26 Replies Latest reply on Oct 8, 2009 11:45 AM by r0berth1

    Netflow Config On 6509

    jeff.stewart

      Just thought I'd post this since it seemed confusing during our install.

       To config our 6509 for netflow data to be sent we added the following commands.

      mls flow ip full

      mls nde sender version 5

      ip flow-export source blahblah

      ip flow-export version 5

      ip flow-export destination blahblah portblah

      This will send netflow data for all routed interface on the router.  No need to add 'ip route cache flow' or any other command to each interface.

        • Re: Netflow Config On 6509
          jp

          Thanks, Jeff!

          This looks just like what I use as well, just wanted to verify this for others on the forum.

          'mls netflow sampling' also helps on some of our SVIs if we're missing some statistics - this often happens.

          -JP

          • Re: Netflow Config On 6509
            SLXer

            On 6500s

            If you are planning on flowing layer 2 / vlan info you will need the following commands

            ip flow ingress layer2-switched vlan X

            mls flow ip interface-full

            l3 interfaces will need the following command entered in order to flow

            ip flow ingress or ip flow egress or both i suppose depending on your application

              • Re: Netflow Config On 6509

                Yes,

                on the other hand, please take care of command on 6500, which are native mode and hybrid OS.

                Native mode is mostly using IOS and Hybrid mode is mostly using CATOS.

                Below is a link for your reference to configure your 6509 switch.

                http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080721701.shtml

                • Re: Netflow Config On 6509
                  r0berth1

                  this command "ip flow ingress layer2-switched vlan X" does not work on a 6509 with "Cisco Internetwork Operating System Software
                  IOS (tm) s72033_rp Software (s72033_rp-PK9SV-M), Version 12.2(17d)SXB11a, RELEASE SOFTWARE (fc1)".

                  • Re: Netflow Config On 6509

                    Hello all,

                    This has been quite confusing.  We have implemented Netflow on all our 2821 routers.  It was pretty easy. 

                    Now the 6513 we have is a whole other story.  none of the suggested answers posted here work.
                    ip flow ingress layer2-switched vlan X is not even an option.  Once I hit "layer2" when typing the command, it is not recognized.

                    I have had success for about 20 minutes using this method:

                    Conf t - Int vlanXX

                    Ip flow ingress

                    ip route-cache flow

                    Conf t

                    ip flow-export version 5

                    ip flow-export source vlanXX

                    ip flow-export destination x.x.x.x 2055

                     

                    This sends the vlan traffic to Orion, and displays properly for about 20 minutes, then it just stops.  Also, when using this method, 99% of the stats are regarding the broadcast IP of the vlan.

                    Can anyone out there come up with a solid method for implementing netflow on a 6513?

                    Ciscos docs dont seem to help me out.

                      • Re: Netflow Config On 6509
                        SLXer

                        If this is not a layer 3 interface your not going to flow from it. If supported you would need to configure netflow on the layer 3 vlan interface.

                        If your access side is layer 2 your layer 3 vlans are likely on your core.

                        I hope this helps

                          • Re: Netflow Config On 6509

                            Thanks for the tip SLXer,

                            I believe it is a layer 3 interface.  It is a user VLAN (10.66.130.0) and connects to our core switch on blade one.  on blade 2 is where we have all our servers (10.66.128.0)

                            Blade 3 is our DMZ stuff, etc.

                            When I used the config I had previously posted, the flows came to Orion for about 20 minutes, then abrublty stopped.  Also, it was all hosts talking to the broadcast IP 10.66.133.255.

                            Perhaps its not a layer 3 interface and I am in over my head.  We basically want to see the flows from this user VLAN, but I am not having any luck searching Cisco or Thwack.

                            Thanks again for the tip!

                              • Re: Netflow Config On 6509
                                SLXer

                                Mike,

                                I can promise you your never going to see more than what your seeing right now with that configuration.

                                Its rather annoying that cisco lets you apply the netflow configuration to a layer 2 interface. No doubt its because the interface has the capacity to be configured as a layer 3 interface.

                                Netflow however is a layer 3 technology and will only work properly when applied to a layer 3 interface.

                                (For it to be a layer 3 interface the interface would need its own IP address)

                                  • Re: Netflow Config On 6509

                                    Thanks SLXer,

                                    Without getting to technical, off the top of your head, do you know of a way to configure this to get flows from users who connect to the core switch through fiber trunks?
                                    We are a New York State Agency, and we have several offices through out the state.  It was pretty easy to set up Netflow on these Far Site 2821 routers.  Life was great.

                                    Then MGMT wanted to see the flow traffic of users here in our 10 Floor Central Office.  Each floors user switch (3550) connects back to the core using a fiber trunk.  Blade 1 of our core are all the fiber connections to switch closets.

                                    Anyway we can config the 6513 to see the flows of this traffic? 
                                    If we cant, then it really impacts our use of Netflow.  Seeing the top talkers, apps, convos of these far sites is great, but we are missing a GIANT chunk if we cant see any of the 500 users here at the Central Office.

