Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Configure Cisco Router for Netflow

I have spend many days trying to get my Cisco routers (12.4) working with the Network Traffic Anaysis and nothing seems to be working (no firewalls are blocking).

Can someone provide a cisco config that actually works with this tool? Ideally, I want to capture sub-interfaces and also our WAN interface (multilink and/or serial interfaces).

interface Multilink1
ip flow egress

ip flow-export source Multilink 1
ip flow-export version 9 (have tried ver 5 as well)
ip flow-export destination x.x.x.x 2055

In the network analsysis site

NetFlow Receiver Service [server] is receiving a NetFlow data stream from an unmanaged interface on 172.x.x.x. The NetFlow data stream will be discarded. Please use the Orion System Manager to add Interface #14 in order to process this NetFlow data stream.

What does it mean by Interface #14? We only have 4 interfaces on the router. All interfaces are setup in Orion.

Find more posts tagged with

Accepted answers

All comments

mark_wiggans

Use version 5 - then add all the interfaces on the router to Orion and then add them all to NetFlow.

The ones sending data (the netflow packets tagged with the interface id) will show up on the website with a "Time data received" timestamp. You can then delete the interfaces you do not need.

Those will say "Never".

Interfaces are assigned by Orion. Look at the interface details in the system manager to find interface 14.

also try this for catalyst www.solarwinds.com/.../OrionNetFlowSwitches.pdf

Hope that helps...

ckaleth

I have ALL interfaces added in Orion and Netflow but still nothing shows up. I see "never" for all interfaces and if I click on any of the intefaces it shows nothing. I can see my router sending the netflow traffic.

What about that beta that was suppose to configure the router for you? This should not be this difficult to monitor my traffic.

mark_wiggans

Verify that you are using version 5- version 9 will not work-

Go to Start > Run and type in Perfmon in the run dialog box. On the perfmon menu bar there is a “+” sign, select the “+” sign, change the Performance Object to “Solarwinds” and select the “All Counters” radial button. Click Add and Close. Change the view to View Report (click CTRL+R or click the view just to the left of the “+” sign. )

From here you should see the NetFlow v5 packet count increments

if you are not seeing any progress or data

- I would encourage you to submit a ticket so a deeper analysis can be placed on your system and configuration setup-

forms.netsuite.com/.../externalcasepage.nl

joesim123

Here's the perfect small config...

ip flow-cache timeout active 1
ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination 10.245.8.36 9995

Then on your interfaces...I'll use two examples:

interface FastEthernet0/0
ip route-cache flow
!
!
interface Serial0/0/0
ip route-cache flow

Notes: In the "ip flow-export source Loopback0" the source interface needs to be in Solarwinds Orion somewhere...either as the node IP or being monitored by Orion. Secondly, in your example, you changed the destination port to 2055. The standard default is 9995 and Orion Netflow app its set to listen on 9995.

Mithrilhall

I'm trying out the evaluation and I'm having trouble setting Netflow up on the routers.

Router - Cisco 1711

ip flow-cache timeout active 1
ip flow-export source FastEthernet 0
ip flow-export version 5
ip flow-export destination 10.1.3.45 9995

Should I be setting up " ip route-cache flow" on each interface?

FastEthernet 0 - To the Internet
FastEthernet 1 - To computer
FastEthernet 2 - To computer
FastEthernet 3 - To computer
FastEthernet 4 - To computer
Tunnel 11 - VPN tunnel to home office

ckaleth

1)If you configure Fastether0/0 with the ip route-cache command will it include all sub-interfaces? I tried adding that command to a sub-interface and its not an option.

(config)#int fas0/0.34
(config-subif)#ip route-cache ?
same-interface Enable fast-switching on the same interface
<cr>

2)Do you need to add the ingress/egress command on each interface or just the loopback? What is the difference between ingress/egress?
Ex.) LAN ----- > ROUTER ------- WAN
What happens when ingress is configured on the router? Does it capture traffic coming from the WAN or traffic from the LAN?

3) The port that was configured when I installed the app was 2055. No biggie as long as they set on both sides

joesim123

Make sure your using the command "ip route-cache flow"

For sub-interfaces, simply add the command to the primary interface....not the subs. The subs won't take it as you know. Adding it to the primary interface enables all the sub interfaces for NetFlow.

In the Orion NetFlow setup area, make sure you add the primary and/or subs to netflow in Orion.....depending on what your trying to get.

No need to use the ingress/egress commands if your using the 'ip route-cache flow' statement. They are just alternative commands.

The rule of thumb for using Netflow is this: On a L3 device, you should add NetFlow to EVERY L3 interface on the device to make sure you capture all possible flows.

If you have a router with 5 interfaces, add 'ip route-cache flow' to all five interfaces. If you have a L3 switch, like a 6500, add NetFlow (ip route-cache flow) to every L3 interface on the switch.

ckaleth

I'm still having issues getting the sub-interfaces to report (the WAN and second Gig interface work (no subs on this interface). Here is an example config I am using.

The subinteface is setup in Orion and Neflow. Any thoughts?

interface GigabitEthernet0/0
no ip address
ip route-cache flow
no keepalive
!
interface GigabitEthernet0/0.3
encapsulation dot1Q 3
ip address 172.x.x.2 255.255.255.0
no ip redirects
standby 3 ip 172.x.x.1
standby 3 priority 110
standby 3 preempt