Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Cisco 6509 Netflow problems...

Hi All,

I am trying to get Netflow configured on my Cisco 6509 switch... I have managed to get my ORION netflow server to successfully see data from one routed interface (gi1/41) and 2 VLAN interfaces, but i cannot seem to get it to pick up the other 7 or so VLAN interfaces. I have followed many configuration guides and am presuming that something is working as i can see a few of the interfaces. My config is:

ip flow ingress layer2-switched vlan 2-3,8,50,200,300,400,500,999
mls ip multicast flow-stat-timer 9
mls aging long 64
mls aging normal 32
mls flow ip interface-full
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
mls cef error action freeze

interface Vlan2
description NPNetMan
ip address xxx.xxx.xxx.xxx 255.255.255.0
ip flow ingress

interface GigabitEthernet1/41
description xxxxxxxxxxxxxxxxxxxxxxxx
ip address xxx.xxx.xxx.xxx 255.255.255.252
no ip redirects
ip flow ingress

ip flow-export source Vlan2
ip flow-export version 5
ip flow-export destination xxx.xxx.xxx.xxx 2055

there are a large number of VLAN interfaces and they are all configrured as per VLAN 2 above. Interface gi1/41 is correctly exporting data and i am getting some lovely stats from it, i am also able to see stats from 2 of the 7 VLAN interfaces... any ideas? The Interfaces are all monitored in ORION and selected for the NTA as well and i am now going round in circles trying to work out what is going wrong...

Many thanks

Jonathan

Find more posts tagged with

Accepted answers

hairy51

Hi,

I have actually managed to get it working now, all i did was remove the node from ORION and re-add it. All of the interfaces then began to report traffic to the analyser.

I have actually configured each interface with the "ip flow ingress" command, as this is what the ORION documentation instructed, and as far as understood, this does the same as the "IP route-cache flow" command.

The monitoring server appears to be collecting the netflow data ok now. Is there any reason i should be using the route-cache command as opposed to the ip flow ingress command?

Cheers

Jon

All comments

BXIV

do you have "ip route-cache flow" on the interface vlans?

hairy51

Hi,

I have actually managed to get it working now, all i did was remove the node from ORION and re-add it. All of the interfaces then began to report traffic to the analyser.

The monitoring server appears to be collecting the netflow data ok now. Is there any reason i should be using the route-cache command as opposed to the ip flow ingress command?

Cheers

Jon

BXIV

ingress , packets coming into the network

egress are the packets leaving

hairy51

Hi again,

So i am assuming that there is no difference in using the ip flow ingress command to using the ip route-cache flow command.

All is working quite happily now,

Many thanks

:-)