Flexible Netflow on Interface Vlan to IOS XE

[nostosalgos]

Hi everyone, I need to enable Flexible Netflow for interface Gi0/0/0.1510 (encapsulation dot1Q), my SolarWinds no picture data, because Netflow sumarizes routed traffic. When apply Flexible Netflow to interface Gi0/0/0.1510 with commands  "show flow monitor <name> cache format table" collect data, but my SolarWinds no data. Some one has same scenario.

[Georg Pauwen]

Hello,

what device is this configured on ? Can you post the running config ?

[balaji.bandi]

In addition to other comment,

Does your solarwinds working with netflow devices ? is this only First device you configuring to export data to Solarwinds ?

Is Solarwinds IP reachable to device  you trying to export Data ?

Can you post the  relavant configuration  as requested, and alos as you mentioned that you see the data on device exported (not seeing on solarwinds ) - in that path do you have any firewall ? also rung any wireshark see is the packet reaching from Device to solarwinds ?

[nostosalgos]

Hi @balaji.bandi, on router see traffic with Exporter IPs and I have many devices in Solar but it is not picture data.

ROUPCCHIPR#sh flow monitor FLOW-MONITOR-SOLAR cache format table | i 2055
MM.NN.OO.PP AA.BB.CC.DD 55673 2055 Null 0xE0 17 Gi0/0/0.1510 556 4
MM.NN.OO.PP FF.GG.HH.II 57204 2055 Null 0xE0 17 Gi0/0/0.1510 556 4

[Giuseppe Larosa]

Hello @nostosalgos ,

you have to provide more details and info in order to get help.

post

show version

posr all netflow related configuration

and also what is the source interface used for exporting Netflow data ?

Some platforms cannot use the management interface to export Netflow data, so the choice of the source interface for sending neflow accounting packets is important.

Hope to help

Giuseppe

[nostosalgos]

Hi, configuration C1117-4P

flow record FLOWR-SUNAT
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes long
collect counter packets long
flow exporter FLOWE-GICS
destination AA.BB.CC.DD
source GigabitEthernet0/0/0.1510
dscp 56
transport udp 2055
flow exporter SOLAR
destination FF.GG.HH.II
source GigabitEthernet0/0/0.1510
dscp 56
transport udp 2055
flow monitor FLOW-MONITOR-SOLAR
exporter FLOWE-GICS
exporter SOLAR
cache timeout active 60
record FLOWR-SUNAT

!
interface GigabitEthernet0/0/0.1510
description ENLACE WAN CD XXXX
encapsulation dot1Q 1510
ip flow monitor FLOW-MONITOR-SOLAR input
ip flow monitor FLOW-MONITOR-SOLAR output
ip address MM.NN.OO.PP 255.255.255.252
service-policy output OUT_VPN
end

!

show version

Cisco IOS XE Software, Version 16.06.04
Cisco IOS Software [Everest], ISR Software (ARMV8EB_LINUX_IOSD-UNIVERSALK9_IAS-M), Version 16.6.4, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Sun 08-Jul-18 01:38 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2018 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON

ROUPCCHIPR uptime is 1 week, 28 minutes
Uptime for this control processor is 1 week, 31 minutes
System returned to ROM by PowerOn
System restarted at 08:35:02 GMT Fri Sep 17 2021
System image file is "bootflash:c1100-universalk9_ias.16.06.04.SPA.bin"
Last reload reason: PowerOn

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Suite License Information for Module:'esg'

--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 None None None
securityk9
appxk9

Technology Package License Information:

-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 appxk9 Permanent appxk9
securityk9 None None None
ipbase ipbasek9 Permanent ipbasek9

cisco C1117-4P (1RU) processor with 1464045K/6147K bytes of memory.
Processor board ID FGL231714W5
1 Ethernet interface
4 Virtual Ethernet interfaces
5 Gigabit Ethernet interfaces
1 ATM interface
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
2863103K bytes of flash memory at bootflash:.
0K bytes of WebUI ODM Files at webui:.

Configuration register is 0x2102

[Georg Pauwen]

Hello,

you might want to globally configure:

ip flow export-version 9

[Giuseppe Larosa]

Hello @nostosalgos ,

interface gi0/0/0.1510 is at the same time the interface you would like to monitor with netflow and the source for sending netflow account packets.

You would see also those accounting flows exported.

If you want to test the feature apply the ip flow FLOW_MONITOR-SOL to other interfaces on the router and remove it from the interface used for exporiting netflow accounting data.

However, your configuration looks like correct try to apply the global command suggested by @Georg Pauwen about Netflow version.

Hope to help

Giuseppe

[balaji.bandi]

I never using mixing monitor in one (exports in) - i always use different IN and OUT flow Monitors

also worth adding below line for your monitor

cache timeout active 60

Can you post :

show flow monitor  FLOW-MONITOR-SOLAR cache

@i do not believe it required netflow version, some version of code now show, but can be view in show run all.