Need some clarity on Netflow

reply.prak

Hi ,

I want some clarity on netflow related data while configuring NTA. we have multiple level switches in network. like on top there is one core L3 switch and one L2 and One L3 switch is connected from this core switch. should i enable netflow on all the switch or only core switch and below connected L3 switch is sufficient to send all the data(including all the Mac-ports-Ips) to NTA server.

Regards

prak

jswan

You can go either way. It just depends whether you need the additional visibility on flows that might be confined to lower layers of the topology. NetFlow is interface-specific, so you need to export from all interfaces for which you need detailed visibility. If you only need visibility at the L3 point in the topology, that will be fine. However, be aware that if you do export from multiple points in the network and the same traffic crosses multiple interfaces, you'll get double-counting in your reports if you run reports that aggregate across those different interfaces.