[c-nsp] 6500 not exporting layer 2 netflow data
Tassos Chatzithomaoglou
achatz at forthnet.gr
Tue Apr 29 13:21:00 EDT 2008
Maybe add "mls nde sender version 5"? I don't know if that's causing any problem, but from your previous output, you're using v7
for PFC and v5 for MSFC.
Also what's the output of "sh ip flow export"?
As a last solution (although i'm almost sure it won't make any difference), try replacing "ip route-cache flow" with "ip flow
ingress".
--
Tassos
Andy Ellsworth wrote on 29/4/2008 7:37 μμ:
> Tassos Chatzithomaoglou wrote:
>> If i understand correctly, you're doing netflow for bridged IP traffic.
> Correct.
>> If yes, do you have a a corresponding VLAN interface with an IP
>> address as the one you're gathering netflow data from?
> I did come across that requirement (and it gave me quite a headache
> until I found it outlined in the docs), but yes - I do have an SVI
> configured, with an IP address, in the VLAN(s) I'm interested in. If I
> didn't have that configured, I don't believe I'd see any corresponding
> layer 2 flows in my "show mls netflow ip" output.
>> Maybe posting your mls/flow config would help a little more.
> Here's the relevant snippets. For the purposes of this discussion, I'm
> mostly interested in traffic on VLAN 201:
>
> mls aging long 300
> mls aging normal 60
> mls flow ip full
> no mls flow ipv6
> mls nde sender
> ip flow ingress layer2-switched vlan 1,18,201,253-254
> ip flow-export source Vlan253
> ip flow-export version 5
> ip flow-export destination 10.100.253.210 30002
> interface Vlan201
> ip address 10.100.201.249 255.255.255.0
> ip route-cache flow
> end
>
> Note that the "ip flow export layer2-switched vlan" command does not
> show up in a "show run" output, since export is implicitly enabled along
> with the "ip flow ingress" command.
>
> -Andy
>
>
More information about the cisco-nsp
mailing list