ip flow issue

[pashtigo1]

Hello everybody.

I'm having issue with ip flow.

I use cisco ISR G2 2951 as my edge router. 48-ports switch module is installed there. I need activate ip flow there but I'm afraid current IOS version is not supporting it. There is show version output below. Thank you forward.

Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 12.2(52)EX1, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2010 by Cisco Systems, Inc.

Compiled Thu 13-May-10 14:25 by prod_rel_team

Image text-base: 0x00003000, data-base: 0x02400000

ROM: Bootstrap program is C3560E boot loader

BOOTLDR: C3560E Boot Loader (C3560E-HBOOT-M) Version 12.2(52r)EX, RELEASE SOFTWARE (fc1)

Internet uptime is 16 weeks, 3 days, 6 hours, 38 minutes

System returned to ROM by power-on

System restarted at 01:05:56 UTC Fri May 20 2011

System image file is "flash:/c3560e-universalk9-mz.122-52.EX1.bin"

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

License Level: ipbase

License Type: Default. No valid license found.

Next reload license Level: ipbase

cisco SM-D-ES3-48-P (PowerPC405) processor with 131072K bytes of memory.

Processor board ID FOC14171ZZB

Last reset from power-on

3 Virtual Ethernet interfaces

48 FastEthernet interfaces

4 Gigabit Ethernet interfaces

The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address       : C8:4C:75:FE:C8:80

Motherboard serial number       : FOC14171ZZB

Model number                    : SM-D-ES3-48-P

System serial number            : FOC14171ZZB

Hardware Board Revision Number  : 0x00

Switch Ports Model              SW Version            SW Image                

------ ----- -----              ----------            ----------              

*    1 52    SM-D-ES3-48-P      12.2(52)EX1           C3560E-UNIVERSALK9-M    

Configuration register is 0xF

[garapoglou]

Hi,

The output you provide is from a Cisco 3560 switch instead.

Best regards,

Giorgos

[pashtigo1]

This is output from 48-ports switch module. it gives exactly what U see

[garapoglou]

I thought you were talking about the edge router.

Anyway, the IOS version running on the switch supports Netflow.

Best regards,

Giorgos

[pashtigo1]

this is edge router with switch module and no ip flow command are available there.

[garapoglou]

I was wrong on my previous reply, sorry about that. I double-checked with Cisco and found Netflow is not supported on 3560.

http://www.manageengine.com/products/netflow/help/cisco-netflow/netflow-ios-versions.html

Giorgos

[Don Jacob]

Hi,

This switch module if it has IOS 12.2(58)SE and carries the IP base or IP services license, can support NetFlow. Can you try configuring NetFlow as in the below link:

https://blogs.manageengine.com/netflowanalyzer/2011/08/08/cisco-3k-switches-now-supports-netflow-export

If that doesnt work, you may need to talk to Cisco TAC about possible upgrade paths if any.

Regards,

Don Thomas Jacob

ME - NetFlow Analyzer

[Richard Burts]

I find Don's answer to be slightly misleading. I read the release notes for 12.2(58)SE and found that a new feature called Smart Logging and Telemetry on the 3560E can use NetFlow v9 formatted messages to send notification of particular events. I then read the link that Don posted a bit more carefully and found this disclaimer:"As always there are limitations like, this NetFlow export can not be used for complete bandwidth monitoring or Billing purposes. But you can use this technology to track users traffic denial and flow creations etc and also can be used for security analytics." I think that what it is saying is that this is not really an implementation of NetFlow that Pavel could use to monitor his switch.

HTH

Rick

[Don Jacob]

Hi Richard,

Apologies if I was not clear. I think I should have mentioned SLT instead of NetFlow. My position was regarding support for NetFlow (or SLT) on the ES3 module which may be possible with the IOS version I had mentioned.The reason I stated this is because the module is based on Cisco 3560E switch. A comment from Cisco below:

The Cisco Enhanced EtherSwitch Service Modules  (Figure 1) greatly expands the router's capabilities by integrating  industry-leading Layer 2 and Layer 3 switching with feature sets  identical to those found in the Cisco Catalyst® 3560-E and Catalyst 2960 Series Switches.

Now, 3560E added SLT support from IOS 12.2(58)SE, which is based on NetFlow v9 and so I expect the switch module also to support SLT if it has a similar IOS. SLT is triggered based on events occurring on the switch, like ACL permitting or denying a packet. In short, using SLT users will be able to see traffic conversations occuring but they will not be exported with volume / speed details in real time.

An important use of NetFlow traditionally has been bandwidth monitoring due to its ability to export traffic information in almost real time and due to its ability to account for traffic based on IN / OUT direction.

But, SLT exports information based on events triggered and not based on active and inactive flow timeout as with NetFlow. Furthermore,traffic direction (IN or OUT) may not be captured with SLT. Since bandwidth information is not available in real time and becuase direction of traffic is not captured, SLT cannot be used for bandwidth monitoring or usage based billing purposes but can still can help in traffic analytics.

Regards,

Don Thomas Jacob

ME - NetFlow Analyzer

[pashtigo1]

Thanks all for the help