7 Replies Latest reply on Aug 20, 2009 6:39 PM by Donald_Francis

    Cisco ip flow commands

    BryanBecker

      I was wondering how other customers set up NetFlow in their Cisco environment.  Traditionally, and this is how we do it today, on a router interface we have the "ip route-cache flow" on the LAN and WAN interfaces.  This is needed so that you get traffic coming in and going out of a router.

      With newer code I see the the ip flow ingress and ip flow egress commands are available.  How are people using these in there environment?  Does this allow you to only enable NetFlow on the WAN interface and still get the to/from on that interface?

      Thanks for you info.

      BB
       

        • Re: Cisco ip flow commands
          joesim123

          This has worked well for me on routers since SW released Netflow: 

          ip flow-cache timeout active 1
          ip flow-export source Loopback0
          ip flow-export version 5
          ip flow-export destination 10.x.x.x 9995


          On ALL routed interfaces:  ip route-cache flow

            • Re: Cisco ip flow commands
              BryanBecker

              This has worked well for me on routers since SW released Netflow: 

              ip flow-cache timeout active 1
              ip flow-export source Loopback0
              ip flow-export version 5
              ip flow-export destination 10.x.x.x 9995


              On ALL routed interfaces:  ip route-cache flow

               



               

              I use this now was well.  My question is more for the people using the newer ingress/egress commands and how they are different.

              BB

                • Re: Cisco ip flow commands
                  achrich

                  the ip route-cache flow command works in the same way as ip flow ingress

                    • Re: Cisco ip flow commands
                      JTL

                      One thing we are running into is if you have CEF enabled you will get flows from all CEF enabled interface.  It doesn't matter if the interface has the ip route cache flow on the interface or not.  We are working with our Cisco SE about this.  Now the Solarwinds part that also needs fixed is in NTA I have 1 interface for device X selected to receive flows .  Even though the Cisco device is sending flows for all CEF enabled interfaces (lets say a total of 3 interfaces)  I only have one of the 3 interfaces in NTA selected to except flow info.  However the interfaces in NTA is still collecting flow info and saving it in the database for the interfaces that I do not have selected.