I have a customer who is trying to determin if he needs two different netflow configurations to replace the v5 default he was running prior to needing to change to Flexible. He is looking for recommendation regarding using one netflow for WAN interfaces and another for iWAN interfaces.
The CU needed to move from v5 to v9 and ran into a few bugs. That took us down the Flexible Netflow path.
Any professional recommendataions?
WAN -
flow record RECORD-1
match ipv4 tos
match ipv4 precedence
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match interface output
match flow direction
collect ipv4 source mask
collect ipv4 destination mask
collect flow sampler
collect counter bytes
collect counter packets
collect ipv4 dscp
!
!
flow exporter EXPORTER-1
description FNFv9
destination 1.1.1.1
source loopback0
transport udp 9995
!
!
flow monitor MONITOR-1
exporter EXPORTER-1
record RECORD-1
!
-------------------------------------------------
iWAN
!
flow record Record-FNF-IWAN
description Flexible NetFlow for IWAN Monitoring
match ipv4 dscp
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match flow direction
collect routing source as
collect routing destination as
collect routing next-hop address ipv4
collect ipv4 id
collect ipv4 source prefix
collect ipv4 source mask
collect ipv4 destination mask
collect transport tcp flags
collect interface output
collect flow sampler
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect application name
!
flow exporter Export-FNF-IWAN
description FNFv9
destination 1.1.1.1
source Loopback0
transport udp 9995
option interface-table
option application-table
!
flow monitor Monitor-FNF-IWAN
description IWAN Traffic Analysis
exporter Export-FNF-IWAN
cache timeout inactive 10
cache timeout active 60
record Record-FNF-IWAN
