1

I am using 2 Cisco Catalyst 2960X as a stacked switch and I am trying to set up Netflow on them with PRTG as network monitor but it seems that I'm stuck somewhere, below are the config I'm using:

flow record toPRTG
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect interface input
!
!
flow record toPRTG1
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
!
!
flow exporter toPRTG
destination 172.18.145.xxx
transport udp 9995
!
!
flow monitor toPRTG
exporter toPRTG
cache timeout active 15000
record toPRTG
!
!
sampler toPRTG
mode random 1 out-of 32
!
!
interface GigabitEthernet2/0/10
switchport access vlan xxx
switchport mode access
ip flow monitor toPRTG sampler toPRTG input
spanning-tree portfast
!
ip flow-export version 9
ip flow-export destination 172.18.145.xxx 9995

And the settings on PRTG

PRTG Settings 1 PRTG Settings 2

I can see that the Flow Exporter is sending data, but PRTG does not receive any thing on the UDP port I have configured. There is a firewall between 2 devices but I have allowed the flow to go through. Also there are no firewall on PRTG.

LBN-STACK-SW#show flow exporter statistics
Flow Exporter toPRTG:
Packet send statistics (last cleared 2d00h ago):
Successfully sent: 6489 (4907448 bytes)
Client send statistics:
Client: Flow Monitor toPRTG
Records added: 195422
- sent: 195422
Bytes added: 3126752
- sent: 3126752

May I know what I might have configured wrong? Thanks in advance.

Edited: Added more information

Flow Exporter toPRTG:
  Description:              User defined
  Export protocol:          NetFlow Version 9
  Transport Configuration:
    Destination IP address: 172.18.145.203
    Source IP address:      172.18.148.13
    Source Interface:       Vlan148
    Transport Protocol:     UDP
    Destination Port:       9995
    Source Port:            49334
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Not Used

interface Vlan148
 ip address 172.18.148.13 255.255.255.240

edited: full config

Building configuration...

Current configuration : 8535 bytes
!
! Last configuration change at 03:21:14 UTC Tue Aug 15 2017 by admin
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname LBN-STACK-SW
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
switch 1 provision ws-c2960x-24ts-l
switch 2 provision ws-c2960x-24ts-l
ip routing
!
!

vtp mode transparent
!
!
!
!
!
!
!
flow record toPRTG
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 collect interface input
!
!
flow record toPRTG1
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
!
!
flow exporter toPRTG
 destination 172.18.145.xxx
 source Vlan148
 transport udp 9995
!
!
flow monitor toPRTG
 exporter toPRTG
 cache timeout active 15000
 record toPRTG
!
!
sampler toPRTG
 mode random 1 out-of 32
!
!
crypto pki trustpoint TP-self-signed-3314246400
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3314246400
 revocation-check none
 rsakeypair TP-self-signed-3314246400
!
!
crypto pki certificate chain TP-self-signed-3314246400
 certificate self-signed 01
xxxx
        quit
!
spanning-tree mode pvst
spanning-tree extend system-id
spanning-tree vlan 1 priority 24576
!
!
!
!
vlan internal allocation policy ascending
!
vlan 144
 name xxxx
!
vlan 145
 name xxxx
!
vlan 146
 name xxxx
!
vlan 147
 name xxxx
!
vlan 148
 name Mgnt-vlan
!
vlan 150
 name xxxx
!
vlan 155
 name xxxx
!
vlan 1441
 name xxxx
!
vlan 1442
 name xxxx
!
vlan 1443
 name xxxx
!
vlan 1447
 name xxxx
!
vlan 1451
 name xxxx
!
vlan 1452
 name xxxx
!
vlan 1453
 name xxxx
!
vlan 1488
 name xxxx
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
 description to-LBN-ACC-01
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
!
interface Port-channel2
 description to-LBN-ACC-02
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
!
interface Port-channel3
 description to-LBN-ACC-03
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
!
interface Port-channel4
 description to-WLC
 switchport mode trunk
!
interface Port-channel5
 description to-LBN-ACC-04
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
!
interface FastEthernet0
 no ip address
 no ip route-cache
 shutdown
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
 switchport access vlan 1451
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 5 mode active
!
interface GigabitEthernet1/0/20
 switchport trunk allowed vlan 144-146,148,150,155,1441-1443,1447,1451-1453
 switchport trunk allowed vlan add 1488
 switchport mode trunk
!
interface GigabitEthernet1/0/21
 switchport mode trunk
 channel-protocol lacp
 channel-group 4 mode active
!
interface GigabitEthernet1/0/22
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 1 mode active
!
interface GigabitEthernet1/0/23
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 2 mode active
!
interface GigabitEthernet1/0/24
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 3 mode active
!
interface GigabitEthernet1/0/25
!
interface GigabitEthernet1/0/26
!
interface GigabitEthernet1/0/27
!
interface GigabitEthernet1/0/28
!
interface GigabitEthernet2/0/1
!
interface GigabitEthernet2/0/2
!
interface GigabitEthernet2/0/3
!
interface GigabitEthernet2/0/4
!
interface GigabitEthernet2/0/5
!
interface GigabitEthernet2/0/6
 switchport mode access
!
interface GigabitEthernet2/0/7
!
interface GigabitEthernet2/0/8
!
interface GigabitEthernet2/0/9
 switchport access vlan 147
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet2/0/10
 switchport access vlan 148
 switchport mode access
 ip flow monitor toPRTG sampler toPRTG input
 spanning-tree portfast
!
interface GigabitEthernet2/0/11
!
interface GigabitEthernet2/0/12
 description to-Fortinet-Port3
 switchport access vlan 148
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet2/0/13
!
interface GigabitEthernet2/0/14
!
interface GigabitEthernet2/0/15
!
interface GigabitEthernet2/0/16
!
interface GigabitEthernet2/0/17
!
interface GigabitEthernet2/0/18
!
interface GigabitEthernet2/0/19
!
interface GigabitEthernet2/0/20
!
interface GigabitEthernet2/0/21
 description to-WLC-port10
 switchport mode trunk
 channel-protocol lacp
 channel-group 4 mode active
!
interface GigabitEthernet2/0/22
 description to-access-sw01-port-50
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 1 mode active
!
interface GigabitEthernet2/0/23
 description to-access-sw02-port-50
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 2 mode active
!
interface GigabitEthernet2/0/24
 description to-access-sw03-port-48
 switchport trunk allowed vlan 144-148,150,1441-1443,1451-1453
 switchport mode trunk
 channel-protocol lacp
 channel-group 3 mode active
!
interface GigabitEthernet2/0/25
!
interface GigabitEthernet2/0/26
!
interface GigabitEthernet2/0/27
!
interface GigabitEthernet2/0/28
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan145
 no ip address
!
interface Vlan148
 ip address 172.18.148.xx 255.255.255.240
!
interface Vlan1441
 no ip address
!
interface Vlan1442
 no ip address
!
interface Vlan1443
 no ip address
!
interface Vlan1451
 no ip address
!
interface Vlan1452
 no ip address
!
ip default-gateway 172.18.148.xx
ip http server
ip http secure-server
ip flow-export version 9
ip flow-export destination 172.18.145.xxx 9995
!
ip route 0.0.0.0 0.0.0.0 172.18.148.xx
ip ssh version 2
!
!
snmp-server community xxxx RO
!
!
line con 0
line vty 0 4
 login local
 transport input ssh
line vty 5 15
 login
!
end
Improve this question
7
  • Your question is confusing. The title says that the switch is not sending data, but the question says that you can see it is sending, but the server is not receiving. Those are really opposite problems. Does the firewall log so that the traffic is flowing through? Can you ping the server from the switch?
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 2:02
  • It would be helpful to see the rest of the switch configuration. For example, you are not specifying the source interface, and we cannot see any of the layer-3 interfaces on the switch, so we have no idea what address is the source address of the records.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 2:09
  • Hello Ron, Sorry for my confusing question, what I mean is that the PRTG monitor does not receive any Netflow data from my switch, however I have also setup SNMP monitoring on my switch from the same PRTG and it works well. I cannot see any FW logs that drops the traffic and also tcpdump on my firewall does not show Netflow data. I have included some more of my config, hope they will help.
    – Khanh Nguyen
    Commented Aug 15, 2017 at 3:24
  • Please check above for more config
    – Khanh Nguyen
    Commented Aug 15, 2017 at 3:25
  • Please, just edit your question to include the entire switch configuration.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 3:30

