Solved

Cisco Netflow Export Question

Posted on 2014-02-06
25
440 Views
Last Modified: 2014-02-17
Hello Experts,

We're having a problem getting our router to export Netflow information to our Solarwinds server.

The server ip addresses are 10.44.108.168 and 10.44.108.68.

We've tried everything we can imagine but we still can't get the router to export netflow data.

I wonder if you guys/girls can help?

I have attached our router configuration

Cheers

Carlton
0
Comment
Question by:cpatte7372
  • 12
  • 8
  • 3
25 Comments
 
LVL 6

Expert Comment

by:Jordan Medlen
ID: 39838842
I don't see anywhere in your configuration an export statement, such as...

ip flow-export 10.44.108.168 2055
ip flow-export 10.44.108.68 2055

Adding these should help get flow information going to your workstations.
0
 

Author Comment

by:cpatte7372
ID: 39838864
Jordan

There stated as:

ip flow-export destination 10.44.108.68 2055
ip flow-export destination 10.44.108.168 2055
0
 
LVL 6

Expert Comment

by:Jordan Medlen
ID: 39838940
I know I search the document for those. Must still be sleepy. I'll keep digging for ya though.
0
 

Author Comment

by:cpatte7372
ID: 39839049
Thanks Jordan
0
 

Author Comment

by:cpatte7372
ID: 39840590
Experts,

Can anyone else take a look at this?

Cheers
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39840933
Did you add the appropriate flow commands on the interface that you are collecting netflow data from?

ip flow ingress   - for ingress netflow collection

global configuration
ip flow-export version 5 - netflow version information

Can you route to the destination? can the destination route to the Router?


harbor235 ;}
0
 

Author Comment

by:cpatte7372
ID: 39841075
Harbour,

Thanks for responding.

The attached configs show that I have added ip flow ingress on the interface.

Also the configs should also show that I have added ip flow-export version 5
0
 

Author Comment

by:cpatte7372
ID: 39841076
Harbor,

I can route to the server - the only information that won't be exported is Netflow data.

Regards
0
 

Author Comment

by:cpatte7372
ID: 39841467
Hello Experts,

For some reason the attached configs appear to have disappeared...

Reattached
13-29-33--IPC-MapleCross-10.44.1.txt
0
 
LVL 6

Expert Comment

by:Jordan Medlen
ID: 39841553
Can you show the route table for this router, as well as the config and route table for the other router(s) connected via the Fa1/0 interface that you have OSPF running on?
0
 

Author Comment

by:cpatte7372
ID: 39841664
Jordan,

There is a route to 10.44.108.168 and 10.44.108.68 in the table....
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 32

Expert Comment

by:harbor235
ID: 39841741
Verify your router is collecting netflow:

show ip cache flow

Verify your router is exporting flow data: (look for flows exported)

show ip flow export

If this all looks good than its your flow collector config, verify Solarwinds is listening on port 2055, then verify your Windows firewall allows traffic on udp port 2055


harbor235 ;-}
0
 

Author Comment

by:cpatte7372
ID: 39841988
Hi Harbor

IPC_MapleCross#show ip cache flow
IP packet size distribution (27660M total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .399 .076 .050 .035 .017 .023 .013 .007 .005 .005 .005 .004 .002 .002

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .002 .002 .002 .016 .329 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  16865 active, 48671 inactive, 1839326694 added
  2294894995 ager polls, 0 flow alloc failures
  Active flows timeout in 1 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 664200 bytes
  16871 active, 15897 inactive, 1839322903 added, 1839322903 added to flow
  0 alloc failures, 0 force free
  2 chunks, 307 chunks added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet      278071      0.0        81   152      5.2      30.3      14.2
TCP-FTP          13998      0.0         3    49      0.0       1.5      18.7
TCP-FTPD          2820      0.0      2043   942      1.3      10.8      16.3
TCP-WWW       45796670     10.6        24   357    263.5       3.0      15.1
TCP-SMTP        822288      0.1        76  1329     14.5       0.7       8.2
TCP-X             1499      0.0        22   705      0.0       0.3       2.7
TCP-BGP         332540      0.0        13    49      1.0      60.6       1.2
TCP-NNTP          1170      0.0         1    41      0.0       0.0       3.2
TCP-other   1255126070    292.2        16   624   4935.7       2.4      17.7
UDP-DNS      135874605     31.6         1    72     33.0       0.0      21.5
UDP-NTP        7366535      1.7         1    78      2.1       3.6      17.3
UDP-TFTP          1355      0.0         1    54      0.0       0.3      19.9
UDP-Frag      12082288      2.8         3   853     10.1       4.6      16.6
UDP-other    334213366     77.8         7   322    595.2       5.2      18.9
ICMP          26789346      6.2         3    86     23.5       1.8      17.9
GRE           20589717      4.7       115   328    554.2      34.8       8.9
IP-other         17491      0.0        36   171      0.1      11.5      18.7
Total:      1839309829    428.2        15   556   6440.0       3.1      18.1

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Fa1/0         10.50.98.31     Fa0/0.195     10.45.92.39     06 13C5 D6F8     6
Fa1/0         172.17.41.7     Fa0/0.195     10.45.94.68     06 1F90 D03E     3
Fa1/0         172.17.41.7     Fa0/0.195     10.45.94.68     06 1F90 D03D     3
Fa0/0.196     172.27.40.74    Fa1/1         10.50.83.11     06 C81F 0087     2
Fa1/0         10.44.108.253   Fa0/0.195     10.45.94.76     11 0035 DC7B     1
Fa1/0         172.17.41.8     Fa0/0.195     172.25.137.203  06 1F90 EA87     3
Fa1/0         10.44.108.253   Fa0/0.195     10.45.71.192    11 0035 C7FA     1


IPC_MapleCross#show ip flow export
Flow export v5 is enabled for main cache
  Exporting flows to 10.44.108.68 (2055) 10.44.108.168 (2055)
  Exporting using source interface FastEthernet1/0
  Version 5 flow records
  3074650507 flows exported in 102488727 udp datagrams
  0 flows failed due to lack of export packet
  102488726 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures
IPC_MapleCross#


Cheers
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39842079
Right, so the router is configured properly collecting netflow and exporting netflow records to

the flow collectors
                from the above output - Exporting flows to 10.44.108.68 (2055) 10.44.108.168 (2055)

So now I would verify the Solarwinds configuration and your server that Solarwinds is installed on. The router is fine, like I stated earlier, the problem is likely the following now that we know its not the router:

                         1) Is the Soalrwinds Netflow module installed and running ?
                         2) Netflow is an add on software package and license pak, did you purchase  
                             netflow?
                         3) Does the Windows firewall allow connections from 10.44.108.68 and
                             10.44.108.168 to udp port 2055 on the Solawinds box?
                         4) Is Solarwinds Netflow configured properly
                         5) To verify Netflow records are getting to the server install wireshark and
                              and capture packets destines to the Solarwinds server ip and udp port
                              2055

let me know what you find,

harbor235 ;}
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39842083
Also verify that your Solarwinds Netflow configuration is configured for Netflow version 5, that's the version you have configured.


harbor235 ;-}
0
 

Author Comment

by:cpatte7372
ID: 39842122
Harbor,

I'm going to check Solarwinds as you've suggested. However, we have a number of devices reporting netflow data to same Solarwinds server.
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39842162
cpatte7372,

I understand however the router is reporting exporting data to the IPs"
                   Exporting flows to 10.44.108.68 (2055) 10.44.108.168 (2055)  on udp port 2055

So its either the packets are not getting to the server which can be verified via Wireshark, the port is wrong,  or the server is not configured properly.

How many devices do you have setup on SWs? there may be a limit?


harbor235 ;}
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39842184
Also,

In your solarwinds netflow config, do you have the following enabled:

Enable automatic addition of NetFlow sources
Allow monitoring of flows from unmanaged interfaces.

If you do not then you will have to add that router manually as a valid source and as a manged device and managed interface


harbor235 ;}
0
 

Author Comment

by:cpatte7372
ID: 39845174
Harbor,

Thanks again for responding.

To be honest I don't think the issue is with Solarwinds.

I think the problem is to do with udp flows being blocked via the vrf called SKANSKA.
0
 
LVL 32

Expert Comment

by:harbor235
ID: 39845280
lol, I have not looked at your config until now. So the netflow export is happening via VRF
SKANSKA. Netflow is using the inerface f1/0 as the source, with IP 10.44.113.5/26, this network does not have a network statement in your BGP config. So I assume the Solarwinds server is on an internal network?

I do not see 10.44.113.0/26 in your BGP-OSPF route-map so that network is also not being advertised into vrf SKANSKA via OSPF , and there are not statics for this network. Does not matter since this is udp and as long as we have a route to it we are fine.

what does the following display?

show ip route vrf SKANSKA 10.44.108.68
show ip route vrf SKANSKA 10.44.108.168

I also see this:

ip access-list extended vrf-SKANSKA-netflow
 permit udp host 172.105.30.65 host 10.44.96.137 eq 9996
 permit udp host 10.44.108.168 any
 permit udp host 10.44.108.68 any

which is activated via

route-map vrf-SKANSKA-netflow permit 10
 match ip address vrf-SKANSKA-netflow
 set interface FastEthernet1/0

and this - ip local policy route-map vrf-SKANSKA-netflow

But, "ip local policy" is a command to police traffic generated by the router, not incoming.
http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfindp1.html#wp1017871

Can you post the output of the following:

show access-list vrf-SKANSKA-netflow  (looking for hits on the ACL)

Add the following lines to the config to see if it works:

ip access-list extended vrf-SKANSKA-netflow
 permit udp host 172.105.30.65 host 10.44.96.137 eq 9996
 permit udp host 10.44.108.168 any
 permit udp host 10.44.108.68 any
permit udp any host 10.44.108.168
permit udp any host 10.44.108.68


harbor235 ;}
0
 
LVL 32

Accepted Solution

by:
harbor235 earned 500 total points
ID: 39845285
However, OSPF for vrf SKANSA does include the interface statement for f1/0

router ospf 10 vrf SKANSKA
 log-adjacency-changes
 redistribute bgp xxx metric 15 subnets route-map BGP-OSPF
 network 10.44.113.0 0.0.0.63 area 0

So it may be the "ip local policy route-map" command and the associated ACL.

harbor235 ;}
0
 

Author Comment

by:cpatte7372
ID: 39864151
Harbor,

Thanks for your help. We have concluded tha the problem was the IOS version not allowing traffic to exported via vrf.

The minimum code requirement is 12.4. We're running 12.1

Regards
0
 

Author Closing Comment

by:cpatte7372
ID: 39864152
Excellent effort
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Transparency shows that a company is the kind of business that it wants people to think it is.
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now