9300 Switch - Netflow on SPAN Destination Port

[Sijian.Bao]

Hello All,

So the thing is like this. We've setup the netflow on our 9300 switch to send the flows to the analyzer years ago. Now we'd like to filter out some specific traffic like any traffic comming from or going to the host 1.1.1.1

It seems that 9300 is not supporting Performance Monitor for the moment, so I could not do it from Netflow side. Then I'm thinking if I can SPAN the traffic from the interface we've setup the Netflow already to another port with SPAN filter and Netflow the destination port. The SPAN filtering is working fine but it seems the Netflow is not sending any flows to our analyzer

Do you know if this is possible or is there any other way I can try with?

Thanks

[balaji.bandi]

how is your config look like, i have not tested mixing span and netflow.

but SPAN should give fully mirrror traffic.

how about flexible netflow matching ipv4 destination

[Sijian.Bao]

Hello Balaji,

Here comes the configuration:

SPAN:

monitor session 2 source interface Gi1/0/3 rx
monitor session 2 destination interface Gi2/0/2
monitor session 2 filter ip access-group Zscaler


Netflow:

flow record Flow_Rec_In
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
match ipv4 tos
match flow direction
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last
flow record Flow_Rec_Out
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface output
match ipv4 tos
match flow direction
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last

flow exporter Flow_Exp_WUG
description Exporter to WUG
destination x.x.x.x
source Vlan110
transport udp 9999
template data timeout 900

flow monitor Flow_Mon_In
description Monitor to WUG
exporter Flow_Exp_WUG
cache timeout active 60
record Flow_Rec_In
flow monitor Flow_Mon_Out
description Monitor to WUG
exporter Flow_Exp_WUG
cache timeout active 60
record Flow_Rec_Out

interface GigabitEthernet2/0/2
ip flow monitor Flow_Mon_In input
ip flow monitor Flow_Mon_Out output

I just include both source/destination (in/out) for testing but no luck.

Thanks

[Sijian.Bao]

Edited