Not receiving Netflow data

You'll need to set the NetFlow destination to be the external interface of your firewall, then create a firewall port forward for UDP port 2055 to forward to the machine where Orion NetFlow Traffic Analyzer is installed. You'll still need add the router and monitor its interfaces with Orion NPM (Network Performance Monitor) but you shouldn't need any special port/address translations for that to happen. 

Depending on your firewall you may need to allow the traffic through the firewall. You'll need to allow UDP port 161 bidirectionally to/from your Orion server and the router that's sending the netflow data. You'll also want to allow ICMP echo request from the Orion server to your Netflow router, and accept the ICMP echo reply packets back through the firewall from your netflow router to your Orion server. Additionally you might need to allow UDP port 2055 to the the firewall for the port forwarding to work properly.

That is a really geat response!  Some I had already tried, but the idea of sending the netflow to the firewall interface did not come to mind.  Would this not render this port a mirror port?  When spanning or port mirroring in Cisco IOS the destination port is no longer switchable or routable.  It just copies packets.  Just a little nervous..........

Because the firewall is doing NAT there's no direct route from the router to the server running NTA so these packets need to be port forwarded through the firewall to the Orion server to get to the flows to NTA. This is the reason you'll need to set the netflow destination on the Cisco router as the firewall itself. Ultimately these packets should be redirected/forwarded to the appropriate destination by the firewall so it's just semantics. 

Hi,

I know this is an old topic but why do we need to allow ICMP from router toward Netflow collector?

vladani19I don't think you need specifically ICMP to be allowed, but the router needs to be monitored in some way by NPM, whether it is ICMP, SNMP or others.