Hi.
Relatively new the Thwack and NTA so grateful for some advice - mainly on applying Net flow to interfaces.
I am aware of the possibility of duplicate flow data if applied incorrectly to multiple interfaces but most examples don't quite mirror our setup. Basically we have switch stacks with 2 up-links to core switches as shown in my attached diagram. Data may flow from either or both. Therefore I have configured each interface to send flow data as shown below. This config seems to be working fine but I want to be sure I am collecting correctly.
I appreciate any thoughts and advice you can give:
flow record NTARecord_Ingress
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes long
collect counter packets long
Collect timestamp absolute first
Collect timestamp absolute last
flow record NTARecord_Egress
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
collect interface input
collect counter bytes long
collect counter packets long
Collect timestamp absolute first
Collect timestamp absolute last
flow exporter NTAExporter
destination (Solar Winds Web Server)
source Loopback0
transport udp 2055
flow monitor NTAMonitor_Ingress
exporter NTAExporter
cache timeout active 60
record NTARecord_Ingress
flow monitor NTAMonitor_Egress
exporter NTAExporter
cache timeout active 60
record NTARecord_Egress
interface GigabitEthernet1/1/1 and G2/1/1
..............................
ip flow monitor NTAMonitor_Ingress input
ip flow monitor NTAMonitor_Egress output
..............................
