5 Replies Latest reply on Jun 13, 2012 7:53 PM by singh_bains

    Flexible-Netflow from router on IPSec VPN Tunnel

    daveh

      Hi all,

      I’m trying to collect netflow data from a remote site which only has one Cisco 881 router and is connected to our corporate WAN using an IPSec VPN tunnel. According to Cisco and bug CSCsk25481 it appears as though only the new “Flexible-Netflow” will work over IPSec VPN tunnels when the router that generates the IPSec VPN tunnel is trying to send netflow info, as long as you have IOS version 12.4(17.2)T. I’ve tried to configure this using the commands below but it still doesn’t send any netflow data to our NTA. The router is being monitored by Solarwinds Orion using the Lo0 IP address. The VPN tunnel does go through a firewall but all ports are open for VPN’s for both UDP and TCP.

      Here’s what Cisco say…

      IOS does not encrypt NetFlow export packets which originate from the router itself. This is day 0
      functionality as features are not applied to NetFlow export packets and never have been.

      The solution to this does not fix the above for Cisco's older netflow-switch code but rather
      provides the ability to encrypt outgoing NetFlow export packets for the newer flexible-netflow
      product.

      Here’s the config on the router…

      flow exporter export-to-DCRAP014
      destination 10.254.17.14
      source Loopback0
      transport udp 9996
      !
      !
      flow monitor flow-monitor
      record netflow-original
      exporter export-to-DCRAP014

      interface FastEthernet4
      ip flow monitor flow-monitor input
      ip flow monitor flow-monitor output

      interface Vlan1
      ip address 10.254.41.1 255.255.255.0
      ip flow monitor flow-monitor input
      ip flow monitor flow-monitor output

      Is my config of the router wrong or am I missing something?

      wireshark also doesn't pick up any traffic from the remote router on the Orion server so it doesn't look like the router is sending anything.

      many thanks
      Dave

        • Re: Flexible-Netflow from router on IPSec VPN Tunnel
          kevin2me

          I replied to you David in the case, but in case anyone else is wondering about Flexible-Netflow.

          At present we do Not Support it.

          Flexible NetFlow (FNF) has a lot of abilities that standard flow technologies do not.

          The implementation for a NetFlow collector is extremely complicated and at present we have had almost no customers asking for it.

          Also I have not seen any other Vendor supporting it in regards to Network Management.

          • Re: Flexible-Netflow from router on IPSec VPN Tunnel
            singh_bains

            Here is Netflow configuration from one of router which is configured with IPsec tunnel. Netflow over IPsec tunnel.

             

            Configured for Netflow exporter

             

            flow exporter NETFLOW1

            destination 10.1.x.x

            source Vlan1

            output-features

            transport udp 2055

            export-protocol netflow-v5

            template data timeout 30

            !

            !

            flow monitor NETFLOW1

            record netflow-original

            exporter NETFLOW1

            cache timeout active 30

            !

             

            Interfaces are configured with net flow export and exporter

             

            interface FastEthernet4

            description OUTSIDE

            ip address x.x.x.x 255.255.255.252

            ip flow monitor NETFLOW1 input

            ip flow ingress

            !

            !

            interface Vlan1

            description inside network

            ip address 192.16.2.1 255.255.255.0

            ip flow monitor NETFLOW1 input

            ip flow ingress

            !

             

            Also configured Netflow export

             

            ip flow-export source Vlan1

            ip flow-export version 5

            ip flow-export destination 10.1.x.x 2055

             

             

            Commands to check Netflow

             

            sh ip flow export

             

            sh flow exporter

            sh flow exporter statistics

             

            when i just configured netflow exporter i could see traffic is not going over tunnel then i enabled netflow export then it start working. u have to enable both. cus export command pull traffic so then expoter send it over tunnel