monitor disiFMAllISPzm
exporter disiFEflowmon
statistics packet protocol
statistics packet size
record netflow-original

isr4#show flow monitor disiFMAllISPzm statistics
Cache type: Normal (Platform cache)
Cache size: 200000
Current entries: 7800
High Watermark: 10203

Flows added: 231388
Flows aged: 223588
- Inactive timeout ( 15 secs) 223588

isr4#show flow exporter disiFEflowmon statistics
Flow Exporter disiFEflowmon:
Packet send statistics (last cleared 1d00h ago):
Successfully sent: 60 (27600 bytes)

Client send statistics:
Client: Flow Monitor disiFMAllISPzm
Records added: 0
Bytes added: 0

[cmarva]

please post the output of "sho flow interf"

[Mark Malone]

Hi
i have running fine on that image/routers heres an example , wheres your record section ? and its applied to L3 interface yes ?


flow record LIVEACTION-FLOWRECORD
description DO NOT MODIFY. USED BY LIVEACTION.
match flow direction
match interface input
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect application name
collect counter bytes
collect counter packets
collect flow sampler
collect interface output
collect ipv4 destination mask
collect ipv4 dscp
collect ipv4 id
collect ipv4 source mask
collect ipv4 source prefix
collect routing destination as
collect routing next-hop address ipv4
collect routing source as
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect transport tcp flags
!
!
flow record type performance-monitor LIVEACTION-FLOWRECORD-AVC
description DO NOT MODIFY. USED BY LIVEACTION.
match application name account-on-resolution
match connection client ipv4 address
match connection server ipv4 address
match connection server transport port
match ipv4 protocol
match routing vrf input
collect application http host
collect connection client counter bytes long
collect connection client counter bytes network long
collect connection client counter packets long
collect connection client counter packets retransmitted
collect connection delay application sum
collect connection delay network client-to-server sum
collect connection delay network to-client sum
collect connection delay network to-server sum
collect connection delay response client-to-server sum
collect connection delay response to-server histogram late
collect connection delay response to-server sum
collect connection initiator
collect connection new-connections
collect connection server counter bytes long
collect connection server counter bytes network long
collect connection server counter packets long
collect connection server counter responses
collect connection sum-duration
collect connection transaction counter complete
collect connection transaction duration max
collect connection transaction duration min
collect connection transaction duration sum
collect interface input
collect interface output
collect ipv4 destination address
collect ipv4 dscp
collect ipv4 source address
collect ipv4 ttl
!
!
flow record type performance-monitor LIVEACTION-FLOWRECORD-MEDIANET
description DO NOT MODIFY. USED BY LIVEACTION.
match flow direction
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match transport destination-port
match transport rtp ssrc
match transport source-port
collect application media bytes counter
collect application media bytes rate
collect application media event
collect application media packets counter
collect application media packets rate
collect application name
collect counter bytes
collect counter bytes rate
collect counter packets
collect interface input
collect interface output
collect ipv4 dscp
collect ipv4 ttl
collect monitor event
collect routing forwarding-status
collect timestamp interval
collect transport event packet-loss counter
collect transport packets expected counter
collect transport packets lost counter
collect transport packets lost rate
collect transport rtp jitter maximum
collect transport rtp jitter mean
collect transport rtp jitter minimum
!
!
flow exporter LIVEACTION-FLOWEXPORTER-IPFIX
description DO NOT MODIFY. USED BY LIVEACTION.
destination x.x.x.x vrf Mgmt-vrf
source GigabitEthernet0/0/5
transport udp 2055
export-protocol ipfix
option interface-table
option vrf-table
option sampler-table
option application-table
option c3pl-class-table
option c3pl-policy-table
option application-attributes

[jehanproc]

here is the show flow interface

isr4#show flow interface
Interface GigabitEthernet0/0/0.10
FNF: monitor: disiFMAllISPzm
direction: Input
traffic(ip): on
FNF: monitor: disiFMAllISPzm
direction: Output
traffic(ip): on

the flow monitor is applied on a "sub-interface" for a vlan 10 :

interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
ip address 83.167.34.69 255.255.255.254
ip flow monitor disiFMAllISPzm input
ip flow monitor disiFMAllISPzm output

I add also the show flow monitor disiFMAllISPzm statistics to show that data is well acquired :

isr4#show flow monitor disiFMAllISPzm statistics
Cache type: Normal (Platform cache)
Cache size: 200000
Current entries: 10448
High Watermark: 15652

Flows added: 8959209
Flows aged: 8948761
- Active timeout ( 1800 secs) 2440
- Inactive timeout ( 15 secs) 8946321

Packet size distribution (364749451 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416
.000 .327 .036 .012 .006 .004 .006 .004 .001 .001 .001 .000 .000

448 480 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .001 .001 .001 .002 .011 .576 .000 .000 .000 .000 .000 .000

Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 128322 0.0 1 41 0.0 0.7 15.4
TCP-FTP 3333 0.0 1 42 0.0 0.3 15.4
TCP-FTPD 1162 0.0 10 747 0.0 0.4 15.5
TCP-WWW 194507 0.0 152 1041 6.8 5.3 15.4
TCP-SMTP 7160 0.0 3 96 0.0 1.5 15.5
TCP-X 1332 0.0 1 204 0.0 0.1 15.4
TCP-BGP 172 0.0 365 150 0.0 209.3 13.7
TCP-NNTP 336 0.0 1 40 0.0 0.0 15.5
TCP-Frag 11 0.0 2 938 0.0 0.0 15.4
TCP-other 7032510 1.6 32 857 54.0 1.7 15.4
UDP-DNS 257640 0.0 1 89 0.0 0.0 15.4
UDP-NTP 20030 0.0 1 87 0.0 0.2 15.4
UDP-TFTP 69 0.0 1 47 0.0 0.0 15.5
UDP-Frag 211 0.0 588 41 0.0 6.1 15.5
UDP-other 1033753 0.2 93 877 22.4 12.4 15.4
ICMP 267764 0.0 2 86 0.1 2.3 15.4
IPv6INIP 449 0.0 3 92 0.0 6.6 15.4

it's the exporter that seem to fail , but cannot figure out why ?

thanks.

[Mark Malone]

Could be hitting this bug

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi16916

Netflow not exporting with 03.16.7S release
CSCvi16916
Description
Symptom:
FNF cannot export with netflow-v9 export protocol (default export protocol).

Conditions:
Configure FNF with default export protocol netflow-v9.

Workaround:
Configure FNF with export protocol IPFIX.

Further Problem Description:
to be specific, isr4300-universalk9.03.16.07.S.155-3.S7-ext.SPA.bin is affecteed

Customer Visible

[jehanproc]

Good reply , you've found it !

indeed I am hitting the bug :https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi16916

I do run Cisco IOS XE Software, Version 03.16.07.S

So I change the export-porotocol from default netflow-v9 to ipfix :

flow exporter disiFEflowmon
destination 157.149.210.80
source Loopback0
transport udp 2055
export-protocol ipfix
template data timeout 300

now stats does show sent data :

isr4#show flow exporter disiFEflowmon statistics
Flow Exporter disiFEflowmon:
Packet send statistics (last cleared 1d11h ago):
Successfully sent: 77538 (99371128 bytes)

Client send statistics:
Client: Flow Monitor disiFMAllISPzm
Records added: 1977516
- sent: 1977516
Bytes added: 98875800
- sent: 98875800

Unfortunatly on my nfsen 1.6 collector , apparently there's no support for ipfix :-(

I'll have to either update nfsen or IOS image .

thanks for that precious help .

regards .