Netflow

[hs08]

Hello,

I enabled netflow on interface g0/0/1 which this interface connected to the ISP. Then why on my flow collector there is flow source from interface g0/0/0? My flow collector vendor say even we only configure netflow only in one interface, actually the device also send from other interface. Is that statement is correct?

[Giuseppe Larosa · Accepted solution]

Hello @hs08 ,

the export of flows to the collector will use the interface that would be used to reach the server, unless there is an explicit configuration.

So yes you can have netflow enabled on gi0/0/1 and the flows can be exported using the source of gi0/0/0 if the route to the destination server is via gi0/0/0.

Hope to help

Giuseppe

[hs08]

Hello @Giuseppe Larosa 

So if I'm only want the flow send on interface g0/0/1 and not from other interface, it's possible?

[Giuseppe Larosa]

Hello @hs08 ,

>> So if I'm only want the flow send on interface g0/0/1 and not from other interface, it's possible?

yes, it is possible you need to configure the source to be used as gi0/0/1's IP address.

I guess it should be done in the flow exporter profile.

try to see if there is a source option in flow exporter configuration mode.

Edit:

• source interface-type interface-number see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-16/fnf-xe-16-book/fnf-output-features.html
• the command is given in the flow exporter context

Most of the times we use a loopback address as source for consistency over time as it will never go down until the node is alive and connected to the rest of the network.

Hope to help

Giuseppe

[hs08]

will try, thanks.