7 Replies Latest reply on Jan 20, 2009 2:30 PM by kweise

    The "Netflow Config On 6509" post

      Do the commands listed in that post track both ingress and egress traffic on all interfaces?

      What about switched interfaces?  Do I need to configure those manually?

        • Re: The "Netflow Config On 6509" post
          r0berth1

          I have all of the commands needed to setup ingress and egress on a 6509. I will post them tomorrow when i get back to the office.

          but to answer your question, I had to manually configure every port that i wanted to monitor. I ended up just setting up Ingress and egress on the vlan instead.

            • Re: The "Netflow Config On 6509" post

              Thats interesting.  I posted this same question on cisco's netpro forum and was told by two different people that there was not a way to monitor layer2 interfaces, only layer3.  I thought I saw somewhere that there was a way to do layer2.

              Are you setting up ingress/egress on layer3 vlan interfaces?  I found that does work.

                • Re: The "Netflow Config On 6509" post
                  r0berth1

                  Use the code below to monitor a vlan. But you could also replace interface Vlan??? with interface GigabitEthernet1/41 or any other port that you want to monitor.

                  ip flow-cache timeout active 1
                  !
                  mls aging fast time 8 threshold 127
                  mls aging normal 32
                  mls flow ip full
                  no mls flow ipv6
                  mls nde sender version 7
                  !
                  interface Vlan???
                   description **???**
                   ip address ???.???.???.??? ???.???.???.???
                   ip pim sparse-dense-mode
                   ip route-cache flow
                   ip igmp snooping mrouter interface GigabitEthernet1/48
                  !
                  interface Vlan???
                   description **???**
                   ip address ???.???.???.??? ???.???.???.???
                   ip pim sparse-dense-mode
                   ip route-cache flow
                   mls netflow sampling
                  !
                  interface Vlan???
                   description **???**
                   ip address ???.???.???.??? ???.???.???.???
                   ip helper-address ???.???.???.???
                   ip flow ingress
                   ip pim sparse-dense-mode
                   ip route-cache flow
                   mls netflow sampling
                  !
                  ip flow-export source Vlan???
                  ip flow-export destination ???.???.???.???
                  !
                  end

                  • Re: The "Netflow Config On 6509" post
                    kweise

                    One other thing to keep in mind when trying to monitor layer 2 interfaces for NetFlow on 6500s.  In order to get both routed and bridged traffic from Netflow, you'll need either a PFC3B or PFC3BXL running IOS 12.2(18) SXE or later.  If you have a PFC3A or you're running IOS code earlier than 12.2(18)SXE, you'll only get routed traffic stats.

                • Re: The "Netflow Config On 6509" post
                  Jesquitin

                  Here is a link to a Cisco document that goes through the steps for configuring Netflow on 6500 series swtches, both hybrid and native IOS.  They key command to monitor layer 2 is "     ip flow ingress layer2-switched vlan xxxx". Also verify the NDE version is version 5, by default version 7 is configured.

                   

                  http://www.cisco.com/application/pdf/paws/70974/netflow-catalyst6500.pdf

                   

                  Hope this helps