Hello!
I have a 2811 doing dNAT and not much else. I was playing around with NetFlow data exporting, when a very confusing issue arose.
Initially, both interfaces had ip route-cache flow configured, and everything worked fine. Then I switched to ip flow ingress, which AFAIK is the same command on newer IOS releases.
Now, if I turn inbound NetFlow off on LAN interface with no ip flow ingress, all DNS traffic from LAN to WAN stops coming through.
This is very confusing, since cisco command reference describe ip flow commands as commands for collecting data, not actually doing any switching, and ip route-cache flow is called deprecated and substituted by ip flow ingress.
I'd like to disable ingress netflow in favor of egress, but can't do that, since DNS service is of course mandatory. Even if that's not possible, I would very much like to know what's going on.
Any suggestions are greatly appreciated!
The config:
Current configuration : 2231 bytes
!
! Last configuration change at 00:19:29 UTC+4 Thu Aug 15 2013 by ***
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ***
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
aaa session-id common
!
resource policy
!
clock timezone UTC+4 4
ip subnet-zero
!
!
ip cef
!
!
ip flow-cache timeout active 3
!
username *** privilege 15 secret **********************
!
!
!
interface FastEthernet0/0
description RoSNet
ip address 217.171.15.*** 255.255.255.240 secondary
ip address 217.171.15.*** 255.255.255.240
ip flow ingress
ip flow egress
ip nat outside
duplex auto
speed auto
no cdp enable
!
interface FastEthernet0/1
ip address 192.168.0.1 255.255.255.0
ip access-group 101 in
ip flow ingress
ip flow egress
ip nat inside
duplex auto
speed auto
!
ip classless
ip route 0.0.0.0 0.0.0.0 217.171.15.***
ip route 192.168.2.0 255.255.255.0 192.168.0.242
ip flow-export version 9
ip flow-export destination 192.168.0.43 9996
!
no ip http server
ip nat inside source list 1 interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.0.129 *** 217.171.15.*** *** extendable
ip nat inside source static tcp 192.168.0.130 *** 217.171.15.*** *** extendable
ip nat inside source static tcp 192.168.0.131 *** 217.171.15.*** *** extendable
ip nat inside source static tcp 192.168.0.134 *** 217.171.15.*** *** extendable
ip nat inside source static tcp 192.168.0.135 *** 217.171.15.*** *** extendable
ip nat inside source static tcp 192.168.0.250 *** 217.171.15.*** *** extendable
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 12 permit 192.168.0.0 0.0.0.255
access-list 12 deny any
access-list 101 permit ip any any
snmp-server group snmpsec v2c access 12
snmp-server community public RO 12
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
access-class 12 in
privilege level 15
transport input telnet
line vty 5 15
access-class 12 in
privilege level 15
transport input telnet
!
scheduler allocate 20000 1000
ntp clock-period 17180328
ntp server 192.168.0.252
!
end
