I have attempted to configure netflow v9, but I am not able to generate any flows within my 3750X switches. Should I add more configuration to my netflow module to get the flows to be read on my solarwinds NTA server? Or should I switch to netflow v5 to accomplish this task?
Here is my configuration & I am using IOS 15.2(4):
flow record Record
match datalink source-vlan-id
match datalink dot1q priority
match datalink mac source-address
match datalink mac destination-address
match ipv4 version
match ipv4 tos
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input physical snmp
collect interface output snmp
collect counter flows
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
flow exporter Export
destination < Solarwinds Server IP >
source < Site VLAN >
transport udp 2055
option interface-table timeout 60
!
!
flow monitor Monitor
exporter Export
cache timeout active 60
statistics packet protocol
record Record
!
!
sampler NTA_Sampler
description NTA_Flows
mode random 1 out-of 32
!
interface GigabitEthernet1/1/2 < Netflow Module >
description **** NTA export ****
ip flow monitor Monitor layer2-switched inputsh flow interface
Interface GigabitEthernet1/1/2
FNF: checking sub traffic.
FNF: monitor: Monitor
direction: Input
traffic(ip): layer2-switchedSh flow exporter statistics
Flow Exporter Export:
Packet send statistics (last cleared 01:31:20 ago):
Successfully sent: 1820 (2328144 bytes)
Client send statistics:
Client: Option options interface-table
Records added: 21021
- sent: 21021
Bytes added: 2102100
- sent: 2102100
Client: Flow Monitor Monitor
Records added: 0
Bytes added: 0sh flow exporter templates
Flow Exporter Export:
Client: Option options interface-table
Exporter Format: NetFlow Version 9
Template ID : 256
Source ID : 1
Record Size : 104
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| v9-scope system | 1 | 0 | 4 |
| interface input snmp | 10 | 4 | 4 |
| interface name short | 82 | 8 | 32 |
| interface name long | 83 | 40 | 64 |
---------------------------------------------------------------------
Client: Flow Monitor Monitor
Exporter Format: NetFlow Version 9
Template ID : 257
Source ID : 1
Record Size : 59
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| interface input physical snmp | 252 | 8 | 4 |
| datalink source-vlan-id | 58 | 12 | 2 |
| datalink mac source-address | 56 | 14 | 6 |
| datalink mac destination-address | 80 | 20 | 6 |
| transport source-port | 7 | 26 | 2 |
| transport destination-port | 11 | 28 | 2 |
| datalink dot1q priority | 244 | 30 | 1 |
| ip version | 60 | 31 | 1 |
| ip tos | 5 | 32 | 1 |
| ip protocol | 4 | 33 | 1 |
| ip ttl | 192 | 34 | 1 |
| interface output snmp | 14 | 35 | 4 |
| counter flows | 3 | 39 | 4 |
| counter bytes | 1 | 43 | 4 |
| counter packets | 2 | 47 | 4 |
| timestamp sys-uptime first | 22 | 51 | 4 |
| timestamp sys-uptime last | 21 | 55 | 4 |
---------------------------------------------------------------------
Client: Flow Monitor Monitor
Exporter Format: NetFlow Version 9
Template ID : 0
Source ID : 0
Record Size : 60
Template layout
_____________________________________________________________________
| Field | Type | Offset | Size |
---------------------------------------------------------------------
| datalink source-vlan-id | 58 | 0 | 2 |
| datalink dot1q priority | 244 | 2 | 1 |
---------------------------------------------------------------------Sh ip flow cache
IP packet size distribution (0 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 0 bytes
0 active, 0 inactive, 0 added
0 ager polls, 0 flow alloc failures
Active flows timeout in 1 minutes
Inactive flows timeout in 15 seconds
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pktssh ip flow export < Not sure why main cache is v1 instead of v9? >
Flow export v1 is disabled for main cache
Version 1 flow records
0 flows exported in 0 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level