NetFlow v5 export from a 7600 / IOS 12.2(18)S to multiple destinations

[koteasahay]

Hello All,

Need some help here. I'm having an issue on my 7600 where NetFlow is enabled on all interfaces but I'm only seeing unidirectional NetFlow traffic (about 85%). I'm presently using IOS 12.2(18)S and forwarding to two different NetFlow collection systems.

Can anyone help or provide advice?

Config:

<snip>

mls flow ip interface-full

mls nde sender version 5

<snip>

ip flow-export source Loopback1

ip flow-export version 5 origin-as

ip flow-export destination [IP1_scrubbed] [Port1_scrubbed]

ip flow-export destination [IP2_scrubbed] [Port2_scrubbed]

<snip>

interface GigabitEthernet1/1

description Link to Internal

mtu 9000

ip address [IP_scrubbed] [netmask_scrubbed]

ip route-cache flow

[Jan Nejman]

Hello,

It is neccessary to setup up ip route-cache flow on all interfaces, bacause netflow is collected only on the input of interface... so you see only flows from Internal network. Another solution is use ip flow ingress. It will account flows to Internal network, but don't enable ip route-cache flow on other interfaces, because you will get these flows twice.

Jan

Caligare Co.

http://www.caligare.com/

[koteasahay]

Hi Jan,

I appreciate the suggestion but I've already enabled NetFlow on all of the interfaces (my snippet of code only listed the one as an example). As for setting up ip flow ingress on one interface only we need to account for all interfaces so I don't believe that is an option.

[trongduc]

The following may be your case:

NetFlow Data Export (NDE) is not exporting all the flow records. The number of flows per second reported by the NetFlow collector is much lower than the actual traffic. This problem is resolved in Release 12.2(18)SXF2. (CSCsa79630)