NetFlow

[ARMANDO ALVARADO]

Does anyone know how to setup netflow for layer 2 interface. I know how to do it in a routed interface but not on a layer 2 port.This is for a nexus 7010 to monitor port for SQL Server. Any help would be great. Thanks

[Lucien Avramov · Accepted solution]

Here is the configuration guide, look at the section:

Configuring Layer 2 NetFlow

http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_15netflow.html#wp1094178

[rdboyd · Accepted solution]

The configuration guide is fairly confusing and you really don't know what you need to implement. Typically, I did the 'flow exporter' and found that obviously did not work. Here is what works now:

flow exporter MGT
  destination x.x.x.x
  transport udp 2055
  source loopback0
  version 9
    option exporter-stats timeout 1
flow record CasFlow
  description ipv4Flow
  match transport destination-port
  collect counter packets
flow monitor Cascade
  description ipv4Monitor
  record netflow-original
  exporter MGT

interface Vlanxx
  no shutdown
  ip flow monitor Cascade input

I would use what we are running on our Nexus 7000s and adapt to your own use. Our configuration is fairly generic.

regards

Ricky Boyd

CCIE 2901

[Robert Taylor · Accepted solution]

You cannot place it specifically on the l2 port ... you must place the monitor on the L3 interface, and then use your collector software to filter it down by the ip address of the server/sql ports.

Rob

[joanna.lenczewska]

I'm trying to set up netflow on layer2 interface that is also a trunk. Is that OK to do? I barely receive any flows in my Netflow analyzer. At first I put a command

"layer2-switched flow monitor Layer2Flow input" on layer2 port as per configuration guide. Since that doesn't really work I applied:

"ip flow monitor Layer2Flow input 
  ip flow monitor Layer2Flow output"

commands on layer3 interface.

In Netflow analyzer I see some data going through, barely any, and Source IP and Destination IP fields show only 0.0.0.0

Am I missing something? Is it possible to receive flows from a layer2, trunked interface?

thanks in advance!

-Joanna