NetFlow-working one direction only

Question

Cisco 3850/IP Base/IOS XE 3.7.2

I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one sensor in the monitoring suite. I set up another sensor on the monitoring software, using the next numerical port. It worked as intended for about 5 minutes, then stopped transmitting.

What am I missing here? the In exporter is using 2055, the Out using 2056. This was done to allow separate sensors in software. It did work for a few minutes and then it quit. There definitely seems to be a change, as the still working NetFlow sensor shows highly reduced traffic.

flow record Ripon-Core-In
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect counter bytes long
 collect counter packets long
!
!
flow record Ripon-Core-Out
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface output
 collect counter bytes long
 collect counter packets long
!         
!         
flow exporter Ripon-Core
 destination 10.2.225.65
 source Vlan110
 transport udp 2055
!         
!         
flow exporter Ripon-Core-Out
 destination 10.2.225.65
 source Vlan110
 transport udp 2056
!         
!         
flow monitor Ripon-Core-In
  exporter Ripon-Core
 cache timeout active 900
 record Ripon-Core-In
!         
!         
flow monitor Ripon-Core-Out
 exporter Ripon-Core-Out
 cache timeout active 900
 record Ripon-Core-Out

sho flow exporter status:

Flow Exporter Ripon-Core:
  Packet send statistics (last cleared 2w2d ago):
    Successfully sent:         2666339               (3097186452 bytes)

  Client send statistics:
    Client: Flow Monitor Ripon-Core-In
      Records added:           41619483
        - sent:                41619483
      Bytes added:             1415062422
        - sent:                1415062422

Flow Exporter Ripon-Core-Out:
  Packet send statistics (last cleared 00:48:04 ago):
    Successfully sent:         60                    (70098 bytes)

  Client send statistics:
    Client: Flow Monitor Ripon-Core-Out
      Records added:           1893
        - sent:                1893
      Bytes added:             64362
        - sent:                64362

and the port to which it is applied:

interface TenGigabitEthernet1/0/12
 switchport access vlan 110
 switchport mode access
 ip flow monitor Ripon-Core-In input
 ip flow monitor Ripon-Core-Out output`

Answer 1

The configuration looks good to me though I don't recall having to use "switchport mode access" in configuring other Cisco devices for flexible NetFlow. (I've got an example configuration here, if you want a look at a similar one that I know worked in another environment)

I have seen problems in the past with having both an input and an output flow monitor on the same interface in Cisco devices (not this particular one, but you never know). Since this isn't working for you, I would recommend applying an input flow monitor on all of your interfaces, rather than an input and an output on just one. You should be able to replicate the current setup by having the current input flow monitor sending to UDP/2055 and all the others sending to UDP/2056.

I would also look into the possibility that it's correct: perhaps you've got some kind of accidental asymmetric routing situation here, and the traffic is egressing through a different interface entirely.

Answer 2

In my experience, I generally will use one port as an outflow and another port as the collector in promiscuous mode....

I work in a full juniper environment now and their equipment has some abilities CIsco does not, like being able to PCAP right off of a switch and read the wireshark. Cisco may have something similar but I dont recall knowing of such as thing.

We use it all of the time to assist in troubleshooting on out Juniper ex 4300-4600 and SRX3600 devices.