Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Netflow from Cisco Netflow Collection Engine to CS MARS

I have been setting up a MARS appliance on our network lately. Right now it is only receiving information from a few IPS'. Now I'm getting ready to set it up to collect netflow. I just found out that we have a Cisco Netflow Collection Engine (don't know version yet) running on our network. I assume that I could use that machine to get my netflow data instead of configuring every switch and router to push that data directly to the MARS machine (in addition to the netflow collector). I didn't find any mention of forwarding to a MARS appliance or any netflow consumer when skimming the manual for the Netflow Collection Engine, but it looks like it is possible.

Is this a good idea? Is it possible?

Thanks!

3 REPLIES

Re: Netflow from Cisco Netflow Collection Engine to CS MARS

Hi,

This would assume that you wanted the same set of devices to report to both MARS and the NCE which I'm not sure would be what you want.

Also, I'd suspect it wouldn't be possible as the NCE would have to rewrite the destination IP to be the MARS IP and re-send the packet which I'm pretty sure it can't do.

The best solution would be to configure additional netflow destinations as long as your ios/catos supports it.

HTH

Andrew.

Community Member

Re: Netflow from Cisco Netflow Collection Engine to CS MARS

Thank you very much, Andrew. I think we will end up having our netflow "producers" simply send netflow separately to NCE and MARS.

-Erik

Gold

Re: Netflow from Cisco Netflow Collection Engine to CS MARS

On the bright side...at least according to Cisco's own tests, adding a second netflow destination might not impact your networking equipment all that much:

http://www.cisco.com/application/pdf/en/us/guest/tech/tk812/c1550/cdccont_0900aecd802a0eb9.pdf

162
Views
5
Helpful
3
Replies
CreatePlease to create content