Cisco router netflow question

I have a need to setup accurate bandwidth monitoring temporarily to identify some issues with bandwidth consumption.  To do this I understand I need to use netflow which is only available through a router.  The problem is that I already have a firewall in place (a Juniper SSG).  I have a Cisco PIX or ASA at my disposal but they too do not support netflow.  My question is how can I setup a router to act transparently on the inside of my firewall to enable netflow and get accurate bandwidth statistics?  It's nothing permanent.  I just need to let it run for a week or so which is why I don't want to go through the hassle of getting a router with the firewall options, etc etc etc.  I want to leave the current firewalls in place and drop in a router periodically to do some bandwidth testing then pull it out and drop it in another location at some other point.  Kind of a mobile bandwidth monitoring idea.

Can anyone tell me how I can setup my Cisco 2600 to function transparently to achieve this goal?  I don't want to setup a double NAT or change my firewall to run transparently and have the router do the NAT since that'll require too much work to simply drop it in, run bandwidth captures for a week, then pull it out.

Who is Participating?
jmeggersConnect With a Mentor Sr. Network and Security EngineerCommented:
I don't know for sure that it will work with bridging, but as I said, I don't see anything that specifically says it won't.  However, integration of the two technologies will mean you will need some layer 3 information on the router if you want to send the netflow information to a collector.  So my guess is what you need to do is what Cisco calls integrated routing and bridging, or IRB.  I can't guarantee this will work, but try this configuration on the router:

bridge irb

int fa0/0
bridge-group 1

int fa0/1
bridge-group 1

int bvi1
ip address <address> <mask>

bridge 1 prot ieee
bridge 1 route ip

ip route <next-hop IP address>

The address on the BVI (bridge virtual interface) should be in the same subnet as the layer 3 endpoints that the interfaces are bridging.  It's like putting a VLAN interface on a switch.  With bridging, you do not assign IP addresses to the interfaces (remember, bridging is layer 2 and IP addressing is layer 3), you simply add them to the bridge group.

For netflow, the general commands are:

ip flow-export <ip address> <udp port> version <version number>

interface fa0/0
ip route-cache flow

Again, I make no promises this will work.  You may have to look in the documentation for the syntax of the flow-export command, I suspect there are variations depending on the version of IOS you're using.  It's also possible there will be feature-set issues, meaning netflow may not be supported in all feature sets such as IP Base.  

Let me know how it goes....
jmeggersSr. Network and Security EngineerCommented:
To set up a router "transparently" you're really talking about bridging between interfaces.  There are a bunch of different ways of bridging, but the simplest is to specify the bridge protocol (usually ieee) and then put one or more interfaces in the bridge group.

bridge 1 protocol ieee

interface fa0/0
bridge-group 1

interface fa0/1
bridge-group 1  

There's a white paper on that gives more examples at

I don't know anyone that's mixed the two technologies, but I don't see anything that looks like they are incompatible.
tekrageAuthor Commented:
Do you know if netflow will work with ieee?
tekrageAuthor Commented:
Also can you tell me how I would physically set this up?  In other words, do I plug eth0 into my core network switch and plug eth1 into my firewall's internal interface?

Do I assign IP addresses to eth0 & 1?  Or do I leave them with no IP addresses?  I've never used netflow before so some of this is foreign to me.

tekrageAuthor Commented:
I've been away and haven't had time to try this out but I'm going to try to test it out this weekend.  It's about the best solution I've seen so far!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.