                                    Any assistance would be GREATLY appreciated.

                                    Thanks again!

                                      • Re: Netflow Config On 6509
                                        chris.lapoint

                                        I found a post on another forum that might help.  Let me know if this helps or not.

                                        =================

                                        Create a dummy L3 interface for each VLAN.  Don't give it an IP and then shut it down.

                                        E.g.

                                        interface vlan 123
                                        description FOR NETFLOW DO NOT USE
                                        no ip address
                                        shutdown
                                        end

                                        Ensure you have the following command:

                                        ip flow ingress layer2-switched vlan 123 (add any vlans you want)

                                        In Orion NTA, you will want to  put a different name on the interface. Recommend making a distinction between L2 and L3 so it doesn't get confusing. For L2 you may want to increase the speed to something higher than the typical port speed (e.g. speed of the maximum etherchannel going to the switch or backplane speed).

                                        The cool thing about this is you can now see traffic going through the switch between physical ports and not just L3 interfaces that are routing traffic. Also all the traffic is all incoming to the vlan there is no outgoing traffic so you can see everything in one view.

                                        ==========

                                          • Re: Netflow Config On 6509

                                            Thanks Chris. 
                                            Maybe a limitation on the image we are using, but the command 'ip flow ingress layer2-switched vlan x' is not accepted.

                                            From Config mode, the only command is 'ip flow-aggregation, cache, or export.

                                            From Config Interface VLANxx, the only command is 'ip flow ingress'.  It will not allow the 'layer2-switched vlanx' suffix.

                                            We are running this image:

                                            IOS (tm) s72033_rp Software (s72033_rp-IPSERVICESK9-M), Version 12.2(18)SXF2, RELEASE SOFTWARE (fc1)

                                             

                                            I really dont want to give up hope on enable flows on the 6513.  Like I mentioned in a previous post, we have hundreds of users in remote offices, and can see the flows from these routers, but without the 500 or so users in the main office, our Netflow stats are missing a Giant piece.

                                            Thanks for all the suggestions, and I guess I will keep plugging away.

                                          • Re: Netflow Config On 6509
                                            SLXer

                                            Mike,

                                            This is about the best i can do to help. The following is a production configuration from a 6513 running 12.2-33.SXH4. Obviously all real addressing has been changed to protect the innocent. Aside from that the configuration is real.


                                            ip flow ingress layer2-switched vlan Y
                                            ipv6 mfib hardware-switching replication-mode ingress
                                            vtp mode transparent
                                            mls netflow interface
                                            mls flow ip interface-full
                                            mls nde sender version 5

                                            interface Loopback0
                                             description My Management Interface
                                             ip address 5.0.0.0 255.255.255.255

                                            interface GigabitEthernet1/1
                                             description Physical Interface connects to X
                                             bandwidth 1000000
                                             ip address 10.0.0.10 255.255.255.0
                                             ip flow ingress

                                            interface VlanX
                                             description L3 Vlan Interface
                                             ip address 11.0.0.0 255.255.255.0
                                             ip flow ingress

                                            interface VlanY
                                             description L2 Vlan Interface
                                             no ip address
                                             ip flow ingress

                                            ip flow-export source Loopback0
                                            ip flow-export destination 12.0.0.12 2055

                                            If there is anything here you dont understand.. look it up on cisco's website.

                                            last thing.. technically it is possible to flow L2 layer information provided there is a layer 3 interface on the same device that can be used as a source.. That is what this command is for "ip flow ingress layer2-switched vlan Y"

                                            Good luck!

                                              • Re: Netflow Config On 6509
                                                r0berth1

                                                This is almost what mine looks like, except that i dont the the ip flow ingress layer2-switched vlan on mine and i am getting flows from my 6509s, just not getting all of the data. but, the flows never stop like his does. It just works. I have a Cisco Rep that will be on one of my sites soon to do an in-depth discussion on the 6500 switches. I will ask him about the flows and post any findings here if you would like.

                                                  • Re: Netflow Config On 6509

                                                    That would be great r0berth1.

                                                    I wonder what differences our configs have.  You are seeing more than just broadcast traffic using that config?

                                                    My export aburtly stops after about a half hour withthe config like that. 

                                                    I noticed that after the flow stopped being picked up by Orion, if I go on the core and do a Show IP Flow Export, it says 1 packet was sent up to process level.  Once that happens, it seems the flow collection stops.

                                                    Anyways,.. my head is begining to hurt from Netflow and 6513.  Im taking the rest of the day off from this subject.  Hopefully I will have better luck tomorrow.
                                                    We are covered by TAC, so perhaps I will open a TAC case (Cisco Support).

                                                    Thanks to everyone for thier suggestions and assistance. 

