Cisco Netflow on Sub-Interfaces

Hello Experts,

I never really understood if its necessary to configure netflow on sub-interfaces or just on the physical interface. For example, our WAN circuit is physically connected to Gi 0/0. We have sub-interface of Gi0/0/2928. Both interfaces are currently configured as follows:

interface GigabitEthernet0/0
 no ip address
 load-interval 30
 duplex full
 speed 10

interface GigabitEthernet0/0.2938
 description BT MPLS CID SHI/CU-SHI/BT NP432 (supplier 2013-04655-k01)
 encapsulation dot1Q 2938
 ip address 10.1.243.38 255.255.255.252
 no ip unreachables
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in
 no cdp enable
 service-policy output Shape-Ethernet-QoS
end

As you can see, netflow is configured on the sub-interface but we don't have it configured on our physical interface. Should we have it configured on both?

Regards

Carlton
cpatte7372Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jody LemoineNetwork ArchitectCommented:
Enabling Netflow on the physical interface will capture everything going through it and its sub-interfaces. Enabling it only on the sub-interface will capture only what traverses the sub-interface. If you have only one sub-interface for 802.11q processing, then it makes no difference which one you have it on, but enabling it on both will create double entries for the same flows.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
eeRootCommented:
Are there any other sub interfaces that you want to monitor?  And do you want to monitor the L3 traffic that is going through the physical interface such as routing protocols and link status packets?
0
cpatte7372Author Commented:
Hi Jody, thats great.

eeRoot, there are no other sub-interfaces I want to monitor.

Cheers
0
Jody LemoineNetwork ArchitectCommented:
Glad I could help. Is there anything else that needs clarification or are you good with the answers provided?
0
cpatte7372Author Commented:
Cheers
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.