Netflow Config

Answered Question
Oct 21st, 2009
User Badges:

Hello,


I have Cisco 2811 with 2 serial interfaces (2xT1).Originally there was only 1 serial card installed with ip flow v5 enabled on it. Then 2nd serial card was added, and bundled into multilink int. Here's the question: how should I configure netflow? Should I enable it on the 2nd serial interface or perhaps just on multilink interface?

Thank you,

Regards


lukasz

Correct Answer by yjdabear about 7 years 5 months ago

Here's a document that discusses the testing result of NetFlow config on a Multilink interface and its underlying serial interfaces, on pgs 10-12. It reads to me that the member serial interfaces won't produce NetFlow, so just enable NetFlow on the logical Multilink interface, similar to the scenario of layer-3 EthterChannel and its member physical ports.


http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd8045b422.pdf

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
forman102 Wed, 10/21/2009 - 06:22
User Badges:

I found the answer, please disregard my post:


The "ip route-cache flow" can be used only under the main interface, while the "ip flow ingress" was an enhancement to be used under subinterfaces.


The NetFlow Subinterface Support feature provides the ability to enable NetFlow on a per-subinterface basis. In a scenario in which your network contains thousands of subinterfaces and you want to collect export records from only a few subinterfaces, you can fine-tune your collection of data to only specified subinterfaces. The result is lower bandwidth requirements for NetFlow Data Export (NDE ) and reduced platform requirements for NetFlow data-collection devices.


Using the NetFlow Subinterface Support feature, you can enable NetFlow on selected subinterfaces using the ip flow ingress command. If you configure the ip flow ingress command on a few selected subinterfaces and then configure the ip route-cache flow command on the main interface, enabling the main interface will overwrite the ip flow ingress command and data collection will start from the main interface as well as all the subinterfaces. In a scenario in which you configure the ip flow ingress command and then configure the ip route-cache flow command on the main interface, you can restore subinterface data collection by using the no ip route-cache flow command. This configuration will disable data collection from the main interface and restore data collection to the subinterfaces you originally configured with the ip flow ingress command.

Correct Answer
yjdabear Wed, 10/21/2009 - 06:25
User Badges:
  • Gold, 750 points or more

Here's a document that discusses the testing result of NetFlow config on a Multilink interface and its underlying serial interfaces, on pgs 10-12. It reads to me that the member serial interfaces won't produce NetFlow, so just enable NetFlow on the logical Multilink interface, similar to the scenario of layer-3 EthterChannel and its member physical ports.


http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd8045b422.pdf

Actions

This Discussion