Re: Nexus 9000 Netflow

Moudar · ‎08-12-2023

Hi

I am configuring the netflow on my Nexus:

Hardware
  cisco Nexus9000 C93180YC-FX Chassis
  Intel(R) Xeon(R) CPU D-1528 @ 1.90GHz with 24569704 kB of memory.

I am using these commands:

flow exporter PRTG-Exporter
 destination 10.2.58.106 use-vrf KIS-ADM
 source vlan410
 version 9
 template data timeout 20
flow record PRTG-Record
 match ipv4 source address
 match ipv4 destination address
 collect counter bytes
 collect counter packets
flow monitor PRTG-Monitor
 record PRTG-Record
 exporter PRTG-Exporter
interface Ethernet1/5
 ip flow monitor foo input

The problem is that interface Ethernet 1/5 does not have Flow command:

Here is the ETH1/5 running configuration:

interface Ethernet1/5
  description Internet
  switchport
  switchport access vlan 3
  spanning-tree port type edge
  no shutdown

What do i miss here?!

M02@rt37 · ‎08-12-2023

Hello @Moudar,

NetFlow monitoring is typically performed on routed interfaces or Layer 3 interfaces.

You'll need to change the configuration to make it a routed interface.

interface Ethernet1/5
no switchport

--> interface Ethernet1/5
ip address <IP_ADDRESS> <SUBNET_MASK>

Configure the NetFlow monitor on that interface:

interface Ethernet1/5
ip flow monitor PRTG-Monitor input

-> no "foo" but your Monitor configured.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-12-2023

This interface must not be routed, it should be a trunk. So L2 Netflow is possible I think

When I check the documentaions of Nexus switches I see:

Do these commands affect the overall efficiency of that port. I don't want to cut the internet for 4000 people

What info should L2 Netflow show?

M02@rt37 · ‎08-12-2023

OK @Moudar

What about the name of your Monitor on your interface... foo? No PRTG-Monitor?

If yes, ensure that the configuration in PRTG matches the settings you've provided for the flow exporter and monitor. Double-check IP addresses, ports, and other settings...

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-12-2023

Now it looks like this:

flow exporter PRTG-Exporter
  destination 10.2.58.106 use-vrf KIS-ADM
  transport udp 2055
  source Vlan410
  version 9
    template data timeout 20
flow record PRTG-Record
  match datalink ethertype
flow monitor PRTG-Monitor
  record PRTG-Record
  exporter PRTG-Exporter

The switch is like this:

Nexus-1# sh flow exporter PRTG-Exporter
Flow timeout 10
Flow exporter PRTG-Exporter:
    Destination: 10.2.58.106
    VRF: KIS-ADM (1)
    Destination UDP Port 2055
    Source Interface Vlan410 (10.32.0.251)
    Export Version 9
        Sequence number 2432
        Data template timeout 20 seconds
    Exporter Statistics
        Number of Flow Records Exported 2649
        Number of Templates Exported 813
        Number of Export Packets Sent 2433
        Number of Export Bytes Sent 110532
        Number of Destination Unreachable Events 0
        Number of No Buffer Events 0
        Number of Packets Dropped (No Route to Host) 0
        Number of Packets Dropped (other) 0
        Number of Packets Dropped (LC to RP Error) 0
        Number of Packets Dropped (Output Drops) 0
        Time statistics were last cleared: Never

But PRTG still not getting the flows. When checking the Nexus IP on Wireshark i could see CFLOW packets come as expected:

And the Netflow sensor grayed out:

M02@rt37 · ‎08-12-2023

Hello @Moudar,

The pcap wireshark is where the Netflow server is installed ?

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-12-2023

Correct, where PRTG is installed!

M02@rt37 · ‎08-13-2023

@Moudar

Then check PRTG configuration regarding your flow Exporter configuration.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-13-2023

As you can see, everything is running as expected. only Netflow is not! I tried to add IPFIX but still grayed out

So I don't know what to do. I have same problem with Cisco WLC, the netflow is grayed out.

I have many switches and routers and these are sending Netflow traffic and working without any problem

M02@rt37 · ‎08-13-2023

@Moudar,

What is N9k firmware version please?

Also, you don't have a sampler configured?

You confirm you modify this?

interface Ethernet1/5
 ip flow monitor foo input

By this --ip flow monitor PRTG-Monitor input

Thanks.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-13-2023

Software
  BIOS: version 05.39
 NXOS: version 9.3(2)
  BIOS compile time:  08/30/2019
  NXOS image file is: bootflash:///nxos.9.3.2.bin
  NXOS compile time:  11/4/2019 12:00:00 [11/04/2019 23:13:33]

The interface eth 1/5 does not have the ip flow command as I mentioned before

This is how running configuration of eth1/5 looks like:

interface Ethernet1/5
  description Internet
  switchport
  switchport access vlan 3
  spanning-tree port type edge
  mac packet-classify
  layer2-switched flow monitor PRTG-Monitor input
  no shutdown

commands:

mac packet-classify
  layer2-switched flow monitor PRTG-Monitor input

are used to gather L2 Netflow, the problem is that PRTG is not showing anything!

M02@rt37 · ‎08-13-2023

Thanks @Moudar,

Share please the output of that command:

#show hardware flow ip

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Moudar · ‎08-13-2023

There is no command show hardware ip flow!

Nexus-1# show hardware flow etrap

slot  1
=======

========================================================================================================================================
                                                     Elephant Flows

========================================================================================================================================
Unit:Slc Index:Type  Source Address
 Destination Address                     Ports(Src:Dst)  Proto  Approx_Rate
========================================================================================================================================


----------------------------------------------------------------------------------------------------------------------------------------
 Index- Index in table. Type- 0:CE, 1:FCoE, 2:IPv4, 3:IPv6.

===========================================================================================================================
=============

Nexus-1# sh hardware ?
  <CR>
  >                   Redirect it to a file
  >>                  Redirect it to a file in append mode
  access-list         Access Control List
  capacity            Resource inventory and/or usage level
  feature-capability  Show registered features supported
  flow                Traffic flow information
  forwarding          Show hardware information for forwarding path
  internal            Show hardware internal information
  mac                 MAC configuration commands
  profile             Profile settings
  qos                 Show qos related information
  rate-limiter        Show Rate-Limiter configs and statistics
  |                   Pipe command output to filter

sh hardware flow ?
  etrap  Elephant Trap information

M02@rt37 · ‎08-13-2023

@Moudar

It is show hardware flow ip

Feature netflow is activated?

Thanks.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

MHM Cisco World · ‎08-12-2023

I send you private message