04-22-2022 02:57 AM
Hello,
I am facing a problem with Netflow and port-channels.
i'm using a Catalyst 3850 on IOS 16.12.05b.
Everything works on physical ports without "port-channel"
But for the interfaces grouped in port channel, no traffic is detected :
Cache type: Normal (Platform cache)
Cache size: 10000
Current entries: 0
Flows added: 0
Flows aged: 0
Can you help me ?
My setup is basic:
flow record goelastic_input
match transport source-port
match transport destination-port
match ipv4 protocol
match ipv4 tos
match ipv4 ttl
match interface input
match flow direction
match datalink vlan input
match ipv4 source address
match ipv4 destination address
collect counter bytes long
collect counter packets long
!
!
flow exporter exp_goelastic_input
destination XX.XXX.XXX.XXX
source Loopback0
transport udp 2055
!
!
flow monitor ipv4_netflow_input
exporter exp_goelastic_input
cache timeout active 60
record goelastic_input
Solved! Go to Solution.
04-22-2022 04:53 AM - edited 04-22-2022 06:17 AM
Ok i found the problem.
the problem comes from nbar
we cannot apply on the same interface netflow and nbar
04-22-2022 03:30 AM - edited 04-22-2022 03:32 AM
Hi,
please post netflow configuration under the interfaces.
In addition:
Flexible NetFlow configurations applied on one of the Layer 3 port-channel member port will also be applied across all other member ports within the same device. For devices configured either as part of stack or with StackWise Virtual, Cisco recommends to configure the Flexible NetFlow on the port-channel interface.
Flexible NetFlow is not supported on the Layer 2 port-channel interface, but is supported on the Layer 2 port-channel member ports.
Multiple Flexible Netflow configurations are supported either on port-channel interface or port-channel member ports but not on both.
04-22-2022 04:25 AM - edited 04-22-2022 04:27 AM
Hi thanks for your respons,
here is the configuration of my port channels:
interface Port-channel43
switchport mode trunk
switchport nonegotiate
And the configuration of a physical interface:
interface GigabitEthernet1/0/11
switchport mode trunk
switchport nonegotiate
channel-group 43 mode active
ip nbar protocol-discovery
!
To listen to netflow traffic, I just apply the flow monitor to the physical interfaces (member of a port channel) :
#interface Gi1/0/1
#ip flow monitor .... input
it's supposed to work, I don't understand the error
Thanks for your help
04-22-2022 04:53 AM - edited 04-22-2022 06:17 AM
Ok i found the problem.
the problem comes from nbar
we cannot apply on the same interface netflow and nbar
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide