Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

CISCO 3560 flexible netflow

FormerMember

I´m trying to setup the new "Flexible Netflow" feature on a 3560G with IOS version 150-2.SE.

I have followed the diff. guides on the net but so far without any luck.

Do any in the forum have a working example how to setup Flexible Netflow on a 3560G?

I have included my setup if.

*************Config************************

flow exporter SolarwindsNF

description To Netflow in dkanm1

destination <IP for NTA>

source Vlan232

transport udp 2055

template data timeout 60

flow record standard

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

collect routing source as

collect routing destination as

collect routing next-hop address ipv4

collect ipv4 id

collect ipv4 source mask

collect ipv4 destination mask

collect transport tcp source-port

collect transport tcp destination-port

collect transport tcp flags

collect interface input

collect interface output

collect flow direction

collect counter bytes

collect counter packets

collect timestamp sys-uptime first

collect timestamp sys-uptime last

flow monitor standard-Monitor

description Default monitor

record standard

exporter SolarwindsNF

cache timeout active 60

interface GigabitEthernet0/24

description MPLS-Router

switchport access vlan 232

switchport mode access

ip flow monitor standard-Monitor input

spanning-tree portfast

ip flow monitor standard-Monitor input

ip address 10.144.232.254 255.255.255.0

ip helper-address 10.144.17.5

no ip mroute-cache

interface Vlan233

ip flow monitor standard-Monitor input

ip address 10.144.233.254 255.255.255.0

ip helper-address 10.144.17.5

no ip mroute-cache

Find more posts tagged with

Accepted answers

All comments

jswan

The 3560G does not support NetFlow. The commands are there (probably for OS-level compatibility with the 3560-X with the Flexible NetFlow expansion module), but they don't do anything.

FormerMember

Hi jswan

According to our official national Cisco office Felxible Netflow is supported on all 3560 models that will run IOS 12.2.58(SE) or never (And some in the 2900 series).

I also found a announcement from one of the competitors to NTA

http://blogs.manageengine.com/netflowanalyzer/2011/08/08/cisco-3k-switches-now-supports-netflow-export/

But so far no luck in getting anything into NTA however the switch seems to send some kind of netflow as NPM addes the "Netflow v9" on the summary window

rjnicholson

The article you posted is a bit off. You can do NETFLOW with that version of IOS but only SLT or Flex NetFlow. This is a different type of netflow you can read about it here.

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps10745/product_bulletin_c25-658743_ps6406_Products_Bulletin.html

You do in fact need the x-module that cost around 3-4k to have these switches export netflow. Once you send data into the module it can export it has NetFlow traffic.

jswan

Yeah, Richard is correct. The key phrase from the competitor's post: "NetFlow export can not be used for complete bandwidth monitoring or Billing purposes."

The reason the older switches can't do NetFlow export for bandwidth monitoring is that they simply don't have the correct ASIC for it. That's why the expansion module is needed on the X series: it gives you the ASIC to monitor the uplink ports (but not the regular ports, AFAIK).

The SLT feature described in the link Richard posted is possible because the switch events that trigger the Flexible NetFlow export event are handled at least partially in software rather than entirely on an ASIC.