0

I have a core switch (backbone) of our network that broadcasts all the vlans to other switches. I am trying to configure netflow on the switch and link it up to a Netflow sensor on PRTG.

I followed this implementation: https://www.nazaudy.com/index.php/12-technology/cisco/34-enable-netflow-v9-in-cisco-switches-with-prtg

For some reason when i do show flow export statistics, shows '0" as if nothing is getting exported!

This is my stacked core switch type: C3750X, IOS Version 15.2(4)E5, License Level: ipservices, sdm: "desktop routing"

This is the configuration i am using to get the netflow on the switch, (i tried with v9 but same issue, the below is v5):

flow record PRTG-FLOW-RECORD
 description Record-Network-Traffic
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

!
!
flow exporter PRTG-EXPORTERv5
 description Export-Flow-to-PRTG
 destination 10.7.7.200
 source Vlan7
 transport udp 9997
 export-protocol netflow-v5
!
!
flow monitor PRTG-MONITOR
 description Monitor-PRTG-Flow
 exporter PRTG-EXPORTERv5
 cache timeout active 60
 record PRTG-FLOW-RECORD
!
!
sampler PRTG-SAMPLER
 mode random 1 out-of 32

When i do show exporter statistics:

Flow Exporter PRTG-EXPORTERv5:
  Packet send statistics (last cleared 05:45:07 ago):
    Successfully sent:         0                     (0 bytes)

  Client send statistics:
    Client: Flow Monitor PRTG-MONITOR
      Records added:           0
      Bytes added:             0

When i do show flow exporter:

Flow Exporter PRTG-EXPORTERv5:
  Description:              Export-Flow-to-PRTG
  Export protocol:          NetFlow Version 5
  Transport Configuration:
    Destination IP address: 10.7.7.200
    Source IP address:      10.7.7.1
    Source Interface:       Vlan7
    Transport Protocol:     UDP
    Destination Port:       9997
    Source Port:            49747
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Not Used

When i do show flow monitor:

Flow Monitor PRTG-MONITOR:
  Description:       Monitor-PRTG-Flow
  Flow Record:       PRTG-FLOW-RECORD
  Flow Exporter:     PRTG-EXPORTERv5
  Cache:
    Type:                 normal
    Status:               allocated
    Size:                 128 entries / 6660 bytes
  Cache:
    Type:                 normal (Platform cache)
    Status:               allocated
    Size:                 Unknown
  Timers:
                       Local        Global
    Inactive Timeout:     15 secs
    Active Timeout:       60 secs      1800 secs
    Update Timeout:       1800 secs
    Synchronized Timeout: 600 secs

I am applying these two commands under the interface VLAN:

ip flow monitor PRTG-MONITOR sampler PRTG-SAMPLER input
ip flow monitor PRTG-MONITOR sampler PRTG-SAMPLER output

For some reason i get the foolowing if i apply it under a Gigabit interface:

Error: Flexible Net Flow is not supported on this interface

My PRTG server under port 9997 is open, i made sure of that! It's just not receiving any netflow data

I would appreciate any help at this level!

8
  • Have you made sure the SDM is using the lanbase-default template?
    – Zac67
    Jan 30, 2020 at 16:24
  • On which VLAN are you applying the flow monitor? Also, you really want to pick a direction and either monitor ingress or egress, otherwise you will get double statistics.
    – Ron Maupin
    Jan 30, 2020 at 17:34
  • @Zac67 i will give this a go - currently its in "desktop routing" mode
    – HQJ
    Feb 3, 2020 at 7:14
  • @RonMaupin i did pick a direction, a lot of googling suggested to add both directions.
    – HQJ
    Feb 3, 2020 at 7:15
  • @RonMaupin also, i am applying the monitor on all interfaces available on the switch
    – HQJ
    Feb 3, 2020 at 7:52

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.