1 Answer 1

Reset to default
3

The Catalyst 2960-X supports what is called netflow lite, not full netflow, and for that, it needs at least the LANBASE license. See "Prerequisites" on https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/fnf/configuration_guide/b_fnf_1522e_2960x_cg/b_fnf_32se_3850_cg_chapter_010.html (publically available Cisco Doc).

See the outputs of show version or show license to check the license on the given 2960-X. We have seen cases where a Lan Lite switch would accept commands for unsupported features without returning an error - and the feature would just not work.

That being said, I don't see where the error in the config might be - we have

a) a flow record
b) a flow exporter 
c) a flow monitor making use of a) and b)  
d) a flow sampler  
e) and finally an interface config making use of c) and d).

... and that's what the config guide suggest. I suspect the problem is on the netflow analyzer side.

Please verify that PRTG actually supports netflow lite. My current understanding from what I can find at paessler.com is that netflow lite is not directly supported, and that eventually, you might need to convert netflow lite to classic netflow with some kind of itermediate service (such as http://www.ntop.org/products/netflow/nprobe/netflow-lite-plugin/)

Using one of the tools at https://www.paessler.com/tools/netflowtester might help with the analysis.

One more thing:

Instead of naming at least three related config items "toPRTG", I suggest using a config style as outlined below. It helps to track what is what, and to keep track of all the needed config bits. In short, it helps to understand the config concept. We use similar config styles in larger multi-tenant QoS configurations (that we maintain manually), so we can keep track of the per-tenant class-maps and policy maps, the ACLs to go with it etc. In general, we put a Prefix in there describing what kind of config item it is, the customer's name and the name itself. This then might look like this: PM_QUE_CUST01_WANPOLICY01 or CM_QOS_CUST04_REALTIME-TRAFFIC.

So here's what I suggest for a netflow config:

flow record NFREC_MYRECORD1
 match ...
 collect ...  
!
!
flow exporter NFEXP_MYEXPORT1
 destination 172.18.145.xxx
 transport udp 9995
!
!
flow monitor NFMON_MYMONITOR1
 exporter NFEXP_MYEXPORT1
 cache timeout active 15000
 record NFREC_MYRECORD1
!
!
sampler NFSMP_MYSAMPLER1
 mode ...
!
!
interface GigabitEthernety/0/yy
 ...
 ip flow monitor NFMON_MYMONITOR1 sampler NFSMP_MYSAMPLER1 input
 ...
Improve this answer
1
  • Hello Marc, thanks for the detailed answer. So far using Wireshark and the tool you provided above I can see that my PRTG machine does receive Netflow packets on the port that I have config. So it might be PRTG itself does not support NetFlow lite. Thanks for pinpointing where my problems are. I will mark this answer as accepted.
    – Khanh Nguyen
    Commented Aug 17, 2017 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.