Netflow on 2960x switch

[mrochac]

Good day all - please see what i used to attempt to gather netflow from a switch; my question here is - why do i see traffic from all my other branches from this one location?

flow record record1
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect counter bytes long
collect counter packets long
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
flow exporter export1
destination 172.24.5.25
transport udp 2055
template data timeout 60
!
!
flow monitor monitor1
exporter export1
cache timeout inactive 120
cache timeout active 300
record record1

[Jaderson Pessoa]

Hello,

This switch connect your other branches?

I suggest to apply it on interface/vlan that you need see traffic.

[mrochac]

yes an no -  its a weird design, all branches connect to MPLS service provider (CE) using access port, so in theory yes. I was under the impression this would not work since it's a layer 3 service but i guess not. not as great as running on router but every bit counts.

MR.

[mrochac]

Hi there here is the conifg; applied to vlan 1 - still seeing traffic from multiple locations, normal?

interface Vlan1
description old-data
ip flow monitor monitor1 sampler SampleTest input
ip address 192.168.3.9 255.255.255.0
no ip redirects
end

[Jaderson Pessoa · Accepted solution]

Yes, man if your vlan 1 is used in all branches and they are connected on this SWL3, you will see the traffic from them. Below an exemple of netflow configuration.

flow record Netflow-In
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match flow direction
collect interface output
collect counter bytes long
collect counter packets long
!
flow record Netflow-Out
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
match flow direction
collect interface input
collect counter bytes long
collect counter packets long
!
flow exporter export1
description ### Export to SolarWinds:Flow-Analizer ###
destination 3.3.3.3
source Vlan10
transport udp 2055
!

!Exemple using VRF
!flow exporter export1
! description ### Export to SolarWinds:Flow-Analizer ###
! destination 1.1.1.1 vrf VRFNAME
! source 202 (check vlan id)
! transport udp 2055
!

flow monitor Netflow-Monitor-In
description ### Export to SolarWinds:Flow-Analizer ###
exporter export1
cache timeout inactive 10
cache timeout active 60
record Netflow-In
!
!
flow monitor Netflow-Monitor-Out
description ### Export to SolarWinds:Flow-Analizer ###
exporter export1
cache timeout inactive 10
cache timeout active 60
record Netflow-Out
!
!

! Check vlans that want monitor
vlan configuration 100,101,200-205
ip flow monitor Netflow-Monitor-In input
ip flow monitor Netflow-Monitor-Out output

[mrochac]

Thanks for the info Jaderson - its working fine now, after some research i notice that some of the other locations were also using the same UDP port (go figure....always over look easy!) i made changes and added some of your suggestions.

thanks.

[Jaderson Pessoa · Accepted solution]

Great, good lucky.