NetFlow v9 on Cisco Catalyst 3560 not working

Question

my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work. let me show you the config:

 flow exporter NETFLOW-EXPORTER
 destination 10.10.10.12
 source Vlan100
 transport udp 2055
!
!
flow record NETFLOW-RECORD
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long
!
!
flow monitor NETFLOW-MONITOR
 record NETFLOW
 exporter NETFLOW
 statistics packet protocol
 statistics packet size
 cache timeout active 60

interface range GigabitEthernet 0/1-52
 ip flow ingress
 ip flow egress
 ip flow monitor NETFLOW-MONITOR input
 ip flow monitor NETFLOW-MONITOR output

As you can see, we are at a point where we added pretty much everything. The exporter still does not seem to send anything to the destination:

Flow Exporter NETFLOW-EXPORTER:
Description:              User defined
Export protocol:          NetFlow Version 9
Transport Configuration:
    Destination IP address: 10.10.10.12
    Source IP address:      10.10.100.254
    Source Interface:       Vlan100
    Transport Protocol:     UDP
    Destination Port:       2055
    Source Port:            61154
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Not Used

The destination: 10.10.10.12 is running a PRTG instance where this switch is configured. SNMP information seem to work just fine, it's just NetFlow that wont show anything. The config on the PRTG should be fine (IP and port are a match)

Any Ideas?

Thanks in advance :)

Answer 1

Your Flow Monitor doesn't match your Flow Record or Flow Exporter. You have record NETFLOW and exporter NETFLOW. Try something like this:

flow monitor NETFLOW-MONITOR
 record NETFLOW-RECORD
 exporter NETFLOW-EXPORTER
 statistics packet protocol
 statistics packet size
 cache timeout active 60

You also don't need the old NetFlow commands on the interface, so you can remove:

 ip flow ingress
 ip flow egress

This is the way I have seen it work successfully, albeit only used on layer-3 interfaces, and only in one direction or the other:

flow record NETFLOW-RECORD
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 collect interface input
 collect interface output
 collect counter bytes
 collect counter packets
!
flow exporter NETFLOW-EXPORTER
 destination 10.10.10.12
 transport udp 2055
 source Vlan100
!
flow monitor NETFLOW-MONITOR
 record NETFLOW-RECORD
 exporter NETFLOW-EXPORTER
 cache timeout inactive 15
 cache timeout active 60
!

You can try it in both directions on a layer-2 interface, but I think your problem is the incorrect Flow Record and Flow Exporter in the Flow Monitor.

interface range GigabitEthernet 0/1-52
 ip flow monitor NETFLOW-MONITOR input
 ip flow monitor NETFLOW-MONITOR output
!

Edit:

This is from Configuring Flexible NetFlow:

NetFlow is supported only on the network services module. Only one flow monitor per interface and per direction is supported by the network services module.

As I understand it, you need IOS 15.x, and at least the IP Base license with the Network Services Module for Flexible NetFlow.

You are trying to apply it to non-module ports, G0/1-48, which doesn't work, anyway. It should only work on G0/49-52, but I'm not sure you can use it on the 3560 at all. I saw a note generated from Cisco TAC saying that this only works on a 3750X:

The netflow module is only available in the 3750x's. You're out of luck.

Sent from Cisco Technical Support Android App