Not able to see netflow on flow collector VM

[kishor.navale@logix.in]

We have installed SMC & FC appliance and configure netflow on switch but we dont see flow on Flow collector appliance. i can see the netflows on switches.

Plz help, here.

[Georg Pauwen]

Hello,

which switch model do you have ? Post the output of 'show version'...

[GRANT3779]

Hi,

Can we see the flow record please on the switch. I assume this is flexible Netflow?

I had issues before where traffic was getting to the collector but being dropped at collector due to the template not being recognized and I had to amend some fields of my flow record.

Is this Stealthwatch? There should be a capture option available that will let you see if this is the case.

[kishor.navale@logix.in]

Hi,

We are facing same problem here. As we dont see aby flows on FC its dropping the packets.

Take a look at the Cisco Netflow Configuration:

- flow exporter netflow_to_stealthwatch

- description Export NetFlow to StealthWatch

- destination 10.10.35.105<> use-vrf server

- transport udp 2055

- source Vlan22

- version 9

- flow record StealthWatch

- match ipv4 source address

- match ipv4 destination address

- match ip protocol

- match ip tos

- match transport source-port

- match transport destination-port

- collect routing destination as

- collect routing next-hop address ipv4

- collect transport tcp flags

- collect counter bytes

- collect counter packets

- collect timestamp sys-uptime last

- collect ip version

- sampler netflow_stealthwatch

- mode 1 out-of 1000

- flow monitor standard_v9netflow

- record StealthWatch

- exporter netflow_to_stealthwatch

-

- interface Vlan22

- description B-Prod-DMZ-App1

- no shutdown

- bandwidth 10000000

- delay 10

- vrf member server

- ip flow monitor standard_v9netflow input sampler netflow_stealthwatch

- no ip redirects

- ip address 10.10.23.253/23<>

- ip proxy-arp

- glbp 22

- ip 10.10.23.252<>

- priority 110

- load-balancing host-dependent

I can able see the packets on switch level.

Please guide how to resolve.

Thanks.

[GRANT3779]

Hi There,

Try the following record. If this works then add any further entries one at a time to see which it doesn't like. 

match ipv4 source address 
match ipv4 destination address
match ipv4 protocol
match transport source-port
match transport destination-port
match ipv4 tos
match interface input
collect interface output
collect counter bytes long
collect counter packets long

[kishor.navale@logix.in]

Still having the same problem. Not seen any flows.

[GRANT3779]

Hi, 

Can you take a packet capture from SC. It is under support/capture i believe. Have a look and see if the netflow data is indeed reaching the appliance but then being dropped.

[GRANT3779]

Can you also post current netflow config from device.

[kishor.navale@logix.in]

Hi,
Tried with packet capture can see the packet reaching FC but its dropped. Checked.

,

We are facing same problem here. As we dont see aby flows on FC its dropping the packets.

Take a look at the Cisco Netflow Configuration:

- flow exporter netflow_to_stealthwatch

- description Export NetFlow to StealthWatch

- destination 10.10.35.105<> use-vrf server

- transport udp 2055

- source Vlan22

- version 9

- flow record StealthWatch

- match ipv4 source address

- match ipv4 destination address

- match ip protocol

- match ip tos

- match transport source-port

- match transport destination-port

- collect routing destination as

- collect routing next-hop address ipv4

- collect transport tcp flags

- collect counter bytes

- collect counter packets

- collect timestamp sys-uptime last

- collect ip version

- sampler netflow_stealthwatch

- mode 1 out-of 1000

- flow monitor standard_v9netflow

- record StealthWatch

- exporter netflow_to_stealthwatch

-

- interface Vlan22

- description B-Prod-DMZ-App1

- no shutdown

- bandwidth 10000000

- delay 10

- vrf member server

- ip flow monitor standard_v9netflow input sampler netflow_stealthwatch

- no ip redirects

- ip address 10.10.23.253/23<>

- ip proxy-arp

- glbp 22

- ip 10.10.23.252<>

- priority 110

- load-balancing host-dependent

I can able see the packets on switch level.

Please guide how to resolve.

[GRANT3779]

Can you please amend the flow record so it ONLY has the following (for testing) - Remove all other entries within the record. You will have to disassociate it from the rest of the config first to amend it.

match ipv4 source address 
match ipv4 destination address
match ipv4 protocol
match transport source-port
match transport destination-port
match ipv4 tos
match interface input
collect interface output
collect counter bytes long
collect counter packets long