Net Flow help

DevilWAH

Hi any one with net-flow experience?

The back story is that this rouer was set up to export net flow to the collector 10.1.1.1 using the #IP flow-export destination 10.1.1.1 9999, and #ip flow ingress configured under each of three interfaces. I then decided to test the flow record / flow monitor and flow exporter to a new collector 10.2.2.2 (flexible net-flow), so set up the config as below and assigned the monitor to a single interface.

What I find is happening is that the collector at 10.2.2.2 is seeing the flows from all 3 interfaces, not just GigabitEthernet0/1 that it is assigned to? I assume the problem is to do with using the two formats to configure net-flow, but currently I would like to keep the old one in place till we have fully implemented the new collector with all the filters and alerting from the old one.

Any thoughts on how to tidy it up?

EXISTING CODE

ip flow-export version 5
ip flow-export destination 10.1.1.1 9999
ip flow-cache timeout inactive 10
ip flow-cache timeout active 5

NEW CODE

flow record Prime_janet
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect ipv4 dscp
 collect interface output
 collect flow direction
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
 collect application name
!
!
flow exporter Prime_1
 destination 10.2.2.2
 template data timeout 60
 option interface-table
 option application-table
!
!
flow monitor Prime_janet
 record Prime_janet
 exporter Prime_1
 cache timeout active 60

Interface Config

interface GigabitEthernet0/0
ip flow ingress


interface GigabitEthernet0/1
ip flow monitor Prime_janet input
 ip flow ingress


interface GigabitEthernet0/2.1000
ip flow ingress

DevilWAH

I guess no one then

cjaco0667

Have you tried to add match interface output and collect interface input within the flow record?

flow record Prime_janet
 match interface output
 collect interface input

DevilWAH

I will try that but could you elaborate on this?

why would his stop the collection on the other interfaces?

xXErebuS

Have you tried removing the ip flow ingress? Or do you still want it monitored just not sent to a collector?

DevilWAH

i want the ip flow ingress to sill sent to the original collector, and the new flow monitor flows sent to the new collector. So need them both working.

The old collector is our current solution, I would like to set up the new collector completely before I kill of the old one. I could set up a new flow monitor for the existing flows, but really I don't want to touch that config if i can help it.

xXErebuS

Edit: Nvm

xXErebuS

Everything I have found points to it being the ip flow ingress. To have both in tandum maybe setup like this then remove the ingress command.


http://docwiki.cisco.com/wiki/Migrating_from_Traditional_to_Flexible_NetFlow

See bottom