I've configured Netflow on my Cisco 1841 router running 12.4(13r)T which is connected via IPSEC VPN to my head office.
My Netflow collector is in the head office and, at first, everything seemed to be ok and the collector was receiving netflow data.
However, then the collector just stopped receiving data for one particular device, my Cisco 1841. (I have other Cisco devices still sending netflow data and being received by the collector without issue - this is the only Cisco 1841 I have though)
However, every now and then, the collector will suddenly start seeing netflow traffic from the device again for a short while then stop. (Of course, I've rebooted the router but this has not helped)
At first I assumed it was a problem with my collector as the Cisco 1841 itself indicated it was still sending the netflow data to my collector:
sh ip flow export
Flow export v5 is enabled for main cache
Exporting flows to **** (****)
Exporting using source interface FastEthernet0/1.1
Version 5 flow records
421593 flows exported in 17461 udp datagrams
0 flows failed due to lack of export packet
6 export packets were sent up to process level
0 export packets were dropped due to no fib
2 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
However, after setting up a packet sniffer on the collector itself and also using a packet sniffer on my firewall, I've established that the netflow data is NOT actually coming into the collector after all so it does seem to be a router issue.
Anyone had any similar problems with the Cisco 1841 or know how I can resolve this?
I wonder if it could be a fragmentation issue with the VPN. If NetFlow builds a "full size" packet and it goes through the VPN, then adding the IPSec header might produce a packet that required fragmentation.
If you have other sites sending NetFlow through VPN tunnels could you check and see whether they handle fragmentation in a way that might be any different from what is done on the 1841?