"ip flow ingress" or "ip flow egress" in Cat3850 or Cat9300

[bensonlei]

Hi, Guys,

I am far away from such configuration.

Any document or article about the these configuration in Cat3850 and Cat9300 ?

I would like to enable the netflow in the latest switches, in order to check/inspect network traffic within the devices in real-time; any advice or recommendation ?

Many many thanks

[balaji.bandi]

here is a good example to start with IOS XE (both 3850 and 9300 )

https://support.solarwinds.com/SuccessCenter/s/article/NetFlow-Configuration-Example-Cisco-3850-IOS-XE?language=en_US

[bensonlei]

Hi BB,

Is this configuration for only exporting netflow data to Solarwinds ?

I would like to find the netflow configuration for inspecting netflow traffic in siwtches themselves, any recommendation ?

Thanks

Benson LEI

[balaji.bandi]

as i understand you want to have this exported inside switch. ? Cat 9300 you can have app deployment (is this consider here ?)

[Giuseppe Larosa · Accepted solution]

Hello @bensonlei ,

Netflow has been always used up to now in this way:

the network device(s) export flow data to a collector .

On the collector you can perform different types of analysis consolidation of data.

From a security point of view you may be interested on the TOP N talkers among hosts and  so on.

Running a collector on the switch itself using recent features like IOx or IOS XE guestshell might be difficult as there is also a need to store data on a hard  disk.

In other words netflow has been deployed in this distributed way and it is not so "real time" as you may think.

I would suggest you to explore the options of the CLI that can provide the TOPN talkrs from the cache

Hope to help

Giuseppe

[bensonlei]

Hi, Giuseppe,

Great thanks for your update information.

But what a pity, we donot have a netflow device....only be able to inspect the traffic and ip within the device.

By the way, if it is possible to write an EEM script to capture the TOPN talkers in some scheduled periods, any recommendation ?

Cheers

Benson LEI