cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1460
Views
0
Helpful
1
Replies

Netflow from SPAN

Hello,

One of our clients wants to implement the following topology:

+----------+C

|Cisco 2921|<---------+

+----------+          |

                      |B

+----------+    A+------------+D

| Internal |---->| Cisco 2960 |----> ISP

+----------+     +------------+

Normal traffic flows from port A to port D.

The goal is to use the router as a netflow analyzer, using SPAN to mirror the traffic on port A to port B.

On port B we can see output rate, but on port C (on the router) we see no input rate at all.

Any ideas?

Regards,

Shahar.

1 Reply 1

hobbe
Level 7
Level 7

Hi

Well the thing is we do not know enough for the reasons why they want this ie the expected end result.

I have serious doubt that using the 2960 with a SPAN port towards a 2921 will give you the answer that you are out after.

To the best of my understanding you will need to have the flows go THROUGH the router to be able to use the routers netflow collecting abilities to its potential.

So would it not be smarter to insert the  router between the 2960 and the ISP ?

It would work to just use a netflow collector instead of the router.

Good luck

Hope This Helps

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco