Bridged netflow on 3750x

itinfrastructure3 · ‎02-15-2017

I'm trying to setup intra vlan netflow to monitor traffic within the same Vlan (IP source/dest, mac source/dest, port source/dest)

On a 3750x running 15.2(4)E2 IPServices

When I try to add the flow to the layer 2 vlan, I get the following error:

% Flow Monitor: 'MONITOR1' could not be added.

My setup:

flow exporter AWSSplunk
 description AWSSplunk
 destination 10.34.13.245
 transport udp 9996
 option interface-table timeout 60
 option application-table timeout 60
 
 flow record RECORD1
 match datalink mac source-address
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 
 flow monitor MONITOR1
 exporter AWSSplunk
 cache timeout inactive 30
 cache timeout active 60
 record RECORD1

Error:

vlan configuration 16
ip flow monitor MONITOR1 input
% Flow Monitor: 'MONITOR1' could not be added

I was able to do the same config on a 3850 but not on 3750x

Is this not supported on 3750x ?

Reza Sharifi · ‎02-15-2017

For 3750x, you need the network service module ( C3KX-SM-10G).

Flexible NetFlow is supported only on the Catalyst 3750-X and 3560-X switch running the IP base or IP services feature set and equipped with the network services module. It is not supported on switches running the NPE or the LAN base image.

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_1_se/configuration/guide/3750xcg/swmnetflow.html

HTH

itinfrastructure3 · ‎02-15-2017

We got this module installed:

C3KX-NM-10G

Reza Sharifi · ‎02-15-2017

So, is a port on the ( C3KX-SM-10G) module configured to export the flow?

itinfrastructure3 · ‎02-15-2017

adding:

ip flow monitor MONITOR1 input

to the Port-Channel interface (Te interfaces part of the module) gives the same error message:

% Flow Monitor: 'MONITOR1' could not be added.

DCalkins0924 · ‎05-28-2019

I am in the same boat using a 3750X switch with IPBase license.