I have following network connections
LAN -> Cisco Router -> 16 port switch -> Server (netflow)
-> ISP
And i have following config on Cisco router
interface FastEthernet0/0
ip address 10.10.10.1 255.255.255.0
ip nat inside
interface FastEthernet0/1
ip address <router ip> 255.255.255.x
ip nat outside
ip route 0.0.0.0 0.0.0.0 <gateway ip>
ip flow-export destination <server ip> <port>
I have allowed router ip
on Server
. Though I had no data received on server:port
which a service was running. But when I tcpdump the port:
$ tcpdump -pn udp port <port>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
12:30:52.926946 IP 10.10.10.1.59663 > server:port: UDP, length 1464
12:30:52.927521 IP 10.10.10.1.59663 > server:port: UDP, length 1464
Which is weird to me. I was expecting the router ip
.
- Why does it show LAN address?
- Is it ok to allow
10.10.10.1
to myserver
?
ip flow-export source f0/1
ip flow-export source Loopback0
must be the issue.