Netflow from Cisco Netflow Collection Engine to CS MARS

[eander123]

I have been setting up a MARS appliance on our network lately. Right now it is only receiving information from a few IPS'. Now I'm getting ready to set it up to collect netflow. I just found out that we have a Cisco Netflow Collection Engine (don't know version yet) running on our network. I assume that I could use that machine to get my netflow data instead of configuring every switch and router to push that data directly to the MARS machine (in addition to the netflow collector). I didn't find any mention of forwarding to a MARS appliance or any netflow consumer when skimming the manual for the Netflow Collection Engine, but it looks like it is possible.

Is this a good idea? Is it possible?

Thanks!

[andrew.burns]

Hi,

This would assume that you wanted the same set of devices to report to both MARS and the NCE which I'm not sure would be what you want.

Also, I'd suspect it wouldn't be possible as the NCE would have to rewrite the destination IP to be the MARS IP and re-send the packet which I'm pretty sure it can't do.

The best solution would be to configure additional netflow destinations as long as your ios/catos supports it.

HTH

Andrew.

[eander123]

Thank you very much, Andrew. I think we will end up having our netflow "producers" simply send netflow separately to NCE and MARS.

-Erik

[mhellman]

On the bright side...at least according to Cisco's own tests, adding a second netflow destination might not impact your networking equipment all that much:

http://www.cisco.com/application/pdf/en/us/guest/tech/tk812/c1550/cdccont_0900aecd802a0eb9.pdf