                                                      • Re: Netflow Config On 6509
                                                        r0berth1

                                                        Yes, i get more that just broadcasts. "ip route-cache flow" is for the layer 3 interfaces and "ip flow ingress" is for the layer 2 interfaces. Here is my template:


                                                        ip flow-cache timeout active 1
                                                        !
                                                        mls aging fast time 8 threshold 127
                                                        mls aging normal 32
                                                        mls flow ip full
                                                        no mls flow ipv6
                                                        mls nde sender version 7
                                                        !
                                                        interface Vlan???
                                                         description **???**
                                                         ip address ???.???.???.??? ???.???.???.???
                                                         ip pim sparse-dense-mode
                                                         ip route-cache flow
                                                         ip igmp snooping mrouter interface GigabitEthernet1/48
                                                        !
                                                        interface Vlan???
                                                         description **???**
                                                         ip address ???.???.???.??? ???.???.???.???
                                                         ip pim sparse-dense-mode
                                                         ip route-cache flow
                                                         mls netflow sampling
                                                        !
                                                        interface Vlan???
                                                         description **???**
                                                         ip address ???.???.???.??? ???.???.???.???
                                                         ip helper-address ???.???.???.???
                                                         ip flow ingress
                                                         ip pim sparse-dense-mode
                                                         ip route-cache flow
                                                         mls netflow sampling
                                                        !
                                                        ip flow-export source Vlan???
                                                        ip flow-export destination ???.???.???.???
                                                        !
                                                        end

                                                    • Re: Netflow Config On 6509

                                                      Thanks SLXer,

                                                      I guess I will need to brush up on my Netflow understanding. 

                                                      The image we are running on the 6513 does not accept the ip flow ingress layer2 command.

                                                      I guess its time to hit the books, as implementing on the 6513 is very differant, and more difficult than the 2821 routers.

                                                      Thanks again for all your suggestions, and if I make any progess, I'll post to this thread.

                                                      Thanks guys!!!

                                                      • Re: Netflow Config On 6509

                                                        This was a great suggestion.

                                                        I followed this advice, and got some good results..

                                                        only problem is, I several vlan "y"s I would like to get data out of. I created a "dummy" interface for each of them wit hthe ip low ingress..

                                                        that all seems fine anddandy. I also added each of the unrouted vlans to the ip flow ingress layer2-switched vlan.

                                                        that all looks good...

                                                        My problem is, that of the 10 unrouted vlans I have set up like this, only two show up as getting netflow data in the Orion NTA. It is maddening.

                                                        I have compared the ones that work, and the ones that don't and they are identical. any suggestions?

                                                          • Re: Netflow Config On 6509
                                                            r0berth1

                                                            Here is what i ended up with after my TAC case with Cisco.

                                                                   

                                                             In native IOS you have to enable mls on the MSFC only.  I am sending you minimum commands require for enabling netflow on cat 6000 switch.
                                                             
                                                            Config for switch running Native IOS:
                                                             
                                                            mls aging fast time 8 threshold 127
                                                             
                                                            mls aging normal 32
                                                             
                                                            mls flow ip full
                                                             
                                                            mls nde sender version 7
                                                             
                                                            interface vlanx or Gigx/y
                                                             
                                                            ip route-cache flow 
                                                             
                                                            ip flow-export destination 172.17.246.225 9996 
                                                             
                                                            ip flow-export source <interface>
                                                             
                                                            The ip route-cache flow will work on layer 3 interface only so for the trunk link it needs to be on interface vlan. In Release 12.2(18)SXF and later
                                                            releases, you need to enter the ip flow ingress command to enable NetFlow for the interface. In releases prior to Release 12.2(18)SXF, NetFlow is
                                                            enabled by default.Here I am sending you sample configuration document,I hope this will be useful.

                                                        • Re: Netflow Config On 6509

                                                          HI Good People,

                                                          I am totally new to Netflow Traffic Analyser and CCNA. How do I implement Netflow on my Cisco 1700 series router and Cisco 3600 router.

                                              • Re: Netflow Config On 6509
                                                dan-uk

                                                Good Morning

                                                I'm new to solarwinds Netflow and was wondering where my schoolboy error might be.  I have a 6509 running the following IOS image :

                                                sup-bootflash:s72033-ipservicesk9-mz.122-18.SXF12a.bin

                                                I am monitoring only 1 routed interface in NPM at the moment for the purposes of getting netflow working/displaying correctly.

                                                I have entered the following commands in global conf mode on the 6509:

                                                mls flow ip full
                                                mls nde sender version 5
                                                ip flow-export source xxx.xxx.xxx.xxx
                                                ip flow-export destination xxx.xxx.xxx.xxx xxxx

                                                This should send data for all routed interfaces without the need to configure the interface with :

                                                ip flow ingress
                                                ip route-cache flow

                                                In NTA, I have added this one interface.  The problem I'm having is that on the summary page, the Top 5 Applications shows virtually no traffic, just some SNMP, NTP and Netbios.

                                                However, if I click on the specific interface, the Top 5 Applications returns the real data, I.E several gigs of traffic replicating between our SANS, email, http etc..

                                                If i only have one interface monitored in NTA, why does the summary page not display the same top 5 as in the interface view ?

                                                As a test I added one more interface but this time from a 3600 series router and this time the summary page accurately reflects the stats in the interface page.....

                                                Any help greatly appreciated.

                                                Cheers

                                                Dam