3

I have a problem with config NetFlow on 4500-X switch.

This is NetFlow config

flow record NFArecord
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input netflow
 match interface output netflow
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!
!
flow exporter ELK
 destination 172.17.214.33
 transport udp 9966
!
!
flow monitor NFAmonitor
 exporter ELK
 cache timeout inactive 30
 cache entries 10000
 record NFArecord
!

I want to collect records for inter vlan traffic.

Try to do this:

interface Port-channel2 
//this is port-channel to SW3750, want to collect ingress traffic on in interface
 description Trunk to 6floor
 switchport
 switchport mode trunk
 end

Core-4500x(config-if)#ip flow monitor NFAmonitor in
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

Ok, try to apply ip flow to vlan 60 and have same result:

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor layer2-switched input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

What's wrong? What should I do for NetFlow working?

  • 3
    I have zero experience with netflow on Cisco, but my guess would be that you're trying to apply ip settings on a switched (layer 2) interface, which just doesn't make much sense. You apply netflow on routed interfaces. – Teun Vink May 24 '18 at 9:14
  • @TeunVink's answer is correct. And if you use "datalink flow monitor" command, it can be applied to Layer 2 port. – Roger Sanghee Gold May 25 '18 at 3:48
1

From your error it seems that some of flow records cannot be used for Layer-3 flow capture.

Try this configuration. It will be applied on bridge level.

flow record FLOW-RECORD-IPV4
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long

flow exporter FLOW-EXPORTER-X.X.X.X
 description FLOW-EXPORTER X.X.X.X
 destination X.X.X.X
 source VlanX
 transport udp 2055

flow monitor FLOW-MONITOR-IN
 description MONITOR INGRESS FLOWS
 record FLOW-RECORD-IPV4
 exporter FLOW-EXPORTER-X.X.X.X
 cache timeout inactive 60

vlan configuration 10,20,30,40,50,60
ip flow monitor FLOW-MONITOR-IN input

Also you could apply it on interface level:

interface GigabitEthernet1/3/1
 ip flow monitor FLOW-MONITOR-IN input
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.