[c-nsp] 6500 not exporting layer 2 netflow data

Tassos Chatzithomaoglou achatz at forthnet.gr
Tue Apr 29 13:21:00 EDT 2008


Maybe add "mls nde sender version 5"? I don't know if that's causing any problem, but from your previous output, you're using v7 
for PFC and v5 for MSFC.

Also what's the output of "sh ip flow export"?

As a last solution (although i'm almost sure it won't make any difference), try replacing "ip route-cache flow" with "ip flow 
ingress".

--
Tassos

Andy Ellsworth wrote on 29/4/2008 7:37 μμ:
> Tassos Chatzithomaoglou wrote:
>> If i understand correctly, you're doing netflow for bridged IP traffic.
> Correct.
>> If yes, do you have a a corresponding VLAN interface with an IP 
>> address as the one you're gathering netflow data from?
> I did come across that requirement (and it gave me quite a headache 
> until I found it outlined in the docs), but yes - I do have an SVI 
> configured, with an IP address, in the VLAN(s) I'm interested in. If I 
> didn't have that configured, I don't believe I'd see any corresponding 
> layer 2 flows in my "show mls netflow ip" output.
>> Maybe posting your mls/flow config would help a little more.
> Here's the relevant snippets. For the purposes of this discussion, I'm 
> mostly interested in traffic on VLAN 201:
> 
> mls aging long 300
> mls aging normal 60
> mls flow ip full
> no mls flow ipv6
> mls nde sender
> ip flow ingress layer2-switched vlan 1,18,201,253-254
> ip flow-export source Vlan253
> ip flow-export version 5
> ip flow-export destination 10.100.253.210 30002
> interface Vlan201
> ip address 10.100.201.249 255.255.255.0
> ip route-cache flow
> end
> 
> Note that the "ip flow export layer2-switched vlan" command does not 
> show up in a "show run" output, since export is implicitly enabled along 
> with the "ip flow ingress" command.
> 
> -Andy
> 
> 



More information about the cisco-nsp mailing list