Does NetFlow not work on L2 interfaces?

[Mitrixsen]

Hello, everyone.

I am studying NetFlow and here is my topology:

I started a ping from R2 to R1 and I configured the following on SW1:

Why doesn't SW1 register the flow (ignore the Total Flows set to 1, that was from a different config)? I've read some explanations on the internet which said  that NetFlow won't capture anything on L2 ports? So is it not possible to capture local LAN/VLAN flows?

Thank you.

David

[Joseph W. Doherty]

"Why doesn't SW1 register the flow . . . ?"

Most likely for the same reason "switch when you can, route when you must".

If you don't know the latter's reason, its forwarding performance.

BTW, and historically, on routers, a major feature of NetFlow was to increase a router's performance.  On a switch, it would decrease its performance.

Today, a switch's performance wouldn't necessarily be impacted, but it would very likely increase its cost.

[balaji.bandi]

I am not sure in the Virtual environment, but the recent Cat 9K Model works.

May be try cat 9K v for testing (you may need good compute for the image - i have not tested).

[Joseph W. Doherty]

". . . but the recent Cat 9K Model works."

I didn't know that but not too surprising as these current gen switches are also L3 and aren't particularly inexpensive.

I find it interesting how many previously only software features are now supported by hardware, often Cisco proprietary hardware.

[Giuseppe Larosa]

Hello @Mitrixsen ,

as noted by BB some platforms may support it but my guess is you need a special configuration for netflow to capture bridged traffic. I have seen it on Nexus 9000 series.

see

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-16/configuration_guide/nmgmt/b_1716_nmgmt_9300_cg/configuring_flexible_netflow.html#task_wmh_rjf_qgb

My understanding is that you can configure bridged netflow at broadcast domain layer.

on a physical layer 2 interface you can create a custom flow record that matches on IP and/or on MAC addresses or ethertype and it is supported only in  ingress direction.

Hope to help

Giuseppe