Hi all
i am tearing my hair out trying to get Netflow working from a Cisco 3750X to NTA. It is running IPservices, IOS 15.2(4)E3 and has the required C3KX-NM-10G module.
i have used the config from this topic - https://thwack.solarwinds.com/community/solarwinds-community/geek-speak_tht/blog/2014/01/22/netflow-and-catalyst-switch-…
granted it is for a 3850 but most of the syntax matches. NTA is seeing it but telling me it is an invalid template. i dont have issues with other devices(routers), just 3750X's. It is for a trunk port but some users indicate i can still get the Netflow with layer2-switched output?
I've spent ages trying to get this working but close to giving up. Any advice? I am guessing its an obscure template option but I have tried the ones specified here as well - http://www.solarwinds.com/documentation/kbLoader.aspx?lang=en&kb=802
Config:
flow record FR-NETFLOW-IN
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input physical snmp
collect interface output snmp
collect counter bytes long
collect counter packets long
!
flow record FR-NETFLOW-OUT
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output physical snmp
collect interface input snmp
collect counter bytes long
collect counter packets long
!
flow exporter FE-NETFLOW-IN
destination x.x.x.x vrf VRF-MGT
source Vlan100
transport udp 2055
option interface-table timeout 60
!
flow exporter FE-NETFLOW-OUT
destination x.x.x.x vrf VRF-MGT
source Vlan100
transport udp 2055
option interface-table timeout 60
!
flow monitor FM-NETFLOW-INGRESS
exporter FE-NETFLOW-IN
cache timeout active 60
record FR-NETFLOW-IN
!
flow monitor FM-NETFLOW-EGRESS
exporter FE-NETFLOW-OUT
cache timeout active 60
record FR-NETFLOW-OUT
!
interface GigabitEthernet1/1/1
switchport trunk allowed vlan 100,110,111
switchport trunk encapsulation dot1q
switchport trunk native vlan 110
switchport mode trunk
ip flow monitor FM-NETFLOW-INGRESS layer2-switched input
ip flow monitor FM-NETFLOW-EGRESS layer2-switched output
Some show commands:
sh flow exporter templates
Flow Exporter FE-NETFLOW-IN:
Client: Option options interface-table
Exporter Format: NetFlow Version 9
Template ID : 256
Source ID : 1
Record Size : 104
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| v9-scope system | 1 | 0 | 4 |
| interface input snmp | 10 | 4 | 4 |
| interface name short | 82 | 8 | 32 |
| interface name long | 83 | 40 | 64 |
---------------------------------------------------------------------
Client: Flow Monitor FM-NETFLOW-INGRESS
Exporter Format: NetFlow Version 9
Template ID : 258
Source ID : 1
Record Size : 38
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| interface input physical snmp | 252 | 8 | 4 |
| transport source-port | 7 | 12 | 2 |
| transport destination-port | 11 | 14 | 2 |
| ip tos | 5 | 16 | 1 |
| ip protocol | 4 | 17 | 1 |
| interface output snmp | 14 | 18 | 4 |
| counter bytes long | 1 | 22 | 8 |
| counter packets long | 2 | 30 | 8 |
---------------------------------------------------------------------
Client: Flow Monitor FM-NETFLOW-INGRESS
Exporter Format: NetFlow Version 9
Template ID : 0
Source ID : 0
Record Size : 42
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| transport source-port | 7 | 8 | 2 |
| transport destination-port | 11 | 10 | 2 |
| interface output snmp | 14 | 12 | 4 |
| interface input physical snmp | 252 | 16 | 4 |
---------------------------------------------------------------------
Flow Exporter FE-NETFLOW-OUT:
Client: Option options interface-table
Exporter Format: NetFlow Version 9
Template ID : 256
Source ID : 1
Record Size : 104
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| v9-scope system | 1 | 0 | 4 |
| interface input snmp | 10 | 4 | 4 |
| interface name short | 82 | 8 | 32 |
| interface name long | 83 | 40 | 64 |
---------------------------------------------------------------------
Client: Flow Monitor FM-NETFLOW-EGRESS
Exporter Format: NetFlow Version 9
Template ID : 258
Source ID : 1
Record Size : 38
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| interface output physical snmp | 253 | 8 | 4 |
| transport source-port | 7 | 12 | 2 |
| transport destination-port | 11 | 14 | 2 |
| ip tos | 5 | 16 | 1 |
| ip protocol | 4 | 17 | 1 |
| interface input snmp | 10 | 18 | 4 |
| counter bytes long | 1 | 22 | 8 |
| counter packets long | 2 | 30 | 8 |
---------------------------------------------------------------------
Client: Flow Monitor FM-NETFLOW-EGRESS
Exporter Format: NetFlow Version 9
Template ID : 0
Source ID : 0
Record Size : 42
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| transport source-port | 7 | 8 | 2 |
| transport destination-port | 11 | 10 | 2 |
| interface input snmp | 10 | 12 | 4 |
| interface output physical snmp | 253 | 16 | 4 |
---------------------------------------------------------------------
sh flow exporter statistics
Flow Exporter FE-NETFLOW-IN:
Packet send statistics (last cleared 01:11:35 ago):
Successfully sent: 288 (299520 bytes)
Client send statistics:
Client: Option options interface-table
Records added: 2664
- sent: 2664
Bytes added: 266400
- sent: 266400
Client: Flow Monitor FM-NETFLOW-INGRESS
Records added: 0
Bytes added: 0
Flow Exporter FE-NETFLOW-OUT:
Packet send statistics (last cleared 01:11:35 ago):
Successfully sent: 288 (299520 bytes)
Client send statistics:
Client: Option options interface-table
Records added: 2664
- sent: 2664
Bytes added: 266400
- sent: 266400
Client: Flow Monitor FM-NETFLOW-EGRESS
Records added: 0
Bytes added: 0
